--- /dev/null
+From 53fa1f6e8a5958da698a31edf366ffe90596b490 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 17 Apr 2018 18:23:50 +0200
+Subject: ACPI / video: Only default only_lcd to true on Win8-ready _desktops_
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 53fa1f6e8a5958da698a31edf366ffe90596b490 upstream.
+
+Commit 5928c281524f (ACPI / video: Default lcd_only to true on Win8-ready
+and newer machines) made only_lcd default to true on all machines where
+acpi_osi_is_win8() returns true, including laptops.
+
+The purpose of this is to avoid the bogus / non-working acpi backlight
+interface which many newer BIOS-es define on desktop machines.
+
+But this is causing a regression on some laptops, specifically on the
+Dell XPS 13 2013 model, which does not have the LCD flag set for its
+fully functional ACPI backlight interface.
+
+Rather then DMI quirking our way out of this, this commits changes the
+logic for setting only_lcd to true, to only do this on machines with
+a desktop (or server) dmi chassis-type.
+
+Note that we cannot simply only check the chassis-type and not register
+the backlight interface based on that as there are some laptops and
+tablets which have their chassis-type set to "3" aka desktop. Hopefully
+the combination of checking the LCD flag, but only on devices with
+a desktop(ish) chassis-type will avoid the needs for DMI quirks for this,
+or at least limit the amount of DMI quirks which we need to a minimum.
+
+Fixes: 5928c281524f (ACPI / video: Default lcd_only to true on Win8-ready and newer machines)
+Reported-and-tested-by: James Hogan <jhogan@kernel.org>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Cc: 4.15+ <stable@vger.kernel.org> # 4.15+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/acpi_video.c | 27 +++++++++++++++++++++++++--
+ 1 file changed, 25 insertions(+), 2 deletions(-)
+
+--- a/drivers/acpi/acpi_video.c
++++ b/drivers/acpi/acpi_video.c
+@@ -2123,6 +2123,25 @@ static int __init intel_opregion_present
+ return opregion;
+ }
+
++static bool dmi_is_desktop(void)
++{
++ const char *chassis_type;
++
++ chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE);
++ if (!chassis_type)
++ return false;
++
++ if (!strcmp(chassis_type, "3") || /* 3: Desktop */
++ !strcmp(chassis_type, "4") || /* 4: Low Profile Desktop */
++ !strcmp(chassis_type, "5") || /* 5: Pizza Box */
++ !strcmp(chassis_type, "6") || /* 6: Mini Tower */
++ !strcmp(chassis_type, "7") || /* 7: Tower */
++ !strcmp(chassis_type, "11")) /* 11: Main Server Chassis */
++ return true;
++
++ return false;
++}
++
+ int acpi_video_register(void)
+ {
+ int ret = 0;
+@@ -2143,8 +2162,12 @@ int acpi_video_register(void)
+ * win8 ready (where we also prefer the native backlight driver, so
+ * normally the acpi_video code should not register there anyways).
+ */
+- if (only_lcd == -1)
+- only_lcd = acpi_osi_is_win8();
++ if (only_lcd == -1) {
++ if (dmi_is_desktop() && acpi_osi_is_win8())
++ only_lcd = true;
++ else
++ only_lcd = false;
++ }
+
+ dmi_check_system(video_dmi_table);
+
--- /dev/null
+From 8a500df63d07d8aee44b7ee2c54e462e47ce93ec Mon Sep 17 00:00:00 2001
+From: Finn Thain <fthain@telegraphics.com.au>
+Date: Wed, 11 Apr 2018 20:50:14 -0400
+Subject: block/swim: Check drive type
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+commit 8a500df63d07d8aee44b7ee2c54e462e47ce93ec upstream.
+
+The SWIM chip is compatible with GCR-mode Sony 400K/800K drives but
+this driver only supports MFM mode. Therefore only Sony FDHD drives
+are supported. Skip incompatible drives.
+
+Cc: Laurent Vivier <lvivier@redhat.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: stable@vger.kernel.org # v4.14+
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Acked-by: Laurent Vivier <lvivier@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/swim.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/block/swim.c
++++ b/drivers/block/swim.c
+@@ -834,10 +834,12 @@ static int swim_floppy_init(struct swim_
+ /* scan floppy drives */
+
+ swim_drive(base, INTERNAL_DRIVE);
+- if (swim_readbit(base, DRIVE_PRESENT))
++ if (swim_readbit(base, DRIVE_PRESENT) &&
++ !swim_readbit(base, ONEMEG_DRIVE))
+ swim_add_floppy(swd, INTERNAL_DRIVE);
+ swim_drive(base, EXTERNAL_DRIVE);
+- if (swim_readbit(base, DRIVE_PRESENT))
++ if (swim_readbit(base, DRIVE_PRESENT) &&
++ !swim_readbit(base, ONEMEG_DRIVE))
+ swim_add_floppy(swd, EXTERNAL_DRIVE);
+
+ /* register floppy drives */
--- /dev/null
+From 8e2ab5a4efaac77fb93e5b5b109d0b3976fdd3a0 Mon Sep 17 00:00:00 2001
+From: Finn Thain <fthain@telegraphics.com.au>
+Date: Wed, 11 Apr 2018 20:50:14 -0400
+Subject: block/swim: Don't log an error message for an invalid ioctl
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+commit 8e2ab5a4efaac77fb93e5b5b109d0b3976fdd3a0 upstream.
+
+The 'eject' shell command may send various different ioctl commands.
+This leads to error messages on the console even though the FDEJECT
+ioctl succeeds.
+
+~# eject floppy
+SWIM floppy_ioctl: unknown cmd 21257
+SWIM floppy_ioctl: unknown cmd 1
+
+Don't log an error message for an invalid ioctl, just do as the
+swim3 driver does and return -ENOTTY.
+
+Cc: Laurent Vivier <lvivier@redhat.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: stable@vger.kernel.org # v4.14+
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Acked-by: Laurent Vivier <lvivier@redhat.com>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/swim.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+--- a/drivers/block/swim.c
++++ b/drivers/block/swim.c
+@@ -727,14 +727,9 @@ static int floppy_ioctl(struct block_dev
+ if (copy_to_user((void __user *) param, (void *) &floppy_type,
+ sizeof(struct floppy_struct)))
+ return -EFAULT;
+- break;
+-
+- default:
+- printk(KERN_DEBUG "SWIM floppy_ioctl: unknown cmd %d\n",
+- cmd);
+- return -ENOSYS;
++ return 0;
+ }
+- return 0;
++ return -ENOTTY;
+ }
+
+ static int floppy_getgeo(struct block_device *bdev, struct hd_geometry *geo)
--- /dev/null
+From 7ae6a2b6cc058005ee3d0d2b9ce27688e51afa4b Mon Sep 17 00:00:00 2001
+From: Finn Thain <fthain@telegraphics.com.au>
+Date: Wed, 11 Apr 2018 20:50:14 -0400
+Subject: block/swim: Fix array bounds check
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+commit 7ae6a2b6cc058005ee3d0d2b9ce27688e51afa4b upstream.
+
+In the floppy_find() function in swim.c is a call to
+get_disk(swd->unit[drive].disk). The actual parameter to this call
+can be a NULL pointer when drive == swd->floppy_count. This causes
+an oops in get_disk().
