--- /dev/null
+From aea808172018ca01abf53db808323aed23281835 Mon Sep 17 00:00:00 2001
+From: Dennis Wassenberg <dennis.wassenberg@secunet.com>
+Date: Thu, 8 Mar 2018 15:49:03 +0100
+Subject: ALSA: hda: add dock and led support for HP EliteBook 820 G3
+
+From: Dennis Wassenberg <dennis.wassenberg@secunet.com>
+
+commit aea808172018ca01abf53db808323aed23281835 upstream.
+
+This patch adds missing initialisation for HP 2013 UltraSlim Dock
+Line-In/Out PINs and activates keyboard mute/micmute leds
+for HP EliteBook 820 G3
+
+Signed-off-by: Dennis Wassenberg <dennis.wassenberg@secunet.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_conexant.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -957,6 +957,7 @@ static const struct snd_pci_quirk cxt506
+ SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_ASPIRE_DMIC),
+ SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC),
+ SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK),
++ SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
+ SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC),
+ SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO),
--- /dev/null
+From 099fd6ca0ad25bc19c5ade2ea4b25b8fadaa11b3 Mon Sep 17 00:00:00 2001
+From: Dennis Wassenberg <dennis.wassenberg@secunet.com>
+Date: Thu, 8 Mar 2018 15:49:24 +0100
+Subject: ALSA: hda: add dock and led support for HP ProBook 640 G2
+
+From: Dennis Wassenberg <dennis.wassenberg@secunet.com>
+
+commit 099fd6ca0ad25bc19c5ade2ea4b25b8fadaa11b3 upstream.
+
+This patch adds missing initialisation for HP 2013 UltraSlim Dock
+Line-In/Out PINs and activates keyboard mute/micmute leds
+for HP ProBook 640 G2
+
+Signed-off-by: Dennis Wassenberg <dennis.wassenberg@secunet.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_conexant.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -958,6 +958,7 @@ static const struct snd_pci_quirk cxt506
+ SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC),
+ SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK),
++ SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
+ SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC),
+ SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO),
--- /dev/null
+From d5078193e56bb24f4593f00102a3b5e07bb84ee0 Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Fri, 2 Mar 2018 13:05:36 +0800
+Subject: ALSA: hda - Fix a wrong FIXUP for alc289 on Dell machines
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit d5078193e56bb24f4593f00102a3b5e07bb84ee0 upstream.
+
+With the alc289, the Pin 0x1b is Headphone-Mic, so we should assign
+ALC269_FIXUP_DELL4_MIC_NO_PRESENCE rather than
+ALC225_FIXUP_DELL1_MIC_NO_PRESENCE to it. And this change is suggested
+by Kailang of Realtek and is verified on the machine.
+
+Fixes: 3f2f7c553d07 ("ALSA: hda - Fix headset mic detection problem for two Dell machines")
+Cc: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6793,7 +6793,7 @@ static const struct snd_hda_pin_quirk al
+ {0x12, 0x90a60120},
+ {0x14, 0x90170110},
+ {0x21, 0x0321101f}),
+- SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
++ SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
+ {0x12, 0xb7a60130},
+ {0x14, 0x90170110},
+ {0x21, 0x04211020}),
--- /dev/null
+From ae104a21e52b1f9aab342cf6924405177b720069 Mon Sep 17 00:00:00 2001
+From: Kailang Yang <kailang@realtek.com>
+Date: Mon, 5 Feb 2018 16:07:20 +0800
+Subject: ALSA: hda/realtek - Add headset mode support for Dell laptop
+
+From: Kailang Yang <kailang@realtek.com>
+
+commit ae104a21e52b1f9aab342cf6924405177b720069 upstream.
+
+This platform was only one phone Jack.
+Add dummy lineout verb to fix automute mode disable.
+This just the workaround.
+
+[ More background information:
+ since the platform has only a headphone jack without speaker, the
+ driver doesn't create the auto-mute control. Meanwhile we do update
+ the headset mode via the automute hook in the driver, thus with this
+ setup, the headset won't be updated any longer.
+
+ By adding a dummy line-out pin here, the auto-mute is added by the
+ driver, and the headset update is triggered properly.
+
+ Note that this is different from the other
+ ALC274_FIXUP_DELL_AIO_LINEOUT_VERB, which has the real line-out pin,
+ while this quirk adds a dummy line-out pin. -- tiwai ]
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5363,6 +5363,7 @@ enum {
+ ALC274_FIXUP_DELL_BIND_DACS,
+ ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
+ ALC298_FIXUP_TPT470_DOCK,
++ ALC255_FIXUP_DUMMY_LINEOUT_VERB,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -6210,6 +6211,15 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE
+ },
++ [ALC255_FIXUP_DUMMY_LINEOUT_VERB] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x14, 0x0201101f },
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -6263,6 +6273,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+ SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
++ SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB),
+ SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
--- /dev/null
+From 5f36413526677b11d3226ebf064f471894ea2e5d Mon Sep 17 00:00:00 2001
+From: Kailang Yang <kailang@realtek.com>
+Date: Tue, 25 Jul 2017 16:28:16 +0800
+Subject: ALSA: hda/realtek - Add support headset mode for DELL WYSE
+
+From: Kailang Yang <kailang@realtek.com>
+
+commit 5f36413526677b11d3226ebf064f471894ea2e5d upstream.
+
+Enable headset mode support for WYSE platform.
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5358,6 +5358,7 @@ enum {
+ ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE,
+ ALC233_FIXUP_LENOVO_MULTI_CODECS,
+ ALC294_FIXUP_LENOVO_MIC_LOCATION,
++ ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE,
+ ALC700_FIXUP_INTEL_REFERENCE,
+ ALC274_FIXUP_DELL_BIND_DACS,
+ ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
+@@ -6161,6 +6162,18 @@ static const struct hda_fixup alc269_fix
+ { }
+ },
+ },
++ [ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x16, 0x0101102f }, /* Rear Headset HP */
++ { 0x19, 0x02a1913c }, /* use as Front headset mic, without its own jack detect */
++ { 0x1a, 0x01a19030 }, /* Rear Headset MIC */
++ { 0x1b, 0x02011020 },
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
++ },
+ [ALC700_FIXUP_INTEL_REFERENCE] = {
+ .type = HDA_FIXUP_VERBS,
+ .v.verbs = (const struct hda_verb[]) {
+@@ -6246,6 +6259,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
+ SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
++ SND_PCI_QUIRK(0x1028, 0x080c, "Dell WYSE", ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+ SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
--- /dev/null
+From e312a869cd726c698a75caca0d9e5c22fd3f1534 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 6 Mar 2018 12:14:17 +0100
+Subject: ALSA: hda/realtek - Fix dock line-out volume on Dell Precision 7520
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit e312a869cd726c698a75caca0d9e5c22fd3f1534 upstream.
+
+The dock line-out pin (NID 0x17 of ALC3254 codec) on Dell Precision
+7520 may route to three different DACs, 0x02, 0x03 and 0x06. The
+first two DACS have the volume amp controls while the last one
+doesn't. And unfortunately, the auto-parser assigns this pin to DAC3,
+resulting in the non-working volume control for the line out.
+
+Fix it by disabling the routing to DAC3 on the corresponding pin.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199029
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5152,6 +5152,16 @@ static void alc298_fixup_speaker_volume(
+ }
+ }
+
++/* disable DAC3 (0x06) selection on NID 0x17 as it has no volume amp control */
++static void alc295_fixup_disable_dac3(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++ hda_nid_t conn[2] = { 0x02, 0x03 };
++ snd_hda_override_conn_list(codec, 0x17, 2, conn);
++ }
++}
++
+ /* Hook to update amp GPIO4 for automute */
+ static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec,
+ struct hda_jack_callback *jack)
+@@ -5344,6 +5354,7 @@ enum {
+ ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY,
+ ALC255_FIXUP_DELL_SPK_NOISE,
+ ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
++ ALC295_FIXUP_DISABLE_DAC3,
+ ALC280_FIXUP_HP_HEADSET_MIC,
+ ALC221_FIXUP_HP_FRONT_MIC,
+ ALC292_FIXUP_TPT460,
+@@ -6078,6 +6089,10 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE,
+ },
++ [ALC295_FIXUP_DISABLE_DAC3] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc295_fixup_disable_dac3,
++ },
+ [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+@@ -6268,6 +6283,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
++ SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3),
+ SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+ SND_PCI_QUIRK(0x1028, 0x080c, "Dell WYSE", ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
--- /dev/null
+From 85981dfd6b0a0fd9ed87ca4a525981b67c21f098 Mon Sep 17 00:00:00 2001
+From: Benjamin Berg <bberg@redhat.com>
+Date: Wed, 14 Feb 2018 13:29:39 +0100
+Subject: ALSA: hda/realtek: Limit mic boost on T480
+
+From: Benjamin Berg <bberg@redhat.com>
+
+commit 85981dfd6b0a0fd9ed87ca4a525981b67c21f098 upstream.
+
+The internal mic boost on the T480 is too high. Fix this by applying the
+ALC269_FIXUP_LIMIT_INT_MIC_BOOST fixup to the machine to limit the gain.
+
+Signed-off-by: Benjamin Berg <bberg@redhat.com>
+Tested-by: Benjamin Berg <bberg@redhat.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6414,6 +6414,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x17aa, 0x224b, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
++ SND_PCI_QUIRK(0x17aa, 0x225d, "Thinkpad T480", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
--- /dev/null
+From e4c07b3b66b7d6a24c2fe3b1ddeff5cd9b378b3a Mon Sep 17 00:00:00 2001
+From: Dennis Wassenberg <dennis.wassenberg@secunet.com>
+Date: Thu, 8 Mar 2018 13:17:54 +0100
+Subject: ALSA: hda/realtek - Make dock sound work on ThinkPad L570
+
+From: Dennis Wassenberg <dennis.wassenberg@secunet.com>
+
+commit e4c07b3b66b7d6a24c2fe3b1ddeff5cd9b378b3a upstream.
+
+One version of Lenovo Thinkpad T570 did not use ALC298
+(like other Kaby Lake devices). Instead it uses ALC292.
+In order to make the Lenovo dock working with that codec
+the dock quirk for ALC292 will be used.
+
+Signed-off-by: Dennis Wassenberg <dennis.wassenberg@secunet.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6427,6 +6427,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x17aa, 0x2245, "Thinkpad T470", ALC298_FIXUP_TPT470_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x2246, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x2247, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
++ SND_PCI_QUIRK(0x17aa, 0x2249, "Thinkpad", ALC292_FIXUP_TPT460),
+ SND_PCI_QUIRK(0x17aa, 0x224b, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
--- /dev/null
+From d85739367c6d56e475c281945c68fdb05ca74b4c Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 5 Mar 2018 22:00:55 +0100
+Subject: ALSA: seq: Don't allow resizing pool in use
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit d85739367c6d56e475c281945c68fdb05ca74b4c upstream.
+
+This is a fix for a (sort of) fallout in the recent commit
+d15d662e89fc ("ALSA: seq: Fix racy pool initializations") for
+CVE-2018-1000004.
+As the pool resize deletes the existing cells, it may lead to a race
+when another thread is writing concurrently, eventually resulting a
+UAF.
+
+A simple workaround is not to allow the pool resizing when the pool is
+in use. It's an invalid behavior in anyway.
+
+Fixes: d15d662e89fc ("ALSA: seq: Fix racy pool initializations")
+Reported-by: 范龙飞 <long7573@126.com>
+Reported-by: Nicolai Stange <nstange@suse.de>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/seq/seq_clientmgr.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -1838,6 +1838,9 @@ static int snd_seq_ioctl_set_client_pool
+ (! snd_seq_write_pool_allocated(client) ||
+ info->output_pool != client->pool->size)) {
+ if (snd_seq_write_pool_allocated(client)) {
++ /* is the pool in use? */
++ if (atomic_read(&client->pool->counter))
++ return -EBUSY;
+ /* remove all existing cells */
+ snd_seq_pool_mark_closing(client->pool);
+ snd_seq_queue_client_leave_cells(client->number);
--- /dev/null
+From 7bd80091567789f1c0cb70eb4737aac8bcd2b6b9 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 5 Mar 2018 22:06:09 +0100
+Subject: ALSA: seq: More protection for concurrent write and ioctl races
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 7bd80091567789f1c0cb70eb4737aac8bcd2b6b9 upstream.
+
+This patch is an attempt for further hardening against races between
+the concurrent write and ioctls. The previous fix d15d662e89fc
+("ALSA: seq: Fix racy pool initializations") covered the race of the
+pool initialization at writer and the pool resize ioctl by the
+client->ioctl_mutex (CVE-2018-1000004). However, basically this mutex
+should be applied more widely to the whole write operation for
+avoiding the unexpected pool operations by another thread.
+
+The only change outside snd_seq_write() is the additional mutex
+argument to helper functions, so that we can unlock / relock the given
+mutex temporarily during schedule() call for blocking write.
+
+Fixes: d15d662e89fc ("ALSA: seq: Fix racy pool initializations")
+Reported-by: 范龙飞 <long7573@126.com>
+Reported-by: Nicolai Stange <nstange@suse.de>
+Reviewed-and-tested-by: Nicolai Stange <nstange@suse.de>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/seq/seq_clientmgr.c | 18 +++++++++++-------
+ sound/core/seq/seq_fifo.c | 2 +-
+ sound/core/seq/seq_memory.c | 14 ++++++++++----
+ sound/core/seq/seq_memory.h | 3 ++-
+ 4 files changed, 24 insertions(+), 13 deletions(-)
+
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -910,7 +910,8 @@ int snd_seq_dispatch_event(struct snd_se
+ static int snd_seq_client_enqueue_event(struct snd_seq_client *client,
+ struct snd_seq_event *event,
+ struct file *file, int blocking,
+- int atomic, int hop)
++ int atomic, int hop,
++ struct mutex *mutexp)
+ {
+ struct snd_seq_event_cell *cell;
+ int err;
+@@ -948,7 +949,8 @@ static int snd_seq_client_enqueue_event(
+ return -ENXIO; /* queue is not allocated */
+
+ /* allocate an event cell */
+- err = snd_seq_event_dup(client->pool, event, &cell, !blocking || atomic, file);
++ err = snd_seq_event_dup(client->pool, event, &cell, !blocking || atomic,
++ file, mutexp);
+ if (err < 0)
+ return err;
+
+@@ -1017,12 +1019,11 @@ static ssize_t snd_seq_write(struct file
+ return -ENXIO;
+
+ /* allocate the pool now if the pool is not allocated yet */
++ mutex_lock(&client->ioctl_mutex);
+ if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) {
+- mutex_lock(&client->ioctl_mutex);
+ err = snd_seq_pool_init(client->pool);
+- mutex_unlock(&client->ioctl_mutex);
+ if (err < 0)
+- return -ENOMEM;
++ goto out;
+ }
+
+ /* only process whole events */
+@@ -1073,7 +1074,7 @@ static ssize_t snd_seq_write(struct file
+ /* ok, enqueue it */
+ err = snd_seq_client_enqueue_event(client, &event, file,
+ !(file->f_flags & O_NONBLOCK),
+- 0, 0);
++ 0, 0, &client->ioctl_mutex);
+ if (err < 0)
+ break;
+
+@@ -1084,6 +1085,8 @@ static ssize_t snd_seq_write(struct file
+ written += len;
+ }
+
++ out:
++ mutex_unlock(&client->ioctl_mutex);
+ return written ? written : err;
+ }
+
+@@ -2263,7 +2266,8 @@ static int kernel_client_enqueue(int cli
+ if (! cptr->accept_output)
+ result = -EPERM;
+ else /* send it */
+- result = snd_seq_client_enqueue_event(cptr, ev, file, blocking, atomic, hop);
++ result = snd_seq_client_enqueue_event(cptr, ev, file, blocking,
++ atomic, hop, NULL);
+
+ snd_seq_client_unlock(cptr);
+ return result;
+--- a/sound/core/seq/seq_fifo.c
++++ b/sound/core/seq/seq_fifo.c
+@@ -125,7 +125,7 @@ int snd_seq_fifo_event_in(struct snd_seq
+ return -EINVAL;
+
+ snd_use_lock_use(&f->use_lock);
+- err = snd_seq_event_dup(f->pool, event, &cell, 1, NULL); /* always non-blocking */
++ err = snd_seq_event_dup(f->pool, event, &cell, 1, NULL, NULL); /* always non-blocking */
+ if (err < 0) {
+ if ((err == -ENOMEM) || (err == -EAGAIN))
+ atomic_inc(&f->overflow);
+--- a/sound/core/seq/seq_memory.c
++++ b/sound/core/seq/seq_memory.c
+@@ -220,7 +220,8 @@ void snd_seq_cell_free(struct snd_seq_ev
+ */
+ static int snd_seq_cell_alloc(struct snd_seq_pool *pool,
+ struct snd_seq_event_cell **cellp,
+- int nonblock, struct file *file)
++ int nonblock, struct file *file,
++ struct mutex *mutexp)
+ {
+ struct snd_seq_event_cell *cell;
+ unsigned long flags;
+@@ -244,7 +245,11 @@ static int snd_seq_cell_alloc(struct snd
+ set_current_state(TASK_INTERRUPTIBLE);
+ add_wait_queue(&pool->output_sleep, &wait);
+ spin_unlock_irq(&pool->lock);
++ if (mutexp)
++ mutex_unlock(mutexp);
+ schedule();
++ if (mutexp)
++ mutex_lock(mutexp);
+ spin_lock_irq(&pool->lock);
+ remove_wait_queue(&pool->output_sleep, &wait);
+ /* interrupted? */
+@@ -287,7 +292,7 @@ __error:
+ */
+ int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event,
+ struct snd_seq_event_cell **cellp, int nonblock,
+- struct file *file)
++ struct file *file, struct mutex *mutexp)
+ {
+ int ncells, err;
+ unsigned int extlen;
+@@ -304,7 +309,7 @@ int snd_seq_event_dup(struct snd_seq_poo
+ if (ncells >= pool->total_elements)
+ return -ENOMEM;
+
+- err = snd_seq_cell_alloc(pool, &cell, nonblock, file);
++ err = snd_seq_cell_alloc(pool, &cell, nonblock, file, mutexp);
+ if (err < 0)
+ return err;
+
+@@ -330,7 +335,8 @@ int snd_seq_event_dup(struct snd_seq_poo
+ int size = sizeof(struct snd_seq_event);
+ if (len < size)
+ size = len;
+- err = snd_seq_cell_alloc(pool, &tmp, nonblock, file);
++ err = snd_seq_cell_alloc(pool, &tmp, nonblock, file,
++ mutexp);
+ if (err < 0)
+ goto __error;
+ if (cell->event.data.ext.ptr == NULL)
+--- a/sound/core/seq/seq_memory.h
++++ b/sound/core/seq/seq_memory.h
+@@ -66,7 +66,8 @@ struct snd_seq_pool {
+ void snd_seq_cell_free(struct snd_seq_event_cell *cell);
+
+ int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event,
+- struct snd_seq_event_cell **cellp, int nonblock, struct file *file);
++ struct snd_seq_event_cell **cellp, int nonblock,
++ struct file *file, struct mutex *mutexp);
+
+ /* return number of unused (free) cells */
+ static inline int snd_seq_unused_cells(struct snd_seq_pool *pool)
--- /dev/null
+From 753e8abc36b2c966caea075db0c845563c8a19bf Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Fri, 23 Feb 2018 18:04:48 +0000
+Subject: arm64: mm: fix thinko in non-global page table attribute check
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+commit 753e8abc36b2c966caea075db0c845563c8a19bf upstream.
+
+The routine pgattr_change_is_safe() was extended in commit 4e6020565596
+("arm64: mm: Permit transitioning from Global to Non-Global without BBM")
+to permit changing the nG attribute from not set to set, but did so in a
+way that inadvertently disallows such changes if other permitted attribute
+changes take place at the same time. So update the code to take this into
+account.
+
+Fixes: 4e6020565596 ("arm64: mm: Permit transitioning from Global to ...")
+Cc: <stable@vger.kernel.org> # 4.14.x-
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Reviewed-by: Marc Zyngier <marc.zyngier@arm.com>
+Acked-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/mm/mmu.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/arm64/mm/mmu.c
++++ b/arch/arm64/mm/mmu.c
+@@ -107,7 +107,7 @@ static bool pgattr_change_is_safe(u64 ol
+ * The following mapping attributes may be updated in live
+ * kernel mappings without the need for break-before-make.
+ */
+- static const pteval_t mask = PTE_PXN | PTE_RDONLY | PTE_WRITE;
++ static const pteval_t mask = PTE_PXN | PTE_RDONLY | PTE_WRITE | PTE_NG;
+
+ /* creating or taking down mappings is always safe */
+ if (old == 0 || new == 0)
+@@ -117,9 +117,9 @@ static bool pgattr_change_is_safe(u64 ol
+ if ((old | new) & PTE_CONT)
+ return false;
+
+- /* Transitioning from Global to Non-Global is safe */
+- if (((old ^ new) == PTE_NG) && (new & PTE_NG))
+- return true;
++ /* Transitioning from Non-Global to Global is unsafe */
++ if (old & ~new & PTE_NG)
++ return false;
+
+ return ((old ^ new) & ~mask) == 0;
+ }
--- /dev/null
+From 86755b7a96faed57f910f9e6b8061e019ac1ec08 Mon Sep 17 00:00:00 2001
+From: Michael Lyle <mlyle@lyle.org>
+Date: Mon, 5 Mar 2018 13:41:55 -0800
+Subject: bcache: don't attach backing with duplicate UUID
+
+From: Michael Lyle <mlyle@lyle.org>
+
+commit 86755b7a96faed57f910f9e6b8061e019ac1ec08 upstream.
+
+This can happen e.g. during disk cloning.
+
+This is an incomplete fix: it does not catch duplicate UUIDs earlier
+when things are still unattached. It does not unregister the device.
+Further changes to cope better with this are planned but conflict with
+Coly's ongoing improvements to handling device errors. In the meantime,
+one can manually stop the device after this has happened.
+
+Attempts to attach a duplicate device result in:
+
+[ 136.372404] loop: module loaded
+[ 136.424461] bcache: register_bdev() registered backing device loop0
+[ 136.424464] bcache: bch_cached_dev_attach() Tried to attach loop0 but duplicate UUID already attached
+
+My test procedure is:
+
+ dd if=/dev/sdb1 of=imgfile bs=1024 count=262144
+ losetup -f imgfile
+
+Signed-off-by: Michael Lyle <mlyle@lyle.org>
+Reviewed-by: Tang Junhui <tang.junhui@zte.com.cn>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/bcache/super.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -951,6 +951,7 @@ int bch_cached_dev_attach(struct cached_
+ uint32_t rtime = cpu_to_le32(get_seconds());
+ struct uuid_entry *u;
+ char buf[BDEVNAME_SIZE];
++ struct cached_dev *exist_dc, *t;
+
+ bdevname(dc->bdev, buf);
+
+@@ -974,6 +975,16 @@ int bch_cached_dev_attach(struct cached_
+ return -EINVAL;
+ }
+
++ /* Check whether already attached */
++ list_for_each_entry_safe(exist_dc, t, &c->cached_devs, list) {
++ if (!memcmp(dc->sb.uuid, exist_dc->sb.uuid, 16)) {
++ pr_err("Tried to attach %s but duplicate UUID already attached",
++ buf);
++
++ return -EINVAL;
++ }
++ }
++
+ u = uuid_find(c, dc->sb.uuid);
+
+ if (u &&
--- /dev/null
+From cc40daf91bdddbba72a4a8cd0860640e06668309 Mon Sep 17 00:00:00 2001
+From: Tang Junhui <tang.junhui@zte.com.cn>
+Date: Mon, 5 Mar 2018 13:41:54 -0800
+Subject: bcache: fix crashes in duplicate cache device register
+
+From: Tang Junhui <tang.junhui@zte.com.cn>
+
+commit cc40daf91bdddbba72a4a8cd0860640e06668309 upstream.
