--- /dev/null
+From 4febced15ac8ddb9cf3e603edb111842e4863d9a Mon Sep 17 00:00:00 2001
+From: Jerome Brunet <jbrunet@baylibre.com>
+Date: Wed, 27 Jun 2018 17:36:38 +0200
+Subject: ASoC: dpcm: don't merge format from invalid codec dai
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+commit 4febced15ac8ddb9cf3e603edb111842e4863d9a upstream.
+
+When merging codec formats, dpcm_runtime_base_format() should skip
+the codecs which are not supporting the current stream direction.
+
+At the moment, if a BE link has more than one codec, and only one
+of these codecs has no capture DAI, it becomes impossible to start
+a capture stream because the merged format would be 0.
+
+Skipping invalid codec DAI solves the problem.
+
+Fixes: b073ed4e2126 ("ASoC: soc-pcm: DPCM cares BE format")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-pcm.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -1694,6 +1694,14 @@ static u64 dpcm_runtime_base_format(stru
+ int i;
+
+ for (i = 0; i < be->num_codecs; i++) {
++ /*
++ * Skip CODECs which don't support the current stream
++ * type. See soc_pcm_init_runtime_hw() for more details
++ */
++ if (!snd_soc_dai_stream_valid(be->codec_dais[i],
++ stream))
++ continue;
++
+ codec_dai_drv = be->codec_dais[i]->driver;
+ if (stream == SNDRV_PCM_STREAM_PLAYBACK)
+ codec_stream = &codec_dai_drv->playback;
--- /dev/null
+From ae1c696a480c67c45fb23b35162183f72c6be0e1 Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Thu, 26 Jul 2018 15:49:10 -0500
+Subject: ASoC: sirf: Fix potential NULL pointer dereference
+
+From: Gustavo A. R. Silva <gustavo@embeddedor.com>
+
+commit ae1c696a480c67c45fb23b35162183f72c6be0e1 upstream.
+
+There is a potential execution path in which function
+platform_get_resource() returns NULL. If this happens,
+we will end up having a NULL pointer dereference.
+
+Fix this by replacing devm_ioremap with devm_ioremap_resource,
+which has the NULL check and the memory region request.
+
+This code was detected with the help of Coccinelle.
+
+Cc: stable@vger.kernel.org
+Fixes: 2bd8d1d5cf89 ("ASoC: sirf: Add audio usp interface driver")
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/sirf/sirf-usp.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/sound/soc/sirf/sirf-usp.c
++++ b/sound/soc/sirf/sirf-usp.c
+@@ -370,10 +370,9 @@ static int sirf_usp_pcm_probe(struct pla
+ platform_set_drvdata(pdev, usp);
+
+ mem_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- base = devm_ioremap(&pdev->dev, mem_res->start,
+- resource_size(mem_res));
+- if (base == NULL)
+- return -ENOMEM;
++ base = devm_ioremap_resource(&pdev->dev, mem_res);
++ if (IS_ERR(base))
++ return PTR_ERR(base);
+ usp->regmap = devm_regmap_init_mmio(&pdev->dev, base,
+ &sirf_usp_regmap_config);
+ if (IS_ERR(usp->regmap))
--- /dev/null
+From b1470d4ce77c2d60661c7d5325d4fb8063e15ff8 Mon Sep 17 00:00:00 2001
+From: Ajit Pandey <ajit.pandey@cirrus.com>
+Date: Tue, 7 Aug 2018 18:30:42 +0100
+Subject: ASoC: wm_adsp: Correct DSP pointer for preloader control
+
+From: Ajit Pandey <ajit.pandey@cirrus.com>
+
+commit b1470d4ce77c2d60661c7d5325d4fb8063e15ff8 upstream.
+
+The offset of the DSP core needs to be taken into account for the DSP
+preloader control get and put. Currently the dsp->preloaded variable
+will only ever be read/updated on the first DSP, whilst this doesn't
+affect the operation of the control the readback will be incorrect.
