--- /dev/null
+From 299c2a904b1e8d5096d4813df6371357d97a6cd1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Fredrik=20Sch=C3=B6n?= <fredrikschon@gmail.com>
+Date: Fri, 17 Aug 2018 22:07:28 +0200
+Subject: drm/i915: Increase LSPCON timeout
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Fredrik Schön <fredrikschon@gmail.com>
+
+commit 299c2a904b1e8d5096d4813df6371357d97a6cd1 upstream.
+
+100 ms is not enough time for the LSPCON adapter on Intel NUC devices to
+settle. This causes dropped display modes at boot or screen reconfiguration.
+Empirical testing can reproduce the error up to a timeout of 190 ms. Basic
+boot and stress testing at 200 ms has not (yet) failed.
+
+Increase timeout to 400 ms to get some margin of error.
+
+Changes from v1:
+The initial suggestion of 1000 ms was lowered due to concerns about delaying
+valid timeout cases.
+Update patch metadata.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107503
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1570392
+Fixes: 357c0ae9198a ("drm/i915/lspcon: Wait for expected LSPCON mode to settle")
+Cc: Shashank Sharma <shashank.sharma@intel.com>
+Cc: Imre Deak <imre.deak@intel.com>
+Cc: Jani Nikula <jani.nikula@intel.com>
+Cc: <stable@vger.kernel.org> # v4.11+
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Reviewed-by: Shashank Sharma <shashank.sharma@intel.com>
+Signed-off-by: Fredrik Schön <fredrik.schon@gmail.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180817200728.8154-1-fredrik.schon@gmail.com
+(cherry picked from commit 59f1c8ab30d6f9042562949f42cbd3f3cf69de94)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Reviewed-by: Shashank Sharma <shashank.sharma@intel.com>
+Signed-off-by: Fredrik Schön <fredrik.schon@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/intel_lspcon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_lspcon.c
++++ b/drivers/gpu/drm/i915/intel_lspcon.c
+@@ -75,7 +75,7 @@ static enum drm_lspcon_mode lspcon_wait_
+ lspcon_mode_name(mode));
+
+ wait_for((current_mode = lspcon_get_current_mode(lspcon)) == mode ||
+- current_mode == DRM_LSPCON_MODE_INVALID, 100);
++ current_mode == DRM_LSPCON_MODE_INVALID, 400);
+ if (current_mode != mode)
+ DRM_DEBUG_KMS("LSPCON mode hasn't settled\n");
+
--- /dev/null
+From 01cffe9ded15c0d664e0beb33c594e00c0d57bba Mon Sep 17 00:00:00 2001
+From: Dave Young <dyoung@redhat.com>
+Date: Fri, 1 Dec 2017 20:19:34 +0800
+Subject: HID: add quirk for another PIXART OEM mouse used by HP
+
+From: Dave Young <dyoung@redhat.com>
+
+commit 01cffe9ded15c0d664e0beb33c594e00c0d57bba upstream.
+
+This mouse keep disconnecting in runleve 3 like below, add it needs the
+quirk to mute the anoying messages.
