--- /dev/null
+From 92d32170847bfff2dd08af2c016085779f2fd2a1 Mon Sep 17 00:00:00 2001
+From: David Sterba <dsterba@suse.com>
+Date: Mon, 16 Apr 2018 21:10:14 +0200
+Subject: btrfs: fix unaligned access in readdir
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David Sterba <dsterba@suse.com>
+
+commit 92d32170847bfff2dd08af2c016085779f2fd2a1 upstream.
+
+The last update to readdir introduced a temporary buffer to store the
+emitted readdir data, but as there are file names of variable length,
+there's a lot of unaligned access.
+
+This was observed on a sparc64 machine:
+
+ Kernel unaligned access at TPC[102f3080] btrfs_real_readdir+0x51c/0x718 [btrfs]
+
+Fixes: 23b5ec74943 ("btrfs: fix readdir deadlock with pagefault")
+CC: stable@vger.kernel.org # 4.14+
+Reported-and-tested-by: René Rebe <rene@exactcode.com>
+Reviewed-by: Liu Bo <bo.liu@linux.alibaba.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/inode.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -42,6 +42,7 @@
+ #include <linux/blkdev.h>
+ #include <linux/posix_acl_xattr.h>
+ #include <linux/uio.h>
++#include <asm/unaligned.h>
+ #include "ctree.h"
+ #include "disk-io.h"
+ #include "transaction.h"
+@@ -5980,11 +5981,13 @@ static int btrfs_filldir(void *addr, int
+ struct dir_entry *entry = addr;
+ char *name = (char *)(entry + 1);
+
+- ctx->pos = entry->offset;
+- if (!dir_emit(ctx, name, entry->name_len, entry->ino,
+- entry->type))
++ ctx->pos = get_unaligned(&entry->offset);
++ if (!dir_emit(ctx, name, get_unaligned(&entry->name_len),
++ get_unaligned(&entry->ino),
++ get_unaligned(&entry->type)))
+ return 1;
+- addr += sizeof(struct dir_entry) + entry->name_len;
++ addr += sizeof(struct dir_entry) +
++ get_unaligned(&entry->name_len);
+ ctx->pos++;
+ }
+ return 0;
+@@ -6078,14 +6081,15 @@ again:
+ }
+
+ entry = addr;
+- entry->name_len = name_len;
++ put_unaligned(name_len, &entry->name_len);
+ name_ptr = (char *)(entry + 1);
+ read_extent_buffer(leaf, name_ptr, (unsigned long)(di + 1),
+ name_len);
+- entry->type = btrfs_filetype_table[btrfs_dir_type(leaf, di)];
++ put_unaligned(btrfs_filetype_table[btrfs_dir_type(leaf, di)],
++ &entry->type);
+ btrfs_dir_item_key_to_cpu(leaf, di, &location);
+- entry->ino = location.objectid;
+- entry->offset = found_key.offset;
++ put_unaligned(location.objectid, &entry->ino);
++ put_unaligned(found_key.offset, &entry->offset);
+ entries++;
+ addr += sizeof(struct dir_entry) + name_len;
+ total_len += sizeof(struct dir_entry) + name_len;
--- /dev/null
+From 1d0cffa674cfa7d185a302c8c6850fc50b893bed Mon Sep 17 00:00:00 2001
+From: Steve French <smfrench@gmail.com>
+Date: Fri, 20 Apr 2018 12:19:07 -0500
+Subject: cifs: do not allow creating sockets except with SMB1 posix exensions
+
+From: Steve French <smfrench@gmail.com>
+
+commit 1d0cffa674cfa7d185a302c8c6850fc50b893bed upstream.
+
+RHBZ: 1453123
+
+Since at least the 3.10 kernel and likely a lot earlier we have
+not been able to create unix domain sockets in a cifs share
+when mounted using the SFU mount option (except when mounted
+with the cifs unix extensions to Samba e.g.)
+Trying to create a socket, for example using the af_unix command from
+xfstests will cause :
+BUG: unable to handle kernel NULL pointer dereference at 00000000
+00000040
+
+Since no one uses or depends on being able to create unix domains sockets
+on a cifs share the easiest fix to stop this vulnerability is to simply
+not allow creation of any other special files than char or block devices
+when sfu is used.
+
+Added update to Ronnie's patch to handle a tcon link leak, and
+to address a buf leak noticed by Gustavo and Colin.
