From bbecac5b5e033021f6c7d0db62ab87fbff07ef47 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 12 Mar 2018 16:42:52 +0100 Subject: [PATCH] 4.15-stable patches added patches: alsa-hda-add-dock-and-led-support-for-hp-elitebook-820-g3.patch alsa-hda-add-dock-and-led-support-for-hp-probook-640-g2.patch alsa-hda-fix-a-wrong-fixup-for-alc289-on-dell-machines.patch alsa-hda-realtek-add-headset-mode-support-for-dell-laptop.patch alsa-hda-realtek-add-support-headset-mode-for-dell-wyse.patch alsa-hda-realtek-fix-dock-line-out-volume-on-dell-precision-7520.patch alsa-hda-realtek-limit-mic-boost-on-t480.patch alsa-hda-realtek-make-dock-sound-work-on-thinkpad-l570.patch alsa-seq-don-t-allow-resizing-pool-in-use.patch alsa-seq-more-protection-for-concurrent-write-and-ioctl-races.patch arm64-mm-fix-thinko-in-non-global-page-table-attribute-check.patch bcache-don-t-attach-backing-with-duplicate-uuid.patch bcache-fix-crashes-in-duplicate-cache-device-register.patch bug-use-pb-in-bug-and-stack-protector-failure.patch dm-bufio-avoid-false-positive-wmaybe-uninitialized-warning.patch documentation-sphinx-fix-directive-import-error.patch drm-allow-determining-if-current-task-is-output-poll-worker.patch drm-amd-display-check-for-ipp-before-calling-cursor-operations.patch drm-amd-display-default-hdmi6g-support-to-true.-log-vbios-table-error.patch drm-amd-powerplay-fix-power-over-limit-on-fiji.patch drm-amd-powerplay-smu7-allow-mclk-switching-with-no-displays.patch drm-amd-powerplay-vega10-allow-mclk-switching-with-no-displays.patch drm-amdgpu-always-save-uvd-vcpu_bo-in-vm-mode.patch drm-amdgpu-correct-max-uvd-handles.patch drm-amdgpu-fix-deadlock-on-runtime-suspend.patch drm-amdgpu-fix-kv-harvesting.patch drm-amdgpu-notify-sbios-device-ready-before-send-request.patch drm-amdgpu-used-cached-pcie-gen-info-for-si-v2.patch drm-i915-always-call-to-intel_display_set_init_power-in-resume_early.patch drm-i915-audio-fix-check-for-av_enc_map-overflow.patch drm-i915-check-for-fused-or-unused-pipes.patch drm-i915-clear-the-in-use-marker-on-execbuf-failure.patch drm-i915-disable-dc-states-around-gmbus-on-glk.patch drm-i915-fix-rsvd2-mask-when-out-fence-is-returned.patch drm-i915-perf-fix-perf-stream-opening-lock.patch drm-i915-try-edid-bitbanging-on-hdmi-after-failed-read.patch drm-i915-update-watermark-state-correctly-in-sanitize_watermarks.patch drm-nouveau-fix-deadlock-on-runtime-suspend.patch drm-nouveau-prefer-xbgr2101010-for-addfb-ioctl.patch drm-radeon-fix-deadlock-on-runtime-suspend.patch drm-radeon-fix-kv-harvesting.patch drm-radeon-insist-on-32-bit-dma-for-cedar-on-ppc64-ppc64le.patch ib-core-fix-missing-rdma-cgroups-release-in-case-of-failure-to-register-device.patch ib-mlx5-fix-incorrect-size-of-klms-in-the-memory-region.patch input-matrix_keypad-fix-race-when-disabling-interrupts.patch kbuild-handle-builtin-dtb-file-names-containing-hyphens.patch kvm-s390-fix-memory-overwrites-when-not-using-sca-entries.patch lib-bug.c-exclude-non-bug-warn-exceptions-from-report_bug.patch loop-fix-lost-writes-caused-by-missing-flag.patch mips-ath25-check-for-kzalloc-allocation-failure.patch mips-bmips-do-not-mask-ipis-during-suspend.patch mips-octeon-irq-check-for-null-return-on-kzalloc-allocation.patch mm-memblock.c-hardcode-the-end_pfn-being-1.patch mm-page_alloc-fix-memmap_init_zone-pageblock-alignment.patch ovl-redirect_dir-nofollow-should-not-follow-redirect-for-opaque-lower.patch pci-dwc-fix-enumeration-end-when-reaching-root-subordinate.patch perf-tools-fix-trigger-class-trigger_on.patch regulator-stm32-vrefbuf-fix-check-on-ready-flag.patch