+
+Data read fault at 0x00000198 in Super Data (pc=0x1be5b6)
+BAD KERNEL BUSERR
+Oops: 00000000
+Modules linked in: swim_mod ipv6 mac8390
+PC: [<001be5b6>] get_disk+0xc/0x76
+SR: 2004 SP: 9a078bc1 a2: 0213ed90
+d0: 00000000 d1: 00000000 d2: 00000000 d3: 000000ff
+d4: 00000002 d5: 02983590 a0: 02332e00 a1: 022dfd64
+Process dd (pid: 285, task=020ab25b)
+Frame format=B ssw=074d isc=4a88 isb=6732 daddr=00000198 dobuf=00000000
+baddr=001be5bc dibuf=bfffffff ver=f
+Stack from 022dfca4:
+ 00000000 0203fc00 0213ed90 022dfcc0 02982936 00000000 00200000 022dfd08
+ 0020f85a 00200000 022dfd64 02332e00 004040fc 00000014 001be77e 022dfd64
+ 00334e4a 001be3f8 0800001d 022dfd64 01c04b60 01c04b70 022aba80 029828f8
+ 02332e00 022dfd2c 001be7ac 0203fc00 00200000 022dfd64 02103a00 01c04b60
+ 01c04b60 0200e400 022dfd68 000e191a 00200000 022dfd64 02103a00 0800001d
+ 00000000 00000003 000b89de 00500000 02103a00 01c04b60 02103a08 01c04c2e
+Call Trace: [<02982936>] floppy_find+0x3e/0x4a [swim_mod]
+ [<00200000>] uart_remove_one_port+0x1a2/0x260
+ [<0020f85a>] kobj_lookup+0xde/0x132
+ [<00200000>] uart_remove_one_port+0x1a2/0x260
+ [<001be77e>] get_gendisk+0x0/0x130
+ [<00334e4a>] mutex_lock+0x0/0x2e
+ [<001be3f8>] disk_block_events+0x0/0x6c
+ [<029828f8>] floppy_find+0x0/0x4a [swim_mod]
+ [<001be7ac>] get_gendisk+0x2e/0x130
+ [<00200000>] uart_remove_one_port+0x1a2/0x260
+ [<000e191a>] __blkdev_get+0x32/0x45a
+ [<00200000>] uart_remove_one_port+0x1a2/0x260
+ [<000b89de>] complete_walk+0x0/0x8a
+ [<000e1e22>] blkdev_get+0xe0/0x29a
+ [<000e1fdc>] blkdev_open+0x0/0xb0
+ [<000b89de>] complete_walk+0x0/0x8a
+ [<000e1fdc>] blkdev_open+0x0/0xb0
+ [<000e01cc>] bd_acquire+0x74/0x8a
+ [<000e205c>] blkdev_open+0x80/0xb0
+ [<000e1fdc>] blkdev_open+0x0/0xb0
+ [<000abf24>] do_dentry_open+0x1a4/0x322
+ [<00020000>] __do_proc_douintvec+0x22/0x27e
+ [<000b89de>] complete_walk+0x0/0x8a
+ [<000baa62>] link_path_walk+0x0/0x48e
+ [<000ba3f8>] inode_permission+0x20/0x54
+ [<000ac0e4>] vfs_open+0x42/0x78
+ [<000bc372>] path_openat+0x2b2/0xeaa
+ [<000bc0c0>] path_openat+0x0/0xeaa
+ [<0004463e>] __irq_wake_thread+0x0/0x4e
+ [<0003a45a>] task_tick_fair+0x18/0xc8
+ [<000bd00a>] do_filp_open+0xa0/0xea
+ [<000abae0>] do_sys_open+0x11a/0x1ee
+ [<00020000>] __do_proc_douintvec+0x22/0x27e
+ [<000abbf4>] SyS_open+0x1e/0x22
+ [<00020000>] __do_proc_douintvec+0x22/0x27e
+ [<00002b40>] syscall+0x8/0xc
+ [<00020000>] __do_proc_douintvec+0x22/0x27e
+ [<0000c00b>] dyadic+0x1/0x28
+Code: 4e5e 4e75 4e56 fffc 2f0b 2f02 266e 0008 <206b> 0198 4a88 6732 2428 002c 661e 486b 0058 4eb9 0032 0b96 588f 4a88 672c 2008
+Disabling lock debugging due to kernel taint
+
+Fix the array index bounds check to avoid this.
+
+Cc: Laurent Vivier <lvivier@redhat.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: stable@vger.kernel.org # v4.14+
+Fixes: 8852ecd97488 ("[PATCH] m68k: mac - Add SWIM floppy support")
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Acked-by: Laurent Vivier <lvivier@redhat.com>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/swim.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/block/swim.c
++++ b/drivers/block/swim.c
+@@ -790,7 +790,7 @@ static struct kobject *floppy_find(dev_t
+ struct swim_priv *swd = data;
+ int drive = (*part & 3);
+
+- if (drive > swd->floppy_count)
++ if (drive >= swd->floppy_count)
+ return NULL;
+
+ *part = 0;
--- /dev/null
+From 5a13388d7aa1177b98d7168330ecbeeac52f844d Mon Sep 17 00:00:00 2001
+From: Finn Thain <fthain@telegraphics.com.au>
+Date: Wed, 11 Apr 2018 20:50:14 -0400
+Subject: block/swim: Fix IO error at end of medium
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+commit 5a13388d7aa1177b98d7168330ecbeeac52f844d upstream.
+
+Reading to the end of a 720K disk results in an IO error instead of EOF
+because the block layer thinks the disk has 2880 sectors. (Partly this
+is a result of inverted logic of the ONEMEG_MEDIA bit that's now fixed.)
+
+Initialize the density and head count in swim_add_floppy() to agree
+with the device size passed to set_capacity() during drive probe.
+
+Call set_capacity() again upon device open, after refreshing the density
+and head count values.
+
+Cc: Laurent Vivier <lvivier@redhat.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: stable@vger.kernel.org # v4.14+
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Acked-by: Laurent Vivier <lvivier@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/swim.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/block/swim.c
++++ b/drivers/block/swim.c
+@@ -612,7 +612,6 @@ static void setup_medium(struct floppy_s
+ struct floppy_struct *g;
+ fs->disk_in = 1;
+ fs->write_protected = swim_readbit(base, WRITE_PROT);
+- fs->type = swim_readbit(base, TWOMEG_MEDIA);
+
+ if (swim_track00(base))
+ printk(KERN_ERR
+@@ -620,6 +619,9 @@ static void setup_medium(struct floppy_s
+
+ swim_track00(base);
+
++ fs->type = swim_readbit(base, TWOMEG_MEDIA) ?
++ HD_MEDIA : DD_MEDIA;
++ fs->head_number = swim_readbit(base, SINGLE_SIDED) ? 1 : 2;
+ get_floppy_geometry(fs, 0, &g);
+ fs->total_secs = g->size;
+ fs->secpercyl = g->head * g->sect;
+@@ -656,6 +658,8 @@ static int floppy_open(struct block_devi
+ goto out;
+ }
+
++ set_capacity(fs->disk, fs->total_secs);
++
+ if (mode & FMODE_NDELAY)
+ return 0;
+
+@@ -808,10 +812,9 @@ static int swim_add_floppy(struct swim_p
+
+ swim_motor(base, OFF);
+
+- if (swim_readbit(base, SINGLE_SIDED))
+- fs->head_number = 1;
+- else
+- fs->head_number = 2;
++ fs->type = HD_MEDIA;
++ fs->head_number = 2;
++
+ fs->ref_count = 0;
+ fs->ejected = 1;
+
--- /dev/null
+From c1d6207cc0eef2a7f8551f9c7420d8776268f6e1 Mon Sep 17 00:00:00 2001
+From: Finn Thain <fthain@telegraphics.com.au>
+Date: Wed, 11 Apr 2018 20:50:14 -0400
+Subject: block/swim: Remove extra put_disk() call from error path
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+commit c1d6207cc0eef2a7f8551f9c7420d8776268f6e1 upstream.