+
+Signed-off-by: Ajit Pandey <ajit.pandey@cirrus.com>
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm_adsp.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -2642,7 +2642,10 @@ int wm_adsp2_preloader_get(struct snd_kc
+ struct snd_ctl_elem_value *ucontrol)
+ {
+ struct snd_soc_component *component = snd_soc_kcontrol_component(kcontrol);
+- struct wm_adsp *dsp = snd_soc_component_get_drvdata(component);
++ struct wm_adsp *dsps = snd_soc_component_get_drvdata(component);
++ struct soc_mixer_control *mc =
++ (struct soc_mixer_control *)kcontrol->private_value;
++ struct wm_adsp *dsp = &dsps[mc->shift - 1];
+
+ ucontrol->value.integer.value[0] = dsp->preloaded;
+
+@@ -2654,10 +2657,11 @@ int wm_adsp2_preloader_put(struct snd_kc
+ struct snd_ctl_elem_value *ucontrol)
+ {
+ struct snd_soc_component *component = snd_soc_kcontrol_component(kcontrol);
+- struct wm_adsp *dsp = snd_soc_component_get_drvdata(component);
++ struct wm_adsp *dsps = snd_soc_component_get_drvdata(component);
+ struct snd_soc_dapm_context *dapm = snd_soc_component_get_dapm(component);
+ struct soc_mixer_control *mc =
+ (struct soc_mixer_control *)kcontrol->private_value;
++ struct wm_adsp *dsp = &dsps[mc->shift - 1];
+ char preload[32];
+
+ snprintf(preload, ARRAY_SIZE(preload), "DSP%u Preload", mc->shift);
--- /dev/null
+From c889a45d229938a94b50aadb819def8bb11a6a54 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 25 Jul 2018 22:40:49 +0200
+Subject: ASoC: zte: Fix incorrect PCM format bit usages
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit c889a45d229938a94b50aadb819def8bb11a6a54 upstream.
+
+zx-tdm driver sets the DAI driver definitions with the format bits
+wrongly set with SNDRV_PCM_FORMAT_*, instead of SNDRV_PCM_FMTBIT_*.
+
+This patch corrects the definitions.
+
+Spotted by a sparse warning:
+ sound/soc/zte/zx-tdm.c:363:35: warning: restricted snd_pcm_format_t degrades to integer
+
+Fixes: 870e0ddc4345 ("ASoC: zx-tdm: add zte's tdm controller driver")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/zte/zx-tdm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/zte/zx-tdm.c
++++ b/sound/soc/zte/zx-tdm.c
+@@ -144,8 +144,8 @@ static void zx_tdm_rx_dma_en(struct zx_t
+ #define ZX_TDM_RATES (SNDRV_PCM_RATE_8000 | SNDRV_PCM_RATE_16000)
+
+ #define ZX_TDM_FMTBIT \
+- (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FORMAT_MU_LAW | \
+- SNDRV_PCM_FORMAT_A_LAW)
++ (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_MU_LAW | \
++ SNDRV_PCM_FMTBIT_A_LAW)
+
+ static int zx_tdm_dai_probe(struct snd_soc_dai *dai)
+ {
--- /dev/null
+From 2aa650d1950fce94f696ebd7db30b8830c2c946f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20B=C3=BCsch?= <m@bues.ch>
+Date: Tue, 31 Jul 2018 21:14:04 +0200
+Subject: b43/leds: Ensure NUL-termination of LED name string
+
+From: Michael Buesch <m@bues.ch>
+
+commit 2aa650d1950fce94f696ebd7db30b8830c2c946f upstream.
+
+strncpy might not NUL-terminate the string, if the name equals the buffer size.
+Use strlcpy instead.