+
+[ 111.230555] usb 2-2: USB disconnect, device number 6
+[ 112.718156] usb 2-2: new low-speed USB device number 7 using xhci_hcd
+[ 112.941594] usb 2-2: New USB device found, idVendor=03f0, idProduct=094a
+[ 112.984866] usb 2-2: New USB device strings: Mfr=1, Product=2, SerialNumber=0
+[ 113.027731] usb 2-2: Product: HP USB Optical Mouse
+[ 113.069977] usb 2-2: Manufacturer: PixArt
+[ 113.113500] input: PixArt HP USB Optical Mouse as /devices/pci0000:00/0000:00:14.0/usb2/2-2/2-2:1.0/0003:03F0:094A.0002/input/input14
+[ 113.156787] hid-generic 0003:03F0:094A.0002: input: USB HID v1.11 Mouse [PixArt HP USB Optical Mouse] on usb-0000:00:14.0-2/input0
+[ 173.262642] usb 2-2: USB disconnect, device number 7
+[ 174.750244] usb 2-2: new low-speed USB device number 8 using xhci_hcd
+[ 174.935740] usb 2-2: New USB device found, idVendor=03f0, idProduct=094a
+[ 174.990435] usb 2-2: New USB device strings: Mfr=1, Product=2, SerialNumber=0
+[ 175.014984] usb 2-2: Product: HP USB Optical Mouse
+[ 175.037886] usb 2-2: Manufacturer: PixArt
+[ 175.061794] input: PixArt HP USB Optical Mouse as /devices/pci0000:00/0000:00:14.0/usb2/2-2/2-2:1.0/0003:03F0:094A.0003/input/input15
+[ 175.084946] hid-generic 0003:03F0:094A.0003: input: USB HID v1.11 Mouse [PixArt HP USB Optical Mouse] on usb-0000:00:14.0-2/input0
+
+Signed-off-by: Dave Young <dyoung@redhat.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/usbhid/hid-quirks.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -528,6 +528,7 @@
+ #define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A 0x0a4a
+ #define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A 0x0b4a
+ #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE 0x134a
++#define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A 0x094a
+
+ #define USB_VENDOR_ID_HUION 0x256c
+ #define USB_DEVICE_ID_HUION_TABLET 0x006e
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -99,6 +99,7 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
++ { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_IDEACOM, USB_DEVICE_ID_IDEACOM_IDC6680, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C007, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077, HID_QUIRK_ALWAYS_POLL },
--- /dev/null
+From cd8ddbf7a5e206fe6995ab0aee245d597dd6a7f2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Javier=20Gonz=C3=A1lez?= <javier@cnexlabs.com>
+Date: Fri, 13 Oct 2017 14:46:03 +0200
+Subject: lightnvm: pblk: free padded entries in write buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Javier González <javier@cnexlabs.com>
+
+commit cd8ddbf7a5e206fe6995ab0aee245d597dd6a7f2 upstream.
+
+When a REQ_FLUSH reaches pblk, the bio cannot be directly completed.
+Instead, data on the write buffer is flushed and the bio is completed on
+the completion pah. This might require some sectors to be padded in
+order to guarantee a successful write.
+
+This patch fixes a memory leak on the padded pages. A consequence of
+this bad free was that internal bios not containing data (only a flush)
+were not being completed.
+
+Fixes: a4bd217b4326 ("lightnvm: physical block device (pblk) target")
+Signed-off-by: Javier González <javier@cnexlabs.com>
+Signed-off-by: Matias Bjørling <m@bjorling.me>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/lightnvm/pblk-core.c | 1 -
+ drivers/lightnvm/pblk-write.c | 7 ++++++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/lightnvm/pblk-core.c
++++ b/drivers/lightnvm/pblk-core.c
+@@ -190,7 +190,6 @@ void pblk_bio_free_pages(struct pblk *pb
+
+ WARN_ON(off + nr_pages != bio->bi_vcnt);
+
+- bio_advance(bio, off * PBLK_EXPOSED_PAGE_SIZE);
+ for (i = off; i < nr_pages + off; i++) {
+ bv = bio->bi_io_vec[i];
+ mempool_free(bv.bv_page, pblk->page_bio_pool);
+--- a/drivers/lightnvm/pblk-write.c
++++ b/drivers/lightnvm/pblk-write.c
+@@ -33,6 +33,10 @@ static unsigned long pblk_end_w_bio(stru
+ bio_endio(original_bio);
+ }
+
++ if (c_ctx->nr_padded)
++ pblk_bio_free_pages(pblk, rqd->bio, c_ctx->nr_valid,
++ c_ctx->nr_padded);
++
+ #ifdef CONFIG_NVM_DEBUG
+ atomic_long_add(c_ctx->nr_valid, &pblk->sync_writes);
+ #endif
+@@ -521,7 +525,8 @@ static void pblk_free_write_rqd(struct p
+ struct bio *bio = rqd->bio;
+
+ if (c_ctx->nr_padded)
+- pblk_bio_free_pages(pblk, bio, rqd->nr_ppas, c_ctx->nr_padded);
++ pblk_bio_free_pages(pblk, bio, c_ctx->nr_valid,
++ c_ctx->nr_padded);
+ }
+
+ static int pblk_submit_write(struct pblk *pblk)
--- /dev/null
+From 77dd66a3c67c93ab401ccc15efff25578be281fd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20H=2E=20Sch=C3=B6nherr?= <jschoenh@amazon.de>
+Date: Fri, 19 Jan 2018 16:26:33 -0800
+Subject: mm: Fix devm_memremap_pages() collision handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jan H. Schönherr <jschoenh@amazon.de>
+
+commit 77dd66a3c67c93ab401ccc15efff25578be281fd upstream.