+
+Cc: Laurent Vivier <lvivier@redhat.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: stable@vger.kernel.org # v4.14+
+Fixes: 103db8b2dfa5 ("[PATCH] swim: stop sharing request queue across multiple gendisks")
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Acked-by: Laurent Vivier <lvivier@redhat.com>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/swim.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/block/swim.c
++++ b/drivers/block/swim.c
+@@ -858,7 +858,6 @@ static int swim_floppy_init(struct swim_
+ &swd->lock);
+ if (!swd->unit[drive].disk->queue) {
+ err = -ENOMEM;
+- put_disk(swd->unit[drive].disk);
+ goto exit_put_disks;
+ }
+ blk_queue_bounce_limit(swd->unit[drive].disk->queue,
--- /dev/null
+From 56a1c5ee54f69dd767fb61d301883dc919ddc259 Mon Sep 17 00:00:00 2001
+From: Finn Thain <fthain@telegraphics.com.au>
+Date: Wed, 11 Apr 2018 20:50:14 -0400
+Subject: block/swim: Rename macros to avoid inconsistent inverted logic
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+commit 56a1c5ee54f69dd767fb61d301883dc919ddc259 upstream.
+
+The Sony drive status bits use active-low logic. The swim_readbit()
+function converts that to 'C' logic for readability. Hence, the
+sense of the names of the status bit macros should not be inverted.
+
+Mostly they are correct. However, the TWOMEG_DRIVE, MFM_MODE and
+TWOMEG_MEDIA macros have inverted sense (like MkLinux). Fix this
+inconsistency and make the following patches less confusing.
+
+The same problem affects swim3.c so fix that too.
+
+No functional change.
+
+The FDHD drive status bits are documented in sonydriv.cpp from MAME
+and in swimiii.h from MkLinux.
+
+Cc: Laurent Vivier <lvivier@redhat.com>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: linuxppc-dev@lists.ozlabs.org
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: stable@vger.kernel.org # v4.14+
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Acked-by: Laurent Vivier <lvivier@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/swim.c | 8 ++++----
+ drivers/block/swim3.c | 6 +++---
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/block/swim.c
++++ b/drivers/block/swim.c
+@@ -110,7 +110,7 @@ struct iwm {
+ /* Select values for swim_select and swim_readbit */
+
+ #define READ_DATA_0 0x074
+-#define TWOMEG_DRIVE 0x075
++#define ONEMEG_DRIVE 0x075
+ #define SINGLE_SIDED 0x076
+ #define DRIVE_PRESENT 0x077
+ #define DISK_IN 0x170
+@@ -118,9 +118,9 @@ struct iwm {
+ #define TRACK_ZERO 0x172
+ #define TACHO 0x173
+ #define READ_DATA_1 0x174
+-#define MFM_MODE 0x175
++#define GCR_MODE 0x175
+ #define SEEK_COMPLETE 0x176
+-#define ONEMEG_MEDIA 0x177
++#define TWOMEG_MEDIA 0x177
+
+ /* Bits in handshake register */
+
+@@ -612,7 +612,7 @@ static void setup_medium(struct floppy_s
+ struct floppy_struct *g;
+ fs->disk_in = 1;
+ fs->write_protected = swim_readbit(base, WRITE_PROT);
+- fs->type = swim_readbit(base, ONEMEG_MEDIA);
++ fs->type = swim_readbit(base, TWOMEG_MEDIA);
+
+ if (swim_track00(base))
+ printk(KERN_ERR
+--- a/drivers/block/swim3.c
++++ b/drivers/block/swim3.c
+@@ -148,7 +148,7 @@ struct swim3 {
+ #define MOTOR_ON 2
+ #define RELAX 3 /* also eject in progress */
+ #define READ_DATA_0 4
+-#define TWOMEG_DRIVE 5
++#define ONEMEG_DRIVE 5
+ #define SINGLE_SIDED 6 /* drive or diskette is 4MB type? */
+ #define DRIVE_PRESENT 7
+ #define DISK_IN 8
+@@ -156,9 +156,9 @@ struct swim3 {
+ #define TRACK_ZERO 10
+ #define TACHO 11
+ #define READ_DATA_1 12
+-#define MFM_MODE 13
++#define GCR_MODE 13
+ #define SEEK_COMPLETE 14
+-#define ONEMEG_MEDIA 15
++#define TWOMEG_MEDIA 15
+
+ /* Definitions of values used in writing and formatting */
+ #define DATA_ESCAPE 0x99
--- /dev/null
+From b3906535ccc6cd04c42f9b1c7e31d1947b3ebc74 Mon Sep 17 00:00:00 2001
+From: Finn Thain <fthain@telegraphics.com.au>
+Date: Wed, 11 Apr 2018 20:50:14 -0400
+Subject: block/swim: Select appropriate drive on device open
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+commit b3906535ccc6cd04c42f9b1c7e31d1947b3ebc74 upstream.
+
+The driver supports internal and external FDD units so the floppy_open
+function must not hard-code the drive location.
+
+Cc: Laurent Vivier <lvivier@redhat.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: stable@vger.kernel.org # v4.14+
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Acked-by: Laurent Vivier <lvivier@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/swim.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/block/swim.c
++++ b/drivers/block/swim.c
+@@ -646,7 +646,7 @@ static int floppy_open(struct block_devi
+
+ swim_write(base, setup, S_IBM_DRIVE | S_FCLK_DIV2);
+ udelay(10);
+- swim_drive(base, INTERNAL_DRIVE);
++ swim_drive(base, fs->location);
+ swim_motor(base, ON);
+ swim_action(base, SETMFM);
+ if (fs->ejected)
--- /dev/null
+From 9de4ee40547fd315d4a0ed1dd15a2fa3559ad707 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 18 Apr 2018 12:51:31 +0300
+Subject: cdrom: information leak in cdrom_ioctl_media_changed()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 9de4ee40547fd315d4a0ed1dd15a2fa3559ad707 upstream.
+
+This cast is wrong. "cdi->capacity" is an int and "arg" is an unsigned
+long. The way the check is written now, if one of the high 32 bits is
+set then we could read outside the info->slots[] array.
+
+This bug is pretty old and it predates git.
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cdrom/cdrom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/cdrom/cdrom.c
++++ b/drivers/cdrom/cdrom.c
+@@ -2374,7 +2374,7 @@ static int cdrom_ioctl_media_changed(str
+ if (!CDROM_CAN(CDC_SELECT_DISC) || arg == CDSL_CURRENT)
+ return media_changed(cdi, 1);
+
+- if ((unsigned int)arg >= cdi->capacity)
++ if (arg >= cdi->capacity)
+ return -EINVAL;
+
+ info = kmalloc(sizeof(*info), GFP_KERNEL);
--- /dev/null
+From 1f5781725dcbb026438e77091c91a94f678c3522 Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Tue, 10 Apr 2018 15:15:16 +0900
+Subject: commoncap: Handle memory allocation failure.
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+commit 1f5781725dcbb026438e77091c91a94f678c3522 upstream.
+
+syzbot is reporting NULL pointer dereference at xattr_getsecurity() [1],
+for cap_inode_getsecurity() is returning sizeof(struct vfs_cap_data) when
+memory allocation failed. Return -ENOMEM if memory allocation failed.