+
+Kernel crashed when register a duplicate cache device, the call trace is
+bellow:
+[ 417.643790] CPU: 1 PID: 16886 Comm: bcache-register Tainted: G
+ W OE 4.15.5-amd64-preempt-sysrq-20171018 #2
+[ 417.643861] Hardware name: LENOVO 20ERCTO1WW/20ERCTO1WW, BIOS
+N1DET41W (1.15 ) 12/31/2015
+[ 417.643870] RIP: 0010:bdevname+0x13/0x1e
+[ 417.643876] RSP: 0018:ffffa3aa9138fd38 EFLAGS: 00010282
+[ 417.643884] RAX: 0000000000000000 RBX: ffff8c8f2f2f8000 RCX: ffffd6701f8
+c7edf
+[ 417.643890] RDX: ffffa3aa9138fd88 RSI: ffffa3aa9138fd88 RDI: 00000000000
+00000
+[ 417.643895] RBP: ffffa3aa9138fde0 R08: ffffa3aa9138fae8 R09: 00000000000
+1850e
+[ 417.643901] R10: ffff8c8eed34b271 R11: ffff8c8eed34b250 R12: 00000000000
+00000
+[ 417.643906] R13: ffffd6701f78f940 R14: ffff8c8f38f80000 R15: ffff8c8ea7d
+90000
+[ 417.643913] FS: 00007fde7e66f500(0000) GS:ffff8c8f61440000(0000) knlGS:
+0000000000000000
+[ 417.643919] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 417.643925] CR2: 0000000000000314 CR3: 00000007e6fa0001 CR4: 00000000003
+606e0
+[ 417.643931] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 00000000000
+00000
+[ 417.643938] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 00000000000
+00400
+[ 417.643946] Call Trace:
+[ 417.643978] register_bcache+0x1117/0x1270 [bcache]
+[ 417.643994] ? slab_pre_alloc_hook+0x15/0x3c
+[ 417.644001] ? slab_post_alloc_hook.isra.44+0xa/0x1a
+[ 417.644013] ? kernfs_fop_write+0xf6/0x138
+[ 417.644020] kernfs_fop_write+0xf6/0x138
+[ 417.644031] __vfs_write+0x31/0xcc
+[ 417.644043] ? current_kernel_time64+0x10/0x36
+[ 417.644115] ? __audit_syscall_entry+0xbf/0xe3
+[ 417.644124] vfs_write+0xa5/0xe2
+[ 417.644133] SyS_write+0x5c/0x9f
+[ 417.644144] do_syscall_64+0x72/0x81
+[ 417.644161] entry_SYSCALL_64_after_hwframe+0x3d/0xa2
+[ 417.644169] RIP: 0033:0x7fde7e1c1974
+[ 417.644175] RSP: 002b:00007fff13009a38 EFLAGS: 00000246 ORIG_RAX: 0000000
+000000001
+[ 417.644183] RAX: ffffffffffffffda RBX: 0000000001658280 RCX: 00007fde7e1c
+1974
+[ 417.644188] RDX: 000000000000000a RSI: 0000000001658280 RDI: 000000000000
+0001
+[ 417.644193] RBP: 000000000000000a R08: 0000000000000003 R09: 000000000000
+0077
+[ 417.644198] R10: 000000000000089e R11: 0000000000000246 R12: 000000000000
+0001
+[ 417.644203] R13: 000000000000000a R14: 7fffffffffffffff R15: 000000000000
+0000
+[ 417.644213] Code: c7 c2 83 6f ee 98 be 20 00 00 00 48 89 df e8 6c 27 3b 0
+0 48 89 d8 5b c3 0f 1f 44 00 00 48 8b 47 70 48 89 f2 48 8b bf 80 00 00 00 <8
+b> b0 14 03 00 00 e9 73 ff ff ff 0f 1f 44 00 00 48 8b 47 40 39
+[ 417.644302] RIP: bdevname+0x13/0x1e RSP: ffffa3aa9138fd38
+[ 417.644306] CR2: 0000000000000314
+
+When registering duplicate cache device in register_cache(), after failure
+on calling register_cache_set(), bch_cache_release() will be called, then
+bdev will be freed, so bdevname(bdev, name) caused kernel crash.
+
+Since bch_cache_release() will free bdev, so in this patch we make sure
+bdev being freed if register_cache() fail, and do not free bdev again in
+register_bcache() when register_cache() fail.
+
+Signed-off-by: Tang Junhui <tang.junhui@zte.com.cn>
+Reported-by: Marc MERLIN <marc@merlins.org>
+Tested-by: Michael Lyle <mlyle@lyle.org>
+Reviewed-by: Michael Lyle <mlyle@lyle.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/bcache/super.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1191,7 +1191,7 @@ static void register_bdev(struct cache_s
+
+ return;
+ err:
+- pr_notice("error opening %s: %s", bdevname(bdev, name), err);
++ pr_notice("error %s: %s", bdevname(bdev, name), err);
+ bcache_device_stop(&dc->disk);
+ }
+
+@@ -1859,6 +1859,8 @@ static int register_cache(struct cache_s
+ const char *err = NULL; /* must be set for any error case */
+ int ret = 0;
+
++ bdevname(bdev, name);
++
+ memcpy(&ca->sb, sb, sizeof(struct cache_sb));
+ ca->bdev = bdev;
+ ca->bdev->bd_holder = ca;
+@@ -1867,11 +1869,12 @@ static int register_cache(struct cache_s
+ ca->sb_bio.bi_io_vec[0].bv_page = sb_page;
+ get_page(sb_page);
+
+- if (blk_queue_discard(bdev_get_queue(ca->bdev)))
++ if (blk_queue_discard(bdev_get_queue(bdev)))
+ ca->discard = CACHE_DISCARD(&ca->sb);
+
+ ret = cache_alloc(ca);
+ if (ret != 0) {
++ blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
+ if (ret == -ENOMEM)
+ err = "cache_alloc(): -ENOMEM";
+ else
+@@ -1894,14 +1897,14 @@ static int register_cache(struct cache_s
+ goto out;
+ }
+
+- pr_info("registered cache device %s", bdevname(bdev, name));
++ pr_info("registered cache device %s", name);
+
+ out:
+ kobject_put(&ca->kobj);
+
+ err:
+ if (err)
+- pr_notice("error opening %s: %s", bdevname(bdev, name), err);
++ pr_notice("error %s: %s", name, err);
+
+ return ret;
+ }
+@@ -1990,6 +1993,7 @@ static ssize_t register_bcache(struct ko
+ if (err)
+ goto err_close;
+
++ err = "failed to register device";
+ if (SB_IS_BDEV(sb)) {
+ struct cached_dev *dc = kzalloc(sizeof(*dc), GFP_KERNEL);
+ if (!dc)
+@@ -2004,7 +2008,7 @@ static ssize_t register_bcache(struct ko
+ goto err_close;
+
+ if (register_cache(sb, sb_page, bdev, ca) != 0)
+- goto err_close;
++ goto err;
+ }
+ out:
+ if (sb_page)
+@@ -2017,7 +2021,7 @@ out:
+ err_close:
+ blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
+ err:
+- pr_info("error opening %s: %s", path, err);
++ pr_info("error %s: %s", path, err);
+ ret = -EINVAL;
+ goto out;
+ }
--- /dev/null
+From 0862ca422b79cb5aa70823ee0f07f6b468f86070 Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Fri, 9 Mar 2018 15:50:59 -0800
+Subject: bug: use %pB in BUG and stack protector failure
+
+From: Kees Cook <keescook@chromium.org>
+
+commit 0862ca422b79cb5aa70823ee0f07f6b468f86070 upstream.
+
+The BUG and stack protector reports were still using a raw %p. This
+changes it to %pB for more meaningful output.
+
+Link: http://lkml.kernel.org/r/20180301225704.GA34198@beast
+Fixes: ad67b74d2469 ("printk: hash addresses printed with %p")
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Richard Weinberger <richard.weinberger@gmail.com>,
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/panic.c | 2 +-
+ lib/bug.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/kernel/panic.c
++++ b/kernel/panic.c
+@@ -640,7 +640,7 @@ device_initcall(register_warn_debugfs);
+ */
+ __visible void __stack_chk_fail(void)
+ {
+- panic("stack-protector: Kernel stack is corrupted in: %p\n",
++ panic("stack-protector: Kernel stack is corrupted in: %pB\n",
+ __builtin_return_address(0));
+ }
+ EXPORT_SYMBOL(__stack_chk_fail);
+--- a/lib/bug.c
++++ b/lib/bug.c
+@@ -191,7 +191,7 @@ enum bug_trap_type report_bug(unsigned l
+ if (file)
+ pr_crit("kernel BUG at %s:%u!\n", file, line);
+ else
+- pr_crit("Kernel BUG at %p [verbose debug info unavailable]\n",
++ pr_crit("Kernel BUG at %pB [verbose debug info unavailable]\n",
+ (void *)bugaddr);
+
+ return BUG_TRAP_TYPE_BUG;
--- /dev/null
+From 590347e4000356f55eb10b03ced2686bd74dab40 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Thu, 22 Feb 2018 16:56:16 +0100
+Subject: dm bufio: avoid false-positive Wmaybe-uninitialized warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 590347e4000356f55eb10b03ced2686bd74dab40 upstream.
+
+gcc-6.3 and earlier show a new warning after a seemingly unrelated
+change to the arm64 PAGE_KERNEL definition:
+
+In file included from drivers/md/dm-bufio.c:14:0:
+drivers/md/dm-bufio.c: In function 'alloc_buffer':
+include/linux/sched/mm.h:182:56: warning: 'noio_flag' may be used uninitialized in this function [-Wmaybe-uninitialized]
+ current->flags = (current->flags & ~PF_MEMALLOC_NOIO) | flags;
+ ^
+
+The same warning happened earlier on linux-3.18 for MIPS and I did a
+workaround for that, but now it's come back.
+
+gcc-7 and newer are apparently smart enough to figure this out, and
+other architectures don't show it, so the best I could come up with is
+to rework the caller slightly in a way that makes it obvious enough to
+all arm64 compilers what is happening here.
+
+Fixes: 41acec624087 ("arm64: kpti: Make use of nG dependent on arm64_kernel_unmapped_at_el0()")
+Link: https://patchwork.kernel.org/patch/9692829/
+Cc: stable@vger.kernel.org
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+[snitzer: moved declarations inside conditional, altered vmalloc return]
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-bufio.c | 16 ++++++----------
+ 1 file changed, 6 insertions(+), 10 deletions(-)
+
+--- a/drivers/md/dm-bufio.c
++++ b/drivers/md/dm-bufio.c
+@@ -386,9 +386,6 @@ static void __cache_size_refresh(void)
+ static void *alloc_buffer_data(struct dm_bufio_client *c, gfp_t gfp_mask,
+ enum data_mode *data_mode)
+ {
+- unsigned noio_flag;
+- void *ptr;
+-
+ if (c->block_size <= DM_BUFIO_BLOCK_SIZE_SLAB_LIMIT) {
+ *data_mode = DATA_MODE_SLAB;
+ return kmem_cache_alloc(DM_BUFIO_CACHE(c), gfp_mask);
+@@ -412,16 +409,15 @@ static void *alloc_buffer_data(struct dm
+ * all allocations done by this process (including pagetables) are done
+ * as if GFP_NOIO was specified.
+ */
++ if (gfp_mask & __GFP_NORETRY) {
++ unsigned noio_flag = memalloc_noio_save();
++ void *ptr = __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL);
+
+- if (gfp_mask & __GFP_NORETRY)
+- noio_flag = memalloc_noio_save();
+-
+- ptr = __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL);
+-
+- if (gfp_mask & __GFP_NORETRY)
+ memalloc_noio_restore(noio_flag);
++ return ptr;
++ }
+
+- return ptr;
++ return __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL);
+ }
+
+ /*
--- /dev/null
+From ff690eeed804f112242f9a0614eafdf559f9276a Mon Sep 17 00:00:00 2001
+From: Matthew Wilcox <mawilcox@microsoft.com>
+Date: Fri, 2 Mar 2018 10:40:14 -0800
+Subject: Documentation/sphinx: Fix Directive import error
+
+From: Matthew Wilcox <mawilcox@microsoft.com>
+
+commit ff690eeed804f112242f9a0614eafdf559f9276a upstream.
+
+Sphinx 1.7 removed sphinx.util.compat.Directive so people
+who have upgraded cannot build the documentation. Switch to
+docutils.parsers.rst.Directive which has been available since
+docutils 0.5 released in 2009.
+
+Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=1083694
+Co-developed-by: Takashi Iwai <tiwai@suse.de>
+Acked-by: Jani Nikula <jani.nikula@intel.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/sphinx/kerneldoc.py | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/Documentation/sphinx/kerneldoc.py
++++ b/Documentation/sphinx/kerneldoc.py
+@@ -36,8 +36,7 @@ import glob
+
+ from docutils import nodes, statemachine
+ from docutils.statemachine import ViewList
+-from docutils.parsers.rst import directives
+-from sphinx.util.compat import Directive
++from docutils.parsers.rst import directives, Directive
+ from sphinx.ext.autodoc import AutodocReporter
+
+ __version__ = '1.0'
--- /dev/null
+From 25c058ccaf2ebbc3e250ec1e199e161f91fe27d4 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Wed, 14 Feb 2018 06:41:25 +0100
+Subject: drm: Allow determining if current task is output poll worker
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit 25c058ccaf2ebbc3e250ec1e199e161f91fe27d4 upstream.
+
+Introduce a helper to determine if the current task is an output poll
+worker.
+
+This allows us to fix a long-standing deadlock in several DRM drivers
+wherein the ->runtime_suspend callback waits for the output poll worker
+to finish and the worker in turn calls a ->detect callback which waits
+for runtime suspend to finish. The ->detect callback is invoked from
+multiple call sites and waiting for runtime suspend to finish is the
+correct thing to do except if it's executing in the context of the
+worker.
+
+v2: Expand kerneldoc to specifically mention deadlock between
+ output poll worker and autosuspend worker as use case. (Lyude)
+
+Cc: Dave Airlie <airlied@redhat.com>
+Cc: Ben Skeggs <bskeggs@redhat.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/3549ce32e7f1467102e70d3e9cbf70c46bfe108e.1518593424.git.lukas@wunner.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_probe_helper.c | 20 ++++++++++++++++++++
+ include/drm/drm_crtc_helper.h | 1 +
+ 2 files changed, 21 insertions(+)
+
+--- a/drivers/gpu/drm/drm_probe_helper.c
++++ b/drivers/gpu/drm/drm_probe_helper.c
+@@ -655,6 +655,26 @@ out:
+ }
+
+ /**
++ * drm_kms_helper_is_poll_worker - is %current task an output poll worker?
++ *
++ * Determine if %current task is an output poll worker. This can be used
++ * to select distinct code paths for output polling versus other contexts.
++ *
++ * One use case is to avoid a deadlock between the output poll worker and
++ * the autosuspend worker wherein the latter waits for polling to finish
++ * upon calling drm_kms_helper_poll_disable(), while the former waits for
++ * runtime suspend to finish upon calling pm_runtime_get_sync() in a
++ * connector ->detect hook.
++ */
++bool drm_kms_helper_is_poll_worker(void)
++{
++ struct work_struct *work = current_work();
++
++ return work && work->func == output_poll_execute;
++}
++EXPORT_SYMBOL(drm_kms_helper_is_poll_worker);
++
++/**
+ * drm_kms_helper_poll_disable - disable output polling
+ * @dev: drm_device
+ *
+--- a/include/drm/drm_crtc_helper.h
++++ b/include/drm/drm_crtc_helper.h
+@@ -77,5 +77,6 @@ void drm_kms_helper_hotplug_event(struct
+
+ void drm_kms_helper_poll_disable(struct drm_device *dev);
+ void drm_kms_helper_poll_enable(struct drm_device *dev);
++bool drm_kms_helper_is_poll_worker(void);
+
+ #endif
--- /dev/null
+From d6b6669762898dfc99e9273b8d8603bc47014aa9 Mon Sep 17 00:00:00 2001
+From: Shirish S <shirish.s@amd.com>
+Date: Wed, 21 Feb 2018 16:10:33 +0530
+Subject: drm/amd/display: check for ipp before calling cursor operations
+
+From: Shirish S <shirish.s@amd.com>
+
+commit d6b6669762898dfc99e9273b8d8603bc47014aa9 upstream.
+
+Currently all cursor related functions are made to all
+pipes that are attached to a particular stream.
+This is not applicable to pipes that do not have cursor plane
+initialised like underlay.
+Hence this patch allows cursor related operations on a pipe
+only if ipp in available on that particular pipe.
+
+The check is added to set_cursor_position & set_cursor_attribute.
+
+Signed-off-by: Shirish S <shirish.s@amd.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+@@ -200,7 +200,8 @@ bool dc_stream_set_cursor_attributes(
+ for (i = 0; i < MAX_PIPES; i++) {
+ struct pipe_ctx *pipe_ctx = &res_ctx->pipe_ctx[i];
+
+- if (pipe_ctx->stream != stream || (!pipe_ctx->plane_res.xfm && !pipe_ctx->plane_res.dpp))
++ if (pipe_ctx->stream != stream || (!pipe_ctx->plane_res.xfm &&
++ !pipe_ctx->plane_res.dpp) || !pipe_ctx->plane_res.ipp)
+ continue;
+ if (pipe_ctx->top_pipe && pipe_ctx->plane_state != pipe_ctx->top_pipe->plane_state)
+ continue;
+@@ -276,7 +277,8 @@ bool dc_stream_set_cursor_position(
+ if (pipe_ctx->stream != stream ||
+ (!pipe_ctx->plane_res.mi && !pipe_ctx->plane_res.hubp) ||
+ !pipe_ctx->plane_state ||
+- (!pipe_ctx->plane_res.xfm && !pipe_ctx->plane_res.dpp))
++ (!pipe_ctx->plane_res.xfm && !pipe_ctx->plane_res.dpp) ||
++ !pipe_ctx->plane_res.ipp)
+ continue;
+
+ if (pipe_ctx->plane_state->address.type
--- /dev/null
+From caf0a9030d75509f3cacefe466d6d69d26e3dee6 Mon Sep 17 00:00:00 2001
+From: Harry Wentland <harry.wentland@amd.com>
+Date: Tue, 20 Feb 2018 13:36:23 -0500
+Subject: drm/amd/display: Default HDMI6G support to true. Log VBIOS table error.
+
+From: Harry Wentland <harry.wentland@amd.com>
+
+commit caf0a9030d75509f3cacefe466d6d69d26e3dee6 upstream.
+
+There have been many reports of Ellesmere and Baffin systems not being
+able to drive HDMI 4k60 due to the fact that we check the HDMI_6GB_EN
+bit from VBIOS table. Windows seems to not have this issue.
+
+On some systems we fail to the encoder cap info from VBIOS. In that case
+we should default to enabling HDMI6G support.
+
+This was tested by dwagner on
+https://bugs.freedesktop.org/show_bug.cgi?id=102820
+
+Signed-off-by: Harry Wentland <harry.wentland@amd.com>
+Reviewed-by: Roman Li <Roman.Li@amd.com>
+Reviewed-by: Tony Cheng <Tony.Cheng@amd.com>
+Acked-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c
+@@ -683,6 +683,7 @@ void dce110_link_encoder_construct(
+ {
+ struct bp_encoder_cap_info bp_cap_info = {0};
+ const struct dc_vbios_funcs *bp_funcs = init_data->ctx->dc_bios->funcs;
++ enum bp_result result = BP_RESULT_OK;
+
+ enc110->base.funcs = &dce110_lnk_enc_funcs;
+ enc110->base.ctx = init_data->ctx;
+@@ -757,15 +758,24 @@ void dce110_link_encoder_construct(
+ enc110->base.preferred_engine = ENGINE_ID_UNKNOWN;
+ }
+
++ /* default to one to mirror Windows behavior */
++ enc110->base.features.flags.bits.HDMI_6GB_EN = 1;
++
++ result = bp_funcs->get_encoder_cap_info(enc110->base.ctx->dc_bios,
++ enc110->base.id, &bp_cap_info);
++
+ /* Override features with DCE-specific values */
+- if (BP_RESULT_OK == bp_funcs->get_encoder_cap_info(
+- enc110->base.ctx->dc_bios, enc110->base.id,
+- &bp_cap_info)) {
++ if (BP_RESULT_OK == result) {
+ enc110->base.features.flags.bits.IS_HBR2_CAPABLE =
+ bp_cap_info.DP_HBR2_EN;
+ enc110->base.features.flags.bits.IS_HBR3_CAPABLE =
+ bp_cap_info.DP_HBR3_EN;
+ enc110->base.features.flags.bits.HDMI_6GB_EN = bp_cap_info.HDMI_6GB_EN;
++ } else {
++ dm_logger_write(enc110->base.ctx->logger, LOG_WARNING,
++ "%s: Failed to get encoder_cap_info from VBIOS with error code %d!\n",
++ __func__,
++ result);
+ }
+ }
+
--- /dev/null
+From a0aaa03062be252aacad60a776f3374dd53e3f98 Mon Sep 17 00:00:00 2001
+From: Eric Huang <JinHuiEric.Huang@amd.com>
+Date: Mon, 26 Feb 2018 17:36:19 -0500
+Subject: drm/amd/powerplay: fix power over limit on Fiji
+
+From: Eric Huang <JinHuiEric.Huang@amd.com>
+
+commit a0aaa03062be252aacad60a776f3374dd53e3f98 upstream.
+
+power containment disabled only on Fiji and compute
+power profile. It violates PCIe spec and may cause power
+supply failed. Enabling it will fix the issue, even the
+fix will drop performance of some compute tests.
+
+Signed-off-by: Eric Huang <JinHuiEric.Huang@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+@@ -4572,13 +4572,6 @@ static int smu7_set_power_profile_state(
+ int tmp_result, result = 0;
+ uint32_t sclk_mask = 0, mclk_mask = 0;
+
+- if (hwmgr->chip_id == CHIP_FIJI) {
+- if (request->type == AMD_PP_GFX_PROFILE)
+- smu7_enable_power_containment(hwmgr);
+- else if (request->type == AMD_PP_COMPUTE_PROFILE)
+- smu7_disable_power_containment(hwmgr);
+- }
+-
+ if (hwmgr->dpm_level != AMD_DPM_FORCED_LEVEL_AUTO)
+ return -EINVAL;
+
--- /dev/null
+From 51954e17914aaadf18d97b21c2a2cee16fa29513 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 13 Feb 2018 14:26:54 -0500
+Subject: drm/amd/powerplay/smu7: allow mclk switching with no displays
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 51954e17914aaadf18d97b21c2a2cee16fa29513 upstream.
+
+If there are no displays attached, there is no reason to disable
+mclk switching.
+
+Fixes mclks getting set to high when there are no displays attached.
+
+Reviewed-by: Eric Huang <JinhuiEric.Huang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+@@ -2791,10 +2791,13 @@ static int smu7_apply_state_adjust_rules
+ PHM_PlatformCaps_DisableMclkSwitchingForFrameLock);
+
+
+- disable_mclk_switching = ((1 < info.display_count) ||
+- disable_mclk_switching_for_frame_lock ||
+- smu7_vblank_too_short(hwmgr, mode_info.vblank_time_us) ||
+- (mode_info.refresh_rate > 120));
++ if (info.display_count == 0)
++ disable_mclk_switching = false;
++ else
++ disable_mclk_switching = ((1 < info.display_count) ||
++ disable_mclk_switching_for_frame_lock ||
++ smu7_vblank_too_short(hwmgr, mode_info.vblank_time_us) ||
++ (mode_info.refresh_rate > 120));
+
+ sclk = smu7_ps->performance_levels[0].engine_clock;
+ mclk = smu7_ps->performance_levels[0].memory_clock;
--- /dev/null
+From 5825acf5c958a6820b04e9811caeb2f5e572bcd8 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 13 Feb 2018 14:25:11 -0500
+Subject: drm/amd/powerplay/vega10: allow mclk switching with no displays
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 5825acf5c958a6820b04e9811caeb2f5e572bcd8 upstream.
+
+If there are no displays attached, there is no reason to disable
+mclk switching.
+
+Fixes mclks getting set to high when there are no displays attached.
+
+Reviewed-by: Eric Huang <JinhuiEric.Huang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
+@@ -3208,10 +3208,13 @@ static int vega10_apply_state_adjust_rul
+ disable_mclk_switching_for_vr = PP_CAP(PHM_PlatformCaps_DisableMclkSwitchForVR);
+ force_mclk_high = PP_CAP(PHM_PlatformCaps_ForceMclkHigh);
+
+- disable_mclk_switching = (info.display_count > 1) ||
+- disable_mclk_switching_for_frame_lock ||
+- disable_mclk_switching_for_vr ||
+- force_mclk_high;
++ if (info.display_count == 0)
++ disable_mclk_switching = false;
++ else
++ disable_mclk_switching = (info.display_count > 1) ||
++ disable_mclk_switching_for_frame_lock ||
++ disable_mclk_switching_for_vr ||
++ force_mclk_high;
+
+ sclk = vega10_ps->performance_levels[0].gfx_clock;
+ mclk = vega10_ps->performance_levels[0].mem_clock;
--- /dev/null
+From f8bee6135e167f5b35b7789c74c2956dad14d0d5 Mon Sep 17 00:00:00 2001
+From: James Zhu <James.Zhu@amd.com>
+Date: Tue, 6 Mar 2018 14:52:35 -0500
+Subject: drm/amdgpu:Always save uvd vcpu_bo in VM Mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: James Zhu <James.Zhu@amd.com>
+
+commit f8bee6135e167f5b35b7789c74c2956dad14d0d5 upstream.
