--- /dev/null
+From 33ec6dbc5a02677509d97fe36cd2105753f0f0ea Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Sat, 11 Nov 2017 17:29:29 +0100
+Subject: clk: ti: dra7-atl-clock: fix child-node lookups
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 33ec6dbc5a02677509d97fe36cd2105753f0f0ea upstream.
+
+Fix child node-lookup during probe, which ended up searching the whole
+device tree depth-first starting at parent rather than just matching on
+its children.
+
+Note that the original premature free of the parent node has already
+been fixed separately, but that fix was apparently never backported to
+stable.
+
+Fixes: 9ac33b0ce81f ("CLK: TI: Driver for DRA7 ATL (Audio Tracking Logic)")
+Fixes: 660e15519399 ("clk: ti: dra7-atl-clock: Fix of_node reference counting")
+Cc: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/ti/clk-dra7-atl.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/clk/ti/clk-dra7-atl.c
++++ b/drivers/clk/ti/clk-dra7-atl.c
+@@ -265,8 +265,7 @@ static int of_dra7_atl_clk_probe(struct
+
+ /* Get configuration for the ATL instances */
+ snprintf(prop, sizeof(prop), "atl%u", i);
+- of_node_get(node);
+- cfg_node = of_find_node_by_name(node, prop);
++ cfg_node = of_get_child_by_name(node, prop);
+ if (cfg_node) {
+ ret = of_property_read_u32(cfg_node, "bws",
+ &cdesc->bws);
--- /dev/null
+From 660e1551939931657808d47838a3f443c0e83fd0 Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Fri, 11 Mar 2016 16:13:32 +0200
+Subject: clk: ti: dra7-atl-clock: Fix of_node reference counting
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+commit 660e1551939931657808d47838a3f443c0e83fd0 upstream.
+
+of_find_node_by_name() will call of_node_put() on the node so we need to
+get it first to avoid warnings.
+The cfg_node needs to be put after we have finished processing the
+properties.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Tested-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/ti/clk-dra7-atl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/clk/ti/clk-dra7-atl.c
++++ b/drivers/clk/ti/clk-dra7-atl.c
+@@ -265,6 +265,7 @@ static int of_dra7_atl_clk_probe(struct
+
+ /* Get configuration for the ATL instances */
+ snprintf(prop, sizeof(prop), "atl%u", i);
++ of_node_get(node);
+ cfg_node = of_find_node_by_name(node, prop);
+ if (cfg_node) {
+ ret = of_property_read_u32(cfg_node, "bws",
+@@ -278,6 +279,7 @@ static int of_dra7_atl_clk_probe(struct
+ atl_write(cinfo, DRA7_ATL_AWSMUX_REG(i),
+ cdesc->aws);
+ }
++ of_node_put(cfg_node);
+ }
+
+ cdesc->probed = true;
--- /dev/null
+From 8a0d18c62121d3c554a83eb96e2752861d84d937 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bart.vanassche@wdc.com>
+Date: Wed, 11 Oct 2017 10:27:26 -0700
+Subject: IB/srp: Avoid that a cable pull can trigger a kernel crash
+
+From: Bart Van Assche <bart.vanassche@wdc.com>
+
+commit 8a0d18c62121d3c554a83eb96e2752861d84d937 upstream.
+
+This patch fixes the following kernel crash:
+
+general protection fault: 0000 [#1] PREEMPT SMP
+Workqueue: ib_mad2 timeout_sends [ib_core]
+Call Trace:
+ ib_sa_path_rec_callback+0x1c4/0x1d0 [ib_core]
+ send_handler+0xb2/0xd0 [ib_core]
+ timeout_sends+0x14d/0x220 [ib_core]
+ process_one_work+0x200/0x630
+ worker_thread+0x4e/0x3b0
+ kthread+0x113/0x150
+
+Fixes: commit aef9ec39c47f ("IB: Add SCSI RDMA Protocol (SRP) initiator")
+Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/srp/ib_srp.c | 25 +++++++++++++++++++------
+ 1 file changed, 19 insertions(+), 6 deletions(-)
+
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -670,12 +670,19 @@ static void srp_path_rec_completion(int
+ static int srp_lookup_path(struct srp_rdma_ch *ch)
+ {
+ struct srp_target_port *target = ch->target;
+- int ret;
++ int ret = -ENODEV;
+
+ ch->path.numb_path = 1;
+
+ init_completion(&ch->done);
+
++ /*
++ * Avoid that the SCSI host can be removed by srp_remove_target()
++ * before srp_path_rec_completion() is called.