revert-drm-radeon-pm-autoswitch-power-state-when-in-balanced-mode.patch revert-input-synaptics-lenovo-thinkpad-t460p-devices-should-use-rmi.patch revert-nvme-create-slaves-and-holders-entries-for-hidden-controllers.patch scsi-core-avoid-that-ata-error-handling-can-trigger-a-kernel-hang-or-oops.patch scsi-qla2xxx-fix-null-pointer-crash-due-to-active-timer-for-abts.patch scsi-qla2xxx-fix-null-pointer-crash-due-to-probe-failure.patch scsi-qla2xxx-fix-recursion-while-sending-terminate-exchange.patch virtio_ring-fix-num_free-handling-in-error-case.patch workqueue-allow-retrieval-of-current-task-s-work-struct.patch x86-mce-save-microcode-revision-in-machine-check-records.patch x86-mce-serialize-sysfs-changes.patch x86-spectre_v2-don-t-check-microcode-versions-when-running-under-hypervisors.patch --- ...-led-support-for-hp-elitebook-820-g3.patch | 32 +++ ...nd-led-support-for-hp-probook-640-g2.patch | 32 +++ ...ng-fixup-for-alc289-on-dell-machines.patch | 36 +++ ...headset-mode-support-for-dell-laptop.patch | 69 ++++++ ...d-support-headset-mode-for-dell-wyse.patch | 57 +++++ ...ne-out-volume-on-dell-precision-7520.patch | 72 ++++++ ...-hda-realtek-limit-mic-boost-on-t480.patch | 32 +++ ...ake-dock-sound-work-on-thinkpad-l570.patch | 33 +++ ...seq-don-t-allow-resizing-pool-in-use.patch | 45 ++++ ...for-concurrent-write-and-ioctl-races.patch | 179 +++++++++++++++ ...on-global-page-table-attribute-check.patch | 53 +++++ ...t-attach-backing-with-duplicate-uuid.patch | 65 ++++++ ...s-in-duplicate-cache-device-register.patch | 165 +++++++++++++ ...b-in-bug-and-stack-protector-failure.patch | 53 +++++ ...ositive-wmaybe-uninitialized-warning.patch | 73 ++++++ ...on-sphinx-fix-directive-import-error.patch | 38 +++ ...f-current-task-is-output-poll-worker.patch | 74 ++++++ ...ipp-before-calling-cursor-operations.patch | 50 ++++ ...pport-to-true.-log-vbios-table-error.patch | 69 ++++++ ...werplay-fix-power-over-limit-on-fiji.patch | 40 ++++ ...llow-mclk-switching-with-no-displays.patch | 43 ++++ ...llow-mclk-switching-with-no-displays.patch | 43 ++++ ...u-always-save-uvd-vcpu_bo-in-vm-mode.patch | 51 ++++ .../drm-amdgpu-correct-max-uvd-handles.patch | 37 +++ ...dgpu-fix-deadlock-on-runtime-suspend.patch | 151 ++++++++++++ queue-4.15/drm-amdgpu-fix-kv-harvesting.patch | 65 ++++++ ...ios-device-ready-before-send-request.patch | 35 +++ ...-used-cached-pcie-gen-info-for-si-v2.patch | 195 ++++++++++++++++ ...splay_set_init_power-in-resume_early.patch | 44 ++++ ...io-fix-check-for-av_enc_map-overflow.patch | 50 ++++ ...i915-check-for-fused-or-unused-pipes.patch | 43 ++++ ...the-in-use-marker-on-execbuf-failure.patch | 40 ++++ ...isable-dc-states-around-gmbus-on-glk.patch | 35 +++ ...svd2-mask-when-out-fence-is-returned.patch | 39 ++++ ...15-perf-fix-perf-stream-opening-lock.patch | 144 ++++++++++++ ...bitbanging-on-hdmi-after-failed-read.patch | 71 ++++++ ...ate-correctly-in-sanitize_watermarks.patch | 46 ++++ ...veau-fix-deadlock-on-runtime-suspend.patch | 115 ++++++++++ ...u-prefer-xbgr2101010-for-addfb-ioctl.patch | 70 ++++++ ...deon-fix-deadlock-on-runtime-suspend.patch | 217 ++++++++++++++++++ queue-4.15/drm-radeon-fix-kv-harvesting.patch | 66 ++++++ ...2-bit-dma-for-cedar-on-ppc64-ppc64le.patch | 46 ++++ ...n-case-of-failure-to-register-device.patch | 53 +++++ ...ct-size-of-klms-in-the-memory-region.patch | 50 ++++ ...d-fix-race-when-disabling-interrupts.patch | 40 ++++ ...in-dtb-file-names-containing-hyphens.patch | 70 ++++++ ...verwrites-when-not-using-sca-entries.patch | 43 ++++ ...