+
+[1] https://syzkaller.appspot.com/bug?id=a55ba438506fe68649a5f50d2d82d56b365e0107
+
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Fixes: 8db6c34f1dbc8e06 ("Introduce v3 namespaced file capabilities")
+Reported-by: syzbot <syzbot+9369930ca44f29e60e2d@syzkaller.appspotmail.com>
+Cc: stable <stable@vger.kernel.org> # 4.14+
+Acked-by: Serge E. Hallyn <serge@hallyn.com>
+Acked-by: James Morris <james.morris@microsoft.com>
+Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/commoncap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -449,6 +449,8 @@ int cap_inode_getsecurity(struct inode *
+ magic |= VFS_CAP_FLAGS_EFFECTIVE;
+ memcpy(&cap->data, &nscap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
+ cap->magic_etc = cpu_to_le32(magic);
++ } else {
++ size = -ENOMEM;
+ }
+ }
+ kfree(tmpbuf);
--- /dev/null
+From d90a10e2444ba5a351fa695917258ff4c5709fa5 Mon Sep 17 00:00:00 2001
+From: Robert Kolchmeyer <rkolchmeyer@google.com>
+Date: Thu, 19 Apr 2018 10:44:33 -0700
+Subject: fsnotify: Fix fsnotify_mark_connector race
+
+From: Robert Kolchmeyer <rkolchmeyer@google.com>
+
+commit d90a10e2444ba5a351fa695917258ff4c5709fa5 upstream.
+
+fsnotify() acquires a reference to a fsnotify_mark_connector through
+the SRCU-protected pointer to_tell->i_fsnotify_marks. However, it
+appears that no precautions are taken in fsnotify_put_mark() to
+ensure that fsnotify() drops its reference to this
+fsnotify_mark_connector before assigning a value to its 'destroy_next'
+field. This can result in fsnotify_put_mark() assigning a value
+to a connector's 'destroy_next' field right before fsnotify() tries to
+traverse the linked list referenced by the connector's 'list' field.
+Since these two fields are members of the same union, this behavior
+results in a kernel panic.
+
+This issue is resolved by moving the connector's 'destroy_next' field
+into the object pointer union. This should work since the object pointer
+access is protected by both a spinlock and the value of the 'flags'
+field, and the 'flags' field is cleared while holding the spinlock in
+fsnotify_put_mark() before 'destroy_next' is updated. It shouldn't be
+possible for another thread to accidentally read from the object pointer
+after the 'destroy_next' field is updated.
+
+The offending behavior here is extremely unlikely; since
+fsnotify_put_mark() removes references to a connector (specifically,
+it ensures that the connector is unreachable from the inode it was
+formerly attached to) before updating its 'destroy_next' field, a
+sizeable chunk of code in fsnotify_put_mark() has to execute in the
+short window between when fsnotify() acquires the connector reference
+and saves the value of its 'list' field. On the HEAD kernel, I've only
+been able to reproduce this by inserting a udelay(1) in fsnotify().
+However, I've been able to reproduce this issue without inserting a
+udelay(1) anywhere on older unmodified release kernels, so I believe
+it's worth fixing at HEAD.
+
+References: https://bugzilla.kernel.org/show_bug.cgi?id=199437
+Fixes: 08991e83b7286635167bab40927665a90fb00d81
+CC: stable@vger.kernel.org
+Signed-off-by: Robert Kolchmeyer <rkolchmeyer@google.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/fsnotify_backend.h | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/include/linux/fsnotify_backend.h
++++ b/include/linux/fsnotify_backend.h
+@@ -217,12 +217,10 @@ struct fsnotify_mark_connector {
+ union { /* Object pointer [lock] */
+ struct inode *inode;
+ struct vfsmount *mnt;
+- };
+- union {
+- struct hlist_head list;
+ /* Used listing heads to free after srcu period expires */
+ struct fsnotify_mark_connector *destroy_next;
+ };
++ struct hlist_head list;
+ };
+
+ /*
--- /dev/null
+From 877d8948d0aa402fbbede138fc73432bb335b65f Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Tue, 24 Apr 2018 08:59:45 -0700
+Subject: hwmon: (k10temp) Add support for AMD Ryzen w/ Vega graphics
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 877d8948d0aa402fbbede138fc73432bb335b65f upstream.
+
+Enable k10temp for AMD Ryzen APUs w/ Vega Mobile Gfx.
+
+Based on patch from René Rebe <rene@exactcode.de>. Dropped temperature
+offsets since those are not supposed to apply for the affected CPUs.
+
+Cc: stable@vger.kernel.org # v4.16+
+Cc: René Rebe <rene@exactcode.de>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/k10temp.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -40,6 +40,10 @@ static DEFINE_MUTEX(nb_smu_ind_mutex);
+ #define PCI_DEVICE_ID_AMD_17H_DF_F3 0x1463
+ #endif
+
++#ifndef PCI_DEVICE_ID_AMD_17H_RR_NB
++#define PCI_DEVICE_ID_AMD_17H_RR_NB 0x15d0
++#endif
++
+ /* CPUID function 0x80000001, ebx */
+ #define CPUID_PKGTYPE_MASK 0xf0000000
+ #define CPUID_PKGTYPE_F 0x00000000
+@@ -298,6 +302,7 @@ static const struct pci_device_id k10tem
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_DF_F3) },
++ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_RR_NB) },
+ {}
+ };
+ MODULE_DEVICE_TABLE(pci, k10temp_id_table);
--- /dev/null
+From 1b59788979acd230b9627276c76f6e6ba2c4709c Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Tue, 24 Apr 2018 06:55:55 -0700
+Subject: hwmon: (k10temp) Add temperature offset for Ryzen 2700X
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 1b59788979acd230b9627276c76f6e6ba2c4709c upstream.
+
+Ryzen 2700X has a temperature offset of 10 degrees C. If bit 19 of the
+Temperature Control register is set, there is an additional offset of
+49 degrees C. Take this into account as well.
+
+Cc: stable@vger.kernel.org # v4.16+
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/k10temp.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -72,6 +72,7 @@ struct k10temp_data {
+ struct pci_dev *pdev;
+ void (*read_tempreg)(struct pci_dev *pdev, u32 *regval);
+ int temp_offset;
++ u32 temp_adjust_mask;
+ };
+
+ struct tctl_offset {
+@@ -84,6 +85,7 @@ static const struct tctl_offset tctl_off
+ { 0x17, "AMD Ryzen 5 1600X", 20000 },
+ { 0x17, "AMD Ryzen 7 1700X", 20000 },
+ { 0x17, "AMD Ryzen 7 1800X", 20000 },
++ { 0x17, "AMD Ryzen 7 2700X", 10000 },
+ { 0x17, "AMD Ryzen Threadripper 1950X", 27000 },
+ { 0x17, "AMD Ryzen Threadripper 1920X", 27000 },
+ { 0x17, "AMD Ryzen Threadripper 1900X", 27000 },
+@@ -129,6 +131,8 @@ static ssize_t temp1_input_show(struct d
+
+ data->read_tempreg(data->pdev, ®val);
+ temp = (regval >> 21) * 125;
++ if (regval & data->temp_adjust_mask)
++ temp -= 49000;
+ if (temp > data->temp_offset)
+ temp -= data->temp_offset;
+ else
+@@ -259,12 +263,14 @@ static int k10temp_probe(struct pci_dev
+ data->pdev = pdev;
+
+ if (boot_cpu_data.x86 == 0x15 && (boot_cpu_data.x86_model == 0x60 ||
+- boot_cpu_data.x86_model == 0x70))
++ boot_cpu_data.x86_model == 0x70)) {
+ data->read_tempreg = read_tempreg_nb_f15;
+- else if (boot_cpu_data.x86 == 0x17)
++ } else if (boot_cpu_data.x86 == 0x17) {
++ data->temp_adjust_mask = 0x80000;
+ data->read_tempreg = read_tempreg_nb_f17;
+- else
++ } else {
+ data->read_tempreg = read_tempreg_pci;
++ }
+
+ for (i = 0; i < ARRAY_SIZE(tctl_offset_table); i++) {
+ const struct tctl_offset *entry = &tctl_offset_table[i];
--- /dev/null
+From bcbd385b61bbdef3491d662203ac2e8186e5be59 Mon Sep 17 00:00:00 2001
+From: Thomas Richter <tmricht@linux.ibm.com>
+Date: Thu, 19 Apr 2018 12:55:56 +0200
+Subject: kprobes: Fix random address output of blacklist file
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+commit bcbd385b61bbdef3491d662203ac2e8186e5be59 upstream.