+
+If devm_memremap_pages() detects a collision while adding entries
+to the radix-tree, we call pgmap_radix_release(). Unfortunately,
+the function removes *all* entries for the range -- including the
+entries that caused the collision in the first place.
+
+Modify pgmap_radix_release() to take an additional argument to
+indicate where to stop, so that only newly added entries are removed
+from the tree.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 9476df7d80df ("mm: introduce find_dev_pagemap()")
+Signed-off-by: Jan H. Schönherr <jschoenh@amazon.de>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/memremap.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/kernel/memremap.c
++++ b/kernel/memremap.c
+@@ -248,13 +248,16 @@ int device_private_entry_fault(struct vm
+ EXPORT_SYMBOL(device_private_entry_fault);
+ #endif /* CONFIG_DEVICE_PRIVATE */
+
+-static void pgmap_radix_release(struct resource *res)
++static void pgmap_radix_release(struct resource *res, unsigned long end_pgoff)
+ {
+ unsigned long pgoff, order;
+
+ mutex_lock(&pgmap_lock);
+- foreach_order_pgoff(res, order, pgoff)
++ foreach_order_pgoff(res, order, pgoff) {
++ if (pgoff >= end_pgoff)
++ break;
+ radix_tree_delete(&pgmap_radix, PHYS_PFN(res->start) + pgoff);
++ }
+ mutex_unlock(&pgmap_lock);
+
+ synchronize_rcu();
+@@ -309,7 +312,7 @@ static void devm_memremap_pages_release(
+ mem_hotplug_done();
+
+ untrack_pfn(NULL, PHYS_PFN(align_start), align_size);
+- pgmap_radix_release(res);
++ pgmap_radix_release(res, -1);
+ dev_WARN_ONCE(dev, pgmap->altmap && pgmap->altmap->alloc,
+ "%s: failed to free all reserved pages\n", __func__);
+ }
+@@ -459,7 +462,7 @@ void *devm_memremap_pages(struct device
+ untrack_pfn(NULL, PHYS_PFN(align_start), align_size);
+ err_pfn_remap:
+ err_radix:
+- pgmap_radix_release(res);
++ pgmap_radix_release(res, pgoff);
+ devres_free(page_map);
+ return ERR_PTR(error);
+ }
--- /dev/null
+From 295d6d5e373607729bcc8182c25afe964655714f Mon Sep 17 00:00:00 2001
+From: Luca Abeni <luca.abeni@santannapisa.it>
+Date: Thu, 7 Sep 2017 12:09:29 +0200
+Subject: sched/deadline: Fix switching to -deadline
+
+From: Luca Abeni <luca.abeni@santannapisa.it>
+
+commit 295d6d5e373607729bcc8182c25afe964655714f upstream.
+
+Fix a bug introduced in:
+
+ 72f9f3fdc928 ("sched/deadline: Remove dl_new from struct sched_dl_entity")
+
+After that commit, when switching to -deadline if the scheduling
+deadline of a task is in the past then switched_to_dl() calls
+setup_new_entity() to properly initialize the scheduling deadline
+and runtime.
+
+The problem is that the task is enqueued _before_ having its parameters
+initialized by setup_new_entity(), and this can cause problems.
+For example, a task with its out-of-date deadline in the past will
+potentially be enqueued as the highest priority one; however, its
+adjusted deadline may not be the earliest one.
+
+This patch fixes the problem by initializing the task's parameters before
+enqueuing it.
+
+Signed-off-by: luca abeni <luca.abeni@santannapisa.it>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Juri Lelli <juri.lelli@arm.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Cc: Mike Galbraith <efault@gmx.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/1504778971-13573-3-git-send-email-luca.abeni@santannapisa.it
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/sched/deadline.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -1365,6 +1365,10 @@ enqueue_dl_entity(struct sched_dl_entity
+ update_dl_entity(dl_se, pi_se);
+ } else if (flags & ENQUEUE_REPLENISH) {
+ replenish_dl_entity(dl_se, pi_se);
++ } else if ((flags & ENQUEUE_RESTORE) &&
++ dl_time_before(dl_se->deadline,
++ rq_clock(rq_of_dl_rq(dl_rq_of_se(dl_se))))) {
++ setup_new_dl_entity(dl_se);
+ }
+
+ __enqueue_dl_entity(dl_se);
+@@ -2256,13 +2260,6 @@ static void switched_to_dl(struct rq *rq
+
+ return;
+ }
+- /*
+- * If p is boosted we already updated its params in
+- * rt_mutex_setprio()->enqueue_task(..., ENQUEUE_REPLENISH),
+- * p's deadline being now already after rq_clock(rq).