-bug-warn-exceptions-from-report_bug.patch | 74 ++++++ ...x-lost-writes-caused-by-missing-flag.patch | 68 ++++++ ...check-for-kzalloc-allocation-failure.patch | 37 +++ ...mips-do-not-mask-ipis-during-suspend.patch | 54 +++++ ...or-null-return-on-kzalloc-allocation.patch | 39 ++++ ...block.c-hardcode-the-end_pfn-being-1.patch | 61 +++++ ...memmap_init_zone-pageblock-alignment.patch | 166 ++++++++++++++ ...not-follow-redirect-for-opaque-lower.patch | 70 ++++++ ...n-end-when-reaching-root-subordinate.patch | 89 +++++++ ...f-tools-fix-trigger-class-trigger_on.patch | 81 +++++++ ...tm32-vrefbuf-fix-check-on-ready-flag.patch | 35 +++ ...ch-power-state-when-in-balanced-mode.patch | 51 ++++ ...hinkpad-t460p-devices-should-use-rmi.patch | 71 ++++++ ...lders-entries-for-hidden-controllers.patch | 114 +++++++++ ...ng-can-trigger-a-kernel-hang-or-oops.patch | 118 ++++++++++ ...r-crash-due-to-active-timer-for-abts.patch | 120 ++++++++++ ...l-pointer-crash-due-to-probe-failure.patch | 68 ++++++ ...ion-while-sending-terminate-exchange.patch | 44 ++++ queue-4.15/series | 70 ++++++ ...-fix-num_free-handling-in-error-case.patch | 35 +++ ...rieval-of-current-task-s-work-struct.patch | 69 ++++++ ...de-revision-in-machine-check-records.patch | 60 +++++ .../x86-mce-serialize-sysfs-changes.patch | 115 ++++++++++ ...sions-when-running-under-hypervisors.patch | 57 +++++ 71 files changed, 4935 insertions(+) create mode 100644 queue-4.15/alsa-hda-add-dock-and-led-support-for-hp-elitebook-820-g3.patch create mode 100644 queue-4.15/alsa-hda-add-dock-and-led-support-for-hp-probook-640-g2.patch create mode 100644 queue-4.15/alsa-hda-fix-a-wrong-fixup-for-alc289-on-dell-machines.patch create mode 100644 queue-4.15/alsa-hda-realtek-add-headset-mode-support-for-dell-laptop.patch create mode 100644 queue-4.15/alsa-hda-realtek-add-support-headset-mode-for-dell-wyse.patch create mode 100644 queue-4.15/alsa-hda-realtek-fix-dock-line-out-volume-on-dell-precision-7520.patch create mode 100644 queue-4.15/alsa-hda-realtek-limit-mic-boost-on-t480.patch create mode 100644 queue-4.15/alsa-hda-realtek-make-dock-sound-work-on-thinkpad-l570.patch create mode 100644 queue-4.15/alsa-seq-don-t-allow-resizing-pool-in-use.patch create mode 100644 queue-4.15/alsa-seq-more-protection-for-concurrent-write-and-ioctl-races.patch create mode 100644 queue-4.15/arm64-mm-fix-thinko-in-non-global-page-table-attribute-check.patch create mode 100644 queue-4.15/bcache-don-t-attach-backing-with-duplicate-uuid.patch create mode 100644 queue-4.15/bcache-fix-crashes-in-duplicate-cache-device-register.patch create mode 100644 queue-4.15/bug-use-pb-in-bug-and-stack-protector-failure.patch create mode 100644 queue-4.15/dm-bufio-avoid-false-positive-wmaybe-uninitialized-warning.patch create mode 100644 queue-4.15/documentation-sphinx-fix-directive-import-error.patch create mode 100644 queue-4.15/drm-allow-determining-if-current-task-is-output-poll-worker.patch create mode 100644 queue-4.15/drm-amd-display-check-for-ipp-before-calling-cursor-operations.patch create mode 100644 queue-4.15/drm-amd-display-default-hdmi6g-support-to-true.