+
+File /sys/kernel/debug/kprobes/blacklist displays random addresses:
+
+[root@s8360046 linux]# cat /sys/kernel/debug/kprobes/blacklist
+0x0000000047149a90-0x00000000bfcb099a print_type_x8
+....
+
+This breaks 'perf probe' which uses the blacklist file to prohibit
+probes on certain functions by checking the address range.
+
+Fix this by printing the correct (unhashed) address.
+
+The file mode is read all but this is not an issue as the file
+hierarchy points out:
+ # ls -ld /sys/ /sys/kernel/ /sys/kernel/debug/ /sys/kernel/debug/kprobes/
+ /sys/kernel/debug/kprobes/blacklist
+dr-xr-xr-x 12 root root 0 Apr 19 07:56 /sys/
+drwxr-xr-x 8 root root 0 Apr 19 07:56 /sys/kernel/
+drwx------ 16 root root 0 Apr 19 06:56 /sys/kernel/debug/
+drwxr-xr-x 2 root root 0 Apr 19 06:56 /sys/kernel/debug/kprobes/
+-r--r--r-- 1 root root 0 Apr 19 06:56 /sys/kernel/debug/kprobes/blacklist
+
+Everything in and below /sys/kernel/debug is rwx to root only,
+no group or others have access.
+
+Background:
+Directory /sys/kernel/debug/kprobes is created by debugfs_create_dir()
+which sets the mode bits to rwxr-xr-x. Maybe change that to use the
+parent's directory mode bits instead?
+
+Link: http://lkml.kernel.org/r/20180419105556.86664-1-tmricht@linux.ibm.com
+
+Fixes: ad67b74d2469 ("printk: hash addresses printed with %p")
+Cc: stable@vger.kernel.org
+Cc: <stable@vger.kernel.org> # v4.15+
+Cc: Ananth N Mavinakayanahalli <ananth@linux.vnet.ibm.com>
+Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
+Cc: David S Miller <davem@davemloft.net>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: acme@kernel.org
+
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/kprobes.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -2428,7 +2428,7 @@ static int kprobe_blacklist_seq_show(str
+ struct kprobe_blacklist_entry *ent =
+ list_entry(v, struct kprobe_blacklist_entry, list);
+
+- seq_printf(m, "0x%p-0x%p\t%ps\n", (void *)ent->start_addr,
++ seq_printf(m, "0x%px-0x%px\t%ps\n", (void *)ent->start_addr,
+ (void *)ent->end_addr, (void *)ent->start_addr);
+ return 0;
+ }
--- /dev/null
+From b64576cbf36afa5fabf3b31f62a1994c429ef855 Mon Sep 17 00:00:00 2001
+From: Finn Thain <fthain@telegraphics.com.au>
+Date: Wed, 11 Apr 2018 20:50:14 -0400
+Subject: m68k/mac: Don't remap SWIM MMIO region
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+commit b64576cbf36afa5fabf3b31f62a1994c429ef855 upstream.
+
+For reasons I don't understand, calling ioremap() then iounmap() on
+the SWIM MMIO region causes a hang on 68030 (but not on 68040).
+
+~# modprobe swim_mod
+SWIM floppy driver Version 0.2 (2008-10-30)
+SWIM device not found !
+watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [modprobe:285]
+Modules linked in: swim_mod(+)
+Format 00 Vector: 0064 PC: 000075aa Status: 2000 Not tainted
+ORIG_D0: ffffffff D0: d00c0000 A2: 007c2370 A1: 003f810c
+A0: 00040000 D5: d0096800 D4: d0097e00
+D3: 00000001 D2: 00000003 D1: 00000000
+Non-Maskable Interrupt
+Modules linked in: swim_mod(+)
+PC: [<000075ba>] __iounmap+0x24/0x10e
+SR: 2000 SP: 007abc48 a2: 007c2370
+d0: d00c0000 d1: 000001a0 d2: 00000019 d3: 00000001
+d4: d0097e00 d5: d0096800 a0: 00040000 a1: 003f810c
+Process modprobe (pid: 285, task=007c2370)
+Frame format=0
+Stack from 007abc7c:
+ ffffffed 00000000 006a4060 004712e0 007abca0 000076ea d0080000 00080000
+ 010bb4b8 007abcd8 010ba542 d0096000 00000000 00000000 00000001 010bb59c
+ 00000000 007abf30 010bb4b8 0047760a 0047763c 00477612 00616540 007abcec
+ 0020a91a 00477600 0047760a 010bb4cc 007abd18 002092f2 0047760a 00333b06
+ 007abd5c 00000000 0047760a 010bb4cc 00404f90 004776b8 00000001 007abd38
+ 00209446 010bb4cc 0047760a 010bb4cc 0020938e 0031f8be 00616540 007abd64
+Call Trace: [<000076ea>] iounmap+0x46/0x5a
+ [<00080000>] shrink_page_list+0x7f6/0xe06
+ [<010ba542>] swim_probe+0xe4/0x496 [swim_mod]
+ [<0020a91a>] platform_drv_probe+0x20/0x5e
+ [<002092f2>] driver_probe_device+0x21c/0x2b8
+ [<00333b06>] mutex_lock+0x0/0x2e
+ [<00209446>] __driver_attach+0xb8/0xce
+ [<0020938e>] __driver_attach+0x0/0xce
+ [<0031f8be>] klist_next+0x0/0xa0
+ [<00207562>] bus_for_each_dev+0x74/0xba
+ [<000344c0>] blocking_notifier_call_chain+0x0/0x20
+ [<00333b06>] mutex_lock+0x0/0x2e
+ [<00208e44>] driver_attach+0x1a/0x1e
+ [<0020938e>] __driver_attach+0x0/0xce
+ [<00207e26>] bus_add_driver+0x188/0x234
+ [<000344c0>] blocking_notifier_call_chain+0x0/0x20
+ [<00209894>] driver_register+0x58/0x104
+ [<000344c0>] blocking_notifier_call_chain+0x0/0x20
+ [<010bd000>] swim_init+0x0/0x2c [swim_mod]
+ [<0020a7be>] __platform_driver_register+0x38/0x3c
+ [<010bd028>] swim_init+0x28/0x2c [swim_mod]
+ [<000020dc>] do_one_initcall+0x38/0x196
+ [<000344c0>] blocking_notifier_call_chain+0x0/0x20
+ [<003331cc>] mutex_unlock+0x0/0x3e
+ [<00333b06>] mutex_lock+0x0/0x2e
+ [<003331cc>] mutex_unlock+0x0/0x3e
+ [<00333b06>] mutex_lock+0x0/0x2e
+ [<003331cc>] mutex_unlock+0x0/0x3e
+ [<00333b06>] mutex_lock+0x0/0x2e
+ [<003331cc>] mutex_unlock+0x0/0x3e
+ [<00333b06>] mutex_lock+0x0/0x2e
+ [<00075008>] __free_pages+0x0/0x38
+ [<000045c0>] mangle_kernel_stack+0x30/0xda
+ [<000344c0>] blocking_notifier_call_chain+0x0/0x20
+ [<003331cc>] mutex_unlock+0x0/0x3e
+ [<00333b06>] mutex_lock+0x0/0x2e
+ [<0005ced4>] do_init_module+0x42/0x266
+ [<010bd000>] swim_init+0x0/0x2c [swim_mod]
+ [<000344c0>] blocking_notifier_call_chain+0x0/0x20
+ [<0005eda0>] load_module+0x1a30/0x1e70
+ [<0000465d>] mangle_kernel_stack+0xcd/0xda
+ [<00331c64>] __generic_copy_from_user+0x0/0x46
+ [<0033256e>] _cond_resched+0x0/0x32
+ [<00331b9c>] memset+0x0/0x98
+ [<0033256e>] _cond_resched+0x0/0x32
+ [<0005f25c>] SyS_init_module+0x7c/0x112
+ [<00002000>] _start+0x0/0x8
+ [<00002000>] _start+0x0/0x8
+ [<00331c82>] __generic_copy_from_user+0x1e/0x46
+ [<0005f2b2>] SyS_init_module+0xd2/0x112
+ [<0000465d>] mangle_kernel_stack+0xcd/0xda
+ [<00002b40>] syscall+0x8/0xc
+ [<0000465d>] mangle_kernel_stack+0xcd/0xda
+ [<0008c00c>] pcpu_balance_workfn+0xb2/0x40e
+Code: 2200 7419 e4a9 e589 2841 d9fc 0000 1000 <2414> 7203 c282 7602 b681 6600 0096 0242 fe00 0482 0000 0000 e9c0 11c3 ed89 2642
+
+There's no need to call ioremap() for the SWIM address range, as it lies
+within the usual IO device region at 0x5000 0000, which has already been
+mapped by head.S.