+
+Signed-off-by: Michael Buesch <m@bues.ch>
+Cc: stable@vger.kernel.org
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/broadcom/b43/leds.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/b43/leds.c
++++ b/drivers/net/wireless/broadcom/b43/leds.c
+@@ -131,7 +131,7 @@ static int b43_register_led(struct b43_w
+ led->wl = dev->wl;
+ led->index = led_index;
+ led->activelow = activelow;
+- strncpy(led->name, name, sizeof(led->name));
++ strlcpy(led->name, name, sizeof(led->name));
+ atomic_set(&led->state, 0);
+
+ led->led_dev.name = led->name;
--- /dev/null
+From 4d77a89e3924b12f4a5628b21237e57ab4703866 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20B=C3=BCsch?= <m@bues.ch>
+Date: Tue, 31 Jul 2018 21:14:16 +0200
+Subject: b43legacy/leds: Ensure NUL-termination of LED name string
+
+From: Michael Buesch <m@bues.ch>
+
+commit 4d77a89e3924b12f4a5628b21237e57ab4703866 upstream.
+
+strncpy might not NUL-terminate the string, if the name equals the buffer size.
+Use strlcpy instead.
+
+Signed-off-by: Michael Buesch <m@bues.ch>
+Cc: stable@vger.kernel.org
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/broadcom/b43legacy/leds.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/b43legacy/leds.c
++++ b/drivers/net/wireless/broadcom/b43legacy/leds.c
+@@ -101,7 +101,7 @@ static int b43legacy_register_led(struct
+ led->dev = dev;
+ led->index = led_index;
+ led->activelow = activelow;
+- strncpy(led->name, name, sizeof(led->name));
++ strlcpy(led->name, name, sizeof(led->name));
+
+ led->led_dev.name = led->name;
+ led->led_dev.default_trigger = default_trigger;
--- /dev/null
+From 554ec508653688c21d9b8024af73a1ffaa0164b9 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bart.vanassche@wdc.com>
+Date: Mon, 6 Aug 2018 15:34:21 -0700
+Subject: lib/vsprintf: Do not handle %pO[^F] as %px
+
+From: Bart Van Assche <bart.vanassche@wdc.com>
+
+commit 554ec508653688c21d9b8024af73a1ffaa0164b9 upstream.
+
+This patch avoids that gcc reports the following when building with W=1:
+
+lib/vsprintf.c:1941:3: warning: this statement may fall through [-Wimplicit-fallthrough=]
+ switch (fmt[1]) {
+ ^~~~~~
+
+Fixes: 7b1924a1d930eb2 ("vsprintf: add printk specifier %px")
+Link: http://lkml.kernel.org/r/20180806223421.11995-1-bart.vanassche@wdc.com
+Cc: linux-kernel@vger.kernel.org
+Cc: Bart Van Assche <bart.vanassche@wdc.com>
+Cc: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
+Cc: Joe Perches <joe@perches.com>
+Cc: Rob Herring <robh@kernel.org>
+Cc: v4.15+ <stable@vger.kernel.org>
+Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ lib/vsprintf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/lib/vsprintf.c
++++ b/lib/vsprintf.c
+@@ -1942,6 +1942,7 @@ char *pointer(const char *fmt, char *buf
+ case 'F':
+ return device_node_string(buf, end, ptr, spec, fmt + 1);
+ }
++ break;
+ case 'x':
+ return pointer_string(buf, end, ptr, spec);
+ }
--- /dev/null
+From 19da44cd33a3a6ff7c97fff0189999ff15b241e4 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 13 Jul 2018 17:55:15 +0300
+Subject: pinctrl: freescale: off by one in imx1_pinconf_group_dbg_show()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 19da44cd33a3a6ff7c97fff0189999ff15b241e4 upstream.
+
+The info->groups[] array is allocated in imx1_pinctrl_parse_dt(). It
+has info->ngroups elements. Thus the > here should be >= to prevent
+reading one element beyond the end of the array.
+
+Cc: stable@vger.kernel.org
+Fixes: 30612cd90005 ("pinctrl: imx1 core driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Uwe Kleine-König <u.kleine-könig@pengutronix.de>
+Acked-by: Dong Aisheng <Aisheng.dong@nxp.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/freescale/pinctrl-imx1-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/freescale/pinctrl-imx1-core.c
++++ b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
+@@ -429,7 +429,7 @@ static void imx1_pinconf_group_dbg_show(
+ const char *name;
+ int i, ret;
+
+- if (group > info->ngroups)
++ if (group >= info->ngroups)
+ return;
+
+ seq_puts(s, "\n");
--- /dev/null
+From 15b6c3c9568765f0717b2dd3aa67a5f7eadd9734 Mon Sep 17 00:00:00 2001
+From: Himanshu Madhani <himanshu.madhani@cavium.com>
+Date: Thu, 2 Aug 2018 13:16:55 -0700
+Subject: scsi: qla2xxx: Fix stalled relogin
+
+From: Himanshu Madhani <himanshu.madhani@cavium.com>
+
+commit 15b6c3c9568765f0717b2dd3aa67a5f7eadd9734 upstream.