+- */
+- if (dl_time_before(p->dl.deadline, rq_clock(rq)))
+- setup_new_dl_entity(&p->dl);
+
+ if (rq->curr != p) {
+ #ifdef CONFIG_SMP
drm-amdgpu-add-vcn-booting-with-firmware-loaded-by-psp.patch
uapi-linux-keyctl.h-don-t-use-c-reserved-keyword-as-a-struct-member-name.patch
debugobjects-make-stack-check-warning-more-informative.patch
+sched-deadline-fix-switching-to-deadline.patch
+lightnvm-pblk-free-padded-entries-in-write-buffer.patch
+mm-fix-devm_memremap_pages-collision-handling.patch
+hid-add-quirk-for-another-pixart-oem-mouse-used-by-hp.patch
+usb-dwc3-core-fix-ulpi-phys-and-prevent-phy_get-ulpi_init-during-suspend-resume.patch
+x86-pae-use-64-bit-atomic-xchg-function-in-native_ptep_get_and_clear.patch
+x86-xen-don-t-write-ptes-directly-in-32-bit-pv-guests.patch
+drm-i915-increase-lspcon-timeout.patch
--- /dev/null
+From 98112041bcca164676367e261c8c1073ef70cb51 Mon Sep 17 00:00:00 2001
+From: Roger Quadros <rogerq@ti.com>
+Date: Mon, 12 Feb 2018 15:30:08 +0200
+Subject: usb: dwc3: core: Fix ULPI PHYs and prevent phy_get/ulpi_init during suspend/resume
+
+From: Roger Quadros <rogerq@ti.com>
+
+commit 98112041bcca164676367e261c8c1073ef70cb51 upstream.
+
+In order for ULPI PHYs to work, dwc3_phy_setup() and dwc3_ulpi_init()
+must be doene before dwc3_core_get_phy().
+
+commit 541768b08a40 ("usb: dwc3: core: Call dwc3_core_get_phy() before initializing phys")
+broke this.
+
+The other issue is that dwc3_core_get_phy() and dwc3_ulpi_init() should
+be called only once during the life cycle of the driver. However,
+as dwc3_core_init() is called during system suspend/resume it will
+result in multiple calls to dwc3_core_get_phy() and dwc3_ulpi_init()
+which is wrong.
+
+Fix this by moving dwc3_ulpi_init() out of dwc3_phy_setup()
+into dwc3_core_ulpi_init(). Use a flag 'ulpi_ready' to ensure that
+dwc3_core_ulpi_init() is called only once from dwc3_core_init().
+
+Use another flag 'phys_ready' to call dwc3_core_get_phy() only once from
+dwc3_core_init().