+
+Remove the redundant ioremap() and iounmap() calls to fix the hang.
+
+Cc: Laurent Vivier <lvivier@redhat.com>
+Cc: stable@vger.kernel.org # v4.14+
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Acked-by: Laurent Vivier <lvivier@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/swim.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+--- a/drivers/block/swim.c
++++ b/drivers/block/swim.c
+@@ -911,7 +911,7 @@ static int swim_probe(struct platform_de
+ goto out;
+ }
+
+- swim_base = ioremap(res->start, resource_size(res));
++ swim_base = (struct swim __iomem *)res->start;
+ if (!swim_base) {
+ ret = -ENOMEM;
+ goto out_release_io;
+@@ -923,7 +923,7 @@ static int swim_probe(struct platform_de
+ if (!get_swim_mode(swim_base)) {
+ printk(KERN_INFO "SWIM device not found !\n");
+ ret = -ENODEV;
+- goto out_iounmap;
++ goto out_release_io;
+ }
+
+ /* set platform driver data */
+@@ -931,7 +931,7 @@ static int swim_probe(struct platform_de
+ swd = kzalloc(sizeof(struct swim_priv), GFP_KERNEL);
+ if (!swd) {
+ ret = -ENOMEM;
+- goto out_iounmap;
++ goto out_release_io;
+ }
+ platform_set_drvdata(dev, swd);
+
+@@ -945,8 +945,6 @@ static int swim_probe(struct platform_de
+
+ out_kfree:
+ kfree(swd);
+-out_iounmap:
+- iounmap(swim_base);
+ out_release_io:
+ release_mem_region(res->start, resource_size(res));
+ out:
+@@ -974,8 +972,6 @@ static int swim_remove(struct platform_d
+ for (drive = 0; drive < swd->floppy_count; drive++)
+ floppy_eject(&swd->unit[drive]);
+
+- iounmap(swd->base);
+-
+ res = platform_get_resource(dev, IORESOURCE_MEM, 0);
+ if (res)
+ release_mem_region(res->start, resource_size(res));
--- /dev/null
+From 6c0675331b010daf06d60c889b5765e81ef7b40e Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Fri, 27 Apr 2018 13:49:00 +0200
+Subject: Revert "mm/hmm: fix header file if/else/endif maze"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+This reverts commit 25df8b83e867dcfb660123e9589ebf6f094fcdd3 which is
+commit b28b08de436a638c82d0cf3dcdbdbad055baf1fc upstream.
+
+There are still build errors with this patch applied, and the upstream
+patches do not seem to apply anymore, so reverting this patch seems like
+the best thing to do at this point in time.
+
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Михаил Носов <drdeimosnn@gmail.com>
+Cc: Jérôme Glisse <jglisse@redhat.com>
+Cc: Balbir Singh <bsingharora@gmail.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Ralph Campbell <rcampbell@nvidia.com>
+Cc: John Hubbard <jhubbard@nvidia.com>
+Cc: Evgeny Baskakov <ebaskakov@nvidia.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/hmm.h | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/include/linux/hmm.h
++++ b/include/linux/hmm.h
+@@ -498,16 +498,23 @@ struct hmm_device {
+ struct hmm_device *hmm_device_new(void *drvdata);
+ void hmm_device_put(struct hmm_device *hmm_device);
+ #endif /* CONFIG_DEVICE_PRIVATE || CONFIG_DEVICE_PUBLIC */
++#endif /* IS_ENABLED(CONFIG_HMM) */
+
+ /* Below are for HMM internal use only! Not to be used by device driver! */
++#if IS_ENABLED(CONFIG_HMM_MIRROR)
+ void hmm_mm_destroy(struct mm_struct *mm);
+
+ static inline void hmm_mm_init(struct mm_struct *mm)
+ {
+ mm->hmm = NULL;
+ }
++#else /* IS_ENABLED(CONFIG_HMM_MIRROR) */
++static inline void hmm_mm_destroy(struct mm_struct *mm) {}
++static inline void hmm_mm_init(struct mm_struct *mm) {}
++#endif /* IS_ENABLED(CONFIG_HMM_MIRROR) */
++
++
+ #else /* IS_ENABLED(CONFIG_HMM) */
+ static inline void hmm_mm_destroy(struct mm_struct *mm) {}
+ static inline void hmm_mm_init(struct mm_struct *mm) {}
+-#endif /* IS_ENABLED(CONFIG_HMM) */
+ #endif /* LINUX_HMM_H */
--- /dev/null
+From af2e460ade0b0180d0f3812ca4f4f59cc9597f3e Mon Sep 17 00:00:00 2001
+From: Sebastian Ott <sebott@linux.ibm.com>
+Date: Wed, 11 Apr 2018 11:21:17 +0200
+Subject: s390/cio: update chpid descriptor after resource accessibility event
+
+From: Sebastian Ott <sebott@linux.ibm.com>
+
+commit af2e460ade0b0180d0f3812ca4f4f59cc9597f3e upstream.
+
+Channel path descriptors have been seen as something stable (as
+long as the chpid is configured). Recent tests have shown that the
+descriptor can also be altered when the link state of a channel path
+changes. Thus it is necessary to update the descriptor during
+handling of resource accessibility events.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Sebastian Ott <sebott@linux.ibm.com>
+Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/s390/cio/chsc.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/s390/cio/chsc.c
++++ b/drivers/s390/cio/chsc.c
+@@ -452,6 +452,7 @@ static void chsc_process_sei_link_incide
+
+ static void chsc_process_sei_res_acc(struct chsc_sei_nt0_area *sei_area)
+ {
++ struct channel_path *chp;
+ struct chp_link link;
+ struct chp_id chpid;
+ int status;
+@@ -464,10 +465,17 @@ static void chsc_process_sei_res_acc(str
+ chpid.id = sei_area->rsid;
+ /* allocate a new channel path structure, if needed */
+ status = chp_get_status(chpid);
+- if (status < 0)
+- chp_new(chpid);
+- else if (!status)
++ if (!status)
+ return;
++
++ if (status < 0) {
++ chp_new(chpid);
++ } else {
++ chp = chpid_to_chp(chpid);
++ mutex_lock(&chp->lock);
++ chp_update_desc(chp);
++ mutex_unlock(&chp->lock);
++ }
+ memset(&link, 0, sizeof(struct chp_link));
+ link.chpid = chpid;
+ if ((sei_area->vf & 0xc0) != 0) {
--- /dev/null
+From 5f3ba878e7a2ffef82fb0882c0dd2c3507d734bc Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Andr=C3=A9=20Wild?= <wild@linux.ibm.com>
+Date: Wed, 18 Apr 2018 17:59:58 +0200
+Subject: s390/cpum_cf: rename IBM z13/z14 counter names
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: André Wild <wild@linux.ibm.com>
+
+commit 5f3ba878e7a2ffef82fb0882c0dd2c3507d734bc upstream.