+
+When UVD is in VM mode, there is not uvd handle exchanged,
+uvd.handles are always 0. So vcpu_bo always need save,
+Otherwise amdgpu driver will fail during suspend/resume.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105021
+Signed-off-by: James Zhu <James.Zhu@amd.com>
+Reviewed-by: Leo Liu <leo.liu@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+@@ -297,12 +297,15 @@ int amdgpu_uvd_suspend(struct amdgpu_dev
+ if (adev->uvd.vcpu_bo == NULL)
+ return 0;
+
+- for (i = 0; i < adev->uvd.max_handles; ++i)
+- if (atomic_read(&adev->uvd.handles[i]))
+- break;
++ /* only valid for physical mode */
++ if (adev->asic_type < CHIP_POLARIS10) {
++ for (i = 0; i < adev->uvd.max_handles; ++i)
++ if (atomic_read(&adev->uvd.handles[i]))
++ break;
+
+- if (i == adev->uvd.max_handles)
+- return 0;
++ if (i == adev->uvd.max_handles)
++ return 0;
++ }
+
+ cancel_delayed_work_sync(&adev->uvd.idle_work);
+
--- /dev/null
+From 0e5ee33d2a54e4c55fe92857f23e1cbb0440d6de Mon Sep 17 00:00:00 2001
+From: James Zhu <James.Zhu@amd.com>
+Date: Tue, 6 Mar 2018 14:43:50 -0500
+Subject: drm/amdgpu:Correct max uvd handles
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: James Zhu <James.Zhu@amd.com>
+
+commit 0e5ee33d2a54e4c55fe92857f23e1cbb0440d6de upstream.
+
+Max uvd handles should use adev->uvd.max_handles instead of
+AMDGPU_MAX_UVD_HANDLES here.
+
+Signed-off-by: James Zhu <James.Zhu@amd.com>
+Reviewed-by: Leo Liu <leo.liu@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+@@ -301,7 +301,7 @@ int amdgpu_uvd_suspend(struct amdgpu_dev
+ if (atomic_read(&adev->uvd.handles[i]))
+ break;
+
+- if (i == AMDGPU_MAX_UVD_HANDLES)
++ if (i == adev->uvd.max_handles)
+ return 0;
+
+ cancel_delayed_work_sync(&adev->uvd.idle_work);
--- /dev/null
+From aa0aad57909eb321746325951d66af88a83bc956 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Sun, 11 Feb 2018 10:38:28 +0100
+Subject: drm/amdgpu: Fix deadlock on runtime suspend
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit aa0aad57909eb321746325951d66af88a83bc956 upstream.
+
+amdgpu's ->runtime_suspend hook calls drm_kms_helper_poll_disable(),
+which waits for the output poll worker to finish if it's running.
+
+The output poll worker meanwhile calls pm_runtime_get_sync() in
+amdgpu's ->detect hooks, which waits for the ongoing suspend to finish,
+causing a deadlock.
+
+Fix by not acquiring a runtime PM ref if the ->detect hooks are called
+in the output poll worker's context. This is safe because the poll
+worker is only enabled while runtime active and we know that
+->runtime_suspend waits for it to finish.
+
+Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)")
+Cc: stable@vger.kernel.org # v4.2+: 27d4ee03078a: workqueue: Allow retrieval of current task's work struct
+Cc: stable@vger.kernel.org # v4.2+: 25c058ccaf2e: drm: Allow determining if current task is output poll worker
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Tested-by: Mike Lothian <mike@fireburn.co.uk>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/4c9bf72aacae1eef062bd134cd112e0770a7f121.1518338789.git.lukas@wunner.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 58 ++++++++++++++++---------
+ 1 file changed, 38 insertions(+), 20 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+@@ -737,9 +737,11 @@ amdgpu_connector_lvds_detect(struct drm_
+ enum drm_connector_status ret = connector_status_disconnected;
+ int r;
+
+- r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
+- return connector_status_disconnected;
++ if (!drm_kms_helper_is_poll_worker()) {
++ r = pm_runtime_get_sync(connector->dev->dev);
++ if (r < 0)
++ return connector_status_disconnected;
++ }
+
+ if (encoder) {
+ struct amdgpu_encoder *amdgpu_encoder = to_amdgpu_encoder(encoder);
+@@ -758,8 +760,12 @@ amdgpu_connector_lvds_detect(struct drm_
+ /* check acpi lid status ??? */
+
+ amdgpu_connector_update_scratch_regs(connector, ret);
+- pm_runtime_mark_last_busy(connector->dev->dev);
+- pm_runtime_put_autosuspend(connector->dev->dev);
++
++ if (!drm_kms_helper_is_poll_worker()) {
++ pm_runtime_mark_last_busy(connector->dev->dev);
++ pm_runtime_put_autosuspend(connector->dev->dev);
++ }
++
+ return ret;
+ }
+
+@@ -869,9 +875,11 @@ amdgpu_connector_vga_detect(struct drm_c
+ enum drm_connector_status ret = connector_status_disconnected;
+ int r;
+
+- r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
+- return connector_status_disconnected;
++ if (!drm_kms_helper_is_poll_worker()) {
++ r = pm_runtime_get_sync(connector->dev->dev);
++ if (r < 0)
++ return connector_status_disconnected;
++ }
+
+ encoder = amdgpu_connector_best_single_encoder(connector);
+ if (!encoder)
+@@ -925,8 +933,10 @@ amdgpu_connector_vga_detect(struct drm_c
+ amdgpu_connector_update_scratch_regs(connector, ret);
+
+ out:
+- pm_runtime_mark_last_busy(connector->dev->dev);
+- pm_runtime_put_autosuspend(connector->dev->dev);
++ if (!drm_kms_helper_is_poll_worker()) {
++ pm_runtime_mark_last_busy(connector->dev->dev);
++ pm_runtime_put_autosuspend(connector->dev->dev);
++ }
+
+ return ret;
+ }
+@@ -989,9 +999,11 @@ amdgpu_connector_dvi_detect(struct drm_c
+ enum drm_connector_status ret = connector_status_disconnected;
+ bool dret = false, broken_edid = false;
+
+- r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
+- return connector_status_disconnected;
++ if (!drm_kms_helper_is_poll_worker()) {
++ r = pm_runtime_get_sync(connector->dev->dev);
++ if (r < 0)
++ return connector_status_disconnected;
++ }
+
+ if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) {
+ ret = connector->status;
+@@ -1116,8 +1128,10 @@ out:
+ amdgpu_connector_update_scratch_regs(connector, ret);
+
+ exit:
+- pm_runtime_mark_last_busy(connector->dev->dev);
+- pm_runtime_put_autosuspend(connector->dev->dev);
++ if (!drm_kms_helper_is_poll_worker()) {
++ pm_runtime_mark_last_busy(connector->dev->dev);
++ pm_runtime_put_autosuspend(connector->dev->dev);
++ }
+
+ return ret;
+ }
+@@ -1360,9 +1374,11 @@ amdgpu_connector_dp_detect(struct drm_co
+ struct drm_encoder *encoder = amdgpu_connector_best_single_encoder(connector);
+ int r;
+
+- r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
+- return connector_status_disconnected;
++ if (!drm_kms_helper_is_poll_worker()) {
++ r = pm_runtime_get_sync(connector->dev->dev);
++ if (r < 0)
++ return connector_status_disconnected;
++ }
+
+ if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) {
+ ret = connector->status;
+@@ -1430,8 +1446,10 @@ amdgpu_connector_dp_detect(struct drm_co
+
+ amdgpu_connector_update_scratch_regs(connector, ret);
+ out:
+- pm_runtime_mark_last_busy(connector->dev->dev);
+- pm_runtime_put_autosuspend(connector->dev->dev);
++ if (!drm_kms_helper_is_poll_worker()) {
++ pm_runtime_mark_last_busy(connector->dev->dev);
++ pm_runtime_put_autosuspend(connector->dev->dev);
++ }
+
+ return ret;
+ }
--- /dev/null
+From 545b0bcde7fbd3ee408fa842ea0731451dc4bd0a Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 1 Mar 2018 11:05:31 -0500
+Subject: drm/amdgpu: fix KV harvesting
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 545b0bcde7fbd3ee408fa842ea0731451dc4bd0a upstream.
+
+Always set the graphics values to the max for the
+asic type. E.g., some 1 RB chips are actually 1 RB chips,
+others are actually harvested 2 RB chips.
+
+Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=99353
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 30 ++----------------------------
+ 1 file changed, 2 insertions(+), 28 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+@@ -4403,34 +4403,8 @@ static void gfx_v7_0_gpu_early_init(stru
+ case CHIP_KAVERI:
+ adev->gfx.config.max_shader_engines = 1;
+ adev->gfx.config.max_tile_pipes = 4;
+- if ((adev->pdev->device == 0x1304) ||
+- (adev->pdev->device == 0x1305) ||
+- (adev->pdev->device == 0x130C) ||
+- (adev->pdev->device == 0x130F) ||
+- (adev->pdev->device == 0x1310) ||
+- (adev->pdev->device == 0x1311) ||
+- (adev->pdev->device == 0x131C)) {
+- adev->gfx.config.max_cu_per_sh = 8;
+- adev->gfx.config.max_backends_per_se = 2;
+- } else if ((adev->pdev->device == 0x1309) ||
+- (adev->pdev->device == 0x130A) ||
+- (adev->pdev->device == 0x130D) ||
+- (adev->pdev->device == 0x1313) ||
+- (adev->pdev->device == 0x131D)) {
+- adev->gfx.config.max_cu_per_sh = 6;
+- adev->gfx.config.max_backends_per_se = 2;
+- } else if ((adev->pdev->device == 0x1306) ||
+- (adev->pdev->device == 0x1307) ||
+- (adev->pdev->device == 0x130B) ||
+- (adev->pdev->device == 0x130E) ||
+- (adev->pdev->device == 0x1315) ||
+- (adev->pdev->device == 0x131B)) {
+- adev->gfx.config.max_cu_per_sh = 4;
+- adev->gfx.config.max_backends_per_se = 1;
+- } else {
+- adev->gfx.config.max_cu_per_sh = 3;
+- adev->gfx.config.max_backends_per_se = 1;
+- }
++ adev->gfx.config.max_cu_per_sh = 8;
++ adev->gfx.config.max_backends_per_se = 2;
+ adev->gfx.config.max_sh_per_se = 1;
+ adev->gfx.config.max_texture_channel_caches = 4;
+ adev->gfx.config.max_gprs = 256;
--- /dev/null
+From 1bced75f4ab04bec55aecb57d99435dc6d0ae5a0 Mon Sep 17 00:00:00 2001
+From: Rex Zhu <Rex.Zhu@amd.com>
+Date: Tue, 27 Feb 2018 18:20:53 +0800
+Subject: drm/amdgpu: Notify sbios device ready before send request
+
+From: Rex Zhu <Rex.Zhu@amd.com>
+
+commit 1bced75f4ab04bec55aecb57d99435dc6d0ae5a0 upstream.
+
+it is required if a platform supports PCIe root complex
+core voltage reduction. After receiving this notification,
+SBIOS can apply default PCIe root complex power policy.
+
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Rex Zhu <Rex.Zhu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+@@ -540,6 +540,9 @@ int amdgpu_acpi_pcie_performance_request
+ size_t size;
+ u32 retry = 3;
+
++ if (amdgpu_acpi_pcie_notify_device_ready(adev))
++ return -EINVAL;
++
+ /* Get the device handle */
+ handle = ACPI_HANDLE(&adev->pdev->dev);
+ if (!handle)
--- /dev/null
+From 05656e5e4917a08296300dc0530aed1539202c25 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 26 Feb 2018 11:05:10 -0500
+Subject: drm/amdgpu: used cached pcie gen info for SI (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 05656e5e4917a08296300dc0530aed1539202c25 upstream.
+
+Rather than querying it every time we need it.
+Also fixes a crash in VM pass through if there is no
+root bridge because the cached value fetch already checks
+this properly.
+
+v2: fix includes
+
+Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=105244
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Rex Zhu<rezhu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/si.c | 22 +++++++--------
+ drivers/gpu/drm/amd/amdgpu/si_dpm.c | 50 +++++++++---------------------------
+ 2 files changed, 23 insertions(+), 49 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/si.c
++++ b/drivers/gpu/drm/amd/amdgpu/si.c
+@@ -31,6 +31,7 @@
+ #include "amdgpu_uvd.h"
+ #include "amdgpu_vce.h"
+ #include "atom.h"
++#include "amd_pcie.h"
+ #include "amdgpu_powerplay.h"
+ #include "sid.h"
+ #include "si_ih.h"
+@@ -1461,8 +1462,8 @@ static void si_pcie_gen3_enable(struct a
+ {
+ struct pci_dev *root = adev->pdev->bus->self;
+ int bridge_pos, gpu_pos;
+- u32 speed_cntl, mask, current_data_rate;
+- int ret, i;
++ u32 speed_cntl, current_data_rate;
++ int i;
+ u16 tmp16;
+
+ if (pci_is_root_bus(adev->pdev->bus))
+@@ -1474,23 +1475,20 @@ static void si_pcie_gen3_enable(struct a
+ if (adev->flags & AMD_IS_APU)
+ return;
+
+- ret = drm_pcie_get_speed_cap_mask(adev->ddev, &mask);
+- if (ret != 0)
+- return;
+-
+- if (!(mask & (DRM_PCIE_SPEED_50 | DRM_PCIE_SPEED_80)))
++ if (!(adev->pm.pcie_gen_mask & (CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2 |
++ CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3)))
+ return;
+
+ speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL);
+ current_data_rate = (speed_cntl & LC_CURRENT_DATA_RATE_MASK) >>
+ LC_CURRENT_DATA_RATE_SHIFT;
+- if (mask & DRM_PCIE_SPEED_80) {
++ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) {
+ if (current_data_rate == 2) {
+ DRM_INFO("PCIE gen 3 link speeds already enabled\n");
+ return;
+ }
+ DRM_INFO("enabling PCIE gen 3 link speeds, disable with amdgpu.pcie_gen2=0\n");
+- } else if (mask & DRM_PCIE_SPEED_50) {
++ } else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2) {
+ if (current_data_rate == 1) {
+ DRM_INFO("PCIE gen 2 link speeds already enabled\n");
+ return;
+@@ -1506,7 +1504,7 @@ static void si_pcie_gen3_enable(struct a
+ if (!gpu_pos)
+ return;
+
+- if (mask & DRM_PCIE_SPEED_80) {
++ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) {
+ if (current_data_rate != 2) {
+ u16 bridge_cfg, gpu_cfg;
+ u16 bridge_cfg2, gpu_cfg2;
+@@ -1589,9 +1587,9 @@ static void si_pcie_gen3_enable(struct a
+
+ pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
+ tmp16 &= ~0xf;
+- if (mask & DRM_PCIE_SPEED_80)
++ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3)
+ tmp16 |= 3;
+- else if (mask & DRM_PCIE_SPEED_50)
++ else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2)
+ tmp16 |= 2;
+ else
+ tmp16 |= 1;
+--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
++++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+@@ -26,6 +26,7 @@
+ #include "amdgpu_pm.h"
+ #include "amdgpu_dpm.h"
+ #include "amdgpu_atombios.h"
++#include "amd_pcie.h"
+ #include "sid.h"
+ #include "r600_dpm.h"
+ #include "si_dpm.h"
+@@ -3331,29 +3332,6 @@ static void btc_apply_voltage_delta_rule
+ }
+ }
+
+-static enum amdgpu_pcie_gen r600_get_pcie_gen_support(struct amdgpu_device *adev,
+- u32 sys_mask,
+- enum amdgpu_pcie_gen asic_gen,
+- enum amdgpu_pcie_gen default_gen)
+-{
+- switch (asic_gen) {
+- case AMDGPU_PCIE_GEN1:
+- return AMDGPU_PCIE_GEN1;
+- case AMDGPU_PCIE_GEN2:
+- return AMDGPU_PCIE_GEN2;
+- case AMDGPU_PCIE_GEN3:
+- return AMDGPU_PCIE_GEN3;
+- default:
+- if ((sys_mask & DRM_PCIE_SPEED_80) && (default_gen == AMDGPU_PCIE_GEN3))
+- return AMDGPU_PCIE_GEN3;
+- else if ((sys_mask & DRM_PCIE_SPEED_50) && (default_gen == AMDGPU_PCIE_GEN2))
+- return AMDGPU_PCIE_GEN2;
+- else
+- return AMDGPU_PCIE_GEN1;
+- }
+- return AMDGPU_PCIE_GEN1;
+-}
+-
+ static void r600_calculate_u_and_p(u32 i, u32 r_c, u32 p_b,
+ u32 *p, u32 *u)
+ {
+@@ -5028,10 +5006,11 @@ static int si_populate_smc_acpi_state(st
+ table->ACPIState.levels[0].vddc.index,
+ &table->ACPIState.levels[0].std_vddc);
+ }
+- table->ACPIState.levels[0].gen2PCIE = (u8)r600_get_pcie_gen_support(adev,
+- si_pi->sys_pcie_mask,
+- si_pi->boot_pcie_gen,
+- AMDGPU_PCIE_GEN1);
++ table->ACPIState.levels[0].gen2PCIE =
++ (u8)amdgpu_get_pcie_gen_support(adev,
++ si_pi->sys_pcie_mask,
++ si_pi->boot_pcie_gen,
++ AMDGPU_PCIE_GEN1);
+
+ if (si_pi->vddc_phase_shed_control)
+ si_populate_phase_shedding_value(adev,
+@@ -7172,10 +7151,10 @@ static void si_parse_pplib_clock_info(st
+ pl->vddc = le16_to_cpu(clock_info->si.usVDDC);
+ pl->vddci = le16_to_cpu(clock_info->si.usVDDCI);
+ pl->flags = le32_to_cpu(clock_info->si.ulFlags);
+- pl->pcie_gen = r600_get_pcie_gen_support(adev,
+- si_pi->sys_pcie_mask,
+- si_pi->boot_pcie_gen,
+- clock_info->si.ucPCIEGen);
++ pl->pcie_gen = amdgpu_get_pcie_gen_support(adev,
++ si_pi->sys_pcie_mask,
++ si_pi->boot_pcie_gen,
++ clock_info->si.ucPCIEGen);
+
+ /* patch up vddc if necessary */
+ ret = si_get_leakage_voltage_from_leakage_index(adev, pl->vddc,
+@@ -7330,7 +7309,6 @@ static int si_dpm_init(struct amdgpu_dev
+ struct si_power_info *si_pi;
+ struct atom_clock_dividers dividers;
+ int ret;
+- u32 mask;
+
+ si_pi = kzalloc(sizeof(struct si_power_info), GFP_KERNEL);
+ if (si_pi == NULL)
+@@ -7340,11 +7318,9 @@ static int si_dpm_init(struct amdgpu_dev
+ eg_pi = &ni_pi->eg;
+ pi = &eg_pi->rv7xx;
+
+- ret = drm_pcie_get_speed_cap_mask(adev->ddev, &mask);
+- if (ret)
+- si_pi->sys_pcie_mask = 0;
+- else
+- si_pi->sys_pcie_mask = mask;
++ si_pi->sys_pcie_mask =
++ (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_MASK) >>
++ CAIL_PCIE_LINK_SPEED_SUPPORT_SHIFT;
+ si_pi->force_pcie_gen = AMDGPU_PCIE_GEN_INVALID;
+ si_pi->boot_pcie_gen = si_get_current_pcie_speed(adev);
+
--- /dev/null
+From d13a8479f3584613b6aacbb793eae64578b8f69a Mon Sep 17 00:00:00 2001
+From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Date: Tue, 16 Jan 2018 16:53:24 +0100
+Subject: drm/i915: Always call to intel_display_set_init_power() in resume_early.
+
+From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+
+commit d13a8479f3584613b6aacbb793eae64578b8f69a upstream.
+
+intel_power_domains_init_hw() calls set_init_power, but when using
+runtime power management this call is skipped. This prevents hw readout
+from taking place.
+
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=104172
+Link: https://patchwork.freedesktop.org/patch/msgid/20180116155324.75120-1-maarten.lankhorst@linux.intel.com
+Fixes: bc87229f323e ("drm/i915/skl: enable PC9/10 power states during suspend-to-idle")
+Cc: Nivedita Swaminathan <nivedita.swaminathan@intel.com>
+Cc: Imre Deak <imre.deak@intel.com>
+Cc: Patrik Jakobsson <patrik.jakobsson@linux.intel.com>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: <stable@vger.kernel.org> # v4.5+
+Reviewed-by: Imre Deak <imre.deak@intel.com>
+(cherry picked from commit ac25dfed15d470d7f23dd817e965b54aa3f94a1e)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_drv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -1827,6 +1827,8 @@ static int i915_drm_resume_early(struct
+ if (IS_GEN9_LP(dev_priv) ||
+ !(dev_priv->suspended_to_idle && dev_priv->csr.dmc_payload))
+ intel_power_domains_init_hw(dev_priv, true);
++ else
++ intel_display_set_init_power(dev_priv, true);
+
+ i915_gem_sanitize(dev_priv);
+
--- /dev/null
+From 72a6d72c2cd03bba7b70117b63dea83d2de88057 Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Wed, 14 Feb 2018 19:38:40 +0200
+Subject: drm/i915/audio: fix check for av_enc_map overflow
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+commit 72a6d72c2cd03bba7b70117b63dea83d2de88057 upstream.
+
+Turns out -1 >= ARRAY_SIZE() is always true. Move the bounds check where
+we know pipe >= 0 and next to the array indexing where it makes most
+sense.
+
+Fixes: 9965db26ac05 ("drm/i915: Check for fused or unused pipes")
+Fixes: 0b7029b7e43f ("drm/i915: Check for fused or unused pipes")
+Cc: <stable@vger.kernel.org> # v4.10+
+Cc: Mika Kahola <mika.kahola@intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: intel-gfx@lists.freedesktop.org
+Reviewed-by: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>
+Reviewed-by: Mika Kahola <mika.kahola@intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180214173840.25360-1-jani.nikula@intel.com
+(cherry picked from commit cdb3db8542d854bd678d60cd28861b042e191672)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_audio.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_audio.c
++++ b/drivers/gpu/drm/i915/intel_audio.c
+@@ -754,11 +754,11 @@ static struct intel_encoder *get_saved_e
+ {
+ struct intel_encoder *encoder;
+
+- if (WARN_ON(pipe >= ARRAY_SIZE(dev_priv->av_enc_map)))
+- return NULL;
+-
+ /* MST */
+ if (pipe >= 0) {
++ if (WARN_ON(pipe >= ARRAY_SIZE(dev_priv->av_enc_map)))
++ return NULL;
++
+ encoder = dev_priv->av_enc_map[pipe];
+ /*
+ * when bootup, audio driver may not know it is
--- /dev/null
+From 9965db26ac0548648309f506dc155a92daa2158f Mon Sep 17 00:00:00 2001
+From: Mika Kahola <mika.kahola@intel.com>
+Date: Mon, 18 Dec 2017 10:04:03 +0200
+Subject: drm/i915: Check for fused or unused pipes
+
+From: Mika Kahola <mika.kahola@intel.com>
+
+commit 9965db26ac0548648309f506dc155a92daa2158f upstream.
+
+We may have fused or unused pipes in our system. Let's check that the pipe
+in question is within limits of accessible pipes. In case, that we are not
+able to access the pipe, we return early with a warning.
+
+v2: Rephrasing of the commit message (Jani)
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=103206
+Reported-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Jaswinder Singh Rajput <jaswinder@perfectintelligent.com>
+Suggested-by: Jani Nikula <jani.nikula@intel.com>
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Mika Kahola <mika.kahola@intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/1513584243-12607-1-git-send-email-mika.kahola@intel.com
+(cherry picked from commit 0b7029b7e43fda1304c181a3ade0b429b9edcd9d)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: <stable@vger.kernel.org> # v4.10+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_audio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_audio.c
++++ b/drivers/gpu/drm/i915/intel_audio.c
+@@ -754,7 +754,7 @@ static struct intel_encoder *get_saved_e
+ {
+ struct intel_encoder *encoder;
+
+- if (WARN_ON(pipe >= INTEL_INFO(dev_priv)->num_pipes))
++ if (WARN_ON(pipe >= ARRAY_SIZE(dev_priv->av_enc_map)))
+ return NULL;
+
+ /* MST */
--- /dev/null
+From e659d14ed48096f87a678e7ebbdf286a817b4d0e Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Mon, 19 Feb 2018 14:01:44 +0000
+Subject: drm/i915: Clear the in-use marker on execbuf failure
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit e659d14ed48096f87a678e7ebbdf286a817b4d0e upstream.