+
+Fixes: 541768b08a40 ("usb: dwc3: core: Call dwc3_core_get_phy() before initializing phys")
+Fixes: f54edb539c11 ("usb: dwc3: core: initialize ULPI before trying to get the PHY")
+Cc: linux-stable <stable@vger.kernel.org> # >= v4.13
+Signed-off-by: Roger Quadros <rogerq@ti.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/core.c | 47 ++++++++++++++++++++++++++++++++++++-----------
+ drivers/usb/dwc3/core.h | 5 +++++
+ 2 files changed, 41 insertions(+), 11 deletions(-)
+
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -511,6 +511,22 @@ static void dwc3_cache_hwparams(struct d
+ parms->hwparams8 = dwc3_readl(dwc->regs, DWC3_GHWPARAMS8);
+ }
+
++static int dwc3_core_ulpi_init(struct dwc3 *dwc)
++{
++ int intf;
++ int ret = 0;
++
++ intf = DWC3_GHWPARAMS3_HSPHY_IFC(dwc->hwparams.hwparams3);
++
++ if (intf == DWC3_GHWPARAMS3_HSPHY_IFC_ULPI ||
++ (intf == DWC3_GHWPARAMS3_HSPHY_IFC_UTMI_ULPI &&
++ dwc->hsphy_interface &&
++ !strncmp(dwc->hsphy_interface, "ulpi", 4)))
++ ret = dwc3_ulpi_init(dwc);
++
++ return ret;
++}
++
+ /**
+ * dwc3_phy_setup - Configure USB PHY Interface of DWC3 Core
+ * @dwc: Pointer to our controller context structure
+@@ -522,7 +538,6 @@ static void dwc3_cache_hwparams(struct d
+ static int dwc3_phy_setup(struct dwc3 *dwc)
+ {
+ u32 reg;
+- int ret;
+
+ reg = dwc3_readl(dwc->regs, DWC3_GUSB3PIPECTL(0));
+
+@@ -593,9 +608,6 @@ static int dwc3_phy_setup(struct dwc3 *d
+ }
+ /* FALLTHROUGH */
+ case DWC3_GHWPARAMS3_HSPHY_IFC_ULPI:
+- ret = dwc3_ulpi_init(dwc);
+- if (ret)
+- return ret;
+ /* FALLTHROUGH */
+ default:
+ break;
+@@ -752,6 +764,7 @@ static void dwc3_core_setup_global_contr
+ }
+
+ static int dwc3_core_get_phy(struct dwc3 *dwc);
++static int dwc3_core_ulpi_init(struct dwc3 *dwc);
+
+ /**
+ * dwc3_core_init - Low-level initialization of DWC3 Core
+@@ -783,17 +796,27 @@ static int dwc3_core_init(struct dwc3 *d
+ dwc->maximum_speed = USB_SPEED_HIGH;
+ }
+
+- ret = dwc3_core_get_phy(dwc);
++ ret = dwc3_phy_setup(dwc);
+ if (ret)
+ goto err0;
+
+- ret = dwc3_core_soft_reset(dwc);
+- if (ret)
+- goto err0;
++ if (!dwc->ulpi_ready) {
++ ret = dwc3_core_ulpi_init(dwc);
++ if (ret)
++ goto err0;
++ dwc->ulpi_ready = true;
++ }
+
+- ret = dwc3_phy_setup(dwc);
++ if (!dwc->phys_ready) {
++ ret = dwc3_core_get_phy(dwc);
++ if (ret)
++ goto err0a;
++ dwc->phys_ready = true;
++ }
++
++ ret = dwc3_core_soft_reset(dwc);
+ if (ret)
+- goto err0;
++ goto err0a;
+
+ dwc3_core_setup_global_control(dwc);
+ dwc3_core_num_eps(dwc);
+@@ -866,6 +889,9 @@ err1:
+ phy_exit(dwc->usb2_generic_phy);
+ phy_exit(dwc->usb3_generic_phy);
+
++err0a:
++ dwc3_ulpi_exit(dwc);
++
+ err0:
+ return ret;
+ }
+@@ -1256,7 +1282,6 @@ err4:
+
+ err3:
+ dwc3_free_event_buffers(dwc);
+- dwc3_ulpi_exit(dwc);
+
+ err2:
+ pm_runtime_allow(&pdev->dev);
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -805,7 +805,9 @@ struct dwc3_scratchpad_array {
+ * @usb3_phy: pointer to USB3 PHY
+ * @usb2_generic_phy: pointer to USB2 PHY
+ * @usb3_generic_phy: pointer to USB3 PHY
++ * @phys_ready: flag to indicate that PHYs are ready
+ * @ulpi: pointer to ulpi interface
++ * @ulpi_ready: flag to indicate that ULPI is initialized
+ * @isoch_delay: wValue from Set Isochronous Delay request;
+ * @u2sel: parameter from Set SEL request.
+ * @u2pel: parameter from Set SEL request.
+@@ -903,7 +905,10 @@ struct dwc3 {
+ struct phy *usb2_generic_phy;
+ struct phy *usb3_generic_phy;
+
++ bool phys_ready;
++
+ struct ulpi *ulpi;
++ bool ulpi_ready;
+
+ void __iomem *regs;
+ size_t regs_size;
--- /dev/null
+From b2d7a075a1ccef2fb321d595802190c8e9b39004 Mon Sep 17 00:00:00 2001
+From: Juergen Gross <jgross@suse.com>
+Date: Tue, 21 Aug 2018 17:37:55 +0200
+Subject: x86/pae: use 64 bit atomic xchg function in native_ptep_get_and_clear
+
+From: Juergen Gross <jgross@suse.com>
+
+commit b2d7a075a1ccef2fb321d595802190c8e9b39004 upstream.