-log-vbios-table-error.patch create mode 100644 queue-4.15/drm-amd-powerplay-fix-power-over-limit-on-fiji.patch create mode 100644 queue-4.15/drm-amd-powerplay-smu7-allow-mclk-switching-with-no-displays.patch create mode 100644 queue-4.15/drm-amd-powerplay-vega10-allow-mclk-switching-with-no-displays.patch create mode 100644 queue-4.15/drm-amdgpu-always-save-uvd-vcpu_bo-in-vm-mode.patch create mode 100644 queue-4.15/drm-amdgpu-correct-max-uvd-handles.patch create mode 100644 queue-4.15/drm-amdgpu-fix-deadlock-on-runtime-suspend.patch create mode 100644 queue-4.15/drm-amdgpu-fix-kv-harvesting.patch create mode 100644 queue-4.15/drm-amdgpu-notify-sbios-device-ready-before-send-request.patch create mode 100644 queue-4.15/drm-amdgpu-used-cached-pcie-gen-info-for-si-v2.patch create mode 100644 queue-4.15/drm-i915-always-call-to-intel_display_set_init_power-in-resume_early.patch create mode 100644 queue-4.15/drm-i915-audio-fix-check-for-av_enc_map-overflow.patch create mode 100644 queue-4.15/drm-i915-check-for-fused-or-unused-pipes.patch create mode 100644 queue-4.15/drm-i915-clear-the-in-use-marker-on-execbuf-failure.patch create mode 100644 queue-4.15/drm-i915-disable-dc-states-around-gmbus-on-glk.patch create mode 100644 queue-4.15/drm-i915-fix-rsvd2-mask-when-out-fence-is-returned.patch create mode 100644 queue-4.15/drm-i915-perf-fix-perf-stream-opening-lock.patch create mode 100644 queue-4.15/drm-i915-try-edid-bitbanging-on-hdmi-after-failed-read.patch create mode 100644 queue-4.15/drm-i915-update-watermark-state-correctly-in-sanitize_watermarks.patch create mode 100644 queue-4.15/drm-nouveau-fix-deadlock-on-runtime-suspend.patch create mode 100644 queue-4.15/drm-nouveau-prefer-xbgr2101010-for-addfb-ioctl.patch create mode 100644 queue-4.15/drm-radeon-fix-deadlock-on-runtime-suspend.patch create mode 100644 queue-4.15/drm-radeon-fix-kv-harvesting.patch create mode 100644 queue-4.15/drm-radeon-insist-on-32-bit-dma-for-cedar-on-ppc64-ppc64le.patch create mode 100644 queue-4.15/ib-core-fix-missing-rdma-cgroups-release-in-case-of-failure-to-register-device.patch create mode 100644 queue-4.15/ib-mlx5-fix-incorrect-size-of-klms-in-the-memory-region.patch create mode 100644 queue-4.15/input-matrix_keypad-fix-race-when-disabling-interrupts.patch create mode 100644 queue-4.15/kbuild-handle-builtin-dtb-file-names-containing-hyphens.patch create mode 100644 queue-4.15/kvm-s390-fix-memory-overwrites-when-not-using-sca-entries.patch create mode 100644 queue-4.15/lib-bug.c-exclude-non-bug-warn-exceptions-from-report_bug.patch create mode 100644 queue-4.15/loop-fix-lost-writes-caused-by-missing-flag.patch create mode 100644 queue-4.15/mips-ath25-check-for-kzalloc-allocation-failure.patch create mode 100644 queue-4.15/mips-bmips-do-not-mask-ipis-during-suspend.patch create mode 100644 queue-4.15/mips-octeon-irq-check-for-null-return-on-kzalloc-allocation.patch create mode 100644 queue-4.15/mm-memblock.c-hardcode-the-end_pfn-being-1.patch create mode 100644 queue-4.15/mm-page_alloc-fix-memmap_init_zone-pageblock-alignment.patch create mode 100644 queue-4.15/ovl-redirect_dir-nofollow-should-not-follow-redirect-for-opaque-lower.patch create mode 100644 queue-4.15/pci-dwc-fix-enumeration-end-when-reaching-root-subordinate.patch create mode 100644 queue-4.15/perf-tools-fix-trigger-class-trigger_on.patch create mode 100644 queue-4.15/regulator-stm32-vrefbuf-fix-check-on-ready-flag.patch create mode 100644 queue-4.15/revert-drm-radeon-pm-autoswitch-power-state-when-in-balanced-mode.patch create mode 100644 queue-4.15/revert-input-synaptics-lenovo-thinkpad-t460p-devices-should-use-rmi.patch create mode 100644 queue-4.15/revert-nvme-create-slaves-and-holders-entries-for-hidden-controllers.patch create mode 100644 queue-4.15/scsi-core-avoid-that-ata-error-handling-can-trigger-a-kernel-hang-or-oops.patch create mode 100644 queue-4.15/scsi-qla2xxx-fix-null-pointer-crash-due-to-active-timer-for-abts.patch create mode 100644 