+
+If we fail to unbind the vma (due to a signal on an active buffer that
+needs to be moved for the next execbuf), then we need to clear the
+persistent tracking state we setup for this execbuf.
+
+Fixes: c7c6e46f913b ("drm/i915: Convert execbuf to use struct-of-array packing for critical fields")
+Testcase: igt/gem_fenced_exec_thrash/no-spare-fences-busy*
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: <stable@vger.kernel.org> # v4.14+
+Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180219140144.24004-1-chris@chris-wilson.co.uk
+(cherry picked from commit ed2f3532321083cf40e4da4e36234880e0136136)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_gem_execbuffer.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+@@ -505,6 +505,8 @@ eb_add_vma(struct i915_execbuffer *eb, u
+ list_add_tail(&vma->exec_link, &eb->unbound);
+ if (drm_mm_node_allocated(&vma->node))
+ err = i915_vma_unbind(vma);
++ if (unlikely(err))
++ vma->exec_flags = NULL;
+ }
+ return err;
+ }
--- /dev/null
+From 156961ae7bdf6feb72778e8da83d321b273343fd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Fri, 8 Dec 2017 23:37:36 +0200
+Subject: drm/i915: Disable DC states around GMBUS on GLK
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 156961ae7bdf6feb72778e8da83d321b273343fd upstream.
+
+Prevent the DMC from destroying GMBUS transfers on GLK. GMBUS
+lives in PG1 so DC off is all we need.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20171208213739.16388-1-ville.syrjala@linux.intel.com
+Reviewed-by: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_runtime_pm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
++++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
+@@ -1844,6 +1844,7 @@ void intel_display_power_put(struct drm_
+ CNL_DISPLAY_POWERWELL_2_POWER_DOMAINS | \
+ BIT_ULL(POWER_DOMAIN_MODESET) | \
+ BIT_ULL(POWER_DOMAIN_AUX_A) | \
++ BIT_ULL(POWER_DOMAIN_GMBUS) | \
+ BIT_ULL(POWER_DOMAIN_INIT))
+
+ static const struct i915_power_well_ops i9xx_always_on_power_well_ops = {
--- /dev/null
+From b1b13780ab06ef8c770dd9cbe31dac549a11630e Mon Sep 17 00:00:00 2001
+From: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Date: Wed, 14 Feb 2018 11:18:25 -0800
+Subject: drm/i915: Fix rsvd2 mask when out-fence is returned
+
+From: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+
+commit b1b13780ab06ef8c770dd9cbe31dac549a11630e upstream.
+
+GENMASK_ULL wants the high bit of the mask first. The current value
+cancels the in-fence when an out-fence is returned.
+
+Fixes: fec0445caa273 ("drm/i915: Support explicit fencing for execbuf")
+Testcase: igt/gem_exec_fence/keep-in-fence*
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180214191827.8465-1-daniele.ceraolospurio@intel.com
+Cc: <stable@vger.kernel.org> # v4.12+
+(cherry picked from commit b6a88e4a804cf5a71159906e16df2c1fc7196f92)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_gem_execbuffer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+@@ -2419,7 +2419,7 @@ err_request:
+ if (out_fence) {
+ if (err == 0) {
+ fd_install(out_fence_fd, out_fence->file);
+- args->rsvd2 &= GENMASK_ULL(0, 31); /* keep in-fence */
++ args->rsvd2 &= GENMASK_ULL(31, 0); /* keep in-fence */
+ args->rsvd2 |= (u64)out_fence_fd << 32;
+ out_fence_fd = -1;
+ } else {
--- /dev/null
+From f616f2830c1ed79245cfeca900f7e8a3b3c08c06 Mon Sep 17 00:00:00 2001
+From: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
+Date: Thu, 1 Mar 2018 11:06:13 +0000
+Subject: drm/i915/perf: fix perf stream opening lock
+
+From: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
+
+commit f616f2830c1ed79245cfeca900f7e8a3b3c08c06 upstream.
+
+We're seeing on CI that some contexts don't have the programmed OA
+period timer that directs the OA unit on how often to write reports.
+
+The issue is that we're not holding the drm lock from when we edit the
+context images down to when we set the exclusive_stream variable. This
+leaves a window for the deferred context allocation to call
+i915_oa_init_reg_state() that will not program the expected OA timer
+value, because we haven't set the exclusive_stream yet.
+
+v2: Drop need_lock from gen8_configure_all_contexts() (Matt)
+
+Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
+Reviewed-by: Matthew Auld <matthew.auld@intel.com>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Fixes: 701f8231a2f ("drm/i915/perf: prune OA configs")
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=102254
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=103715
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=103755
+Link: https://patchwork.freedesktop.org/patch/msgid/20180301110613.1737-1-lionel.g.landwerlin@intel.com
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: intel-gfx@lists.freedesktop.org
+Cc: <stable@vger.kernel.org> # v4.14+
+(cherry picked from commit 41d3fdcd15d5ecf29cc73e8b79c2327ebb54b960)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_perf.c | 38 ++++++++++++--------------------------
+ 1 file changed, 12 insertions(+), 26 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_perf.c
++++ b/drivers/gpu/drm/i915/i915_perf.c
+@@ -1301,9 +1301,8 @@ static void i915_oa_stream_destroy(struc
+ */
+ mutex_lock(&dev_priv->drm.struct_mutex);
+ dev_priv->perf.oa.exclusive_stream = NULL;
+- mutex_unlock(&dev_priv->drm.struct_mutex);
+-
+ dev_priv->perf.oa.ops.disable_metric_set(dev_priv);
++ mutex_unlock(&dev_priv->drm.struct_mutex);
+
+ free_oa_buffer(dev_priv);
+
+@@ -1755,22 +1754,13 @@ static int gen8_switch_to_updated_kernel
+ * Note: it's only the RCS/Render context that has any OA state.
+ */
+ static int gen8_configure_all_contexts(struct drm_i915_private *dev_priv,
+- const struct i915_oa_config *oa_config,
+- bool interruptible)
++ const struct i915_oa_config *oa_config)
+ {
+ struct i915_gem_context *ctx;
+ int ret;
+ unsigned int wait_flags = I915_WAIT_LOCKED;
+
+- if (interruptible) {
+- ret = i915_mutex_lock_interruptible(&dev_priv->drm);
+- if (ret)
+- return ret;
+-
+- wait_flags |= I915_WAIT_INTERRUPTIBLE;
+- } else {
+- mutex_lock(&dev_priv->drm.struct_mutex);
+- }
++ lockdep_assert_held(&dev_priv->drm.struct_mutex);
+
+ /* Switch away from any user context. */
+ ret = gen8_switch_to_updated_kernel_context(dev_priv, oa_config);
+@@ -1818,8 +1808,6 @@ static int gen8_configure_all_contexts(s
+ }
+
+ out:
+- mutex_unlock(&dev_priv->drm.struct_mutex);
+-
+ return ret;
+ }
+
+@@ -1862,7 +1850,7 @@ static int gen8_enable_metric_set(struct
+ * to make sure all slices/subslices are ON before writing to NOA
+ * registers.
+ */
+- ret = gen8_configure_all_contexts(dev_priv, oa_config, true);
++ ret = gen8_configure_all_contexts(dev_priv, oa_config);
+ if (ret)
+ return ret;
+
+@@ -1877,7 +1865,7 @@ static int gen8_enable_metric_set(struct
+ static void gen8_disable_metric_set(struct drm_i915_private *dev_priv)
+ {
+ /* Reset all contexts' slices/subslices configurations. */
+- gen8_configure_all_contexts(dev_priv, NULL, false);
++ gen8_configure_all_contexts(dev_priv, NULL);
+
+ I915_WRITE(GDT_CHICKEN_BITS, (I915_READ(GDT_CHICKEN_BITS) &
+ ~GT_NOA_ENABLE));
+@@ -2127,6 +2115,10 @@ static int i915_oa_stream_init(struct i9
+ if (ret)
+ goto err_oa_buf_alloc;
+
++ ret = i915_mutex_lock_interruptible(&dev_priv->drm);
++ if (ret)
++ goto err_lock;
++
+ ret = dev_priv->perf.oa.ops.enable_metric_set(dev_priv,
+ stream->oa_config);
+ if (ret)
+@@ -2134,23 +2126,17 @@ static int i915_oa_stream_init(struct i9
+
+ stream->ops = &i915_oa_stream_ops;
+
+- /* Lock device for exclusive_stream access late because
+- * enable_metric_set() might lock as well on gen8+.
+- */
+- ret = i915_mutex_lock_interruptible(&dev_priv->drm);
+- if (ret)
+- goto err_lock;
+-
+ dev_priv->perf.oa.exclusive_stream = stream;
+
+ mutex_unlock(&dev_priv->drm.struct_mutex);
+
+ return 0;
+
+-err_lock:
++err_enable:
+ dev_priv->perf.oa.ops.disable_metric_set(dev_priv);
++ mutex_unlock(&dev_priv->drm.struct_mutex);
+
+-err_enable:
++err_lock:
+ free_oa_buffer(dev_priv);
+
+ err_oa_buf_alloc:
--- /dev/null
+From 90024a5951029685acc5396258f1b0de9b23cf4a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Stefan=20Br=C3=BCns?= <stefan.bruens@rwth-aachen.de>
+Date: Sun, 31 Dec 2017 23:34:54 +0100
+Subject: drm/i915: Try EDID bitbanging on HDMI after failed read
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stefan Brüns <stefan.bruens@rwth-aachen.de>
+
+commit 90024a5951029685acc5396258f1b0de9b23cf4a upstream.
+
+The ACK/NACK implementation as found in e.g. the G965 has the falling
+clock edge and the release of the data line after the ACK for the received
+byte happen at the same time.
+
+This is conformant with the I2C specification, which allows a zero hold
+time, see footnote [3]: "A device must internally provide a hold time of
+at least 300 ns for the SDA signal (with respect to the V IH(min) of the
+SCL signal) to bridge the undefined region of the falling edge of SCL."
+
+Some HDMI-to-VGA converters apparently fail to adhere to this requirement
+and latch SDA at the falling clock edge, so instead of an ACK
+sometimes a NACK is read and the slave (i.e. the EDID ROM) ends the
+transfer.
+
+The bitbanging releases the data line for the ACK only 1/4 bit time after
+the falling clock edge, so a slave will see the correct value no matter
+if it samples at the rising or the falling clock edge or in the center.
+
+Fallback to bitbanging is already done for the CRT connector.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92685
+Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>
+Cc: stable@vger.kernel.org
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/a39f080b-81a5-4c93-b3f7-7cb0a58daca3@rwthex-w2-a.rwth-ad.de
+(cherry picked from commit cfb926e148e99acc02351d72e8b85e32b5f786ef)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_hdmi.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_hdmi.c
++++ b/drivers/gpu/drm/i915/intel_hdmi.c
+@@ -1573,12 +1573,20 @@ intel_hdmi_set_edid(struct drm_connector
+ struct intel_hdmi *intel_hdmi = intel_attached_hdmi(connector);
+ struct edid *edid;
+ bool connected = false;
++ struct i2c_adapter *i2c;
+
+ intel_display_power_get(dev_priv, POWER_DOMAIN_GMBUS);
+
+- edid = drm_get_edid(connector,
+- intel_gmbus_get_adapter(dev_priv,
+- intel_hdmi->ddc_bus));
++ i2c = intel_gmbus_get_adapter(dev_priv, intel_hdmi->ddc_bus);
++
++ edid = drm_get_edid(connector, i2c);
++
++ if (!edid && !intel_gmbus_is_forced_bit(i2c)) {
++ DRM_DEBUG_KMS("HDMI GMBUS EDID read failed, retry using GPIO bit-banging\n");
++ intel_gmbus_force_bit(i2c, true);
++ edid = drm_get_edid(connector, i2c);
++ intel_gmbus_force_bit(i2c, false);
++ }
+
+ intel_hdmi_dp_dual_mode_detect(connector, edid != NULL);
+
--- /dev/null
+From 556fe36d09da5f82879e92bafa0371b4b79f7d6f Mon Sep 17 00:00:00 2001
+From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Date: Fri, 10 Nov 2017 12:34:53 +0100
+Subject: drm/i915: Update watermark state correctly in sanitize_watermarks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+
+commit 556fe36d09da5f82879e92bafa0371b4b79f7d6f upstream.
+
+We no longer use intel_crtc->wm.active for watermarks any more,
+which was incorrect. But this uncovered a bug in sanitize_watermarks(),
+which meant that we wrote the correct watermarks, but the next
+update would still use the wrong hw watermarks for calculating.
+This caused all further updates to fail with -EINVAL and the
+log would reveal an error like the one below:
+
+[ 10.043902] [drm:ilk_validate_wm_level.part.8 [i915]] Sprite WM0 too large 56 (max 0)
+[ 10.043960] [drm:ilk_validate_pipe_wm [i915]] LP0 watermark invalid
+[ 10.044030] [drm:intel_crtc_atomic_check [i915]] No valid intermediate pipe watermarks are possible
+
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Fixes: b6b178a77210 ("drm/i915: Calculate ironlake intermediate watermarks correctly, v2.")
+Cc: stable@vger.kernel.org #v4.8+
+Link: https://patchwork.freedesktop.org/patch/msgid/20171110113503.16253-1-maarten.lankhorst@linux.intel.com
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -14463,6 +14463,8 @@ retry:
+
+ cs->wm.need_postvbl_update = true;
+ dev_priv->display.optimize_watermarks(intel_state, cs);
++
++ to_intel_crtc_state(crtc->state)->wm = cs->wm;
+ }
+
+ put_state:
--- /dev/null
+From d61a5c1063515e855bedb1b81e20e50b0ac3541e Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Sun, 11 Feb 2018 10:38:28 +0100
+Subject: drm/nouveau: Fix deadlock on runtime suspend
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit d61a5c1063515e855bedb1b81e20e50b0ac3541e upstream.
+
+nouveau's ->runtime_suspend hook calls drm_kms_helper_poll_disable(),
+which waits for the output poll worker to finish if it's running.
+
+The output poll worker meanwhile calls pm_runtime_get_sync() in
+nouveau_connector_detect() which waits for the ongoing suspend to finish,
+causing a deadlock.
+
+Fix by not acquiring a runtime PM ref if nouveau_connector_detect() is
+called in the output poll worker's context. This is safe because
+the poll worker is only enabled while runtime active and we know that
+->runtime_suspend waits for it to finish.
+
+Other contexts calling nouveau_connector_detect() do require a runtime
+PM ref, these comprise:
+
+ status_store() drm sysfs interface
+ ->fill_modes drm callback
+ drm_fb_helper_probe_connector_modes()
+ drm_mode_getconnector()
+ nouveau_connector_hotplug()
+ nouveau_display_hpd_work()
+ nv17_tv_set_property()
+
+Stack trace for posterity:
+
+ INFO: task kworker/0:1:58 blocked for more than 120 seconds.
+ Workqueue: events output_poll_execute [drm_kms_helper]
+ Call Trace:
+ schedule+0x28/0x80
+ rpm_resume+0x107/0x6e0
+ __pm_runtime_resume+0x47/0x70
+ nouveau_connector_detect+0x7e/0x4a0 [nouveau]
+ nouveau_connector_detect_lvds+0x132/0x180 [nouveau]
+ drm_helper_probe_detect_ctx+0x85/0xd0 [drm_kms_helper]
+ output_poll_execute+0x11e/0x1c0 [drm_kms_helper]
+ process_one_work+0x184/0x380
+ worker_thread+0x2e/0x390
+
+ INFO: task kworker/0:2:252 blocked for more than 120 seconds.
+ Workqueue: pm pm_runtime_work
+ Call Trace:
+ schedule+0x28/0x80
+ schedule_timeout+0x1e3/0x370
+ wait_for_completion+0x123/0x190
+ flush_work+0x142/0x1c0
+ nouveau_pmops_runtime_suspend+0x7e/0xd0 [nouveau]
+ pci_pm_runtime_suspend+0x5c/0x180
+ vga_switcheroo_runtime_suspend+0x1e/0xa0
+ __rpm_callback+0xc1/0x200
+ rpm_callback+0x1f/0x70
+ rpm_suspend+0x13c/0x640
+ pm_runtime_work+0x6e/0x90
+ process_one_work+0x184/0x380
+ worker_thread+0x2e/0x390
+
+Bugzilla: https://bugs.archlinux.org/task/53497
+Bugzilla: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870523
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=70388#c33
+Fixes: 5addcf0a5f0f ("nouveau: add runtime PM support (v0.9)")
+Cc: stable@vger.kernel.org # v3.12+: 27d4ee03078a: workqueue: Allow retrieval of current task's work struct
+Cc: stable@vger.kernel.org # v3.12+: 25c058ccaf2e: drm: Allow determining if current task is output poll worker
+Cc: Ben Skeggs <bskeggs@redhat.com>
+Cc: Dave Airlie <airlied@redhat.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/b7d2cbb609a80f59ccabfdf479b9d5907c603ea1.1518338789.git.lukas@wunner.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/nouveau_connector.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
+@@ -570,9 +570,15 @@ nouveau_connector_detect(struct drm_conn
+ nv_connector->edid = NULL;
+ }
+
+- ret = pm_runtime_get_sync(connector->dev->dev);
+- if (ret < 0 && ret != -EACCES)
+- return conn_status;
++ /* Outputs are only polled while runtime active, so acquiring a
++ * runtime PM ref here is unnecessary (and would deadlock upon
++ * runtime suspend because it waits for polling to finish).
++ */
++ if (!drm_kms_helper_is_poll_worker()) {
++ ret = pm_runtime_get_sync(connector->dev->dev);
++ if (ret < 0 && ret != -EACCES)
++ return conn_status;
++ }
+
+ nv_encoder = nouveau_connector_ddc_detect(connector);
+ if (nv_encoder && (i2c = nv_encoder->i2c) != NULL) {
+@@ -647,8 +653,10 @@ detect_analog:
+
+ out:
+
+- pm_runtime_mark_last_busy(connector->dev->dev);
+- pm_runtime_put_autosuspend(connector->dev->dev);
++ if (!drm_kms_helper_is_poll_worker()) {
++ pm_runtime_mark_last_busy(connector->dev->dev);
++ pm_runtime_put_autosuspend(connector->dev->dev);
++ }
+
+ return conn_status;
+ }
--- /dev/null
+From c20bb155c2c5acb775f68be5d84fe679687c3c1e Mon Sep 17 00:00:00 2001
+From: Ilia Mirkin <imirkin@alum.mit.edu>
+Date: Sat, 3 Feb 2018 14:11:23 -0500
+Subject: drm/nouveau: prefer XBGR2101010 for addfb ioctl
+
+From: Ilia Mirkin <imirkin@alum.mit.edu>
+
+commit c20bb155c2c5acb775f68be5d84fe679687c3c1e upstream.
+
+Nouveau only exposes support for XBGR2101010. Prior to the atomic
+conversion, drm would pass in the wrong format in the framebuffer, but
+it was always ignored -- both userspace (xf86-video-nouveau) and the
+kernel driver agreed on the layout, so the fact that the format was
+wrong didn't matter.
+
+With the atomic conversion, nouveau all of a sudden started caring about
+the exact format, and so the previously-working code in
+xf86-video-nouveau no longer functioned since the (internally-assigned)
+format from the addfb ioctl was wrong.
+
+This change adds infrastructure to allow a drm driver to specify that it
+prefers the XBGR format variant for the addfb ioctl, and makes nouveau's
+nv50 display driver set it. (Prior gens had no support for 30bpp at all.)
+
+Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
+Cc: stable@vger.kernel.org # v4.10+
+Acked-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180203191123.31507-1-imirkin@alum.mit.edu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_framebuffer.c | 4 ++++
+ drivers/gpu/drm/nouveau/nv50_display.c | 1 +
+ include/drm/drm_drv.h | 1 +
+ 3 files changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/drm_framebuffer.c
++++ b/drivers/gpu/drm/drm_framebuffer.c
+@@ -118,6 +118,10 @@ int drm_mode_addfb(struct drm_device *de
+ r.pixel_format = drm_mode_legacy_fb_format(or->bpp, or->depth);
+ r.handles[0] = or->handle;
+
++ if (r.pixel_format == DRM_FORMAT_XRGB2101010 &&
++ dev->driver->driver_features & DRIVER_PREFER_XBGR_30BPP)
++ r.pixel_format = DRM_FORMAT_XBGR2101010;
++
+ ret = drm_mode_addfb2(dev, &r, file_priv);
+ if (ret)
+ return ret;
+--- a/drivers/gpu/drm/nouveau/nv50_display.c
++++ b/drivers/gpu/drm/nouveau/nv50_display.c
+@@ -4426,6 +4426,7 @@ nv50_display_create(struct drm_device *d
+ nouveau_display(dev)->fini = nv50_display_fini;
+ disp->disp = &nouveau_display(dev)->disp;
+ dev->mode_config.funcs = &nv50_disp_func;
++ dev->driver->driver_features |= DRIVER_PREFER_XBGR_30BPP;
+ if (nouveau_atomic)
+ dev->driver->driver_features |= DRIVER_ATOMIC;
+
+--- a/include/drm/drm_drv.h
++++ b/include/drm/drm_drv.h
+@@ -55,6 +55,7 @@ struct drm_mode_create_dumb;
+ #define DRIVER_ATOMIC 0x10000
+ #define DRIVER_KMS_LEGACY_CONTEXT 0x20000
+ #define DRIVER_SYNCOBJ 0x40000
++#define DRIVER_PREFER_XBGR_30BPP 0x80000
+
+ /**
+ * struct drm_driver - DRM driver structure
--- /dev/null
+From 15734feff2bdac24aa3266c437cffa42851990e3 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Sun, 11 Feb 2018 10:38:28 +0100
+Subject: drm/radeon: Fix deadlock on runtime suspend
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit 15734feff2bdac24aa3266c437cffa42851990e3 upstream.
+
+radeon's ->runtime_suspend hook calls drm_kms_helper_poll_disable(),
+which waits for the output poll worker to finish if it's running.
+
+The output poll worker meanwhile calls pm_runtime_get_sync() in
+radeon's ->detect hooks, which waits for the ongoing suspend to finish,
+causing a deadlock.
+
+Fix by not acquiring a runtime PM ref if the ->detect hooks are called
+in the output poll worker's context. This is safe because the poll
+worker is only enabled while runtime active and we know that
+->runtime_suspend waits for it to finish.
+
+Stack trace for posterity:
+
+ INFO: task kworker/0:3:31847 blocked for more than 120 seconds
+ Workqueue: events output_poll_execute [drm_kms_helper]
+ Call Trace:
+ schedule+0x3c/0x90
+ rpm_resume+0x1e2/0x690
+ __pm_runtime_resume+0x3f/0x60
+ radeon_lvds_detect+0x39/0xf0 [radeon]
+ output_poll_execute+0xda/0x1e0 [drm_kms_helper]
+ process_one_work+0x14b/0x440
+ worker_thread+0x48/0x4a0
+
+ INFO: task kworker/2:0:10493 blocked for more than 120 seconds.