+
+Change the IBM z13/z14 counter names to be in sync with all other models.
+
+Cc: stable@vger.kernel.org # v4.12+
+Fixes: 3593eb944c ("s390/cpum_cf: add hardware counter support for IBM z14")
+Fixes: 3fc7acebae ("s390/cpum_cf: add IBM z13 counter event names")
+Signed-off-by: André Wild <wild@linux.ibm.com>
+Signed-off-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/kernel/perf_cpum_cf_events.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/s390/kernel/perf_cpum_cf_events.c
++++ b/arch/s390/kernel/perf_cpum_cf_events.c
+@@ -123,7 +123,7 @@ CPUMF_EVENT_ATTR(cf_zec12, L1I_OFFBOOK_L
+ CPUMF_EVENT_ATTR(cf_zec12, TX_NC_TABORT, 0x00b1);
+ CPUMF_EVENT_ATTR(cf_zec12, TX_C_TABORT_NO_SPECIAL, 0x00b2);
+ CPUMF_EVENT_ATTR(cf_zec12, TX_C_TABORT_SPECIAL, 0x00b3);
+-CPUMF_EVENT_ATTR(cf_z13, L1D_WRITES_RO_EXCL, 0x0080);
++CPUMF_EVENT_ATTR(cf_z13, L1D_RO_EXCL_WRITES, 0x0080);
+ CPUMF_EVENT_ATTR(cf_z13, DTLB1_WRITES, 0x0081);
+ CPUMF_EVENT_ATTR(cf_z13, DTLB1_MISSES, 0x0082);
+ CPUMF_EVENT_ATTR(cf_z13, DTLB1_HPAGE_WRITES, 0x0083);
+@@ -179,7 +179,7 @@ CPUMF_EVENT_ATTR(cf_z13, TX_C_TABORT_NO_
+ CPUMF_EVENT_ATTR(cf_z13, TX_C_TABORT_SPECIAL, 0x00dc);
+ CPUMF_EVENT_ATTR(cf_z13, MT_DIAG_CYCLES_ONE_THR_ACTIVE, 0x01c0);
+ CPUMF_EVENT_ATTR(cf_z13, MT_DIAG_CYCLES_TWO_THR_ACTIVE, 0x01c1);
+-CPUMF_EVENT_ATTR(cf_z14, L1D_WRITES_RO_EXCL, 0x0080);
++CPUMF_EVENT_ATTR(cf_z14, L1D_RO_EXCL_WRITES, 0x0080);
+ CPUMF_EVENT_ATTR(cf_z14, DTLB2_WRITES, 0x0081);
+ CPUMF_EVENT_ATTR(cf_z14, DTLB2_MISSES, 0x0082);
+ CPUMF_EVENT_ATTR(cf_z14, DTLB2_HPAGE_WRITES, 0x0083);
+@@ -371,7 +371,7 @@ static struct attribute *cpumcf_zec12_pm
+ };
+
+ static struct attribute *cpumcf_z13_pmu_event_attr[] __initdata = {
+- CPUMF_EVENT_PTR(cf_z13, L1D_WRITES_RO_EXCL),
++ CPUMF_EVENT_PTR(cf_z13, L1D_RO_EXCL_WRITES),
+ CPUMF_EVENT_PTR(cf_z13, DTLB1_WRITES),
+ CPUMF_EVENT_PTR(cf_z13, DTLB1_MISSES),
+ CPUMF_EVENT_PTR(cf_z13, DTLB1_HPAGE_WRITES),
+@@ -431,7 +431,7 @@ static struct attribute *cpumcf_z13_pmu_
+ };
+
+ static struct attribute *cpumcf_z14_pmu_event_attr[] __initdata = {
+- CPUMF_EVENT_PTR(cf_z14, L1D_WRITES_RO_EXCL),
++ CPUMF_EVENT_PTR(cf_z14, L1D_RO_EXCL_WRITES),
+ CPUMF_EVENT_PTR(cf_z14, DTLB2_WRITES),
+ CPUMF_EVENT_PTR(cf_z14, DTLB2_MISSES),
+ CPUMF_EVENT_PTR(cf_z14, DTLB2_HPAGE_WRITES),
--- /dev/null
+From 5d27a2bf6e14f5c7d1033ad1e993fcd0eba43e83 Mon Sep 17 00:00:00 2001
+From: Stefan Haberland <sth@linux.vnet.ibm.com>
+Date: Thu, 12 Apr 2018 13:38:22 +0200
+Subject: s390/dasd: fix IO error for newly defined devices
+
+From: Stefan Haberland <sth@linux.vnet.ibm.com>
+
+commit 5d27a2bf6e14f5c7d1033ad1e993fcd0eba43e83 upstream.
+
+When a new CKD storage volume is defined at the storage server, Linux
+may be relying on outdated information about that volume, which leads to
+the following errors:
+
+1. Command Reject Errors for minidisk on z/VM:
+
+dasd-eckd.b3193d: 0.0.XXXX: An error occurred in the DASD device driver,
+ reason=09
+dasd(eckd): I/O status report for device 0.0.XXXX:
+dasd(eckd): in req: 00000000XXXXXXXX CC:00 FC:04 AC:00 SC:17 DS:02 CS:00
+ RC:0
+dasd(eckd): device 0.0.2046: Failing CCW: 00000000XXXXXXXX
+dasd(eckd): Sense(hex) 0- 7: 80 00 00 00 00 00 00 00
+dasd(eckd): Sense(hex) 8-15: 00 00 00 00 00 00 00 00
+dasd(eckd): Sense(hex) 16-23: 00 00 00 00 e1 00 0f 00
+dasd(eckd): Sense(hex) 24-31: 00 00 40 e2 00 00 00 00
+dasd(eckd): 24 Byte: 0 MSG 0, no MSGb to SYSOP
+
+2. Equipment Check errors on LPAR or for dedicated devices on z/VM:
+
+dasd(eckd): I/O status report for device 0.0.XXXX:
+dasd(eckd): in req: 00000000XXXXXXXX CC:00 FC:04 AC:00 SC:17 DS:0E CS:40
+ fcxs:01 schxs:00 RC:0
+dasd(eckd): device 0.0.9713: Failing TCW: 00000000XXXXXXXX
+dasd(eckd): Sense(hex) 0- 7: 10 00 00 00 13 58 4d 0f
+dasd(eckd): Sense(hex) 8-15: 67 00 00 00 00 00 00 04
+dasd(eckd): Sense(hex) 16-23: e5 18 05 33 97 01 0f 0f
+dasd(eckd): Sense(hex) 24-31: 00 00 40 e2 00 04 58 0d
+dasd(eckd): 24 Byte: 0 MSG f, no MSGb to SYSOP
+
+Fix this problem by using the up-to-date information provided during
+online processing via the device specific SNEQ to detect the case of
+outdated LCU data. If there is a difference, perform a re-read of that
+data.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
+Signed-off-by: Stefan Haberland <sth@linux.vnet.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/s390/block/dasd_alias.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/s390/block/dasd_alias.c
++++ b/drivers/s390/block/dasd_alias.c
+@@ -592,13 +592,22 @@ static int _schedule_lcu_update(struct a
+ int dasd_alias_add_device(struct dasd_device *device)
+ {
+ struct dasd_eckd_private *private = device->private;
+- struct alias_lcu *lcu;
++ __u8 uaddr = private->uid.real_unit_addr;
++ struct alias_lcu *lcu = private->lcu;
+ unsigned long flags;
+ int rc;
+
+- lcu = private->lcu;
+ rc = 0;
+ spin_lock_irqsave(&lcu->lock, flags);
++ /*
++ * Check if device and lcu type differ. If so, the uac data may be
++ * outdated and needs to be updated.