++ */
++ if (!scsi_host_get(target->scsi_host))
++ goto out;
++
+ ch->path_query_id = ib_sa_path_rec_get(&srp_sa_client,
+ target->srp_host->srp_dev->dev,
+ target->srp_host->port,
+@@ -689,18 +696,24 @@ static int srp_lookup_path(struct srp_rd
+ GFP_KERNEL,
+ srp_path_rec_completion,
+ ch, &ch->path_query);
+- if (ch->path_query_id < 0)
+- return ch->path_query_id;
++ ret = ch->path_query_id;
++ if (ret < 0)
++ goto put;
+
+ ret = wait_for_completion_interruptible(&ch->done);
+ if (ret < 0)
+- return ret;
++ goto put;
+
+- if (ch->status < 0)
++ ret = ch->status;
++ if (ret < 0)
+ shost_printk(KERN_WARNING, target->scsi_host,
+ PFX "Path record query failed\n");
+
+- return ch->status;
++put:
++ scsi_host_put(target->scsi_host);
++
++out:
++ return ret;
+ }
+
+ static int srp_send_req(struct srp_rdma_ch *ch, bool multich)
--- /dev/null
+From c70ca38960399a63d5c048b7b700612ea321d17e Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bart.vanassche@wdc.com>
+Date: Wed, 11 Oct 2017 10:27:22 -0700
+Subject: IB/srpt: Do not accept invalid initiator port names
+
+From: Bart Van Assche <bart.vanassche@wdc.com>
+
+commit c70ca38960399a63d5c048b7b700612ea321d17e upstream.
+
+Make srpt_parse_i_port_id() return a negative value if hex2bin()
+fails.
+
+Fixes: commit a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1")
+Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/srpt/ib_srpt.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -3425,7 +3425,7 @@ static int srpt_parse_i_port_id(u8 i_por
+ {
+ const char *p;
+ unsigned len, count, leading_zero_bytes;
+- int ret, rc;
++ int ret;
+
+ p = name;
+ if (strncasecmp(p, "0x", 2) == 0)
+@@ -3437,10 +3437,9 @@ static int srpt_parse_i_port_id(u8 i_por
+ count = min(len / 2, 16U);
+ leading_zero_bytes = 16 - count;
+ memset(i_port_id, 0, leading_zero_bytes);
+- rc = hex2bin(i_port_id + leading_zero_bytes, p, count);
+- if (rc < 0)
+- pr_debug("hex2bin failed for srpt_parse_i_port_id: %d\n", rc);
+- ret = 0;
++ ret = hex2bin(i_port_id + leading_zero_bytes, p, count);
++ if (ret < 0)
++ pr_debug("hex2bin failed for srpt_parse_i_port_id: %d\n", ret);
+ out:
+ return ret;
+ }
--- /dev/null
+From 21f2d551183847bc7fbe8d866151d00cdad18752 Mon Sep 17 00:00:00 2001
+From: Ladi Prosek <lprosek@redhat.com>
+Date: Wed, 11 Oct 2017 16:54:42 +0200
+Subject: KVM: nVMX: set IDTR and GDTR limits when loading L1 host state
+
+From: Ladi Prosek <lprosek@redhat.com>
+
+commit 21f2d551183847bc7fbe8d866151d00cdad18752 upstream.
+
+Intel SDM 27.5.2 Loading Host Segment and Descriptor-Table Registers:
+
+"The GDTR and IDTR limits are each set to FFFFH."
+
+Signed-off-by: Ladi Prosek <lprosek@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/vmx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -10394,6 +10394,8 @@ static void load_vmcs12_host_state(struc
+ vmcs_writel(GUEST_SYSENTER_EIP, vmcs12->host_ia32_sysenter_eip);
+ vmcs_writel(GUEST_IDTR_BASE, vmcs12->host_idtr_base);
+ vmcs_writel(GUEST_GDTR_BASE, vmcs12->host_gdtr_base);
++ vmcs_write32(GUEST_IDTR_LIMIT, 0xFFFF);
++ vmcs_write32(GUEST_GDTR_LIMIT, 0xFFFF);
+
+ /* If not VM_EXIT_CLEAR_BNDCFGS, the L2 value propagates to L1. */
+ if (vmcs12->vm_exit_controls & VM_EXIT_CLEAR_BNDCFGS)
--- /dev/null
+From 15038e14724799b8c205beb5f20f9e54896013c3 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Thu, 26 Oct 2017 09:13:27 +0200
+Subject: KVM: SVM: obey guest PAT
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Paolo Bonzini <pbonzini@redhat.com>
+
+commit 15038e14724799b8c205beb5f20f9e54896013c3 upstream.
+
+For many years some users of assigned devices have reported worse
+performance on AMD processors with NPT than on AMD without NPT,
+Intel or bare metal.