+ Workqueue: pm pm_runtime_work
+ Call Trace:
+ schedule+0x3c/0x90
+ schedule_timeout+0x1b3/0x240
+ wait_for_common+0xc2/0x180
+ wait_for_completion+0x1d/0x20
+ flush_work+0xfc/0x1a0
+ __cancel_work_timer+0xa5/0x1d0
+ cancel_delayed_work_sync+0x13/0x20
+ drm_kms_helper_poll_disable+0x1f/0x30 [drm_kms_helper]
+ radeon_pmops_runtime_suspend+0x3d/0xa0 [radeon]
+ pci_pm_runtime_suspend+0x61/0x1a0
+ vga_switcheroo_runtime_suspend+0x21/0x70
+ __rpm_callback+0x32/0x70
+ rpm_callback+0x24/0x80
+ rpm_suspend+0x12b/0x640
+ pm_runtime_work+0x6f/0xb0
+ process_one_work+0x14b/0x440
+ worker_thread+0x48/0x4a0
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=94147
+Fixes: 10ebc0bc0934 ("drm/radeon: add runtime PM support (v2)")
+Cc: stable@vger.kernel.org # v3.13+: 27d4ee03078a: workqueue: Allow retrieval of current task's work struct
+Cc: stable@vger.kernel.org # v3.13+: 25c058ccaf2e: drm: Allow determining if current task is output poll worker
+Cc: Ismo Toijala <ismo.toijala@gmail.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: Dave Airlie <airlied@redhat.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/64ea02c44f91dda19bc563902b97bbc699040392.1518338789.git.lukas@wunner.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_connectors.c | 74 +++++++++++++++++++----------
+ 1 file changed, 49 insertions(+), 25 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -900,9 +900,11 @@ radeon_lvds_detect(struct drm_connector
+ enum drm_connector_status ret = connector_status_disconnected;
+ int r;
+
+- r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
+- return connector_status_disconnected;
++ if (!drm_kms_helper_is_poll_worker()) {
++ r = pm_runtime_get_sync(connector->dev->dev);
++ if (r < 0)
++ return connector_status_disconnected;
++ }
+
+ if (encoder) {
+ struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+@@ -925,8 +927,12 @@ radeon_lvds_detect(struct drm_connector
+ /* check acpi lid status ??? */
+
+ radeon_connector_update_scratch_regs(connector, ret);
+- pm_runtime_mark_last_busy(connector->dev->dev);
+- pm_runtime_put_autosuspend(connector->dev->dev);
++
++ if (!drm_kms_helper_is_poll_worker()) {
++ pm_runtime_mark_last_busy(connector->dev->dev);
++ pm_runtime_put_autosuspend(connector->dev->dev);
++ }
++
+ return ret;
+ }
+
+@@ -1040,9 +1046,11 @@ radeon_vga_detect(struct drm_connector *
+ enum drm_connector_status ret = connector_status_disconnected;
+ int r;
+
+- r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
+- return connector_status_disconnected;
++ if (!drm_kms_helper_is_poll_worker()) {
++ r = pm_runtime_get_sync(connector->dev->dev);
++ if (r < 0)
++ return connector_status_disconnected;
++ }
+
+ encoder = radeon_best_single_encoder(connector);
+ if (!encoder)
+@@ -1109,8 +1117,10 @@ radeon_vga_detect(struct drm_connector *
+ radeon_connector_update_scratch_regs(connector, ret);
+
+ out:
+- pm_runtime_mark_last_busy(connector->dev->dev);
+- pm_runtime_put_autosuspend(connector->dev->dev);
++ if (!drm_kms_helper_is_poll_worker()) {
++ pm_runtime_mark_last_busy(connector->dev->dev);
++ pm_runtime_put_autosuspend(connector->dev->dev);
++ }
+
+ return ret;
+ }
+@@ -1174,9 +1184,11 @@ radeon_tv_detect(struct drm_connector *c
+ if (!radeon_connector->dac_load_detect)
+ return ret;
+
+- r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
+- return connector_status_disconnected;
++ if (!drm_kms_helper_is_poll_worker()) {
++ r = pm_runtime_get_sync(connector->dev->dev);
++ if (r < 0)
++ return connector_status_disconnected;
++ }
+
+ encoder = radeon_best_single_encoder(connector);
+ if (!encoder)
+@@ -1188,8 +1200,12 @@ radeon_tv_detect(struct drm_connector *c
+ if (ret == connector_status_connected)
+ ret = radeon_connector_analog_encoder_conflict_solve(connector, encoder, ret, false);
+ radeon_connector_update_scratch_regs(connector, ret);
+- pm_runtime_mark_last_busy(connector->dev->dev);
+- pm_runtime_put_autosuspend(connector->dev->dev);
++
++ if (!drm_kms_helper_is_poll_worker()) {
++ pm_runtime_mark_last_busy(connector->dev->dev);
++ pm_runtime_put_autosuspend(connector->dev->dev);
++ }
++
+ return ret;
+ }
+
+@@ -1252,9 +1268,11 @@ radeon_dvi_detect(struct drm_connector *
+ enum drm_connector_status ret = connector_status_disconnected;
+ bool dret = false, broken_edid = false;
+
+- r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
+- return connector_status_disconnected;
++ if (!drm_kms_helper_is_poll_worker()) {
++ r = pm_runtime_get_sync(connector->dev->dev);
++ if (r < 0)
++ return connector_status_disconnected;
++ }
+
+ if (radeon_connector->detected_hpd_without_ddc) {
+ force = true;
+@@ -1437,8 +1455,10 @@ out:
+ }
+
+ exit:
+- pm_runtime_mark_last_busy(connector->dev->dev);
+- pm_runtime_put_autosuspend(connector->dev->dev);
++ if (!drm_kms_helper_is_poll_worker()) {
++ pm_runtime_mark_last_busy(connector->dev->dev);
++ pm_runtime_put_autosuspend(connector->dev->dev);
++ }
+
+ return ret;
+ }
+@@ -1689,9 +1709,11 @@ radeon_dp_detect(struct drm_connector *c
+ if (radeon_dig_connector->is_mst)
+ return connector_status_disconnected;
+
+- r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
+- return connector_status_disconnected;
++ if (!drm_kms_helper_is_poll_worker()) {
++ r = pm_runtime_get_sync(connector->dev->dev);
++ if (r < 0)
++ return connector_status_disconnected;
++ }
+
+ if (!force && radeon_check_hpd_status_unchanged(connector)) {
+ ret = connector->status;
+@@ -1778,8 +1800,10 @@ radeon_dp_detect(struct drm_connector *c
+ }
+
+ out:
+- pm_runtime_mark_last_busy(connector->dev->dev);
+- pm_runtime_put_autosuspend(connector->dev->dev);
++ if (!drm_kms_helper_is_poll_worker()) {
++ pm_runtime_mark_last_busy(connector->dev->dev);
++ pm_runtime_put_autosuspend(connector->dev->dev);
++ }
+
+ return ret;
+ }
--- /dev/null
+From 0b58d90f89545e021d188c289fa142e5ff9e708b Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 1 Mar 2018 11:03:27 -0500
+Subject: drm/radeon: fix KV harvesting
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 0b58d90f89545e021d188c289fa142e5ff9e708b upstream.
+
+Always set the graphics values to the max for the
+asic type. E.g., some 1 RB chips are actually 1 RB chips,
+others are actually harvested 2 RB chips.
+
+Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=99353
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/cik.c | 31 ++-----------------------------
+ 1 file changed, 2 insertions(+), 29 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -3228,35 +3228,8 @@ static void cik_gpu_init(struct radeon_d
+ case CHIP_KAVERI:
+ rdev->config.cik.max_shader_engines = 1;
+ rdev->config.cik.max_tile_pipes = 4;
+- if ((rdev->pdev->device == 0x1304) ||
+- (rdev->pdev->device == 0x1305) ||
+- (rdev->pdev->device == 0x130C) ||
+- (rdev->pdev->device == 0x130F) ||
+- (rdev->pdev->device == 0x1310) ||
+- (rdev->pdev->device == 0x1311) ||
+- (rdev->pdev->device == 0x131C)) {
+- rdev->config.cik.max_cu_per_sh = 8;
+- rdev->config.cik.max_backends_per_se = 2;
+- } else if ((rdev->pdev->device == 0x1309) ||
+- (rdev->pdev->device == 0x130A) ||
+- (rdev->pdev->device == 0x130D) ||
+- (rdev->pdev->device == 0x1313) ||
+- (rdev->pdev->device == 0x131D)) {
+- rdev->config.cik.max_cu_per_sh = 6;
+- rdev->config.cik.max_backends_per_se = 2;
+- } else if ((rdev->pdev->device == 0x1306) ||
+- (rdev->pdev->device == 0x1307) ||
+- (rdev->pdev->device == 0x130B) ||
+- (rdev->pdev->device == 0x130E) ||
+- (rdev->pdev->device == 0x1315) ||
+- (rdev->pdev->device == 0x1318) ||
+- (rdev->pdev->device == 0x131B)) {
+- rdev->config.cik.max_cu_per_sh = 4;
+- rdev->config.cik.max_backends_per_se = 1;
+- } else {
+- rdev->config.cik.max_cu_per_sh = 3;
+- rdev->config.cik.max_backends_per_se = 1;
+- }
++ rdev->config.cik.max_cu_per_sh = 8;
++ rdev->config.cik.max_backends_per_se = 2;
+ rdev->config.cik.max_sh_per_se = 1;
+ rdev->config.cik.max_texture_channel_caches = 4;
+ rdev->config.cik.max_gprs = 256;
--- /dev/null
+From 2c83029cda55a5e7665c7c6326909427d6a01350 Mon Sep 17 00:00:00 2001
+From: Ben Crocker <bcrocker@redhat.com>
+Date: Thu, 22 Feb 2018 17:52:19 -0500
+Subject: drm/radeon: insist on 32-bit DMA for Cedar on PPC64/PPC64LE
+
+From: Ben Crocker <bcrocker@redhat.com>
+
+commit 2c83029cda55a5e7665c7c6326909427d6a01350 upstream.
+
+In radeon_device_init, set the need_dma32 flag for Cedar chips
+(e.g. FirePro 2270). This fixes, or at least works around, a bug
+on PowerPC exposed by last year's commits
+
+8e3f1b1d8255105f31556aacf8aeb6071b00d469 (Russell Currey)
+
+and
+
+253fd51e2f533552ae35a0c661705da6c4842c1b (Alistair Popple)
+
+which enabled the 64-bit DMA iommu bypass.
+
+This caused the device to freeze, in some cases unrecoverably, and is
+the subject of several bug reports internal to Red Hat.
+
+Signed-off-by: Ben Crocker <bcrocker@redhat.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_device.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -1397,6 +1397,10 @@ int radeon_device_init(struct radeon_dev
+ if ((rdev->flags & RADEON_IS_PCI) &&
+ (rdev->family <= CHIP_RS740))
+ rdev->need_dma32 = true;
++#ifdef CONFIG_PPC64
++ if (rdev->family == CHIP_CEDAR)
++ rdev->need_dma32 = true;
++#endif
+
+ dma_bits = rdev->need_dma32 ? 32 : 40;
+ r = pci_set_dma_mask(rdev->pdev, DMA_BIT_MASK(dma_bits));
--- /dev/null
+From 2fb4f4eadd180a50112618dd9c5fef7fc50d4f08 Mon Sep 17 00:00:00 2001
+From: Parav Pandit <parav@mellanox.com>
+Date: Sun, 25 Feb 2018 13:39:56 +0200
+Subject: IB/core: Fix missing RDMA cgroups release in case of failure to register device
+
+From: Parav Pandit <parav@mellanox.com>
+
+commit 2fb4f4eadd180a50112618dd9c5fef7fc50d4f08 upstream.
+
+During IB device registration process, if query_device() fails or if
+ib_core fails to registers sysfs entries, rdma cgroup cleanup is
+skipped.
+
+Cc: <stable@vger.kernel.org> # v4.2+
+Fixes: 4be3a4fa51f4 ("IB/core: Fix kernel crash during fail to initialize device")
+Reviewed-by: Daniel Jurgens <danielj@mellanox.com>
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/device.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/core/device.c
++++ b/drivers/infiniband/core/device.c
+@@ -534,14 +534,14 @@ int ib_register_device(struct ib_device
+ ret = device->query_device(device, &device->attrs, &uhw);
+ if (ret) {
+ pr_warn("Couldn't query the device attributes\n");
+- goto cache_cleanup;
++ goto cg_cleanup;
+ }
+
+ ret = ib_device_register_sysfs(device, port_callback);
+ if (ret) {
+ pr_warn("Couldn't register device %s with driver model\n",
+ device->name);
+- goto cache_cleanup;
++ goto cg_cleanup;
+ }
+
+ device->reg_state = IB_DEV_REGISTERED;
+@@ -557,6 +557,8 @@ int ib_register_device(struct ib_device
+ mutex_unlock(&device_mutex);
+ return 0;
+
++cg_cleanup:
++ ib_device_unregister_rdmacg(device);
+ cache_cleanup:
+ ib_cache_cleanup_one(device);
+ ib_cache_release_one(device);
--- /dev/null
+From da343b6d90e11132f1e917d865d88ee35d6e6d00 Mon Sep 17 00:00:00 2001
+From: Sergey Gorenko <sergeygo@mellanox.com>
+Date: Sun, 25 Feb 2018 13:39:48 +0200
+Subject: IB/mlx5: Fix incorrect size of klms in the memory region
+
+From: Sergey Gorenko <sergeygo@mellanox.com>
+
+commit da343b6d90e11132f1e917d865d88ee35d6e6d00 upstream.
+
+The value of mr->ndescs greater than mr->max_descs is set in the
+function mlx5_ib_sg_to_klms() if sg_nents is greater than
+mr->max_descs. This is an invalid value and it causes the
+following error when registering mr:
+
+mlx5_0:dump_cqe:276:(pid 193): dump error cqe
+00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+00000030: 00 00 00 00 0f 00 78 06 25 00 00 8b 08 1e 8f d3
+
+Cc: <stable@vger.kernel.org> # 4.5
+Fixes: b005d3164713 ("mlx5: Add arbitrary sg list support")
+Signed-off-by: Sergey Gorenko <sergeygo@mellanox.com>
+Tested-by: Laurence Oberman <loberman@redhat.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx5/mr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/mlx5/mr.c
++++ b/drivers/infiniband/hw/mlx5/mr.c
+@@ -1813,7 +1813,6 @@ mlx5_ib_sg_to_klms(struct mlx5_ib_mr *mr
+
+ mr->ibmr.iova = sg_dma_address(sg) + sg_offset;
+ mr->ibmr.length = 0;
+- mr->ndescs = sg_nents;
+
+ for_each_sg(sgl, sg, sg_nents, i) {
+ if (unlikely(i >= mr->max_descs))
+@@ -1825,6 +1824,7 @@ mlx5_ib_sg_to_klms(struct mlx5_ib_mr *mr
+
+ sg_offset = 0;
+ }
++ mr->ndescs = i;
+
+ if (sg_offset_p)
+ *sg_offset_p = sg_offset;
--- /dev/null
+From ea4f7bd2aca9f68470e9aac0fc9432fd180b1fe7 Mon Sep 17 00:00:00 2001
+From: Zhang Bo <zbsdta@126.com>
+Date: Mon, 5 Feb 2018 14:56:21 -0800
+Subject: Input: matrix_keypad - fix race when disabling interrupts
+
+From: Zhang Bo <zbsdta@126.com>
+
+commit ea4f7bd2aca9f68470e9aac0fc9432fd180b1fe7 upstream.
+
+If matrix_keypad_stop() is executing and the keypad interrupt is triggered,
+disable_row_irqs() may be called by both matrix_keypad_interrupt() and
+matrix_keypad_stop() at the same time, causing interrupts to be disabled
+twice and the keypad being "stuck" after resuming.
+
+Take lock when setting keypad->stopped to ensure that ISR will not race
+with matrix_keypad_stop() disabling interrupts.
+
+Signed-off-by: Zhang Bo <zbsdta@126.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/keyboard/matrix_keypad.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/input/keyboard/matrix_keypad.c
++++ b/drivers/input/keyboard/matrix_keypad.c
+@@ -218,8 +218,10 @@ static void matrix_keypad_stop(struct in
+ {
+ struct matrix_keypad *keypad = input_get_drvdata(dev);
+
++ spin_lock_irq(&keypad->lock);
+ keypad->stopped = true;
+- mb();
++ spin_unlock_irq(&keypad->lock);
++
+ flush_work(&keypad->work.work);
+ /*
+ * matrix_keypad_scan() will leave IRQs enabled;
--- /dev/null
+From 55fe6da9efba102866e2fb5b40b04b6a4b26c19e Mon Sep 17 00:00:00 2001
+From: James Hogan <jhogan@kernel.org>
+Date: Thu, 8 Mar 2018 11:02:46 +0000
+Subject: kbuild: Handle builtin dtb file names containing hyphens
+
+From: James Hogan <jhogan@kernel.org>
+
+commit 55fe6da9efba102866e2fb5b40b04b6a4b26c19e upstream.
+
+cmd_dt_S_dtb constructs the assembly source to incorporate a devicetree
+FDT (that is, the .dtb file) as binary data in the kernel image. This
+assembly source contains labels before and after the binary data. The
+label names incorporate the file name of the corresponding .dtb file.
+Hyphens are not legal characters in labels, so .dtb files built into the
+kernel with hyphens in the file name result in errors like the
+following:
+
+bcm3368-netgear-cvg834g.dtb.S: Assembler messages:
+bcm3368-netgear-cvg834g.dtb.S:5: Error: : no such section
+bcm3368-netgear-cvg834g.dtb.S:5: Error: junk at end of line, first unrecognized character is `-'
+bcm3368-netgear-cvg834g.dtb.S:6: Error: unrecognized opcode `__dtb_bcm3368-netgear-cvg834g_begin:'
+bcm3368-netgear-cvg834g.dtb.S:8: Error: unrecognized opcode `__dtb_bcm3368-netgear-cvg834g_end:'
+bcm3368-netgear-cvg834g.dtb.S:9: Error: : no such section
+bcm3368-netgear-cvg834g.dtb.S:9: Error: junk at end of line, first unrecognized character is `-'
+
+Fix this by updating cmd_dt_S_dtb to transform all hyphens from the file
+name to underscores when constructing the labels.
+
+As of v4.16-rc2, 1139 .dts files across ARM64, ARM, MIPS and PowerPC
+contain hyphens in their names, but the issue only currently manifests
+on Broadcom MIPS platforms, as that is the only place where such files
+are built into the kernel. For example when CONFIG_DT_NETGEAR_CVG834G=y,
+or on BMIPS kernels when the dtbs target is used (in the latter case it
+admittedly shouldn't really build all the dtb.o files, but thats a
+separate issue).
+
+Fixes: 695835511f96 ("MIPS: BMIPS: rename bcm96358nb4ser to bcm6358-neufbox4-sercom")
+Signed-off-by: James Hogan <jhogan@kernel.org>
+Reviewed-by: Frank Rowand <frowand.list@gmail.com>
+Cc: Rob Herring <robh+dt@kernel.org>
+Cc: Michal Marek <michal.lkml@markovi.net>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Cc: Kevin Cernekee <cernekee@gmail.com>
+Cc: <stable@vger.kernel.org> # 4.9+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ scripts/Makefile.lib | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/scripts/Makefile.lib
++++ b/scripts/Makefile.lib
+@@ -287,11 +287,11 @@ cmd_dt_S_dtb= \
+ echo '\#include <asm-generic/vmlinux.lds.h>'; \
+ echo '.section .dtb.init.rodata,"a"'; \
+ echo '.balign STRUCT_ALIGNMENT'; \
+- echo '.global __dtb_$(*F)_begin'; \
+- echo '__dtb_$(*F)_begin:'; \
++ echo '.global __dtb_$(subst -,_,$(*F))_begin'; \
++ echo '__dtb_$(subst -,_,$(*F))_begin:'; \
+ echo '.incbin "$<" '; \
+- echo '__dtb_$(*F)_end:'; \
+- echo '.global __dtb_$(*F)_end'; \
++ echo '__dtb_$(subst -,_,$(*F))_end:'; \
++ echo '.global __dtb_$(subst -,_,$(*F))_end'; \
+ echo '.balign STRUCT_ALIGNMENT'; \
+ ) > $@
+
--- /dev/null
+From f07afa0462b76a5b9c4f3a43d5ac24fdb86a90c2 Mon Sep 17 00:00:00 2001
+From: David Hildenbrand <david@redhat.com>
+Date: Tue, 6 Mar 2018 14:27:58 +0100
+Subject: KVM: s390: fix memory overwrites when not using SCA entries
+
+From: David Hildenbrand <david@redhat.com>
+
+commit f07afa0462b76a5b9c4f3a43d5ac24fdb86a90c2 upstream.
+
+Even if we don't have extended SCA support, we can have more than 64 CPUs
+if we don't enable any HW features that might use the SCA entries.
+
+Now, this works just fine, but we missed a return, which is why we
+would actually store the SCA entries. If we have more than 64 CPUs, this
+means writing outside of the basic SCA - bad.
+
+Let's fix this. This allows > 64 CPUs when running nested (under vSIE)
+without random crashes.
+
+Fixes: a6940674c384 ("KVM: s390: allow 255 VCPUs when sca entries aren't used")
+Reported-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: David Hildenbrand <david@redhat.com>
+Message-Id: <20180306132758.21034-1-david@redhat.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/kvm/kvm-s390.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -2118,6 +2118,7 @@ static void sca_add_vcpu(struct kvm_vcpu
+ /* we still need the basic sca for the ipte control */
+ vcpu->arch.sie_block->scaoh = (__u32)(((__u64)sca) >> 32);
+ vcpu->arch.sie_block->scaol = (__u32)(__u64)sca;
++ return;
+ }
+ read_lock(&vcpu->kvm->arch.sca_lock);
+ if (vcpu->kvm->arch.use_esca) {
--- /dev/null
+From 1b4cfe3c0a30dde968fb43c577a8d7e262a145ee Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Fri, 9 Mar 2018 15:51:02 -0800
+Subject: lib/bug.c: exclude non-BUG/WARN exceptions from report_bug()
+
+From: Kees Cook <keescook@chromium.org>
+
+commit 1b4cfe3c0a30dde968fb43c577a8d7e262a145ee upstream.
+
+Commit b8347c219649 ("x86/debug: Handle warnings before the notifier
+chain, to fix KGDB crash") changed the ordering of fixups, and did not
+take into account the case of x86 processing non-WARN() and non-BUG()
+exceptions. This would lead to output of a false BUG line with no other
+information.
+
+In the case of a refcount exception, it would be immediately followed by
+the refcount WARN(), producing very strange double-"cut here":
+
+ lkdtm: attempting bad refcount_inc() overflow
+ ------------[ cut here ]------------
+ Kernel BUG at 0000000065f29de5 [verbose debug info unavailable]
+ ------------[ cut here ]------------
+ refcount_t overflow at lkdtm_REFCOUNT_INC_OVERFLOW+0x6b/0x90 in cat[3065], uid/euid: 0/0
+ WARNING: CPU: 0 PID: 3065 at kernel/panic.c:657 refcount_error_report+0x9a/0xa4
+ ...
+
+In the prior ordering, exceptions were searched first:
+
+ do_trap_no_signal(struct task_struct *tsk, int trapnr, char *str,
+ ...
+ if (fixup_exception(regs, trapnr))
+ return 0;
+
+ - if (fixup_bug(regs, trapnr))
+ - return 0;
+ -
+
+As a result, fixup_bugs()'s is_valid_bugaddr() didn't take into account
+needing to search the exception list first, since that had already
+happened.
+
+So, instead of searching the exception list twice (once in
+is_valid_bugaddr() and then again in fixup_exception()), just add a
+simple sanity check to report_bug() that will immediately bail out if a
+BUG() (or WARN()) entry is not found.
+
+Link: http://lkml.kernel.org/r/20180301225934.GA34350@beast
+Fixes: b8347c219649 ("x86/debug: Handle warnings before the notifier chain, to fix KGDB crash")
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Richard Weinberger <richard.weinberger@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ lib/bug.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/lib/bug.c
++++ b/lib/bug.c
+@@ -150,6 +150,8 @@ enum bug_trap_type report_bug(unsigned l
+ return BUG_TRAP_TYPE_NONE;
+
+ bug = find_bug(bugaddr);
++ if (!bug)
++ return BUG_TRAP_TYPE_NONE;
+
+ file = NULL;
+ line = 0;
--- /dev/null
+From 1d037577c323e5090ce281e96bc313ab2eee5be2 Mon Sep 17 00:00:00 2001
+From: Ross Zwisler <ross.zwisler@linux.intel.com>
+Date: Fri, 9 Mar 2018 08:36:36 -0700
+Subject: loop: Fix lost writes caused by missing flag
+
+From: Ross Zwisler <ross.zwisler@linux.intel.com>
+
+commit 1d037577c323e5090ce281e96bc313ab2eee5be2 upstream.
+
+The following commit:
+
+commit aa4d86163e4e ("block: loop: switch to VFS ITER_BVEC")
+
+replaced __do_lo_send_write(), which used ITER_KVEC iterators, with
+lo_write_bvec() which uses ITER_BVEC iterators. In this change, though,
+the WRITE flag was lost:
+
+- iov_iter_kvec(&from, ITER_KVEC | WRITE, &kvec, 1, len);
++ iov_iter_bvec(&i, ITER_BVEC, bvec, 1, bvec->bv_len);
+
+This flag is necessary for the DAX case because we make decisions based on
+whether or not the iterator is a READ or a WRITE in dax_iomap_actor() and
+in dax_iomap_rw().