++ */
++ if (private->uid.type != lcu->uac->unit[uaddr].ua_type) {
++ lcu->flags |= UPDATE_PENDING;
++ DBF_DEV_EVENT(DBF_WARNING, device, "%s",
++ "uid type mismatch - trigger rescan");
++ }
+ if (!(lcu->flags & UPDATE_PENDING)) {
+ rc = _add_device_to_lcu(lcu, device, device);
+ if (rc)
--- /dev/null
+From 783c3b53b9506db3e05daacfe34e0287eebb09d8 Mon Sep 17 00:00:00 2001
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+Date: Mon, 16 Apr 2018 12:22:24 +0200
+Subject: s390/uprobes: implement arch_uretprobe_is_alive()
+
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+
+commit 783c3b53b9506db3e05daacfe34e0287eebb09d8 upstream.
+
+Implement s390 specific arch_uretprobe_is_alive() to avoid SIGSEGVs
+observed with uretprobes in combination with setjmp/longjmp.
+
+See commit 2dea1d9c38e4 ("powerpc/uprobes: Implement
+arch_uretprobe_is_alive()") for more details.
+
+With this implemented all test cases referenced in the above commit
+pass.
+
+Reported-by: Ziqian SUN <zsun@redhat.com>
+Cc: <stable@vger.kernel.org> # v4.3+
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/kernel/uprobes.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/s390/kernel/uprobes.c
++++ b/arch/s390/kernel/uprobes.c
+@@ -150,6 +150,15 @@ unsigned long arch_uretprobe_hijack_retu
+ return orig;
+ }
+
++bool arch_uretprobe_is_alive(struct return_instance *ret, enum rp_check ctx,
++ struct pt_regs *regs)
++{
++ if (ctx == RP_CHECK_CHAIN_CALL)
++ return user_stack_pointer(regs) <= ret->stack;
++ else
++ return user_stack_pointer(regs) < ret->stack;
++}
++
+ /* Instruction Emulation */
+
+ static void adjust_psw_addr(psw_t *psw, unsigned long len)
--- /dev/null
+From 94e5395d2403c8bc2504a7cbe4c4caaacb7b8b84 Mon Sep 17 00:00:00 2001
+From: "Martin K. Petersen" <martin.petersen@oracle.com>
+Date: Wed, 18 Apr 2018 22:54:59 -0400
+Subject: scsi: mptsas: Disable WRITE SAME
+
+From: Martin K. Petersen <martin.petersen@oracle.com>
+
+commit 94e5395d2403c8bc2504a7cbe4c4caaacb7b8b84 upstream.
+
+First generation MPT Fusion controllers can not translate WRITE SAME
+when the attached device is a SATA drive. Disable WRITE SAME support.
+
+Reported-by: Nikola Ciprich <nikola.ciprich@linuxbox.cz>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/message/fusion/mptsas.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/message/fusion/mptsas.c
++++ b/drivers/message/fusion/mptsas.c
+@@ -1994,6 +1994,7 @@ static struct scsi_host_template mptsas_
+ .cmd_per_lun = 7,
+ .use_clustering = ENABLE_CLUSTERING,
+ .shost_attrs = mptscsih_host_attrs,
++ .no_write_same = 1,
+ };
+
+ static int mptsas_get_linkerrors(struct sas_phy *phy)
net-aquantia-oops-when-shutdown-on-already-stopped-device.patch
virtio_net-split-out-ctrl-buffer.patch
virtio_net-fix-adding-vids-on-big-endian.patch
+revert-mm-hmm-fix-header-file-if-else-endif-maze.patch
+commoncap-handle-memory-allocation-failure.patch
+scsi-mptsas-disable-write-same.patch
+cdrom-information-leak-in-cdrom_ioctl_media_changed.patch
+fsnotify-fix-fsnotify_mark_connector-race.patch
+m68k-mac-don-t-remap-swim-mmio-region.patch
+block-swim-check-drive-type.patch
+block-swim-don-t-log-an-error-message-for-an-invalid-ioctl.patch
+block-swim-remove-extra-put_disk-call-from-error-path.patch
+block-swim-rename-macros-to-avoid-inconsistent-inverted-logic.patch
+block-swim-select-appropriate-drive-on-device-open.patch
+block-swim-fix-array-bounds-check.patch
+block-swim-fix-io-error-at-end-of-medium.patch
+tracing-fix-missing-tab-for-hwlat_detector-print-format.patch
+hwmon-k10temp-add-temperature-offset-for-ryzen-2700x.patch
+hwmon-k10temp-add-support-for-amd-ryzen-w-vega-graphics.patch
+s390-cio-update-chpid-descriptor-after-resource-accessibility-event.patch
+s390-dasd-fix-io-error-for-newly-defined-devices.patch
+s390-uprobes-implement-arch_uretprobe_is_alive.patch
+s390-cpum_cf-rename-ibm-z13-z14-counter-names.patch
+kprobes-fix-random-address-output-of-blacklist-file.patch
+acpi-video-only-default-only_lcd-to-true-on-win8-ready-_desktops_.patch
--- /dev/null
+From 9a0fd675304d410f3a9586e1b333e16f4658d56c Mon Sep 17 00:00:00 2001
+From: Peter Xu <peterx@redhat.com>
+Date: Thu, 15 Mar 2018 14:06:39 +0800
+Subject: tracing: Fix missing tab for hwlat_detector print format
+
+From: Peter Xu <peterx@redhat.com>
+
+commit 9a0fd675304d410f3a9586e1b333e16f4658d56c upstream.
+
+It's been missing for a while but no one is touching that up. Fix it.
+
+Link: http://lkml.kernel.org/r/20180315060639.9578-1-peterx@redhat.com
+
+CC: Ingo Molnar <mingo@kernel.org>
+Cc:stable@vger.kernel.org
+Fixes: 7b2c86250122d ("tracing: Add NMI tracing in hwlat detector")
+Signed-off-by: Peter Xu <peterx@redhat.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/trace_entries.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/trace/trace_entries.h
++++ b/kernel/trace/trace_entries.h
+@@ -356,7 +356,7 @@ FTRACE_ENTRY(hwlat, hwlat_entry,
+ __field( unsigned int, seqnum )
+ ),
+
+- F_printk("cnt:%u\tts:%010llu.%010lu\tinner:%llu\touter:%llunmi-ts:%llu\tnmi-count:%u\n",
++ F_printk("cnt:%u\tts:%010llu.%010lu\tinner:%llu\touter:%llu\tnmi-ts:%llu\tnmi-count:%u\n",
+ __entry->seqnum,
+ __entry->tv_sec,
+ __entry->tv_nsec,
projects / thirdparty / kernel / stable-queue.git / commitdiff