queue-4.15/scsi-qla2xxx-fix-null-pointer-crash-due-to-probe-failure.patch create mode 100644 queue-4.15/scsi-qla2xxx-fix-recursion-while-sending-terminate-exchange.patch create mode 100644 queue-4.15/virtio_ring-fix-num_free-handling-in-error-case.patch create mode 100644 queue-4.15/workqueue-allow-retrieval-of-current-task-s-work-struct.patch create mode 100644 queue-4.15/x86-mce-save-microcode-revision-in-machine-check-records.patch create mode 100644 queue-4.15/x86-mce-serialize-sysfs-changes.patch create mode 100644 queue-4.15/x86-spectre_v2-don-t-check-microcode-versions-when-running-under-hypervisors.patch diff --git a/queue-4.15/alsa-hda-add-dock-and-led-support-for-hp-elitebook-820-g3.patch b/queue-4.15/alsa-hda-add-dock-and-led-support-for-hp-elitebook-820-g3.patch new file mode 100644 index 00000000000..7dc2ec343e9 --- /dev/null +++ b/queue-4.15/alsa-hda-add-dock-and-led-support-for-hp-elitebook-820-g3.patch @@ -0,0 +1,32 @@ +From aea808172018ca01abf53db808323aed23281835 Mon Sep 17 00:00:00 2001 +From: Dennis Wassenberg +Date: Thu, 8 Mar 2018 15:49:03 +0100 +Subject: ALSA: hda: add dock and led support for HP EliteBook 820 G3 + +From: Dennis Wassenberg + +commit aea808172018ca01abf53db808323aed23281835 upstream. + +This patch adds missing initialisation for HP 2013 UltraSlim Dock +Line-In/Out PINs and activates keyboard mute/micmute leds +for HP EliteBook 820 G3 + +Signed-off-by: Dennis Wassenberg +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_conexant.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -957,6 +957,7 @@ static const struct snd_pci_quirk cxt506 + SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_ASPIRE_DMIC), + SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC), + SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK), ++ SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK), + SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE), + SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC), + SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO), diff --git a/queue-4.15/alsa-hda-add-dock-and-led-support-for-hp-probook-640-g2.patch b/queue-4.15/alsa-hda-add-dock-and-led-support-for-hp-probook-640-g2.patch new file mode 100644 index 00000000000..2e697ef6bba --- /dev/null +++ b/queue-4.15/alsa-hda-add-dock-and-led-support-for-hp-probook-640-g2.patch @@ -0,0 +1,32 @@ +From 099fd6ca0ad25bc19c5ade2ea4b25b8fadaa11b3 Mon Sep 17 00:00:00 2001 +From: Dennis Wassenberg +Date: Thu, 8 Mar 2018 15:49:24 +0100 +Subject: ALSA: hda: add dock and led support for HP ProBook 640 G2 + +From: Dennis Wassenberg + +commit 099fd6ca0ad25bc19c5ade2ea4b25b8fadaa11b3 upstream. + +This patch adds missing initialisation for HP 2013 UltraSlim Dock +Line-In/Out PINs and activates keyboard mute/micmute leds +for HP ProBook 640 G2 + +Signed-off-by: Dennis Wassenberg +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_conexant.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -958,6 +958,7 @@ static const struct snd_pci_quirk cxt506 + SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC), + SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK), + SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK), ++ SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK), + SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE), + SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC), + SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO), diff --git a/queue-4.15/alsa-hda-fix-a-wrong-fixup-for-alc289-on-dell-machines.patch b/queue-4.15/alsa-hda-fix-a-wrong-fixup-for-alc289-on-dell-machines.patch