+
+Acked-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+CC: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+Reported-by: Eryu Guan <eguan@redhat.com>
+Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Signed-off-by: Steve French <smfrench@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/dir.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/fs/cifs/dir.c
++++ b/fs/cifs/dir.c
+@@ -684,6 +684,9 @@ int cifs_mknod(struct inode *inode, stru
+ goto mknod_out;
+ }
+
++ if (!S_ISCHR(mode) && !S_ISBLK(mode))
++ goto mknod_out;
++
+ if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL))
+ goto mknod_out;
+
+@@ -692,10 +695,8 @@ int cifs_mknod(struct inode *inode, stru
+
+ buf = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL);
+ if (buf == NULL) {
+- kfree(full_path);
+ rc = -ENOMEM;
+- free_xid(xid);
+- return rc;
++ goto mknod_out;
+ }
+
+ if (backup_cred(cifs_sb))
+@@ -742,7 +743,7 @@ int cifs_mknod(struct inode *inode, stru
+ pdev->minor = cpu_to_le64(MINOR(device_number));
+ rc = tcon->ses->server->ops->sync_write(xid, &fid, &io_parms,
+ &bytes_written, iov, 1);
+- } /* else if (S_ISFIFO) */
++ }
+ tcon->ses->server->ops->close(xid, tcon, &fid);
+ d_drop(direntry);
+
--- /dev/null
+From 7407188489c62a7b5694bc75a6db2b82af94c9a5 Mon Sep 17 00:00:00 2001
+From: Anson Huang <Anson.Huang@nxp.com>
+Date: Thu, 19 Apr 2018 14:04:43 +0800
+Subject: clocksource/imx-tpm: Correct -ETIME return condition check
+
+From: Anson Huang <Anson.Huang@nxp.com>
+
+commit 7407188489c62a7b5694bc75a6db2b82af94c9a5 upstream.
+
+The additional brakects added to tpm_set_next_event's return value
+computation causes (int) forced type conversion NOT taking effect, and the
+incorrect value return will cause various system timer issue, like RCU
+stall etc..
+
+Remove the additional brackets to make sure tpm_set_next_event always
+returns correct value.
+
+Fixes: 059ab7b82eec ("clocksource/drivers/imx-tpm: Add imx tpm timer support")
+Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Dong Aisheng <Aisheng.dong@nxp.com>
+Cc: stable@vger.kernel.org
+Cc: daniel.lezcano@linaro.org
+Cc: Linux-imx@nxp.com
+Link: https://lkml.kernel.org/r/1524117883-2484-1-git-send-email-Anson.Huang@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clocksource/timer-imx-tpm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clocksource/timer-imx-tpm.c
++++ b/drivers/clocksource/timer-imx-tpm.c
+@@ -105,7 +105,7 @@ static int tpm_set_next_event(unsigned l
+ * of writing CNT registers which may cause the min_delta event got
+ * missed, so we need add a ETIME check here in case it happened.
+ */
+- return (int)((next - now) <= 0) ? -ETIME : 0;
++ return (int)(next - now) <= 0 ? -ETIME : 0;
+ }
+
+ static int tpm_set_state_oneshot(struct clock_event_device *evt)
--- /dev/null
+From b4615730530be85fc45ab4631c2ad6d8e2d0b97d Mon Sep 17 00:00:00 2001
+From: Gaurav K Singh <gaurav.k.singh@intel.com>
+Date: Tue, 17 Apr 2018 23:52:18 +0530
+Subject: drm/i915/audio: Fix audio detection issue on GLK
+
+From: Gaurav K Singh <gaurav.k.singh@intel.com>
+
+commit b4615730530be85fc45ab4631c2ad6d8e2d0b97d upstream.
+
+On Geminilake, sometimes audio card is not getting
+detected after reboot. This is a spurious issue happening on
+Geminilake. HW codec and HD audio controller link was going
+out of sync for which there was a fix in i915 driver but
+was not getting invoked for GLK. Extending this fix to GLK as well.
+
+Tested by Du,Wenkai on GLK board.