+
+The reason turned out to be that SVM is discarding the guest PAT
+setting and uses the default (PA0=PA4=WB, PA1=PA5=WT, PA2=PA6=UC-,
+PA3=UC). The guest might be using a different setting, and
+especially might want write combining but isn't getting it
+(instead getting slow UC or UC- accesses).
+
+Thanks a lot to geoff@hostfission.com for noticing the relation
+to the g_pat setting. The patch has been tested also by a bunch
+of people on VFIO users forums.
+
+Fixes: 709ddebf81cb40e3c36c6109a7892e8b93a09464
+Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=196409
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Tested-by: Nick Sarnie <commendsarnex@gmail.com>
+Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/svm.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -3114,6 +3114,13 @@ static int svm_set_msr(struct kvm_vcpu *
+ u32 ecx = msr->index;
+ u64 data = msr->data;
+ switch (ecx) {
++ case MSR_IA32_CR_PAT:
++ if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data))
++ return 1;
++ vcpu->arch.pat = data;
++ svm->vmcb->save.g_pat = data;
++ mark_dirty(svm->vmcb, VMCB_NPT);
++ break;
+ case MSR_IA32_TSC:
+ kvm_write_tsc(vcpu, msr);
+ break;
--- /dev/null
+From b18d4b8a25af6fe83d7692191d6ff962ea611c4f Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Tue, 26 Sep 2017 11:41:28 -0700
+Subject: libnvdimm, namespace: fix label initialization to use valid seq numbers
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit b18d4b8a25af6fe83d7692191d6ff962ea611c4f upstream.
+
+The set of valid sequence numbers is {1,2,3}. The specification
+indicates that an implementation should consider 0 a sign of a critical
+error:
+
+ UEFI 2.7: 13.19 NVDIMM Label Protocol
+
+ Software never writes the sequence number 00, so a correctly
+ check-summed Index Block with this sequence number probably indicates a
+ critical error. When software discovers this case it treats it as an
+ invalid Index Block indication.
+
+While the expectation is that the invalid block is just thrown away, the
+Robustness Principle says we should fix this to make both sequence
+numbers valid.
+
+Fixes: f524bf271a5c ("libnvdimm: write pmem label set")
+Reported-by: Juston Li <juston.li@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nvdimm/label.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvdimm/label.c
++++ b/drivers/nvdimm/label.c
+@@ -823,7 +823,7 @@ static int init_labels(struct nd_mapping
+ nsindex = to_namespace_index(ndd, 0);
+ memset(nsindex, 0, ndd->nsarea.config_size);
+ for (i = 0; i < 2; i++) {
+- int rc = nd_label_write_index(ndd, i, i*2, ND_NSINDEX_INIT);
++ int rc = nd_label_write_index(ndd, i, 3 - i, ND_NSINDEX_INIT);
+
+ if (rc)
+ return rc;
--- /dev/null
+From c1fb3542074fd0c4d901d778bd52455111e4eb6f Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Tue, 26 Sep 2017 11:21:24 -0700
+Subject: libnvdimm, namespace: make 'resource' attribute only readable by root
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit c1fb3542074fd0c4d901d778bd52455111e4eb6f upstream.
+
+For the same reason that /proc/iomem returns 0's for non-root readers
+and acpi tables are root-only, make the 'resource' attribute for
+namespace devices only readable by root. Otherwise we disclose physical
+address information.
+
+Fixes: bf9bccc14c05 ("libnvdimm: pmem label sets and namespace instantiation")
+Reported-by: Dave Hansen <dave.hansen@linux.intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nvdimm/namespace_devs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvdimm/namespace_devs.c
++++ b/drivers/nvdimm/namespace_devs.c
+@@ -1305,7 +1305,7 @@ static umode_t namespace_visible(struct
+ if (a == &dev_attr_resource.attr) {
+ if (is_namespace_blk(dev))
+ return 0;
+- return a->mode;
++ return 0400;
+ }
+
+ if (is_namespace_pmem(dev) || is_namespace_blk(dev)) {
--- /dev/null
+From c45e3e4c5b134b081e8af362109905427967eb19 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Sun, 9 Jul 2017 13:08:58 +0200
+Subject: NFC: fix device-allocation error return
+
+From: Johan Hovold <johan@kernel.org>
+
+commit c45e3e4c5b134b081e8af362109905427967eb19 upstream.
+
+A recent change fixing NFC device allocation itself introduced an
+error-handling bug by returning an error pointer in case device-id
+allocation failed. This is clearly broken as the callers still expected
+NULL to be returned on errors as detected by Dan's static checker.