+
+This patch sets and clears FCF_ASYNC_{SENT|ACTIVE} flags to prevent
+stalling of relogin attempt. Once flag are correctly set/cleared, relogin
+timer can retry relogin attempt for driver to continue login.
+
+Fixes: fa83e65885b9 ("scsi: qla2xxx: ensure async flags are reset correctly")
+Cc: stable@vger.kernel.org #4.17
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_init.c | 2 +-
+ drivers/scsi/qla2xxx/qla_iocb.c | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -382,7 +382,7 @@ qla2x00_async_adisc_sp_done(void *ptr, i
+ "Async done-%s res %x %8phC\n",
+ sp->name, res, sp->fcport->port_name);
+
+- sp->fcport->flags &= ~FCF_ASYNC_SENT;
++ sp->fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
+
+ memset(&ea, 0, sizeof(ea));
+ ea.event = FCME_ADISC_DONE;
+--- a/drivers/scsi/qla2xxx/qla_iocb.c
++++ b/drivers/scsi/qla2xxx/qla_iocb.c
+@@ -2656,6 +2656,7 @@ qla24xx_els_dcmd2_iocb(scsi_qla_host_t *
+ ql_dbg(ql_dbg_io, vha, 0x3073,
+ "Enter: PLOGI portid=%06x\n", fcport->d_id.b24);
+
++ fcport->flags |= FCF_ASYNC_SENT;
+ sp->type = SRB_ELS_DCMD;
+ sp->name = "ELS_DCMD";
+ sp->fcport = fcport;
fuse-umount-should-wait-for-all-requests.patch
fuse-fix-oops-at-process_init_reply.patch
fuse-add-missed-unlock_page-to-fuse_readpages_fill.patch
+lib-vsprintf-do-not-handle-po-as-px.patch
+udl-kms-change-down_interruptible-to-down.patch
+udl-kms-handle-allocation-failure.patch
+udl-kms-fix-crash-due-to-uninitialized-memory.patch
+udl-kms-avoid-division.patch
+b43legacy-leds-ensure-nul-termination-of-led-name-string.patch
+b43-leds-ensure-nul-termination-of-led-name-string.patch
+asoc-dpcm-don-t-merge-format-from-invalid-codec-dai.patch
+asoc-zte-fix-incorrect-pcm-format-bit-usages.patch
+asoc-sirf-fix-potential-null-pointer-dereference.patch
+asoc-wm_adsp-correct-dsp-pointer-for-preloader-control.patch
+soc-qcom-rmtfs-mem-fix-memleak-in-probe-error-paths.patch
+pinctrl-freescale-off-by-one-in-imx1_pinconf_group_dbg_show.patch
+scsi-qla2xxx-fix-stalled-relogin.patch
x86-kvm-avoid-unused-variable-warning.patch
--- /dev/null
+From 78ee559d7fc65e37670a46cfbeaaa62cb014af67 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 12 Jun 2018 14:41:41 +0200
+Subject: soc: qcom: rmtfs-mem: fix memleak in probe error paths
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 78ee559d7fc65e37670a46cfbeaaa62cb014af67 upstream.
+
+Make sure to set the mem device release callback before calling
+put_device() in a couple of probe error paths so that the containing
+object also gets freed.