+
+Bspec: 21829
+
+v2: Instead of checking GEN9_BC, BXT and GLK macros, use IS_GEN9 macro (Jani N)
+
+Cc: <stable@vger.kernel.org> # b651bd2a3ae3 ("drm/i915/audio: Fix audio enumeration issue on BXT")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Gaurav K Singh <gaurav.k.singh@intel.com>
+Reviewed-by: Abhay Kumar <abhay.Kumar@intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/1523989338-29677-1-git-send-email-gaurav.k.singh@intel.com
+(cherry picked from commit 8221229046e862977ae93ec9d34aa583fbd10397)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_audio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_audio.c
++++ b/drivers/gpu/drm/i915/intel_audio.c
+@@ -704,7 +704,7 @@ static void i915_audio_component_codec_w
+ struct drm_i915_private *dev_priv = kdev_to_i915(kdev);
+ u32 tmp;
+
+- if (!IS_GEN9_BC(dev_priv))
++ if (!IS_GEN9(dev_priv))
+ return;
+
+ i915_audio_component_get_power(kdev);
--- /dev/null
+From fcf1fadf4c65eea6c519c773d2d9901e8ad94f5f Mon Sep 17 00:00:00 2001
+From: Xidong Wang <wangxidong_97@163.com>
+Date: Wed, 4 Apr 2018 10:38:24 +0100
+Subject: drm/i915: Do no use kfree() to free a kmem_cache_alloc() return value
+
+From: Xidong Wang <wangxidong_97@163.com>
+
+commit fcf1fadf4c65eea6c519c773d2d9901e8ad94f5f upstream.
+
+Along the eb_lookup_vmas() error path, the return value from
+kmem_cache_alloc() was freed using kfree(). Fix it to use the proper
+kmem_cache_free() instead.
+
+Fixes: d1b48c1e7184 ("drm/i915: Replace execbuf vma ht with an idr")
+Signed-off-by: Xidong Wang <wangxidong_97@163.com>
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Cc: <stable@vger.kernel.org> # v4.14+
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180404093824.9313-1-chris@chris-wilson.co.uk
+(cherry picked from commit 6be1187dbffa0027ea379c53f7ca0c782515c610)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_gem_execbuffer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+@@ -722,7 +722,7 @@ static int eb_lookup_vmas(struct i915_ex
+
+ err = radix_tree_insert(handles_vma, handle, vma);
+ if (unlikely(err)) {
+- kfree(lut);
++ kmem_cache_free(eb->i915->luts, lut);
+ goto err_obj;
+ }
+
--- /dev/null
+From 7eb2c4dd54ff841f2fe509a84973eb25fa20bda2 Mon Sep 17 00:00:00 2001
+From: Imre Deak <imre.deak@intel.com>
+Date: Mon, 16 Apr 2018 18:53:09 +0300
+Subject: drm/i915: Fix LSPCON TMDS output buffer enabling from low-power state
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Imre Deak <imre.deak@intel.com>
+
+commit 7eb2c4dd54ff841f2fe509a84973eb25fa20bda2 upstream.
+
+LSPCON adapters in low-power state may ignore the first I2C write during
+TMDS output buffer enabling, resulting in a blank screen even with an
+otherwise enabled pipe. Fix this by reading back and validating the
+written value a few times.
+
+The problem was noticed on GLK machines with an onboard LSPCON adapter
+after entering/exiting DC5 power state. Doing an I2C read of the adapter
+ID as the first transaction - instead of the I2C write to enable the
+TMDS buffers - returns the correct value. Based on this we assume that
+the transaction itself is sent properly, it's only the adapter that is
+not ready for some reason to accept this first write after waking from
+low-power state. In my case the second I2C write attempt always
+succeeded.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105854
+Cc: Clinton Taylor <clinton.a.taylor@intel.com>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Imre Deak <imre.deak@intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180416155309.11100-1-imre.deak@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_dp_dual_mode_helper.c | 39 ++++++++++++++++++++++++------
+ 1 file changed, 32 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/drm_dp_dual_mode_helper.c
++++ b/drivers/gpu/drm/drm_dp_dual_mode_helper.c
+@@ -350,19 +350,44 @@ int drm_dp_dual_mode_set_tmds_output(enu
+ {
+ uint8_t tmds_oen = enable ? 0 : DP_DUAL_MODE_TMDS_DISABLE;
+ ssize_t ret;
++ int retry;
+
+ if (type < DRM_DP_DUAL_MODE_TYPE2_DVI)
+ return 0;
+
+- ret = drm_dp_dual_mode_write(adapter, DP_DUAL_MODE_TMDS_OEN,
+- &tmds_oen, sizeof(tmds_oen));
+- if (ret) {
+- DRM_DEBUG_KMS("Failed to %s TMDS output buffers\n",
+- enable ? "enable" : "disable");
+- return ret;
++ /*
++ * LSPCON adapters in low-power state may ignore the first write, so
++ * read back and verify the written value a few times.