new file mode 100644 index 00000000000..cf06f9d85c1 --- /dev/null +++ b/queue-4.15/alsa-hda-fix-a-wrong-fixup-for-alc289-on-dell-machines.patch @@ -0,0 +1,36 @@ +From d5078193e56bb24f4593f00102a3b5e07bb84ee0 Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Fri, 2 Mar 2018 13:05:36 +0800 +Subject: ALSA: hda - Fix a wrong FIXUP for alc289 on Dell machines + +From: Hui Wang + +commit d5078193e56bb24f4593f00102a3b5e07bb84ee0 upstream. + +With the alc289, the Pin 0x1b is Headphone-Mic, so we should assign +ALC269_FIXUP_DELL4_MIC_NO_PRESENCE rather than +ALC225_FIXUP_DELL1_MIC_NO_PRESENCE to it. And this change is suggested +by Kailang of Realtek and is verified on the machine. + +Fixes: 3f2f7c553d07 ("ALSA: hda - Fix headset mic detection problem for two Dell machines") +Cc: Kailang Yang +Cc: +Signed-off-by: Hui Wang +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6793,7 +6793,7 @@ static const struct snd_hda_pin_quirk al + {0x12, 0x90a60120}, + {0x14, 0x90170110}, + {0x21, 0x0321101f}), +- SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, ++ SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE, + {0x12, 0xb7a60130}, + {0x14, 0x90170110}, + {0x21, 0x04211020}), diff --git a/queue-4.15/alsa-hda-realtek-add-headset-mode-support-for-dell-laptop.patch b/queue-4.15/alsa-hda-realtek-add-headset-mode-support-for-dell-laptop.patch new file mode 100644 index 00000000000..74f170c1e93 --- /dev/null +++ b/queue-4.15/alsa-hda-realtek-add-headset-mode-support-for-dell-laptop.patch @@ -0,0 +1,69 @@ +From ae104a21e52b1f9aab342cf6924405177b720069 Mon Sep 17 00:00:00 2001 +From: Kailang Yang +Date: Mon, 5 Feb 2018 16:07:20 +0800 +Subject: ALSA: hda/realtek - Add headset mode support for Dell laptop + +From: Kailang Yang + +commit ae104a21e52b1f9aab342cf6924405177b720069 upstream. + +This platform was only one phone Jack. +Add dummy lineout verb to fix automute mode disable. +This just the workaround. + +[ More background information: + since the platform has only a headphone jack without speaker, the + driver doesn't create the auto-mute control. Meanwhile we do update + the headset mode via the automute hook in the driver, thus with this + setup, the headset won't be updated any longer. + + By adding a dummy line-out pin here, the auto-mute is added by the + driver, and the headset update is triggered properly. + + Note that this is different from the other + ALC274_FIXUP_DELL_AIO_LINEOUT_VERB, which has the real line-out pin, + while this quirk adds a dummy line-out pin. -- tiwai ] + +Signed-off-by: Kailang Yang +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5363,6 +5363,7 @@ enum { + ALC274_FIXUP_DELL_BIND_DACS, + ALC274_FIXUP_DELL_AIO_LINEOUT_VERB, + ALC298_FIXUP_TPT470_DOCK, ++ ALC255_FIXUP_DUMMY_LINEOUT_VERB, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -6210,6 +6211,15 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE + }, ++ [ALC255_FIXUP_DUMMY_LINEOUT_VERB] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x14, 0x0201101f }, ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -6263,6 +6273,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), + SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), + SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), ++ SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB), + SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2), diff --git a/queue-4.15/alsa-hda-realtek-add-support-headset-mode-for-dell-wyse.patch b/queue-4.15/alsa-hda-realtek-add-support-headset-mode-for-dell-wyse.patch new file mode 