--- /dev/null
+From 6f44a0bacb79a03972c83759711832b382b1b8ac Mon Sep 17 00:00:00 2001
+From: Qiao Zhou <qiaozhou@asrmicro.com>
+Date: Fri, 7 Jul 2017 17:29:34 +0800
+Subject: arm64: traps: disable irq in die()
+
+From: Qiao Zhou <qiaozhou@asrmicro.com>
+
+commit 6f44a0bacb79a03972c83759711832b382b1b8ac upstream.
+
+In current die(), the irq is disabled for __die() handle, not
+including the possible panic() handling. Since the log in __die()
+can take several hundreds ms, new irq might come and interrupt
+current die().
+
+If the process calling die() holds some critical resource, and some
+other process scheduled later also needs it, then it would deadlock.
+The first panic will not be executed.
+
+So here disable irq for the whole flow of die().
+
+Signed-off-by: Qiao Zhou <qiaozhou@asrmicro.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/kernel/traps.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/kernel/traps.c
++++ b/arch/arm64/kernel/traps.c
+@@ -239,10 +239,12 @@ void die(const char *str, struct pt_regs
+ {
+ struct thread_info *thread = current_thread_info();
+ int ret;
++ unsigned long flags;
++
++ raw_spin_lock_irqsave(&die_lock, flags);
+
+ oops_enter();
+
+- raw_spin_lock_irq(&die_lock);
+ console_verbose();
+ bust_spinlocks(1);
+ ret = __die(str, err, thread, regs);
+@@ -252,13 +254,15 @@ void die(const char *str, struct pt_regs
+
+ bust_spinlocks(0);
+ add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+- raw_spin_unlock_irq(&die_lock);
+ oops_exit();
+
+ if (in_interrupt())
+ panic("Fatal exception in interrupt");
+ if (panic_on_oops)
+ panic("Fatal exception");
++
++ raw_spin_unlock_irqrestore(&die_lock, flags);
++
+ if (ret != NOTIFY_STOP)
+ do_exit(SIGSEGV);
+ }
--- /dev/null
+From 3f3295709edea6268ff1609855f498035286af73 Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Fri, 17 Nov 2017 15:28:04 -0800
+Subject: lib/int_sqrt: optimize small argument
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+commit 3f3295709edea6268ff1609855f498035286af73 upstream.
+
+The current int_sqrt() computation is sub-optimal for the case of small
+@x. Which is the interesting case when we're going to do cumulative
+distribution functions on idle times, which we assume to be a random
+variable, where the target residency of the deepest idle state gives an
+upper bound on the variable (5e6ns on recent Intel chips).
+
+In the case of small @x, the compute loop:
+
+ while (m != 0) {
+ b = y + m;
+ y >>= 1;
+
+ if (x >= b) {
+ x -= b;
+ y += m;
+ }
+ m >>= 2;
+ }
+
+can be reduced to:
+
+ while (m > x)
+ m >>= 2;
+
+Because y==0, b==m and until x>=m y will remain 0.
+
+And while this is computationally equivalent, it runs much faster
+because there's less code, in particular less branches.
+
+ cycles: branches: branch-misses:
+
+OLD:
+
+hot: 45.109444 +- 0.044117 44.333392 +- 0.002254 0.018723 +- 0.000593
+cold: 187.737379 +- 0.156678 44.333407 +- 0.002254 6.272844 +- 0.004305
+
+PRE:
+
+hot: 67.937492 +- 0.064124 66.999535 +- 0.000488 0.066720 +- 0.001113
+cold: 232.004379 +- 0.332811 66.999527 +- 0.000488 6.914634 +- 0.006568
+
+POST:
+
+hot: 43.633557 +- 0.034373 45.333132 +- 0.002277 0.023529 +- 0.000681
+cold: 207.438411 +- 0.125840 45.333132 +- 0.002277 6.976486 +- 0.004219
+
+Averages computed over all values <128k using a LFSR to generate order.
+Cold numbers have a LFSR based branch trace buffer 'confuser' ran between
+each int_sqrt() invocation.
+
+Link: http://lkml.kernel.org/r/20171020164644.876503355@infradead.org
+Fixes: 30493cc9dddb ("lib/int_sqrt.c: optimize square root algorithm")
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Suggested-by: Anshul Garg <aksgarg1989@gmail.com>
+Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Davidlohr Bueso <dave@stgolabs.net>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Will Deacon <will.deacon@arm.com>
+Cc: Joe Perches <joe@perches.com>
+Cc: David Miller <davem@davemloft.net>
+Cc: Matthew Wilcox <mawilcox@microsoft.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Michael Davidson <md@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ lib/int_sqrt.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/lib/int_sqrt.c
++++ b/lib/int_sqrt.c
+@@ -22,6 +22,9 @@ unsigned long int_sqrt(unsigned long x)
+ return x;
+
+ m = 1UL << (BITS_PER_LONG - 2);
++ while (m > x)
++ m >>= 2;
++
+ while (m != 0) {
+ b = y + m;
+ y >>= 1;
--- /dev/null
+From 4350782570b919f254c1e083261a21c19fcaee90 Mon Sep 17 00:00:00 2001
+From: Lanqing Liu <lanqing.liu@spreadtrum.com>
+Date: Tue, 18 Jul 2017 17:58:13 +0800
+Subject: serial: sprd: clear timeout interrupt only rather than all interrupts
+
+From: Lanqing Liu <lanqing.liu@spreadtrum.com>
+
+commit 4350782570b919f254c1e083261a21c19fcaee90 upstream.
+
+On Spreadtrum's serial device, nearly all of interrupts would be cleared
+by hardware except timeout interrupt. This patch removed the operation
+of clearing all interrupt in irq handler, instead added an if statement
+to check if the timeout interrupt is supposed to be cleared.