+
+Fixes: d1de6d6c639b ("soc: qcom: Remote filesystem memory driver")
+Cc: stable <stable@vger.kernel.org> # 4.15
+Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/soc/qcom/rmtfs_mem.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/soc/qcom/rmtfs_mem.c
++++ b/drivers/soc/qcom/rmtfs_mem.c
+@@ -184,6 +184,7 @@ static int qcom_rmtfs_mem_probe(struct p
+ device_initialize(&rmtfs_mem->dev);
+ rmtfs_mem->dev.parent = &pdev->dev;
+ rmtfs_mem->dev.groups = qcom_rmtfs_mem_groups;
++ rmtfs_mem->dev.release = qcom_rmtfs_mem_release_device;
+
+ rmtfs_mem->base = devm_memremap(&rmtfs_mem->dev, rmtfs_mem->addr,
+ rmtfs_mem->size, MEMREMAP_WC);
+@@ -206,8 +207,6 @@ static int qcom_rmtfs_mem_probe(struct p
+ goto put_device;
+ }
+
+- rmtfs_mem->dev.release = qcom_rmtfs_mem_release_device;
+-
+ ret = of_property_read_u32(node, "qcom,vmid", &vmid);
+ if (ret < 0 && ret != -EINVAL) {
+ dev_err(&pdev->dev, "failed to parse qcom,vmid\n");
--- /dev/null
+From 91ba11fb7d7ca0a3bbe8a512e65e666e2ec1e889 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Sun, 3 Jun 2018 16:41:00 +0200
+Subject: udl-kms: avoid division
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 91ba11fb7d7ca0a3bbe8a512e65e666e2ec1e889 upstream.
+
+Division is slow, so it shouldn't be done by the pixel generating code.
+The driver supports only 2 or 4 bytes per pixel, so we can replace
+division with a shift.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/udl/udl_drv.h | 2 -
+ drivers/gpu/drm/udl/udl_fb.c | 15 ++++++++------
+ drivers/gpu/drm/udl/udl_transfer.c | 39 ++++++++++++++++++-------------------
+ 3 files changed, 30 insertions(+), 26 deletions(-)
+
+--- a/drivers/gpu/drm/udl/udl_drv.h
++++ b/drivers/gpu/drm/udl/udl_drv.h
+@@ -112,7 +112,7 @@ udl_fb_user_fb_create(struct drm_device
+ struct drm_file *file,
+ const struct drm_mode_fb_cmd2 *mode_cmd);
+
+-int udl_render_hline(struct drm_device *dev, int bpp, struct urb **urb_ptr,
++int udl_render_hline(struct drm_device *dev, int log_bpp, struct urb **urb_ptr,
+ const char *front, char **urb_buf_ptr,
+ u32 byte_offset, u32 device_byte_offset, u32 byte_width,
+ int *ident_ptr, int *sent_ptr);
+--- a/drivers/gpu/drm/udl/udl_fb.c
++++ b/drivers/gpu/drm/udl/udl_fb.c
+@@ -90,7 +90,10 @@ int udl_handle_damage(struct udl_framebu
+ int bytes_identical = 0;
+ struct urb *urb;
+ int aligned_x;
+- int bpp = fb->base.format->cpp[0];
++ int log_bpp;
++
++ BUG_ON(!is_power_of_2(fb->base.format->cpp[0]));
++ log_bpp = __ffs(fb->base.format->cpp[0]);
+
+ if (!fb->active_16)
+ return 0;
+@@ -125,12 +128,12 @@ int udl_handle_damage(struct udl_framebu
+
+ for (i = y; i < y + height ; i++) {
+ const int line_offset = fb->base.pitches[0] * i;
+- const int byte_offset = line_offset + (x * bpp);
+- const int dev_byte_offset = (fb->base.width * bpp * i) + (x * bpp);
+- if (udl_render_hline(dev, bpp, &urb,
++ const int byte_offset = line_offset + (x << log_bpp);
++ const int dev_byte_offset = (fb->base.width * i + x) << log_bpp;
++ if (udl_render_hline(dev, log_bpp, &urb,
+ (char *) fb->obj->vmapping,
+ &cmd, byte_offset, dev_byte_offset,
+- width * bpp,
++ width << log_bpp,
+ &bytes_identical, &bytes_sent))
+ goto error;
+ }
+@@ -149,7 +152,7 @@ int udl_handle_damage(struct udl_framebu
+ error:
+ atomic_add(bytes_sent, &udl->bytes_sent);
+ atomic_add(bytes_identical, &udl->bytes_identical);
+- atomic_add(width*height*bpp, &udl->bytes_rendered);