++ */
++ for (retry = 0; retry < 3; retry++) {
++ uint8_t tmp;
++
++ ret = drm_dp_dual_mode_write(adapter, DP_DUAL_MODE_TMDS_OEN,
++ &tmds_oen, sizeof(tmds_oen));
++ if (ret) {
++ DRM_DEBUG_KMS("Failed to %s TMDS output buffers (%d attempts)\n",
++ enable ? "enable" : "disable",
++ retry + 1);
++ return ret;
++ }
++
++ ret = drm_dp_dual_mode_read(adapter, DP_DUAL_MODE_TMDS_OEN,
++ &tmp, sizeof(tmp));
++ if (ret) {
++ DRM_DEBUG_KMS("I2C read failed during TMDS output buffer %s (%d attempts)\n",
++ enable ? "enabling" : "disabling",
++ retry + 1);
++ return ret;
++ }
++
++ if (tmp == tmds_oen)
++ return 0;
+ }
+
+- return 0;
++ DRM_DEBUG_KMS("I2C write value mismatch during TMDS output buffer %s\n",
++ enable ? "enabling" : "disabling");
++
++ return -EIO;
+ }
+ EXPORT_SYMBOL(drm_dp_dual_mode_set_tmds_output);
+
--- /dev/null
+From 9f591ae60e1be026901398ef99eede91237aa3a1 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Wed, 21 Mar 2018 15:08:47 +0100
+Subject: drm/i915/gvt: throw error on unhandled vfio ioctls
+
+From: Gerd Hoffmann <kraxel@redhat.com>
+
+commit 9f591ae60e1be026901398ef99eede91237aa3a1 upstream.
+
+On unknown/unhandled ioctls the driver should return an error, so
+userspace knows it tried to use something unsupported.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/gvt/kvmgt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
++++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
+@@ -1153,7 +1153,7 @@ static long intel_vgpu_ioctl(struct mdev
+ return 0;
+ }
+
+- return 0;
++ return -ENOTTY;
+ }
+
+ static ssize_t
--- /dev/null
+From c0db1b677e1d584fab5d7ac76a32e1c0157542e0 Mon Sep 17 00:00:00 2001
+From: Daniel J Blueman <daniel@quora.org>
+Date: Mon, 2 Apr 2018 15:10:35 +0800
+Subject: drm/vc4: Fix memory leak during BO teardown
+
+From: Daniel J Blueman <daniel@quora.org>
+
+commit c0db1b677e1d584fab5d7ac76a32e1c0157542e0 upstream.
+
+During BO teardown, an indirect list 'uniform_addr_offsets' wasn't being
+freed leading to leaking many 128B allocations. Fix the memory leak by
+releasing it at teardown time.
+
+Cc: stable@vger.kernel.org
+Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.")
+Signed-off-by: Daniel J Blueman <daniel@quora.org>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Reviewed-by: Eric Anholt <eric@anholt.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180402071035.25356-1-daniel@quora.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vc4/vc4_bo.c | 2 ++
+ drivers/gpu/drm/vc4/vc4_validate_shaders.c | 1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_bo.c
++++ b/drivers/gpu/drm/vc4/vc4_bo.c
+@@ -173,6 +173,7 @@ static void vc4_bo_destroy(struct vc4_bo
+ vc4_bo_set_label(obj, -1);
+
+ if (bo->validated_shader) {
++ kfree(bo->validated_shader->uniform_addr_offsets);
+ kfree(bo->validated_shader->texture_samples);
+ kfree(bo->validated_shader);
+ bo->validated_shader = NULL;
+@@ -432,6 +433,7 @@ void vc4_free_object(struct drm_gem_obje
+ }
+
+ if (bo->validated_shader) {
++ kfree(bo->validated_shader->uniform_addr_offsets);
+ kfree(bo->validated_shader->texture_samples);
+ kfree(bo->validated_shader);
+ bo->validated_shader = NULL;
+--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
++++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+@@ -942,6 +942,7 @@ vc4_validate_shader(struct drm_gem_cma_o
+ fail:
+ kfree(validation_state.branch_targets);
+ if (validated_shader) {
++ kfree(validated_shader->uniform_addr_offsets);
+ kfree(validated_shader->texture_samples);
+ kfree(validated_shader);
+ }
--- /dev/null
+From 10daf10ab154e31237a8c07242be3063fb6a9bf4 Mon Sep 17 00:00:00 2001
+From: Dou Liyang <douly.fnst@cn.fujitsu.com>
+Date: Thu, 12 Apr 2018 09:40:52 +0800
+Subject: x86/acpi: Prevent X2APIC id 0xffffffff from being accounted
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dou Liyang <douly.fnst@cn.fujitsu.com>
+
+commit 10daf10ab154e31237a8c07242be3063fb6a9bf4 upstream.