+
+Fix this up by returning NULL in the event that we've run out of memory
+when allocating a new device id.
+
+Note that the offending commit is marked for stable (3.8) so this fix
+needs to be backported along with it.
+
+Fixes: 20777bc57c34 ("NFC: fix broken device allocation")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/nfc/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/nfc/core.c
++++ b/net/nfc/core.c
+@@ -1093,7 +1093,7 @@ struct nfc_dev *nfc_allocate_device(stru
+ err_free_dev:
+ kfree(dev);
+
+- return ERR_PTR(rc);
++ return NULL;
+ }
+ EXPORT_SYMBOL(nfc_allocate_device);
+
fs-9p-compare-qid.path-in-v9fs_test_inode.patch
iscsi-target-fix-non-immediate-tmr-reference-leak.patch
target-fix-queue_full-scsi-task-attribute-handling.patch
+kvm-nvmx-set-idtr-and-gdtr-limits-when-loading-l1-host-state.patch
+kvm-svm-obey-guest-pat.patch
+sunrpc-fix-tracepoint-storage-issues-with-svc_recv-and-svc_rqst_status.patch
+clk-ti-dra7-atl-clock-fix-of_node-reference-counting.patch
+clk-ti-dra7-atl-clock-fix-child-node-lookups.patch
+libnvdimm-namespace-fix-label-initialization-to-use-valid-seq-numbers.patch
+libnvdimm-namespace-make-resource-attribute-only-readable-by-root.patch
+ib-srpt-do-not-accept-invalid-initiator-port-names.patch
+ib-srp-avoid-that-a-cable-pull-can-trigger-a-kernel-crash.patch
+nfc-fix-device-allocation-error-return.patch
--- /dev/null
+From e9d4bf219c83d09579bc62512fea2ca10f025d93 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Tue, 10 Oct 2017 17:31:42 -0400
+Subject: SUNRPC: Fix tracepoint storage issues with svc_recv and svc_rqst_status
+
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+
+commit e9d4bf219c83d09579bc62512fea2ca10f025d93 upstream.
+
+There is no guarantee that either the request or the svc_xprt exist
+by the time we get round to printing the trace message.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/trace/events/sunrpc.h | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+--- a/include/trace/events/sunrpc.h
++++ b/include/trace/events/sunrpc.h
+@@ -455,20 +455,22 @@ TRACE_EVENT(svc_recv,
+ TP_ARGS(rqst, status),
+
+ TP_STRUCT__entry(
+- __field(struct sockaddr *, addr)
+ __field(__be32, xid)
+ __field(int, status)
+ __field(unsigned long, flags)
++ __dynamic_array(unsigned char, addr, rqst->rq_addrlen)
+ ),
+
+ TP_fast_assign(
+- __entry->addr = (struct sockaddr *)&rqst->rq_addr;
+ __entry->xid = status > 0 ? rqst->rq_xid : 0;
+ __entry->status = status;
+ __entry->flags = rqst->rq_flags;
++ memcpy(__get_dynamic_array(addr),
++ &rqst->rq_addr, rqst->rq_addrlen);
+ ),
+
+- TP_printk("addr=%pIScp xid=0x%x status=%d flags=%s", __entry->addr,
++ TP_printk("addr=%pIScp xid=0x%x status=%d flags=%s",
++ (struct sockaddr *)__get_dynamic_array(addr),
+ be32_to_cpu(__entry->xid), __entry->status,
+ show_rqstp_flags(__entry->flags))
+ );
+@@ -480,22 +482,23 @@ DECLARE_EVENT_CLASS(svc_rqst_status,
+ TP_ARGS(rqst, status),
+
+ TP_STRUCT__entry(
+- __field(struct sockaddr *, addr)
+ __field(__be32, xid)
+- __field(int, dropme)
+ __field(int, status)
+ __field(unsigned long, flags)
++ __dynamic_array(unsigned char, addr, rqst->rq_addrlen)
+ ),
+
+ TP_fast_assign(
+- __entry->addr = (struct sockaddr *)&rqst->rq_addr;
+ __entry->xid = rqst->rq_xid;
+ __entry->status = status;
+ __entry->flags = rqst->rq_flags;
++ memcpy(__get_dynamic_array(addr),
++ &rqst->rq_addr, rqst->rq_addrlen);
+ ),
+
+ TP_printk("addr=%pIScp rq_xid=0x%x status=%d flags=%s",
+- __entry->addr, be32_to_cpu(__entry->xid),
++ (struct sockaddr *)__get_dynamic_array(addr),
++ be32_to_cpu(__entry->xid),
+ __entry->status, show_rqstp_flags(__entry->flags))
+ );
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