++ atomic_add((width * height) << log_bpp, &udl->bytes_rendered);
+ end_cycles = get_cycles();
+ atomic_add(((unsigned int) ((end_cycles - start_cycles)
+ >> 10)), /* Kcycles */
+--- a/drivers/gpu/drm/udl/udl_transfer.c
++++ b/drivers/gpu/drm/udl/udl_transfer.c
+@@ -83,12 +83,12 @@ static inline u16 pixel32_to_be16(const
+ ((pixel >> 8) & 0xf800));
+ }
+
+-static inline u16 get_pixel_val16(const uint8_t *pixel, int bpp)
++static inline u16 get_pixel_val16(const uint8_t *pixel, int log_bpp)
+ {
+- u16 pixel_val16 = 0;
+- if (bpp == 2)
++ u16 pixel_val16;
++ if (log_bpp == 1)
+ pixel_val16 = *(const uint16_t *)pixel;
+- else if (bpp == 4)
++ else
+ pixel_val16 = pixel32_to_be16(*(const uint32_t *)pixel);
+ return pixel_val16;
+ }
+@@ -125,8 +125,9 @@ static void udl_compress_hline16(
+ const u8 *const pixel_end,
+ uint32_t *device_address_ptr,
+ uint8_t **command_buffer_ptr,
+- const uint8_t *const cmd_buffer_end, int bpp)
++ const uint8_t *const cmd_buffer_end, int log_bpp)
+ {
++ const int bpp = 1 << log_bpp;
+ const u8 *pixel = *pixel_start_ptr;
+ uint32_t dev_addr = *device_address_ptr;
+ uint8_t *cmd = *command_buffer_ptr;
+@@ -153,12 +154,12 @@ static void udl_compress_hline16(
+ raw_pixels_count_byte = cmd++; /* we'll know this later */
+ raw_pixel_start = pixel;
+
+- cmd_pixel_end = pixel + min3(MAX_CMD_PIXELS + 1UL,
+- (unsigned long)(pixel_end - pixel) / bpp,
+- (unsigned long)(cmd_buffer_end - 1 - cmd) / 2) * bpp;
++ cmd_pixel_end = pixel + (min3(MAX_CMD_PIXELS + 1UL,
++ (unsigned long)(pixel_end - pixel) >> log_bpp,
++ (unsigned long)(cmd_buffer_end - 1 - cmd) / 2) << log_bpp);
+
+ prefetch_range((void *) pixel, cmd_pixel_end - pixel);
+- pixel_val16 = get_pixel_val16(pixel, bpp);
++ pixel_val16 = get_pixel_val16(pixel, log_bpp);
+
+ while (pixel < cmd_pixel_end) {
+ const u8 *const start = pixel;
+@@ -170,7 +171,7 @@ static void udl_compress_hline16(
+ pixel += bpp;
+
+ while (pixel < cmd_pixel_end) {
+- pixel_val16 = get_pixel_val16(pixel, bpp);
++ pixel_val16 = get_pixel_val16(pixel, log_bpp);
+ if (pixel_val16 != repeating_pixel_val16)
+ break;
+ pixel += bpp;
+@@ -179,10 +180,10 @@ static void udl_compress_hline16(
+ if (unlikely(pixel > start + bpp)) {
+ /* go back and fill in raw pixel count */
+ *raw_pixels_count_byte = (((start -
+- raw_pixel_start) / bpp) + 1) & 0xFF;
++ raw_pixel_start) >> log_bpp) + 1) & 0xFF;
+
+ /* immediately after raw data is repeat byte */
+- *cmd++ = (((pixel - start) / bpp) - 1) & 0xFF;
++ *cmd++ = (((pixel - start) >> log_bpp) - 1) & 0xFF;
+
+ /* Then start another raw pixel span */
+ raw_pixel_start = pixel;
+@@ -192,14 +193,14 @@ static void udl_compress_hline16(
+
+ if (pixel > raw_pixel_start) {
+ /* finalize last RAW span */
+- *raw_pixels_count_byte = ((pixel-raw_pixel_start) / bpp) & 0xFF;
++ *raw_pixels_count_byte = ((pixel - raw_pixel_start) >> log_bpp) & 0xFF;
+ } else {
+ /* undo unused byte */
+ cmd--;
+ }
+
+- *cmd_pixels_count_byte = ((pixel - cmd_pixel_start) / bpp) & 0xFF;
+- dev_addr += ((pixel - cmd_pixel_start) / bpp) * 2;
++ *cmd_pixels_count_byte = ((pixel - cmd_pixel_start) >> log_bpp) & 0xFF;
++ dev_addr += ((pixel - cmd_pixel_start) >> log_bpp) * 2;
+ }
+
+ if (cmd_buffer_end <= MIN_RLX_CMD_BYTES + cmd) {
+@@ -222,19 +223,19 @@ static void udl_compress_hline16(
+ * (that we can only write to, slowly, and can never read), and (optionally)
+ * our shadow copy that tracks what's been sent to that hardware buffer.