+
+RongQing reported that there are some X2APIC id 0xffffffff in his machine's
+ACPI MADT table, which makes the number of possible CPU inaccurate.
+
+The reason is that the ACPI X2APIC parser has no sanity check for APIC ID
+0xffffffff, which is an invalid id in all APIC types. See "Intel® 64
+Architecture x2APIC Specification", Chapter 2.4.1.
+
+Add a sanity check to acpi_parse_x2apic() which ignores the invalid id.
+
+Reported-by: Li RongQing <lirongqing@baidu.com>
+Signed-off-by: Dou Liyang <douly.fnst@cn.fujitsu.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: stable@vger.kernel.org
+Cc: len.brown@intel.com
+Cc: rjw@rjwysocki.net
+Cc: hpa@zytor.com
+Link: https://lkml.kernel.org/r/20180412014052.25186-1-douly.fnst@cn.fujitsu.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/acpi/boot.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/x86/kernel/acpi/boot.c
++++ b/arch/x86/kernel/acpi/boot.c
+@@ -215,6 +215,10 @@ acpi_parse_x2apic(struct acpi_subtable_h
+ apic_id = processor->local_apic_id;
+ enabled = processor->lapic_flags & ACPI_MADT_ENABLED;
+
++ /* Ignore invalid ID */
++ if (apic_id == 0xffffffff)
++ return 0;
++
+ /*
+ * We need to register disabled CPU as well to permit
+ * counting disabled CPUs. This allows us to size
--- /dev/null
+From d3878e164dcd3925a237a20e879432400e369172 Mon Sep 17 00:00:00 2001
+From: Xiaoming Gao <gxm.linux.kernel@gmail.com>
+Date: Fri, 13 Apr 2018 17:48:08 +0800
+Subject: x86/tsc: Prevent 32bit truncation in calc_hpet_ref()
+
+From: Xiaoming Gao <gxm.linux.kernel@gmail.com>
+
+commit d3878e164dcd3925a237a20e879432400e369172 upstream.
+
+The TSC calibration code uses HPET as reference. The conversion normalizes
+the delta of two HPET timestamps:
+
+ hpetref = ((tshpet1 - tshpet2) * HPET_PERIOD) / 1e6
+
+and then divides the normalized delta of the corresponding TSC timestamps
+by the result to calulate the TSC frequency.
+
+ tscfreq = ((tstsc1 - tstsc2 ) * 1e6) / hpetref
+
+This uses do_div() which takes an u32 as the divisor, which worked so far
+because the HPET frequency was low enough that 'hpetref' never exceeded
+32bit.
+
+On Skylake machines the HPET frequency increased so 'hpetref' can exceed
+32bit. do_div() truncates the divisor, which causes the calibration to
+fail.
+
+Use div64_u64() to avoid the problem.
+
+[ tglx: Fixes whitespace mangled patch and rewrote changelog ]
+
+Signed-off-by: Xiaoming Gao <newtongao@tencent.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: stable@vger.kernel.org
+Cc: peterz@infradead.org
+Cc: hpa@zytor.com
+Link: https://lkml.kernel.org/r/38894564-4fc9-b8ec-353f-de702839e44e@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/tsc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/tsc.c
++++ b/arch/x86/kernel/tsc.c
+@@ -316,7 +316,7 @@ static unsigned long calc_hpet_ref(u64 d
+ hpet2 -= hpet1;
+ tmp = ((u64)hpet2 * hpet_readl(HPET_PERIOD));
+ do_div(tmp, 1000000);
+- do_div(deltatsc, tmp);
++ deltatsc = div64_u64(deltatsc, tmp);
+
+ return (unsigned long) deltatsc;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