+
+Using only 32-bit writes for the pte will result in an intermediate
+L1TF vulnerable PTE. When running as a Xen PV guest this will at once
+switch the guest to shadow mode resulting in a loss of performance.
+
+Use arch_atomic64_xchg() instead which will perform the requested
+operation atomically with all 64 bits.
+
+Some performance considerations according to:
+
+https://software.intel.com/sites/default/files/managed/ad/dc/Intel-Xeon-Scalable-Processor-throughput-latency.pdf
+
+The main number should be the latency, as there is no tight loop around
+native_ptep_get_and_clear().
+
+"lock cmpxchg8b" has a latency of 20 cycles, while "lock xchg" (with a
+memory operand) isn't mentioned in that document. "lock xadd" (with xadd
+having 3 cycles less latency than xchg) has a latency of 11, so we can
+assume a latency of 14 for "lock xchg".
+
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+Tested-by: Jason Andryuk <jandryuk@gmail.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/asm/pgtable-3level.h | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/include/asm/pgtable-3level.h
++++ b/arch/x86/include/asm/pgtable-3level.h
+@@ -2,6 +2,8 @@
+ #ifndef _ASM_X86_PGTABLE_3LEVEL_H
+ #define _ASM_X86_PGTABLE_3LEVEL_H
+
++#include <asm/atomic64_32.h>
++
+ /*
+ * Intel Physical Address Extension (PAE) Mode - three-level page
+ * tables on PPro+ CPUs.
+@@ -147,10 +149,7 @@ static inline pte_t native_ptep_get_and_
+ {
+ pte_t res;
+
+- /* xchg acts as a barrier before the setting of the high bits */
+- res.pte_low = xchg(&ptep->pte_low, 0);
+- res.pte_high = ptep->pte_high;
+- ptep->pte_high = 0;
++ res.pte = (pteval_t)arch_atomic64_xchg((atomic64_t *)ptep, 0);
+
+ return res;
+ }
--- /dev/null
+From f7c90c2aa4004808dff777ba6ae2c7294dd06851 Mon Sep 17 00:00:00 2001
+From: Juergen Gross <jgross@suse.com>
+Date: Tue, 21 Aug 2018 17:37:54 +0200
+Subject: x86/xen: don't write ptes directly in 32-bit PV guests
+
+From: Juergen Gross <jgross@suse.com>
+
+commit f7c90c2aa4004808dff777ba6ae2c7294dd06851 upstream.
+
+In some cases 32-bit PAE PV guests still write PTEs directly instead of
+using hypercalls. This is especially bad when clearing a PTE as this is
+done via 32-bit writes which will produce intermediate L1TF attackable
+PTEs.
+
+Change the code to use hypercalls instead.
+
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/xen/mmu_pv.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/xen/mmu_pv.c
++++ b/arch/x86/xen/mmu_pv.c
+@@ -425,14 +425,13 @@ static void xen_set_pud(pud_t *ptr, pud_
+ static void xen_set_pte_atomic(pte_t *ptep, pte_t pte)
+ {
+ trace_xen_mmu_set_pte_atomic(ptep, pte);
+- set_64bit((u64 *)ptep, native_pte_val(pte));
++ __xen_set_pte(ptep, pte);
+ }
+
+ static void xen_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
+ trace_xen_mmu_pte_clear(mm, addr, ptep);
+- if (!xen_batched_set_pte(ptep, native_make_pte(0)))
+- native_pte_clear(mm, addr, ptep);
++ __xen_set_pte(ptep, native_make_pte(0));
+ }
+
+ static void xen_pmd_clear(pmd_t *pmdp)
+@@ -1543,7 +1542,7 @@ static void __init xen_set_pte_init(pte_
+ pte = __pte_ma(((pte_val_ma(*ptep) & _PAGE_RW) | ~_PAGE_RW) &
+ pte_val_ma(pte));
+ #endif
+- native_set_pte(ptep, pte);
++ __xen_set_pte(ptep, pte);
+ }
+
+ /* Early in boot, while setting up the initial pagetable, assume
projects / thirdparty / kernel / stable-queue.git / commitdiff