+ */
+-int udl_render_hline(struct drm_device *dev, int bpp, struct urb **urb_ptr,
++int udl_render_hline(struct drm_device *dev, int log_bpp, struct urb **urb_ptr,
+ const char *front, char **urb_buf_ptr,
+ u32 byte_offset, u32 device_byte_offset,
+ u32 byte_width,
+ int *ident_ptr, int *sent_ptr)
+ {
+ const u8 *line_start, *line_end, *next_pixel;
+- u32 base16 = 0 + (device_byte_offset / bpp) * 2;
++ u32 base16 = 0 + (device_byte_offset >> log_bpp) * 2;
+ struct urb *urb = *urb_ptr;
+ u8 *cmd = *urb_buf_ptr;
+ u8 *cmd_end = (u8 *) urb->transfer_buffer + urb->transfer_buffer_length;
+
+- BUG_ON(!(bpp == 2 || bpp == 4));
++ BUG_ON(!(log_bpp == 1 || log_bpp == 2));
+
+ line_start = (u8 *) (front + byte_offset);
+ next_pixel = line_start;
+@@ -244,7 +245,7 @@ int udl_render_hline(struct drm_device *
+
+ udl_compress_hline16(&next_pixel,
+ line_end, &base16,
+- (u8 **) &cmd, (u8 *) cmd_end, bpp);
++ (u8 **) &cmd, (u8 *) cmd_end, log_bpp);
+
+ if (cmd >= cmd_end) {
+ int len = cmd - (u8 *) urb->transfer_buffer;
--- /dev/null
+From 8456b99c16d193c4c3b7df305cf431e027f0189c Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Sun, 3 Jun 2018 16:40:55 +0200
+Subject: udl-kms: change down_interruptible to down
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 8456b99c16d193c4c3b7df305cf431e027f0189c upstream.
+
+If we leave urbs around, it causes not only leak, but also memory
+corruption. This patch fixes the function udl_free_urb_list, so that it
+always waits for all urbs that are in progress.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/udl/udl_main.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/udl/udl_main.c
++++ b/drivers/gpu/drm/udl/udl_main.c
+@@ -170,18 +170,13 @@ static void udl_free_urb_list(struct drm
+ struct list_head *node;
+ struct urb_node *unode;
+ struct urb *urb;
+- int ret;
+ unsigned long flags;
+
+ DRM_DEBUG("Waiting for completes and freeing all render urbs\n");
+
+ /* keep waiting and freeing, until we've got 'em all */
+ while (count--) {
+-
+- /* Getting interrupted means a leak, but ok at shutdown*/
+- ret = down_interruptible(&udl->urbs.limit_sem);
+- if (ret)
+- break;
++ down(&udl->urbs.limit_sem);
+
+ spin_lock_irqsave(&udl->urbs.lock, flags);
+
--- /dev/null
+From 09a00abe3a9941c2715ca83eb88172cd2f54d8fd Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Sun, 3 Jun 2018 16:40:57 +0200
+Subject: udl-kms: fix crash due to uninitialized memory
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 09a00abe3a9941c2715ca83eb88172cd2f54d8fd upstream.