+
+We end up going through this path in configurations where we combine a PMEM
+device with 4k sectors, a loopback device and DAX. The consequence of this
+missed flag is that what we intend as a write actually turns into a read in
+the DAX code, so no data is ever written.
+
+The very simplest test case is to create a loopback device and try and
+write a small string to it, then hexdump a few bytes of the device to see
+if the write took. Without this patch you read back all zeros, with this
+you read back the string you wrote.
+
+For XFS this causes us to fail or panic during the following xfstests:
+
+ xfs/074 xfs/078 xfs/216 xfs/217 xfs/250
+
+For ext4 we have a similar issue where writes never happen, but we don't
+currently have any xfstests that use loopback and show this issue.
+
+Fix this by restoring the WRITE flag argument to iov_iter_bvec(). This
+causes the xfstests to all pass.
+
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: stable@vger.kernel.org
+Fixes: commit aa4d86163e4e ("block: loop: switch to VFS ITER_BVEC")
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Ross Zwisler <ross.zwisler@linux.intel.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/loop.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -266,7 +266,7 @@ static int lo_write_bvec(struct file *fi
+ struct iov_iter i;
+ ssize_t bw;
+
+- iov_iter_bvec(&i, ITER_BVEC, bvec, 1, bvec->bv_len);
++ iov_iter_bvec(&i, ITER_BVEC | WRITE, bvec, 1, bvec->bv_len);
+
+ file_start_write(file);
+ bw = vfs_iter_write(file, &i, ppos, 0);
--- /dev/null
+From 1b22b4b28fd5fbc51855219e3238b3ab81da8466 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Thu, 22 Feb 2018 17:50:12 +0000
+Subject: MIPS: ath25: Check for kzalloc allocation failure
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit 1b22b4b28fd5fbc51855219e3238b3ab81da8466 upstream.
+
+Currently there is no null check on a failed allocation of board_data,
+and hence a null pointer dereference will occurr. Fix this by checking
+for the out of memory null pointer.
+
+Fixes: a7473717483e ("MIPS: ath25: add board configuration detection")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: linux-mips@linux-mips.org
+Cc: <stable@vger.kernel.org> # 3.19+
+Patchwork: https://patchwork.linux-mips.org/patch/18657/
+Signed-off-by: James Hogan <jhogan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/ath25/board.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/mips/ath25/board.c
++++ b/arch/mips/ath25/board.c
+@@ -135,6 +135,8 @@ int __init ath25_find_config(phys_addr_t
+ }
+
+ board_data = kzalloc(BOARD_CONFIG_BUFSZ, GFP_KERNEL);
++ if (!board_data)
++ goto error;
+ ath25_board.config = (struct ath25_boarddata *)board_data;
+ memcpy_fromio(board_data, bcfg, 0x100);
+ if (broken_boarddata) {
--- /dev/null
+From 06a3f0c9f2725f5d7c63c4203839373c9bd00c28 Mon Sep 17 00:00:00 2001
+From: Justin Chen <justinpopo6@gmail.com>
+Date: Wed, 27 Sep 2017 17:15:15 -0700
+Subject: MIPS: BMIPS: Do not mask IPIs during suspend
+
+From: Justin Chen <justinpopo6@gmail.com>
+
+commit 06a3f0c9f2725f5d7c63c4203839373c9bd00c28 upstream.
+
+Commit a3e6c1eff548 ("MIPS: IRQ: Fix disable_irq on CPU IRQs") fixes an
+issue where disable_irq did not actually disable the irq. The bug caused
+our IPIs to not be disabled, which actually is the correct behavior.
+
+With the addition of commit a3e6c1eff548 ("MIPS: IRQ: Fix disable_irq on
+CPU IRQs"), the IPIs were getting disabled going into suspend, thus
+schedule_ipi() was not being called. This caused deadlocks where
+schedulable task were not being scheduled and other cpus were waiting
+for them to do something.
+
+Add the IRQF_NO_SUSPEND flag so an irq_disable will not be called on the
+IPIs during suspend.
+
+Signed-off-by: Justin Chen <justinpopo6@gmail.com>
+Fixes: a3e6c1eff548 ("MIPS: IRQ: Fix disabled_irq on CPU IRQs")
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: stable@vger.kernel.org
+Patchwork: https://patchwork.linux-mips.org/patch/17385/
+[jhogan@kernel.org: checkpatch: wrap long lines and fix commit refs]
+Signed-off-by: James Hogan <jhogan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kernel/smp-bmips.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/mips/kernel/smp-bmips.c
++++ b/arch/mips/kernel/smp-bmips.c
+@@ -168,11 +168,11 @@ static void bmips_prepare_cpus(unsigned
+ return;
+ }
+
+- if (request_irq(IPI0_IRQ, bmips_ipi_interrupt, IRQF_PERCPU,
+- "smp_ipi0", NULL))
++ if (request_irq(IPI0_IRQ, bmips_ipi_interrupt,
++ IRQF_PERCPU | IRQF_NO_SUSPEND, "smp_ipi0", NULL))
+ panic("Can't request IPI0 interrupt");
+- if (request_irq(IPI1_IRQ, bmips_ipi_interrupt, IRQF_PERCPU,
+- "smp_ipi1", NULL))
++ if (request_irq(IPI1_IRQ, bmips_ipi_interrupt,
++ IRQF_PERCPU | IRQF_NO_SUSPEND, "smp_ipi1", NULL))
+ panic("Can't request IPI1 interrupt");
+ }
+
--- /dev/null
+From 902f4d067a50ccf645a58dd5fb1d113b6e0f9b5b Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Thu, 22 Feb 2018 18:08:53 +0000
+Subject: MIPS: OCTEON: irq: Check for null return on kzalloc allocation
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit 902f4d067a50ccf645a58dd5fb1d113b6e0f9b5b upstream.
+
+The allocation of host_data is not null checked, leading to a null
+pointer dereference if the allocation fails. Fix this by adding a null
+check and return with -ENOMEM.
+
+Fixes: 64b139f97c01 ("MIPS: OCTEON: irq: add CIB and other fixes")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: David Daney <david.daney@cavium.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: "Steven J. Hill" <Steven.Hill@cavium.com>
+Cc: linux-mips@linux-mips.org
+Cc: <stable@vger.kernel.org> # 4.0+
+Patchwork: https://patchwork.linux-mips.org/patch/18658/
+Signed-off-by: James Hogan <jhogan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/cavium-octeon/octeon-irq.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/mips/cavium-octeon/octeon-irq.c
++++ b/arch/mips/cavium-octeon/octeon-irq.c
+@@ -2277,6 +2277,8 @@ static int __init octeon_irq_init_cib(st
+ }
+
+ host_data = kzalloc(sizeof(*host_data), GFP_KERNEL);
++ if (!host_data)
++ return -ENOMEM;
+ raw_spin_lock_init(&host_data->lock);
+
+ addr = of_get_address(ciu_node, 0, NULL, NULL);
--- /dev/null
+From 379b03b7fa05f7db521b7732a52692448a3c34fe Mon Sep 17 00:00:00 2001
+From: Daniel Vacek <neelx@redhat.com>
+Date: Fri, 9 Mar 2018 15:51:09 -0800
+Subject: mm/memblock.c: hardcode the end_pfn being -1
+
+From: Daniel Vacek <neelx@redhat.com>
+
+commit 379b03b7fa05f7db521b7732a52692448a3c34fe upstream.
+
+This is just a cleanup. It aids handling the special end case in the
+next commit.
+
+[akpm@linux-foundation.org: make it work against current -linus, not against -mm]
+[akpm@linux-foundation.org: make it work against current -linus, not against -mm some more]
+Link: http://lkml.kernel.org/r/1ca478d4269125a99bcfb1ca04d7b88ac1aee924.1520011944.git.neelx@redhat.com
+Signed-off-by: Daniel Vacek <neelx@redhat.com>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Mel Gorman <mgorman@techsingularity.net>
+Cc: Pavel Tatashin <pasha.tatashin@oracle.com>
+Cc: Paul Burton <paul.burton@imgtec.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/memblock.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/mm/memblock.c
++++ b/mm/memblock.c
+@@ -1107,7 +1107,7 @@ unsigned long __init_memblock memblock_n
+ struct memblock_type *type = &memblock.memory;
+ unsigned int right = type->cnt;
+ unsigned int mid, left = 0;
+- phys_addr_t addr = PFN_PHYS(pfn + 1);
++ phys_addr_t addr = PFN_PHYS(++pfn);
+
+ do {
+ mid = (right + left) / 2;
+@@ -1118,15 +1118,15 @@ unsigned long __init_memblock memblock_n
+ type->regions[mid].size))
+ left = mid + 1;
+ else {
+- /* addr is within the region, so pfn + 1 is valid */
+- return min(pfn + 1, max_pfn);
++ /* addr is within the region, so pfn is valid */
++ return pfn;
+ }
+ } while (left < right);
+
+ if (right == type->cnt)
+- return max_pfn;
++ return -1UL;
+ else
+- return min(PHYS_PFN(type->regions[right].base), max_pfn);
++ return PHYS_PFN(type->regions[right].base);
+ }
+
+ /**
--- /dev/null
+From 864b75f9d6b0100bb24fdd9a20d156e7cda9b5ae Mon Sep 17 00:00:00 2001
+From: Daniel Vacek <neelx@redhat.com>
+Date: Fri, 9 Mar 2018 15:51:13 -0800
+Subject: mm/page_alloc: fix memmap_init_zone pageblock alignment
+
+From: Daniel Vacek <neelx@redhat.com>
+
+commit 864b75f9d6b0100bb24fdd9a20d156e7cda9b5ae upstream.
+
+Commit b92df1de5d28 ("mm: page_alloc: skip over regions of invalid pfns
+where possible") introduced a bug where move_freepages() triggers a
+VM_BUG_ON() on uninitialized page structure due to pageblock alignment.
+To fix this, simply align the skipped pfns in memmap_init_zone() the
+same way as in move_freepages_block().
+
+Seen in one of the RHEL reports:
+
+ crash> log | grep -e BUG -e RIP -e Call.Trace -e move_freepages_block -e rmqueue -e freelist -A1
+ kernel BUG at mm/page_alloc.c:1389!
+ invalid opcode: 0000 [#1] SMP
+ --
+ RIP: 0010:[<ffffffff8118833e>] [<ffffffff8118833e>] move_freepages+0x15e/0x160
+ RSP: 0018:ffff88054d727688 EFLAGS: 00010087
+ --
+ Call Trace:
+ [<ffffffff811883b3>] move_freepages_block+0x73/0x80
+ [<ffffffff81189e63>] __rmqueue+0x263/0x460
+ [<ffffffff8118c781>] get_page_from_freelist+0x7e1/0x9e0
+ [<ffffffff8118caf6>] __alloc_pages_nodemask+0x176/0x420
+ --
+ RIP [<ffffffff8118833e>] move_freepages+0x15e/0x160
+ RSP <ffff88054d727688>
+
+ crash> page_init_bug -v | grep RAM
+ <struct resource 0xffff88067fffd2f8> 1000 - 9bfff System RAM (620.00 KiB)
+ <struct resource 0xffff88067fffd3a0> 100000 - 430bffff System RAM ( 1.05 GiB = 1071.75 MiB = 1097472.00 KiB)
+ <struct resource 0xffff88067fffd410> 4b0c8000 - 4bf9cfff System RAM ( 14.83 MiB = 15188.00 KiB)
+ <struct resource 0xffff88067fffd480> 4bfac000 - 646b1fff System RAM (391.02 MiB = 400408.00 KiB)
+ <struct resource 0xffff88067fffd560> 7b788000 - 7b7fffff System RAM (480.00 KiB)
+ <struct resource 0xffff88067fffd640> 100000000 - 67fffffff System RAM ( 22.00 GiB)
+
+ crash> page_init_bug | head -6
+ <struct resource 0xffff88067fffd560> 7b788000 - 7b7fffff System RAM (480.00 KiB)
+ <struct page 0xffffea0001ede200> 1fffff00000000 0 <struct pglist_data 0xffff88047ffd9000> 1 <struct zone 0xffff88047ffd9800> DMA32 4096 1048575
+ <struct page 0xffffea0001ede200> 505736 505344 <struct page 0xffffea0001ed8000> 505855 <struct page 0xffffea0001edffc0>
+ <struct page 0xffffea0001ed8000> 0 0 <struct pglist_data 0xffff88047ffd9000> 0 <struct zone 0xffff88047ffd9000> DMA 1 4095
+ <struct page 0xffffea0001edffc0> 1fffff00000400 0 <struct pglist_data 0xffff88047ffd9000> 1 <struct zone 0xffff88047ffd9800> DMA32 4096 1048575
+ BUG, zones differ!
+
+Note that this range follows two not populated sections
+68000000-77ffffff in this zone. 7b788000-7b7fffff is the first one
+after a gap. This makes memmap_init_zone() skip all the pfns up to the
+beginning of this range. But this range is not pageblock (2M) aligned.
+In fact no range has to be.
+
+ crash> kmem -p 77fff000 78000000 7b5ff000 7b600000 7b787000 7b788000
+ PAGE PHYSICAL MAPPING INDEX CNT FLAGS
+ ffffea0001e00000 78000000 0 0 0 0
+ ffffea0001ed7fc0 7b5ff000 0 0 0 0
+ ffffea0001ed8000 7b600000 0 0 0 0 <<<<
+ ffffea0001ede1c0 7b787000 0 0 0 0
+ ffffea0001ede200 7b788000 0 0 1 1fffff00000000
+
+Top part of page flags should contain nodeid and zonenr, which is not
+the case for page ffffea0001ed8000 here (<<<<).
+
+ crash> log | grep -o fffea0001ed[^\ ]* | sort -u
+ fffea0001ed8000
+ fffea0001eded20
+ fffea0001edffc0
+
+ crash> bt -r | grep -o fffea0001ed[^\ ]* | sort -u
+ fffea0001ed8000
+ fffea0001eded00
+ fffea0001eded20
+ fffea0001edffc0
+
+Initialization of the whole beginning of the section is skipped up to
+the start of the range due to the commit b92df1de5d28. Now any code
+calling move_freepages_block() (like reusing the page from a freelist as
+in this example) with a page from the beginning of the range will get
+the page rounded down to start_page ffffea0001ed8000 and passed to
+move_freepages() which crashes on assertion getting wrong zonenr.
+
+ > VM_BUG_ON(page_zone(start_page) != page_zone(end_page));
+
+Note, page_zone() derives the zone from page flags here.
+
+From similar machine before commit b92df1de5d28:
+
+ crash> kmem -p 77fff000 78000000 7b5ff000 7b600000 7b7fe000 7b7ff000
+ PAGE PHYSICAL MAPPING INDEX CNT FLAGS
+ fffff73941e00000 78000000 0 0 1 1fffff00000000
+ fffff73941ed7fc0 7b5ff000 0 0 1 1fffff00000000
+ fffff73941ed8000 7b600000 0 0 1 1fffff00000000
+ fffff73941edff80 7b7fe000 0 0 1 1fffff00000000
+ fffff73941edffc0 7b7ff000 ffff8e67e04d3ae0 ad84 1 1fffff00020068 uptodate,lru,active,mappedtodisk
+
+All the pages since the beginning of the section are initialized.
+move_freepages()' not gonna blow up.
+
+The same machine with this fix applied:
+
+ crash> kmem -p 77fff000 78000000 7b5ff000 7b600000 7b7fe000 7b7ff000
+ PAGE PHYSICAL MAPPING INDEX CNT FLAGS
+ ffffea0001e00000 78000000 0 0 0 0
+ ffffea0001e00000 7b5ff000 0 0 0 0
+ ffffea0001ed8000 7b600000 0 0 1 1fffff00000000
+ ffffea0001edff80 7b7fe000 0 0 1 1fffff00000000
+ ffffea0001edffc0 7b7ff000 ffff88017fb13720 8 2 1fffff00020068 uptodate,lru,active,mappedtodisk
+
+At least the bare minimum of pages is initialized preventing the crash
+as well.
+
+Customers started to report this as soon as 7.4 (where b92df1de5d28 was
+merged in RHEL) was released. I remember reports from
+September/October-ish times. It's not easily reproduced and happens on
+a handful of machines only. I guess that's why. But that does not make
+it less serious, I think.
+
+Though there actually is a report here:
+ https://bugzilla.kernel.org/show_bug.cgi?id=196443
+
+And there are reports for Fedora from July:
+ https://bugzilla.redhat.com/show_bug.cgi?id=1473242
+and CentOS:
+ https://bugs.centos.org/view.php?id=13964
+and we internally track several dozens reports for RHEL bug
+ https://bugzilla.redhat.com/show_bug.cgi?id=1525121
+
+Link: http://lkml.kernel.org/r/0485727b2e82da7efbce5f6ba42524b429d0391a.1520011945.git.neelx@redhat.com
+Fixes: b92df1de5d28 ("mm: page_alloc: skip over regions of invalid pfns where possible")
+Signed-off-by: Daniel Vacek <neelx@redhat.com>
+Cc: Mel Gorman <mgorman@techsingularity.net>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: Paul Burton <paul.burton@imgtec.com>
+Cc: Pavel Tatashin <pasha.tatashin@oracle.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/page_alloc.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -5353,9 +5353,14 @@ void __meminit memmap_init_zone(unsigned
+ /*
+ * Skip to the pfn preceding the next valid one (or
+ * end_pfn), such that we hit a valid pfn (or end_pfn)
+- * on our next iteration of the loop.
++ * on our next iteration of the loop. Note that it needs
++ * to be pageblock aligned even when the region itself
++ * is not. move_freepages_block() can shift ahead of
++ * the valid region but still depends on correct page
++ * metadata.
+ */
+- pfn = memblock_next_valid_pfn(pfn, end_pfn) - 1;
++ pfn = (memblock_next_valid_pfn(pfn, end_pfn) &
++ ~(pageblock_nr_pages-1)) - 1;
+ #endif
+ continue;
+ }
--- /dev/null
+From d1fe96c0e4de78ba0cd336ea3df3b850d06b9b9a Mon Sep 17 00:00:00 2001
+From: Vivek Goyal <vgoyal@redhat.com>
+Date: Fri, 2 Feb 2018 10:23:24 -0500
+Subject: ovl: redirect_dir=nofollow should not follow redirect for opaque lower
+
+From: Vivek Goyal <vgoyal@redhat.com>
+
+commit d1fe96c0e4de78ba0cd336ea3df3b850d06b9b9a upstream.
+
+redirect_dir=nofollow should not follow a redirect. But in a specific
+configuration it can still follow it. For example try this.
+
+$ mkdir -p lower0 lower1/foo upper work merged
+$ touch lower1/foo/lower-file.txt
+$ setfattr -n "trusted.overlay.opaque" -v "y" lower1/foo
+$ mount -t overlay -o lowerdir=lower1:lower0,workdir=work,upperdir=upper,redirect_dir=on none merged
+$ cd merged
+$ mv foo foo-renamed
+$ umount merged
+
+# mount again. This time with redirect_dir=nofollow
+$ mount -t overlay -o lowerdir=lower1:lower0,workdir=work,upperdir=upper,redirect_dir=nofollow none merged
+$ ls merged/foo-renamed/
+# This lists lower-file.txt, while it should not have.
+
+Basically, we are doing redirect check after we check for d.stop. And
+if this is not last lower, and we find an opaque lower, d.stop will be
+set.
+
+ovl_lookup_single()
+ if (!d->last && ovl_is_opaquedir(this)) {
+ d->stop = d->opaque = true;
+ goto out;
+ }
+
+To fix this, first check redirect is allowed. And after that check if
+d.stop has been set or not.
+
+Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
+Fixes: 438c84c2f0c7 ("ovl: don't follow redirects if redirect_dir=off")
+Cc: <stable@vger.kernel.org> #v4.15
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/overlayfs/namei.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/fs/overlayfs/namei.c
++++ b/fs/overlayfs/namei.c
+@@ -678,9 +678,6 @@ struct dentry *ovl_lookup(struct inode *
+ stack[ctr].layer = lower.layer;
+ ctr++;
+
+- if (d.stop)
+- break;
+-
+ /*
+ * Following redirects can have security consequences: it's like
+ * a symlink into the lower layer without the permission checks.
+@@ -697,6 +694,9 @@ struct dentry *ovl_lookup(struct inode *
+ goto out_put;
+ }
+
++ if (d.stop)
++ break;
++
+ if (d.redirect && d.redirect[0] == '/' && poe != roe) {
+ poe = roe;
+
--- /dev/null
+From fc110ebdd014dd1368c98e7685b47789c31fab42 Mon Sep 17 00:00:00 2001
+From: Koen Vandeputte <koen.vandeputte@ncentric.com>
+Date: Wed, 7 Mar 2018 10:46:39 -0600
+Subject: PCI: dwc: Fix enumeration end when reaching root subordinate
+
+From: Koen Vandeputte <koen.vandeputte@ncentric.com>
+
+commit fc110ebdd014dd1368c98e7685b47789c31fab42 upstream.
+
+The subordinate value indicates the highest bus number which can be
+reached downstream though a certain device.
+
+Commit a20c7f36bd3d ("PCI: Do not allocate more buses than available in
+parent") ensures that downstream devices cannot assign busnumbers higher
+than the upstream device subordinate number, which was indeed illogical.
+
+By default, dw_pcie_setup_rc() inits the Root Complex subordinate to a
+value of 0x01.
+
+Due to this combined with above commit, enumeration stops digging deeper
+downstream as soon as bus num 0x01 has been assigned, which is always the
+case for a bridge device.
+
+This results in all devices behind a bridge bus remaining undetected, as
+these would be connected to bus 0x02 or higher.
+
+Fix this by initializing the RC to a subordinate value of 0xff, which is
+not altering hardware behaviour in any way, but informs probing function
+pci_scan_bridge() later on which reads this value back from register.
+
+The following nasty errors during boot are also fixed by this:
+
+ pci_bus 0000:02: busn_res: can not insert [bus 02-ff] under [bus 01] (conflicts with (null) [bus 01])
+ ...
+ pci_bus 0000:03: [bus 03] partially hidden behind bridge 0000:01 [bus 01]
+ ...
+ pci_bus 0000:04: [bus 04] partially hidden behind bridge 0000:01 [bus 01]
+ ...
+ pci_bus 0000:05: [bus 05] partially hidden behind bridge 0000:01 [bus 01]
+ pci_bus 0000:02: busn_res: [bus 02-ff] end is updated to 05
+ pci_bus 0000:02: busn_res: can not insert [bus 02-05] under [bus 01] (conflicts with (null) [bus 01])
+ pci_bus 0000:02: [bus 02-05] partially hidden behind bridge 0000:01 [bus 01]
+
+Fixes: a20c7f36bd3d ("PCI: Do not allocate more buses than available in
+parent")
+Tested-by: Niklas Cassel <niklas.cassel@axis.com>
+Tested-by: Fabio Estevam <fabio.estevam@nxp.com>
+Tested-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
+Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Acked-by: Lucas Stach <l.stach@pengutronix.de>
+Cc: stable@vger.kernel.org # v4.15+
+Cc: Binghui Wang <wangbinghui@hisilicon.com>
+Cc: Jesper Nilsson <jesper.nilsson@axis.com>
+Cc: Jianguo Sun <sunjianguo1@huawei.com>
+Cc: Jingoo Han <jingoohan1@gmail.com>
+Cc: Kishon Vijay Abraham I <kishon@ti.com>
+Cc: Lucas Stach <l.stach@pengutronix.de>
+Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
+Cc: Minghuan Lian <minghuan.Lian@freescale.com>
+Cc: Mingkai Hu <mingkai.hu@freescale.com>
+Cc: Murali Karicheri <m-karicheri2@ti.com>
+Cc: Pratyush Anand <pratyush.anand@gmail.com>
+Cc: Richard Zhu <hongxing.zhu@nxp.com>
+Cc: Roy Zang <tie-fei.zang@freescale.com>
+Cc: Shawn Guo <shawn.guo@linaro.org>
+Cc: Stanimir Varbanov <svarbanov@mm-sol.com>
+Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Cc: Xiaowei Song <songxiaowei@hisilicon.com>
+Cc: Zhou Wang <wangzhou1@hisilicon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/dwc/pcie-designware-host.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/dwc/pcie-designware-host.c
++++ b/drivers/pci/dwc/pcie-designware-host.c
+@@ -607,7 +607,7 @@ void dw_pcie_setup_rc(struct pcie_port *
+ /* setup bus numbers */
+ val = dw_pcie_readl_dbi(pci, PCI_PRIMARY_BUS);
+ val &= 0xff000000;
+- val |= 0x00010100;
++ val |= 0x00ff0100;
+ dw_pcie_writel_dbi(pci, PCI_PRIMARY_BUS, val);
+
+ /* setup command register */
--- /dev/null
+From de19e5c3c51fdb1ff20d0f61d099db902ff7494b Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Wed, 28 Feb 2018 10:39:04 +0200
+Subject: perf tools: Fix trigger class trigger_on()
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit de19e5c3c51fdb1ff20d0f61d099db902ff7494b upstream.