+
+Wrongly clearing timeout interrupt would lead to uart data stay in rx
+fifo, that means the driver cannot read them out anymore.
+
+Signed-off-by: Lanqing Liu <lanqing.liu@spreadtrum.com>
+Signed-off-by: Chunyan Zhang <chunyan.zhang@spreadtrum.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/sprd_serial.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/sprd_serial.c
++++ b/drivers/tty/serial/sprd_serial.c
+@@ -63,6 +63,7 @@
+
+ /* interrupt clear register */
+ #define SPRD_ICLR 0x0014
++#define SPRD_ICLR_TIMEOUT BIT(13)
+
+ /* line control register */
+ #define SPRD_LCR 0x0018
+@@ -298,7 +299,8 @@ static irqreturn_t sprd_handle_irq(int i
+ return IRQ_NONE;
+ }
+
+- serial_out(port, SPRD_ICLR, ~0);
++ if (ims & SPRD_IMSR_TIMEOUT)
++ serial_out(port, SPRD_ICLR, SPRD_ICLR_TIMEOUT);
+
+ if (ims & (SPRD_IMSR_RX_FIFO_FULL |
+ SPRD_IMSR_BREAK_DETECT | SPRD_IMSR_TIMEOUT))
tcp-dccp-drop-syn-packets-if-accept-queue-is-full.patch
serial-sprd-adjust-timeout-to-a-big-value.patch
hang-soft-lockup-in-d_invalidate-with-simultaneous-calls.patch
+arm64-traps-disable-irq-in-die.patch
+usb-renesas_usbhs-gadget-fix-unused-but-set-variable-warning.patch
+serial-sprd-clear-timeout-interrupt-only-rather-than-all-interrupts.patch
+lib-int_sqrt-optimize-small-argument.patch
+usb-core-only-clean-up-what-we-allocated.patch
--- /dev/null
+From 32fd87b3bbf5f7a045546401dfe2894dbbf4d8c3 Mon Sep 17 00:00:00 2001
+From: Andrey Konovalov <andreyknvl@google.com>
+Date: Mon, 11 Dec 2017 22:48:41 +0100
+Subject: USB: core: only clean up what we allocated
+
+From: Andrey Konovalov <andreyknvl@google.com>
+
+commit 32fd87b3bbf5f7a045546401dfe2894dbbf4d8c3 upstream.
+
+When cleaning up the configurations, make sure we only free the number
+of configurations and interfaces that we could have allocated.
+
+Reported-by: Andrey Konovalov <andreyknvl@google.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/config.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -734,18 +734,21 @@ void usb_destroy_configuration(struct us
+ return;
+
+ if (dev->rawdescriptors) {
+- for (i = 0; i < dev->descriptor.bNumConfigurations; i++)
++ for (i = 0; i < dev->descriptor.bNumConfigurations &&
++ i < USB_MAXCONFIG; i++)
+ kfree(dev->rawdescriptors[i]);
+
+ kfree(dev->rawdescriptors);
+ dev->rawdescriptors = NULL;
+ }
+
+- for (c = 0; c < dev->descriptor.bNumConfigurations; c++) {
++ for (c = 0; c < dev->descriptor.bNumConfigurations &&
++ c < USB_MAXCONFIG; c++) {
+ struct usb_host_config *cf = &dev->config[c];
+
+ kfree(cf->string);
+- for (i = 0; i < cf->desc.bNumInterfaces; i++) {
++ for (i = 0; i < cf->desc.bNumInterfaces &&
++ i < USB_MAXINTERFACES; i++) {
+ if (cf->intf_cache[i])
+ kref_put(&cf->intf_cache[i]->ref,
+ usb_release_interface_cache);
--- /dev/null
+From b7d44c36a6f6d956e1539e0dd42f98b26e5a4684 Mon Sep 17 00:00:00 2001
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Fri, 28 Jul 2017 19:28:57 +0900
+Subject: usb: renesas_usbhs: gadget: fix unused-but-set-variable warning
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+commit b7d44c36a6f6d956e1539e0dd42f98b26e5a4684 upstream.
+
+The commit b8b9c974afee ("usb: renesas_usbhs: gadget: disable all eps
+when the driver stops") causes the unused-but-set-variable warning.
+But, if the usbhsg_ep_disable() will return non-zero value, udc/core.c
+doesn't clear the ep->enabled flag. So, this driver should not return
+non-zero value, if the pipe is zero because this means the pipe is
+already disabled. Otherwise, the ep->enabled flag is never cleared
+when the usbhsg_ep_disable() is called by the renesas_usbhs driver first.
+
+Fixes: b8b9c974afee ("usb: renesas_usbhs: gadget: disable all eps when the driver stops")
+Fixes: 11432050f070 ("usb: renesas_usbhs: gadget: fix NULL pointer dereference in ep_disable()")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/renesas_usbhs/mod_gadget.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/usb/renesas_usbhs/mod_gadget.c
++++ b/drivers/usb/renesas_usbhs/mod_gadget.c
+@@ -641,14 +641,11 @@ static int usbhsg_ep_disable(struct usb_
+ struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep);
+ struct usbhs_pipe *pipe;
+ unsigned long flags;
+- int ret = 0;
+
+ spin_lock_irqsave(&uep->lock, flags);
+ pipe = usbhsg_uep_to_pipe(uep);
+- if (!pipe) {
+- ret = -EINVAL;
++ if (!pipe)
+ goto out;
+- }
+
+ usbhsg_pipe_disable(uep);
+ usbhs_pipe_free(pipe);
projects / thirdparty / kernel / stable-queue.git / commitdiff