+
+We must use kzalloc when allocating the fb_deferred_io structure.
+Otherwise, the field first_io is undefined and it causes a crash.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/udl/udl_fb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/udl/udl_fb.c
++++ b/drivers/gpu/drm/udl/udl_fb.c
+@@ -221,7 +221,7 @@ static int udl_fb_open(struct fb_info *i
+
+ struct fb_deferred_io *fbdefio;
+
+- fbdefio = kmalloc(sizeof(struct fb_deferred_io), GFP_KERNEL);
++ fbdefio = kzalloc(sizeof(struct fb_deferred_io), GFP_KERNEL);
+
+ if (fbdefio) {
+ fbdefio->delay = DL_DEFIO_WRITE_DELAY;
--- /dev/null
+From 542bb9788a1f485eb1a2229178f665d8ea166156 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Sun, 3 Jun 2018 16:40:56 +0200
+Subject: udl-kms: handle allocation failure
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 542bb9788a1f485eb1a2229178f665d8ea166156 upstream.
+
+Allocations larger than PAGE_ALLOC_COSTLY_ORDER are unreliable and they
+may fail anytime. This patch fixes the udl kms driver so that when a large
+alloactions fails, it tries to do multiple smaller allocations.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/udl/udl_main.c | 28 ++++++++++++++++++----------
+ 1 file changed, 18 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/udl/udl_main.c
++++ b/drivers/gpu/drm/udl/udl_main.c
+@@ -200,17 +200,22 @@ static void udl_free_urb_list(struct drm
+ static int udl_alloc_urb_list(struct drm_device *dev, int count, size_t size)
+ {
+ struct udl_device *udl = dev->dev_private;
+- int i = 0;
+ struct urb *urb;
+ struct urb_node *unode;
+ char *buf;
++ size_t wanted_size = count * size;
+
+ spin_lock_init(&udl->urbs.lock);
+
++retry:
+ udl->urbs.size = size;
+ INIT_LIST_HEAD(&udl->urbs.list);
+
+- while (i < count) {
++ sema_init(&udl->urbs.limit_sem, 0);
++ udl->urbs.count = 0;
++ udl->urbs.available = 0;
++
++ while (udl->urbs.count * size < wanted_size) {
+ unode = kzalloc(sizeof(struct urb_node), GFP_KERNEL);
+ if (!unode)
+ break;
+@@ -226,11 +231,16 @@ static int udl_alloc_urb_list(struct drm
+ }
+ unode->urb = urb;
+
+- buf = usb_alloc_coherent(udl->udev, MAX_TRANSFER, GFP_KERNEL,
++ buf = usb_alloc_coherent(udl->udev, size, GFP_KERNEL,
+ &urb->transfer_dma);
+ if (!buf) {
+ kfree(unode);
+ usb_free_urb(urb);
++ if (size > PAGE_SIZE) {
++ size /= 2;
++ udl_free_urb_list(dev);
++ goto retry;
++ }
+ break;
+ }
+
+@@ -241,16 +251,14 @@ static int udl_alloc_urb_list(struct drm
+
+ list_add_tail(&unode->entry, &udl->urbs.list);
+
+- i++;
++ up(&udl->urbs.limit_sem);
++ udl->urbs.count++;
++ udl->urbs.available++;
+ }
+
+- sema_init(&udl->urbs.limit_sem, i);
+- udl->urbs.count = i;
+- udl->urbs.available = i;
+-
+- DRM_DEBUG("allocated %d %d byte urbs\n", i, (int) size);
++ DRM_DEBUG("allocated %d %d byte urbs\n", udl->urbs.count, (int) size);
+
+- return i;
++ return udl->urbs.count;
+ }
+
+ struct urb *udl_get_urb(struct drm_device *dev)
projects / thirdparty / kernel / stable-queue.git / commitdiff