+
+trigger_on() means that the trigger is available but not ready, however
+trigger_on() was making it ready. That can segfault if the signal comes
+before trigger_ready(). e.g. (USR2 signal delivery not shown)
+
+ $ perf record -e intel_pt//u -S sleep 1
+ perf: Segmentation fault
+ Obtained 16 stack frames.
+ /home/ahunter/bin/perf(sighandler_dump_stack+0x40) [0x4ec550]
+ /lib/x86_64-linux-gnu/libc.so.6(+0x36caf) [0x7fa76411acaf]
+ /home/ahunter/bin/perf(perf_evsel__disable+0x26) [0x4b9dd6]
+ /home/ahunter/bin/perf() [0x43a45b]
+ /lib/x86_64-linux-gnu/libc.so.6(+0x36caf) [0x7fa76411acaf]
+ /lib/x86_64-linux-gnu/libc.so.6(__xstat64+0x15) [0x7fa7641d2cc5]
+ /home/ahunter/bin/perf() [0x4ec6c9]
+ /home/ahunter/bin/perf() [0x4ec73b]
+ /home/ahunter/bin/perf() [0x4ec73b]
+ /home/ahunter/bin/perf() [0x4ec73b]
+ /home/ahunter/bin/perf() [0x4eca15]
+ /home/ahunter/bin/perf(machine__create_kernel_maps+0x257) [0x4f0b77]
+ /home/ahunter/bin/perf(perf_session__new+0xc0) [0x4f86f0]
+ /home/ahunter/bin/perf(cmd_record+0x722) [0x43c132]
+ /home/ahunter/bin/perf() [0x4a11ae]
+ /home/ahunter/bin/perf(main+0x5d4) [0x427fb4]
+
+Note, for testing purposes, this is hard to hit unless you add some sleep()
+in builtin-record.c before record__open().
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Wang Nan <wangnan0@huawei.com>
+Cc: stable@vger.kernel.org
+Fixes: 3dcc4436fa6f ("perf tools: Introduce trigger class")
+Link: http://lkml.kernel.org/r/1519807144-30694-1-git-send-email-adrian.hunter@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/perf/util/trigger.h | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/tools/perf/util/trigger.h
++++ b/tools/perf/util/trigger.h
+@@ -12,7 +12,7 @@
+ * States and transits:
+ *
+ *
+- * OFF--(on)--> READY --(hit)--> HIT
++ * OFF--> ON --> READY --(hit)--> HIT
+ * ^ |
+ * | (ready)
+ * | |
+@@ -27,8 +27,9 @@ struct trigger {
+ volatile enum {
+ TRIGGER_ERROR = -2,
+ TRIGGER_OFF = -1,
+- TRIGGER_READY = 0,
+- TRIGGER_HIT = 1,
++ TRIGGER_ON = 0,
++ TRIGGER_READY = 1,
++ TRIGGER_HIT = 2,
+ } state;
+ const char *name;
+ };
+@@ -50,7 +51,7 @@ static inline bool trigger_is_error(stru
+ static inline void trigger_on(struct trigger *t)
+ {
+ TRIGGER_WARN_ONCE(t, TRIGGER_OFF);
+- t->state = TRIGGER_READY;
++ t->state = TRIGGER_ON;
+ }
+
+ static inline void trigger_ready(struct trigger *t)
--- /dev/null
+From f63248fac563125fd5a2f0bc780ce7a299872cab Mon Sep 17 00:00:00 2001
+From: Fabrice Gasnier <fabrice.gasnier@st.com>
+Date: Thu, 8 Feb 2018 14:43:05 +0100
+Subject: regulator: stm32-vrefbuf: fix check on ready flag
+
+From: Fabrice Gasnier <fabrice.gasnier@st.com>
+
+commit f63248fac563125fd5a2f0bc780ce7a299872cab upstream.
+
+stm32_vrefbuf_enable() wrongly checks VRR bit: 0 stands for not ready,
+1 for ready. It currently checks the opposite.
+This makes enable routine to exit immediately without waiting for ready
+flag.
+
+Fixes: 0cdbf481e927 ("regulator: Add support for stm32-vrefbuf")
+Signed-off-by: Fabrice Gasnier <fabrice.gasnier@st.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/stm32-vrefbuf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/regulator/stm32-vrefbuf.c
++++ b/drivers/regulator/stm32-vrefbuf.c
+@@ -51,7 +51,7 @@ static int stm32_vrefbuf_enable(struct r
+ * arbitrary timeout.
+ */
+ ret = readl_poll_timeout(priv->base + STM32_VREFBUF_CSR, val,
+- !(val & STM32_VRR), 650, 10000);
++ val & STM32_VRR, 650, 10000);
+ if (ret) {
+ dev_err(&rdev->dev, "stm32 vrefbuf timed out!\n");
+ val = readl_relaxed(priv->base + STM32_VREFBUF_CSR);
--- /dev/null
+From 53bf277b487eb5ae6695db01bede0fe406792119 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 15 Feb 2018 08:40:30 -0500
+Subject: Revert "drm/radeon/pm: autoswitch power state when in balanced mode"
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 53bf277b487eb5ae6695db01bede0fe406792119 upstream.
+
+This reverts commit 1c331f75aa6ccbf64ebcc5a019183e617c9d818a.
+
+Breaks resume on some systems.
+
+Bug: https://bugs.freedesktop.org/show_bug.cgi?id=100759
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_pm.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_pm.c
++++ b/drivers/gpu/drm/radeon/radeon_pm.c
+@@ -47,7 +47,6 @@ static bool radeon_pm_in_vbl(struct rade
+ static bool radeon_pm_debug_check_in_vbl(struct radeon_device *rdev, bool finish);
+ static void radeon_pm_update_profile(struct radeon_device *rdev);
+ static void radeon_pm_set_clocks(struct radeon_device *rdev);
+-static void radeon_pm_compute_clocks_dpm(struct radeon_device *rdev);
+
+ int radeon_pm_get_type_index(struct radeon_device *rdev,
+ enum radeon_pm_state_type ps_type,
+@@ -80,8 +79,6 @@ void radeon_pm_acpi_event_handler(struct
+ radeon_dpm_enable_bapm(rdev, rdev->pm.dpm.ac_power);
+ }
+ mutex_unlock(&rdev->pm.mutex);
+- /* allow new DPM state to be picked */
+- radeon_pm_compute_clocks_dpm(rdev);
+ } else if (rdev->pm.pm_method == PM_METHOD_PROFILE) {
+ if (rdev->pm.profile == PM_PROFILE_AUTO) {
+ mutex_lock(&rdev->pm.mutex);
+@@ -885,8 +882,7 @@ static struct radeon_ps *radeon_dpm_pick
+ dpm_state = POWER_STATE_TYPE_INTERNAL_3DPERF;
+ /* balanced states don't exist at the moment */
+ if (dpm_state == POWER_STATE_TYPE_BALANCED)
+- dpm_state = rdev->pm.dpm.ac_power ?
+- POWER_STATE_TYPE_PERFORMANCE : POWER_STATE_TYPE_BATTERY;
++ dpm_state = POWER_STATE_TYPE_PERFORMANCE;
+
+ restart_search:
+ /* Pick the best power state based on current conditions */
--- /dev/null
+From 5444a992b4a73aa5246a432c482b20b89bce93a5 Mon Sep 17 00:00:00 2001
+From: Arkadiusz Hiler <arkadiusz.hiler@intel.com>
+Date: Wed, 7 Mar 2018 15:40:28 -0800
+Subject: Revert "Input: synaptics - Lenovo Thinkpad T460p devices should use RMI"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arkadiusz Hiler <arkadiusz.hiler@intel.com>
+
+commit 5444a992b4a73aa5246a432c482b20b89bce93a5 upstream.
+
+This reverts commit 48282969826b3d3c76e908182f69724d86d995fe which
+caused the following issues:
+
+1. On T460p with BIOS version 2.22 touchpad and trackpoint stop working
+after suspend-resume cycle. Due to strange state of the device another
+suspend is impossible.
+
+The following dmesg errors can be observed:
+thinkpad_acpi: EC reports that Thermal Table has changed
+rmi4_smbus 7-002c: failed to get SMBus version number!
+rmi4_physical rmi4-00: rmi_driver_reset_handler: Failed to read current IRQ mask.
+rmi4_f01 rmi4-00.fn01: Failed to restore normal operation: -16.
+rmi4_f01 rmi4-00.fn01: Resume failed with code -16.
+rmi4_physical rmi4-00: Failed to suspend functions: -16
+rmi4_smbus 7-002c: Failed to resume device: -16
+PM: resume devices took 0.640 seconds
+rmi4_f03 rmi4-00.fn03: rmi_f03_pt_write: Failed to write to F03 TX register (-16).
+rmi4_physical rmi4-00: rmi_driver_clear_irq_bits: Failed to change enabled interrupts!
+rmi4_physical rmi4-00: rmi_driver_set_irq_bits: Failed to change enabled interrupts!
+psmouse: probe of serio3 failed with error -1
+
+2. On another T460p with BIOS version 2.15 two finger scrolling gesture
+on the touchpad stops working after suspend-resume cycle (about 75%
+reproducibility, when it still works, the scrolling gesture becomes
+laggy). Nothing suspicious appears in the dmesg.
+
+Analysis form Richard Schütz:
+
+"RMI is unreliable on the ThinkPad T460p because the device is affected
+by the firmware behavior addressed in a7ae81952cda ("i2c: i801: Allow
+ACPI SystemIO OpRegion to conflict with PCI BAR")."
+
+The affected devices often show:
+
+i801_smbus 0000:00:1f.4: BIOS is accessing SMBus registers
+i801_smbus 0000:00:1f.4: Driver SMBus register access inhibited
+
+Reported-by: Richard Schütz <rschuetz@uni-koblenz.de>
+Signed-off-by: Arkadiusz Hiler <arkadiusz.hiler@intel.com>
+Tested-by: Martin Peres <martin.peres@linux.intel.com>
+Tested-by: Arkadiusz Hiler <arkadiusz.hiler@intel.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/synaptics.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -173,7 +173,6 @@ static const char * const smbus_pnp_ids[
+ "LEN0046", /* X250 */
+ "LEN004a", /* W541 */
+ "LEN200f", /* T450s */
+- "LEN2018", /* T460p */
+ NULL
+ };
+
--- /dev/null
+From 8a30ecc6e0ecbb9ae95daf499b2680b885ed0349 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Wed, 7 Mar 2018 14:13:58 +0100
+Subject: Revert "nvme: create 'slaves' and 'holders' entries for hidden controllers"
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit 8a30ecc6e0ecbb9ae95daf499b2680b885ed0349 upstream.
+
+This reverts commit e9a48034d7d1318ece7d4a235838a86c94db9d68.
+
+The slaves and holders link for the hidden gendisks confuse lsblk so that
+it errors out on, or doesn't report the nvme multipath devices. Given
+that we don't need holder relationships for something that can't even be
+directly accessed we should just stop creating those links.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reported-by: Potnuri Bharat Teja <bharat@chelsio.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Keith Busch <keith.busch@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nvme/host/core.c | 2 --
+ drivers/nvme/host/multipath.c | 30 ------------------------------
+ drivers/nvme/host/nvme.h | 8 --------
+ 3 files changed, 40 deletions(-)
+
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -2950,7 +2950,6 @@ static void nvme_alloc_ns(struct nvme_ct
+
+ if (new)
+ nvme_mpath_add_disk(ns->head);
+- nvme_mpath_add_disk_links(ns);
+ return;
+ out_unlink_ns:
+ mutex_lock(&ctrl->subsys->lock);
+@@ -2970,7 +2969,6 @@ static void nvme_ns_remove(struct nvme_n
+ return;
+
+ if (ns->disk && ns->disk->flags & GENHD_FL_UP) {
+- nvme_mpath_remove_disk_links(ns);
+ sysfs_remove_group(&disk_to_dev(ns->disk)->kobj,
+ &nvme_ns_id_attr_group);
+ if (ns->ndev)
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -245,25 +245,6 @@ void nvme_mpath_add_disk(struct nvme_ns_
+ head->disk->disk_name);
+ }
+
+-void nvme_mpath_add_disk_links(struct nvme_ns *ns)
+-{
+- struct kobject *slave_disk_kobj, *holder_disk_kobj;
+-
+- if (!ns->head->disk)
+- return;
+-
+- slave_disk_kobj = &disk_to_dev(ns->disk)->kobj;
+- if (sysfs_create_link(ns->head->disk->slave_dir, slave_disk_kobj,
+- kobject_name(slave_disk_kobj)))
+- return;
+-
+- holder_disk_kobj = &disk_to_dev(ns->head->disk)->kobj;
+- if (sysfs_create_link(ns->disk->part0.holder_dir, holder_disk_kobj,
+- kobject_name(holder_disk_kobj)))
+- sysfs_remove_link(ns->head->disk->slave_dir,
+- kobject_name(slave_disk_kobj));
+-}
+-
+ void nvme_mpath_remove_disk(struct nvme_ns_head *head)
+ {
+ if (!head->disk)
+@@ -278,14 +259,3 @@ void nvme_mpath_remove_disk(struct nvme_
+ blk_cleanup_queue(head->disk->queue);
+ put_disk(head->disk);
+ }
+-
+-void nvme_mpath_remove_disk_links(struct nvme_ns *ns)
+-{
+- if (!ns->head->disk)
+- return;
+-
+- sysfs_remove_link(ns->disk->part0.holder_dir,
+- kobject_name(&disk_to_dev(ns->head->disk)->kobj));
+- sysfs_remove_link(ns->head->disk->slave_dir,
+- kobject_name(&disk_to_dev(ns->disk)->kobj));
+-}
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -405,9 +405,7 @@ bool nvme_req_needs_failover(struct requ
+ void nvme_kick_requeue_lists(struct nvme_ctrl *ctrl);
+ int nvme_mpath_alloc_disk(struct nvme_ctrl *ctrl,struct nvme_ns_head *head);
+ void nvme_mpath_add_disk(struct nvme_ns_head *head);
+-void nvme_mpath_add_disk_links(struct nvme_ns *ns);
+ void nvme_mpath_remove_disk(struct nvme_ns_head *head);
+-void nvme_mpath_remove_disk_links(struct nvme_ns *ns);
+
+ static inline void nvme_mpath_clear_current_path(struct nvme_ns *ns)
+ {
+@@ -448,12 +446,6 @@ static inline void nvme_mpath_add_disk(s
+ static inline void nvme_mpath_remove_disk(struct nvme_ns_head *head)
+ {
+ }
+-static inline void nvme_mpath_add_disk_links(struct nvme_ns *ns)
+-{
+-}
+-static inline void nvme_mpath_remove_disk_links(struct nvme_ns *ns)
+-{
+-}
+ static inline void nvme_mpath_clear_current_path(struct nvme_ns *ns)
+ {
+ }
--- /dev/null
+From 3be8828fc507cdafe7040a3dcf361a2bcd8e305b Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bart.vanassche@wdc.com>
+Date: Thu, 22 Feb 2018 11:30:20 -0800
+Subject: scsi: core: Avoid that ATA error handling can trigger a kernel hang or oops
+
+From: Bart Van Assche <bart.vanassche@wdc.com>
+
+commit 3be8828fc507cdafe7040a3dcf361a2bcd8e305b upstream.
+
+Avoid that the recently introduced call_rcu() call in the SCSI core
+triggers a double call_rcu() call.
+
+Reported-by: Natanael Copa <ncopa@alpinelinux.org>
+Reported-by: Damien Le Moal <damien.lemoal@wdc.com>
+References: https://bugzilla.kernel.org/show_bug.cgi?id=198861
+Fixes: 3bd6f43f5cb3 ("scsi: core: Ensure that the SCSI error handler gets woken up")
+Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
+Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com>
+Tested-by: Damien Le Moal <damien.lemoal@wdc.com>
+Cc: Natanael Copa <ncopa@alpinelinux.org>
+Cc: Damien Le Moal <damien.lemoal@wdc.com>
+Cc: Alexandre Oliva <oliva@gnu.org>
+Cc: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
+Cc: Hannes Reinecke <hare@suse.com>
+Cc: Johannes Thumshirn <jthumshirn@suse.de>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/hosts.c | 3 ---
+ drivers/scsi/scsi_error.c | 5 +++--
+ drivers/scsi/scsi_lib.c | 2 ++
+ include/scsi/scsi_cmnd.h | 3 +++
+ include/scsi/scsi_host.h | 2 --
+ 5 files changed, 8 insertions(+), 7 deletions(-)
+
+--- a/drivers/scsi/hosts.c
++++ b/drivers/scsi/hosts.c
+@@ -328,8 +328,6 @@ static void scsi_host_dev_release(struct
+ if (shost->work_q)
+ destroy_workqueue(shost->work_q);
+
+- destroy_rcu_head(&shost->rcu);
+-
+ if (shost->shost_state == SHOST_CREATED) {
+ /*
+ * Free the shost_dev device name here if scsi_host_alloc()
+@@ -404,7 +402,6 @@ struct Scsi_Host *scsi_host_alloc(struct
+ INIT_LIST_HEAD(&shost->starved_list);
+ init_waitqueue_head(&shost->host_wait);
+ mutex_init(&shost->scan_mutex);
+- init_rcu_head(&shost->rcu);
+
+ index = ida_simple_get(&host_index_ida, 0, 0, GFP_KERNEL);
+ if (index < 0)
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -222,7 +222,8 @@ static void scsi_eh_reset(struct scsi_cm
+
+ static void scsi_eh_inc_host_failed(struct rcu_head *head)
+ {
+- struct Scsi_Host *shost = container_of(head, typeof(*shost), rcu);
++ struct scsi_cmnd *scmd = container_of(head, typeof(*scmd), rcu);
++ struct Scsi_Host *shost = scmd->device->host;
+ unsigned long flags;
+
+ spin_lock_irqsave(shost->host_lock, flags);
+@@ -258,7 +259,7 @@ void scsi_eh_scmd_add(struct scsi_cmnd *
+ * Ensure that all tasks observe the host state change before the
+ * host_failed change.
+ */
+- call_rcu(&shost->rcu, scsi_eh_inc_host_failed);
++ call_rcu(&scmd->rcu, scsi_eh_inc_host_failed);
+ }
+
+ /**
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -670,6 +670,7 @@ static bool scsi_end_request(struct requ
+ if (!blk_rq_is_scsi(req)) {
+ WARN_ON_ONCE(!(cmd->flags & SCMD_INITIALIZED));
+ cmd->flags &= ~SCMD_INITIALIZED;
++ destroy_rcu_head(&cmd->rcu);
+ }
+
+ if (req->mq_ctx) {
+@@ -1150,6 +1151,7 @@ void scsi_initialize_rq(struct request *
+ struct scsi_cmnd *cmd = blk_mq_rq_to_pdu(rq);
+
+ scsi_req_init(&cmd->req);
++ init_rcu_head(&cmd->rcu);
+ cmd->jiffies_at_alloc = jiffies;
+ cmd->retries = 0;
+ }
+--- a/include/scsi/scsi_cmnd.h
++++ b/include/scsi/scsi_cmnd.h
+@@ -69,6 +69,9 @@ struct scsi_cmnd {
+ struct list_head list; /* scsi_cmnd participates in queue lists */
+ struct list_head eh_entry; /* entry for the host eh_cmd_q */
+ struct delayed_work abort_work;
++
++ struct rcu_head rcu;
++
+ int eh_eflags; /* Used by error handlr */
+
+ /*
+--- a/include/scsi/scsi_host.h
++++ b/include/scsi/scsi_host.h
+@@ -571,8 +571,6 @@ struct Scsi_Host {
+ struct blk_mq_tag_set tag_set;
+ };
+
+- struct rcu_head rcu;
+-
+ atomic_t host_busy; /* commands actually active on low-level */
+ atomic_t host_blocked;
+
--- /dev/null
+From 1514839b366417934e2f1328edb50ed1e8a719f5 Mon Sep 17 00:00:00 2001
+From: "himanshu.madhani@cavium.com" <himanshu.madhani@cavium.com>
+Date: Mon, 12 Feb 2018 10:28:14 -0800
+Subject: scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS
+
+From: himanshu.madhani@cavium.com <himanshu.madhani@cavium.com>
+
+commit 1514839b366417934e2f1328edb50ed1e8a719f5 upstream.
+
+This patch fixes NULL pointer crash due to active timer running for abort
+IOCB.
+
+From crash dump analysis it was discoverd that get_next_timer_interrupt()
+encountered a corrupted entry on the timer list.
+
+ #9 [ffff95e1f6f0fd40] page_fault at ffffffff914fe8f8
+ [exception RIP: get_next_timer_interrupt+440]
+ RIP: ffffffff90ea3088 RSP: ffff95e1f6f0fdf0 RFLAGS: 00010013
+ RAX: ffff95e1f6451028 RBX: 000218e2389e5f40 RCX: 00000001232ad600
+ RDX: 0000000000000001 RSI: ffff95e1f6f0fdf0 RDI: 0000000001232ad6
+ RBP: ffff95e1f6f0fe40 R8: ffff95e1f6451188 R9: 0000000000000001
+ R10: 0000000000000016 R11: 0000000000000016 R12: 00000001232ad5f6
+ R13: ffff95e1f6450000 R14: ffff95e1f6f0fdf8 R15: ffff95e1f6f0fe10
+ ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
+
+Looking at the assembly of get_next_timer_interrupt(), address came
+from %r8 (ffff95e1f6451188) which is pointing to list_head with single
+entry at ffff95e5ff621178.
+
+ 0xffffffff90ea307a <get_next_timer_interrupt+426>: mov (%r8),%rdx
+ 0xffffffff90ea307d <get_next_timer_interrupt+429>: cmp %r8,%rdx
+ 0xffffffff90ea3080 <get_next_timer_interrupt+432>: je 0xffffffff90ea30a7 <get_next_timer_interrupt+471>
+ 0xffffffff90ea3082 <get_next_timer_interrupt+434>: nopw 0x0(%rax,%rax,1)
+ 0xffffffff90ea3088 <get_next_timer_interrupt+440>: testb $0x1,0x18(%rdx)
+
+ crash> rd ffff95e1f6451188 10
+ ffff95e1f6451188: ffff95e5ff621178 ffff95e5ff621178 x.b.....x.b.....
+ ffff95e1f6451198: ffff95e1f6451198 ffff95e1f6451198 ..E.......E.....
+ ffff95e1f64511a8: ffff95e1f64511a8 ffff95e1f64511a8 ..E.......E.....
+ ffff95e1f64511b8: ffff95e77cf509a0 ffff95e77cf509a0 ...|.......|....
+ ffff95e1f64511c8: ffff95e1f64511c8 ffff95e1f64511c8 ..E.......E.....
+
+ crash> rd ffff95e5ff621178 10
+ ffff95e5ff621178: 0000000000000001 ffff95e15936aa00 ..........6Y....
+ ffff95e5ff621188: 0000000000000000 00000000ffffffff ................
+ ffff95e5ff621198: 00000000000000a0 0000000000000010 ................
+ ffff95e5ff6211a8: ffff95e5ff621198 000000000000000c ..b.............
+ ffff95e5ff6211b8: 00000f5800000000 ffff95e751f8d720 ....X... ..Q....
+
+ ffff95e5ff621178 belongs to freed mempool object at ffff95e5ff621080.
+
+ CACHE NAME OBJSIZE ALLOCATED TOTAL SLABS SSIZE
+ ffff95dc7fd74d00 mnt_cache 384 19785 24948 594 16k
+ SLAB MEMORY NODE TOTAL ALLOCATED FREE
+ ffffdc5dabfd8800 ffff95e5ff620000 1 42 29 13
+ FREE / [ALLOCATED]
+ ffff95e5ff621080 (cpu 6 cache)
+
+Examining the contents of that memory reveals a pointer to a constant string
+in the driver, "abort\0", which is set by qla24xx_async_abort_cmd().
+
+ crash> rd ffffffffc059277c 20
+ ffffffffc059277c: 6e490074726f6261 0074707572726574 abort.Interrupt.
+ ffffffffc059278c: 00676e696c6c6f50 6920726576697244 Polling.Driver i
+ ffffffffc059279c: 646f6d207325206e 6974736554000a65 n %s mode..Testi
+ ffffffffc05927ac: 636976656420676e 786c252074612065 ng device at %lx
+ ffffffffc05927bc: 6b63656843000a2e 646f727020676e69 ...Checking prod
+ ffffffffc05927cc: 6f20444920746375 0a2e706968632066 uct ID of chip..
+ ffffffffc05927dc: 5120646e756f4600 204130303232414c .Found QLA2200A
+ ffffffffc05927ec: 43000a2e70696843 20676e696b636568 Chip...Checking
+ ffffffffc05927fc: 65786f626c69616d 6c636e69000a2e73 mailboxes...incl
+ ffffffffc059280c: 756e696c2f656475 616d2d616d642f78 ude/linux/dma-ma
+
+ crash> struct -ox srb_iocb
+ struct srb_iocb {
+ union {
+ struct {...} logio;
+ struct {...} els_logo;
+ struct {...} tmf;
+ struct {...} fxiocb;
+ struct {...} abt;
+ struct ct_arg ctarg;
+ struct {...} mbx;
+ struct {...} nack;
+ [0x0 ] } u;
+ [0xb8] struct timer_list timer;
+ [0x108] void (*timeout)(void *);
+ }
+ SIZE: 0x110
+
+ crash> ! bc
+ ibase=16
+ obase=10
+ B8+40
+ F8
+
+The object is a srb_t, and at offset 0xf8 within that structure
+(i.e. ffff95e5ff621080 + f8 -> ffff95e5ff621178) is a struct timer_list.
+
+Cc: <stable@vger.kernel.org> #4.4+
+Fixes: 4440e46d5db7 ("[SCSI] qla2xxx: Add IOCB Abort command asynchronous handling.")
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_init.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -1347,6 +1347,7 @@ qla24xx_abort_sp_done(void *ptr, int res
+ srb_t *sp = ptr;
+ struct srb_iocb *abt = &sp->u.iocb_cmd;
+
++ del_timer(&sp->u.iocb_cmd.timer);
+ complete(&abt->u.abt.comp);
+ }
+
--- /dev/null
+From d64d6c5671db5e693a0caaee79f2571b098749c9 Mon Sep 17 00:00:00 2001
+From: "himanshu.madhani@cavium.com" <himanshu.madhani@cavium.com>
+Date: Mon, 15 Jan 2018 20:46:46 -0800
+Subject: scsi: qla2xxx: Fix NULL pointer crash due to probe failure
+
+From: himanshu.madhani@cavium.com <himanshu.madhani@cavium.com>
+
+commit d64d6c5671db5e693a0caaee79f2571b098749c9 upstream.
+
+This patch fixes regression added by commit d74595278f4ab
+("scsi: qla2xxx: Add multiple queue pair functionality.").
+
+When driver is not able to get reqeusted IRQs from the system, driver will
+attempt tp clean up memory before failing hardware probe. During this cleanup,
+driver assigns NULL value to the pointer which has not been allocated by
+driver yet. This results in a NULL pointer access.
+
+Log file will show following message and stack trace
+
+qla2xxx [0000:a3:00.1]-00c7:21: MSI-X: Failed to enable support, giving up -- 32/-1.
+qla2xxx [0000:a3:00.1]-0037:21: Falling back-to MSI mode --1.
+qla2xxx [0000:a3:00.1]-003a:21: Failed to reserve interrupt 821 already in use.
+BUG: unable to handle kernel NULL pointer dereference at (null)
+IP: [<ffffffffc010c4b6>] qla2x00_probe_one+0x18b6/0x2730 [qla2xxx]
+PGD 0
+Oops: 0002 [#1] SMP
+
+Fixes: d74595278f4ab ("scsi: qla2xxx: Add multiple queue pair functionality.").
+Cc: <stable@vger.kernel.org> # 4.10
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_os.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -3011,9 +3011,6 @@ qla2x00_probe_one(struct pci_dev *pdev,
+ base_vha = qla2x00_create_host(sht, ha);
+ if (!base_vha) {
+ ret = -ENOMEM;
+- qla2x00_mem_free(ha);
+- qla2x00_free_req_que(ha, req);
+- qla2x00_free_rsp_que(ha, rsp);
+ goto probe_hw_failed;
+ }
+
+@@ -3074,7 +3071,7 @@ qla2x00_probe_one(struct pci_dev *pdev,
+ /* Set up the irqs */
+ ret = qla2x00_request_irqs(ha, rsp);
+ if (ret)
+- goto probe_init_failed;
++ goto probe_hw_failed;
+
+ /* Alloc arrays of request and response ring ptrs */
+ if (!qla2x00_alloc_queues(ha, req, rsp)) {
+@@ -3390,6 +3387,9 @@ probe_failed:
+ scsi_host_put(base_vha->host);
+
+ probe_hw_failed:
++ qla2x00_mem_free(ha);
++ qla2x00_free_req_que(ha, req);
++ qla2x00_free_rsp_que(ha, rsp);
+ qla2x00_clear_drv_active(ha);
+
+ iospace_config_failed:
--- /dev/null
+From 3efc31f76dd7fc8a71cd86683909f637e9b7cadb Mon Sep 17 00:00:00 2001
+From: "himanshu.madhani@cavium.com" <himanshu.madhani@cavium.com>
+Date: Mon, 15 Jan 2018 20:46:47 -0800
+Subject: scsi: qla2xxx: Fix recursion while sending terminate exchange
+
+From: himanshu.madhani@cavium.com <himanshu.madhani@cavium.com>
+
+commit 3efc31f76dd7fc8a71cd86683909f637e9b7cadb upstream.
+
+During error test case where switch port status is toggled from enable to
+disable, following stack trace is seen which indicates recursion trying to
+send terminate exchange. This regression was introduced by commit
+82de802ad46e ("scsi: qla2xxx: Preparation for Target MQ.")
+
+BUG: stack guard page was hit at ffffb96488383ff8 (stack is ffffb96488384000..ffffb96488387fff)
+BUG: stack guard page was hit at ffffb964886c3ff8 (stack is ffffb964886c4000..ffffb964886c7fff)
+kernel stack overflow (double-fault): 0000 [#1] SMP
+qlt_term_ctio_exchange+0x9c/0xb0 [qla2xxx]
+qlt_term_ctio_exchange+0x9c/0xb0 [qla2xxx]
+qlt_term_ctio_exchange+0x9c/0xb0 [qla2xxx]
+qlt_term_ctio_exchange+0x9c/0xb0 [qla2xxx]
+qlt_term_ctio_exchange+0x9c/0xb0 [qla2xxx]
+
+Fixes: 82de802ad46e ("scsi: qla2xxx: Preparation for Target MQ.")
+Cc: <stable@vger.kernel.org> #4.10
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_target.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -3708,7 +3708,7 @@ static int qlt_term_ctio_exchange(struct
+ term = 1;
+
+ if (term)
+- qlt_term_ctio_exchange(qpair, ctio, cmd, status);
++ qlt_send_term_exchange(qpair, cmd, &cmd->atio, 1, 0);
+
+ return term;
+ }
ib-uverbs-improve-lockdep_check.patch
mac80211_hwsim-don-t-use-wq_mem_reclaim.patch
net-smc-fix-null-pointer-dereference-on-sock_create_kern-error-path.patch
+regulator-stm32-vrefbuf-fix-check-on-ready-flag.patch
+drm-i915-check-for-fused-or-unused-pipes.patch
+drm-i915-audio-fix-check-for-av_enc_map-overflow.patch
+drm-i915-fix-rsvd2-mask-when-out-fence-is-returned.patch
+drm-i915-clear-the-in-use-marker-on-execbuf-failure.patch
+drm-i915-disable-dc-states-around-gmbus-on-glk.patch
+drm-i915-update-watermark-state-correctly-in-sanitize_watermarks.patch
+drm-i915-try-edid-bitbanging-on-hdmi-after-failed-read.patch
+drm-i915-perf-fix-perf-stream-opening-lock.patch
+scsi-core-avoid-that-ata-error-handling-can-trigger-a-kernel-hang-or-oops.patch
+scsi-qla2xxx-fix-null-pointer-crash-due-to-active-timer-for-abts.patch
+drm-i915-always-call-to-intel_display_set_init_power-in-resume_early.patch
+workqueue-allow-retrieval-of-current-task-s-work-struct.patch
+drm-allow-determining-if-current-task-is-output-poll-worker.patch
+drm-nouveau-fix-deadlock-on-runtime-suspend.patch
+drm-radeon-fix-deadlock-on-runtime-suspend.patch
+drm-amdgpu-fix-deadlock-on-runtime-suspend.patch
+drm-nouveau-prefer-xbgr2101010-for-addfb-ioctl.patch
+drm-amd-powerplay-smu7-allow-mclk-switching-with-no-displays.patch
+drm-amd-powerplay-vega10-allow-mclk-switching-with-no-displays.patch
+revert-drm-radeon-pm-autoswitch-power-state-when-in-balanced-mode.patch
+drm-amd-display-check-for-ipp-before-calling-cursor-operations.patch
+drm-radeon-insist-on-32-bit-dma-for-cedar-on-ppc64-ppc64le.patch
+drm-amd-powerplay-fix-power-over-limit-on-fiji.patch
+drm-amd-display-default-hdmi6g-support-to-true.-log-vbios-table-error.patch
+drm-amdgpu-used-cached-pcie-gen-info-for-si-v2.patch
+drm-amdgpu-notify-sbios-device-ready-before-send-request.patch
+drm-radeon-fix-kv-harvesting.patch
+drm-amdgpu-fix-kv-harvesting.patch
+drm-amdgpu-correct-max-uvd-handles.patch
+drm-amdgpu-always-save-uvd-vcpu_bo-in-vm-mode.patch
+ovl-redirect_dir-nofollow-should-not-follow-redirect-for-opaque-lower.patch
+mips-bmips-do-not-mask-ipis-during-suspend.patch
+mips-ath25-check-for-kzalloc-allocation-failure.patch
+mips-octeon-irq-check-for-null-return-on-kzalloc-allocation.patch
+pci-dwc-fix-enumeration-end-when-reaching-root-subordinate.patch
+input-matrix_keypad-fix-race-when-disabling-interrupts.patch
+revert-input-synaptics-lenovo-thinkpad-t460p-devices-should-use-rmi.patch
+bug-use-pb-in-bug-and-stack-protector-failure.patch
+lib-bug.c-exclude-non-bug-warn-exceptions-from-report_bug.patch
+mm-memblock.c-hardcode-the-end_pfn-being-1.patch
+mm-page_alloc-fix-memmap_init_zone-pageblock-alignment.patch
+documentation-sphinx-fix-directive-import-error.patch
+loop-fix-lost-writes-caused-by-missing-flag.patch
+virtio_ring-fix-num_free-handling-in-error-case.patch
+kvm-s390-fix-memory-overwrites-when-not-using-sca-entries.patch
+arm64-mm-fix-thinko-in-non-global-page-table-attribute-check.patch
+ib-core-fix-missing-rdma-cgroups-release-in-case-of-failure-to-register-device.patch
+revert-nvme-create-slaves-and-holders-entries-for-hidden-controllers.patch
+kbuild-handle-builtin-dtb-file-names-containing-hyphens.patch
+dm-bufio-avoid-false-positive-wmaybe-uninitialized-warning.patch
+ib-mlx5-fix-incorrect-size-of-klms-in-the-memory-region.patch
+bcache-fix-crashes-in-duplicate-cache-device-register.patch
+bcache-don-t-attach-backing-with-duplicate-uuid.patch
+x86-mce-save-microcode-revision-in-machine-check-records.patch
+x86-mce-serialize-sysfs-changes.patch
+perf-tools-fix-trigger-class-trigger_on.patch
+x86-spectre_v2-don-t-check-microcode-versions-when-running-under-hypervisors.patch
+alsa-hda-realtek-add-support-headset-mode-for-dell-wyse.patch
+alsa-hda-realtek-add-headset-mode-support-for-dell-laptop.patch
+alsa-hda-realtek-limit-mic-boost-on-t480.patch
+alsa-hda-realtek-fix-dock-line-out-volume-on-dell-precision-7520.patch
+alsa-hda-realtek-make-dock-sound-work-on-thinkpad-l570.patch
+alsa-seq-don-t-allow-resizing-pool-in-use.patch
+alsa-seq-more-protection-for-concurrent-write-and-ioctl-races.patch
+alsa-hda-fix-a-wrong-fixup-for-alc289-on-dell-machines.patch
+alsa-hda-add-dock-and-led-support-for-hp-elitebook-820-g3.patch
+alsa-hda-add-dock-and-led-support-for-hp-probook-640-g2.patch
+scsi-qla2xxx-fix-null-pointer-crash-due-to-probe-failure.patch
+scsi-qla2xxx-fix-recursion-while-sending-terminate-exchange.patch
--- /dev/null
+From e82df670235138575b37ff0ec24412a471efd97f Mon Sep 17 00:00:00 2001
+From: Tiwei Bie <tiwei.bie@intel.com>
+Date: Fri, 23 Feb 2018 19:41:30 +0800
+Subject: virtio_ring: fix num_free handling in error case
+
+From: Tiwei Bie <tiwei.bie@intel.com>
+
+commit e82df670235138575b37ff0ec24412a471efd97f upstream.
+
+The vq->vq.num_free hasn't been changed when error happens,
+so it shouldn't be changed when handling the error.
+
+Fixes: 780bc7903a32 ("virtio_ring: Support DMA APIs")
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Michael S. Tsirkin <mst@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Tiwei Bie <tiwei.bie@intel.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/virtio/virtio_ring.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -428,8 +428,6 @@ unmap_release:
+ i = virtio16_to_cpu(_vq->vdev, vq->vring.desc[i].next);
+ }
+
+- vq->vq.num_free += total_sg;
+-
+ if (indirect)
+ kfree(desc);
+
--- /dev/null
+From 27d4ee03078aba88c5e07dcc4917e8d01d046f38 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Sun, 11 Feb 2018 10:38:28 +0100
+Subject: workqueue: Allow retrieval of current task's work struct
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit 27d4ee03078aba88c5e07dcc4917e8d01d046f38 upstream.
+
+Introduce a helper to retrieve the current task's work struct if it is
+a workqueue worker.
+
+This allows us to fix a long-standing deadlock in several DRM drivers
+wherein the ->runtime_suspend callback waits for a specific worker to
+finish and that worker in turn calls a function which waits for runtime
+suspend to finish. That function is invoked from multiple call sites
+and waiting for runtime suspend to finish is the correct thing to do
+except if it's executing in the context of the worker.
+
+Cc: Lai Jiangshan <jiangshanlai@gmail.com>
+Cc: Dave Airlie <airlied@redhat.com>
+Cc: Ben Skeggs <bskeggs@redhat.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/2d8f603074131eb87e588d2b803a71765bd3a2fd.1518338788.git.lukas@wunner.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/workqueue.h | 1 +
+ kernel/workqueue.c | 16 ++++++++++++++++
+ 2 files changed, 17 insertions(+)
+
+--- a/include/linux/workqueue.h
++++ b/include/linux/workqueue.h
+@@ -465,6 +465,7 @@ extern bool cancel_delayed_work_sync(str
+
+ extern void workqueue_set_max_active(struct workqueue_struct *wq,
+ int max_active);
++extern struct work_struct *current_work(void);
+ extern bool current_is_workqueue_rescuer(void);
+ extern bool workqueue_congested(int cpu, struct workqueue_struct *wq);
+ extern unsigned int work_busy(struct work_struct *work);
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -4169,6 +4169,22 @@ void workqueue_set_max_active(struct wor
+ EXPORT_SYMBOL_GPL(workqueue_set_max_active);
+
+ /**
++ * current_work - retrieve %current task's work struct
++ *
++ * Determine if %current task is a workqueue worker and what it's working on.
++ * Useful to find out the context that the %current task is running in.
++ *
++ * Return: work struct if %current task is a workqueue worker, %NULL otherwise.
++ */
++struct work_struct *current_work(void)
++{
++ struct worker *worker = current_wq_worker();
++
++ return worker ? worker->current_work : NULL;
++}
++EXPORT_SYMBOL(current_work);
++
++/**
+ * current_is_workqueue_rescuer - is %current workqueue rescuer?
+ *
+ * Determine whether %current is a workqueue rescuer. Can be used from
--- /dev/null
+From fa94d0c6e0f3431523f5701084d799c77c7d4a4f Mon Sep 17 00:00:00 2001
+From: Tony Luck <tony.luck@intel.com>
+Date: Tue, 6 Mar 2018 15:21:41 +0100
+Subject: x86/MCE: Save microcode revision in machine check records
+
+From: Tony Luck <tony.luck@intel.com>
+
+commit fa94d0c6e0f3431523f5701084d799c77c7d4a4f upstream.
+
+Updating microcode used to be relatively rare. Now that it has become
+more common we should save the microcode version in a machine check
+record to make sure that those people looking at the error have this
+important information bundled with the rest of the logged information.
+
+[ Borislav: Simplify a bit. ]
+
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Yazen Ghannam <yazen.ghannam@amd.com>
+Cc: linux-edac <linux-edac@vger.kernel.org>
+Cc: stable@vger.kernel.org
+Link: http://lkml.kernel.org/r/20180301233449.24311-1-tony.luck@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/uapi/asm/mce.h | 1 +
+ arch/x86/kernel/cpu/mcheck/mce.c | 4 +++-
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/include/uapi/asm/mce.h
++++ b/arch/x86/include/uapi/asm/mce.h
+@@ -30,6 +30,7 @@ struct mce {
+ __u64 synd; /* MCA_SYND MSR: only valid on SMCA systems */
+ __u64 ipid; /* MCA_IPID MSR: only valid on SMCA systems */
+ __u64 ppin; /* Protected Processor Inventory Number */
++ __u32 microcode;/* Microcode revision */
+ };
+
+ #define MCE_GET_RECORD_LEN _IOR('M', 1, int)
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -131,6 +131,8 @@ void mce_setup(struct mce *m)
+
+ if (this_cpu_has(X86_FEATURE_INTEL_PPIN))
+ rdmsrl(MSR_PPIN, m->ppin);
++
++ m->microcode = boot_cpu_data.microcode;
+ }
+
+ DEFINE_PER_CPU(struct mce, injectm);
+@@ -263,7 +265,7 @@ static void __print_mce(struct mce *m)
+ */
+ pr_emerg(HW_ERR "PROCESSOR %u:%x TIME %llu SOCKET %u APIC %x microcode %x\n",
+ m->cpuvendor, m->cpuid, m->time, m->socketid, m->apicid,
+- cpu_data(m->extcpu).microcode);
++ m->microcode);
+ }
+
+ static void print_mce(struct mce *m)
--- /dev/null
+From b3b7c4795ccab5be71f080774c45bbbcc75c2aaf Mon Sep 17 00:00:00 2001
+From: Seunghun Han <kkamagui@gmail.com>
+Date: Tue, 6 Mar 2018 15:21:43 +0100
+Subject: x86/MCE: Serialize sysfs changes
+
+From: Seunghun Han <kkamagui@gmail.com>
+
+commit b3b7c4795ccab5be71f080774c45bbbcc75c2aaf upstream.
+
+The check_interval file in
+
+ /sys/devices/system/machinecheck/machinecheck<cpu number>
+
+directory is a global timer value for MCE polling. If it is changed by one
+CPU, mce_restart() broadcasts the event to other CPUs to delete and restart
+the MCE polling timer and __mcheck_cpu_init_timer() reinitializes the
+mce_timer variable.
+
+If more than one CPU writes a specific value to the check_interval file
+concurrently, mce_timer is not protected from such concurrent accesses and
+all kinds of explosions happen. Since only root can write to those sysfs
+variables, the issue is not a big deal security-wise.
+
+However, concurrent writes to these configuration variables is void of
+reason so the proper thing to do is to serialize the access with a mutex.
+
+Boris:
+
+ - Make store_int_with_restart() use device_store_ulong() to filter out
+ negative intervals
+ - Limit min interval to 1 second
+ - Correct locking
+ - Massage commit message
+
+Signed-off-by: Seunghun Han <kkamagui@gmail.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: linux-edac <linux-edac@vger.kernel.org>
+Cc: stable@vger.kernel.org
+Link: http://lkml.kernel.org/r/20180302202706.9434-1-kkamagui@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/cpu/mcheck/mce.c | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -57,6 +57,9 @@
+
+ static DEFINE_MUTEX(mce_log_mutex);
+
++/* sysfs synchronization */
++static DEFINE_MUTEX(mce_sysfs_mutex);
++
+ #define CREATE_TRACE_POINTS
+ #include <trace/events/mce.h>
+
+@@ -2080,6 +2083,7 @@ static ssize_t set_ignore_ce(struct devi
+ if (kstrtou64(buf, 0, &new) < 0)
+ return -EINVAL;
+
++ mutex_lock(&mce_sysfs_mutex);
+ if (mca_cfg.ignore_ce ^ !!new) {
+ if (new) {
+ /* disable ce features */
+@@ -2092,6 +2096,8 @@ static ssize_t set_ignore_ce(struct devi
+ on_each_cpu(mce_enable_ce, (void *)1, 1);
+ }
+ }
++ mutex_unlock(&mce_sysfs_mutex);
++
+ return size;
+ }
+
+@@ -2104,6 +2110,7 @@ static ssize_t set_cmci_disabled(struct
+ if (kstrtou64(buf, 0, &new) < 0)
+ return -EINVAL;
+
++ mutex_lock(&mce_sysfs_mutex);
+ if (mca_cfg.cmci_disabled ^ !!new) {
+ if (new) {
+ /* disable cmci */
+@@ -2115,6 +2122,8 @@ static ssize_t set_cmci_disabled(struct
+ on_each_cpu(mce_enable_ce, NULL, 1);
+ }
+ }
++ mutex_unlock(&mce_sysfs_mutex);
++
+ return size;
+ }
+
+@@ -2122,8 +2131,19 @@ static ssize_t store_int_with_restart(st
+ struct device_attribute *attr,
+ const char *buf, size_t size)
+ {
+- ssize_t ret = device_store_int(s, attr, buf, size);
++ unsigned long old_check_interval = check_interval;
++ ssize_t ret = device_store_ulong(s, attr, buf, size);
++
++ if (check_interval == old_check_interval)
++ return ret;
++
++ if (check_interval < 1)
++ check_interval = 1;
++
++ mutex_lock(&mce_sysfs_mutex);
+ mce_restart();
++ mutex_unlock(&mce_sysfs_mutex);
++
+ return ret;
+ }
+
--- /dev/null
+From 36268223c1e9981d6cfc33aff8520b3bde4b8114 Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Mon, 26 Feb 2018 09:35:01 -0500
+Subject: x86/spectre_v2: Don't check microcode versions when running under hypervisors
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+
+commit 36268223c1e9981d6cfc33aff8520b3bde4b8114 upstream.
+
+As:
+
+ 1) It's known that hypervisors lie about the environment anyhow (host
+ mismatch)
+
+ 2) Even if the hypervisor (Xen, KVM, VMWare, etc) provided a valid
+ "correct" value, it all gets to be very murky when migration happens
+ (do you provide the "new" microcode of the machine?).
+
+And in reality the cloud vendors are the ones that should make sure that
+the microcode that is running is correct and we should just sing lalalala
+and trust them.
+
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Wanpeng Li <kernellwp@gmail.com>
+Cc: kvm <kvm@vger.kernel.org>
+Cc: Krčmář <rkrcmar@redhat.com>
+Cc: Borislav Petkov <bp@alien8.de>
+CC: "H. Peter Anvin" <hpa@zytor.com>
+CC: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20180226213019.GE9497@char.us.oracle.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/cpu/intel.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/arch/x86/kernel/cpu/intel.c
++++ b/arch/x86/kernel/cpu/intel.c
+@@ -144,6 +144,13 @@ static bool bad_spectre_microcode(struct
+ {
+ int i;
+
++ /*
++ * We know that the hypervisor lie to us on the microcode version so
++ * we may as well hope that it is running the correct version.
++ */
++ if (cpu_has(c, X86_FEATURE_HYPERVISOR))
++ return false;
++
+ for (i = 0; i < ARRAY_SIZE(spectre_bad_microcodes); i++) {
+ if (c->x86_model == spectre_bad_microcodes[i].model &&
+ c->x86_stepping == spectre_bad_microcodes[i].stepping)
projects / thirdparty / kernel / stable-queue.git / commitdiff