100644 index 00000000000..f1d720cfabd --- /dev/null +++ b/queue-4.15/alsa-hda-realtek-add-support-headset-mode-for-dell-wyse.patch @@ -0,0 +1,57 @@ +From 5f36413526677b11d3226ebf064f471894ea2e5d Mon Sep 17 00:00:00 2001 +From: Kailang Yang +Date: Tue, 25 Jul 2017 16:28:16 +0800 +Subject: ALSA: hda/realtek - Add support headset mode for DELL WYSE + +From: Kailang Yang + +commit 5f36413526677b11d3226ebf064f471894ea2e5d upstream. + +Enable headset mode support for WYSE platform. + +Signed-off-by: Kailang Yang +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5358,6 +5358,7 @@ enum { + ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE, + ALC233_FIXUP_LENOVO_MULTI_CODECS, + ALC294_FIXUP_LENOVO_MIC_LOCATION, ++ ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE, + ALC700_FIXUP_INTEL_REFERENCE, + ALC274_FIXUP_DELL_BIND_DACS, + ALC274_FIXUP_DELL_AIO_LINEOUT_VERB, +@@ -6161,6 +6162,18 @@ static const struct hda_fixup alc269_fix + { } + }, + }, ++ [ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x16, 0x0101102f }, /* Rear Headset HP */ ++ { 0x19, 0x02a1913c }, /* use as Front headset mic, without its own jack detect */ ++ { 0x1a, 0x01a19030 }, /* Rear Headset MIC */ ++ { 0x1b, 0x02011020 }, ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC ++ }, + [ALC700_FIXUP_INTEL_REFERENCE] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb[]) { +@@ -6246,6 +6259,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), + SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME), + SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), ++ SND_PCI_QUIRK(0x1028, 0x080c, "Dell WYSE", ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), + SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), + SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), diff --git a/queue-4.15/alsa-hda-realtek-fix-dock-line-out-volume-on-dell-precision-7520.patch b/queue-4.15/alsa-hda-realtek-fix-dock-line-out-volume-on-dell-precision-7520.patch new file mode 100644 index 00000000000..06ec463abef --- /dev/null +++ b/queue-4.15/alsa-hda-realtek-fix-dock-line-out-volume-on-dell-precision-7520.patch @@ -0,0 +1,72 @@ +From e312a869cd726c698a75caca0d9e5c22fd3f1534 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 6 Mar 2018 12:14:17 +0100 +Subject: ALSA: hda/realtek - Fix dock line-out volume on Dell Precision 7520 + +From: Takashi Iwai + +commit e312a869cd726c698a75caca0d9e5c22fd3f1534 upstream. + +The dock line-out pin (NID 0x17 of ALC3254 codec) on Dell Precision +7520 may route to three different DACs, 0x02, 0x03 and 0x06. The +first two DACS have the volume amp controls while the last one +doesn't. And unfortunately, the auto-parser assigns this pin to DAC3, +resulting in the non-working volume control for the line out. + +Fix it by disabling the routing to DAC3 on the corresponding pin. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199029 +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5152,6 +5152,16 @@ static void alc298_fixup_speaker_volume( + } + } + ++/* disable DAC3 (0x06) selection on NID 0x17 as it has no volume amp control */ ++static void alc295_fixup_disable_dac3(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) { ++ hda_nid_t conn[2] = { 0x02, 0x03 }; ++ snd_hda_override_conn_list(codec, 0x17, 2, conn); ++ } ++} ++ + /* Hook to update amp GPIO4 for automute */ + static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec, + struct hda_jack_callback *jack) +@@ -5344,6 +5354,7 @@ enum { + ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, + ALC255_FIXUP_DELL_SPK_NOISE, + ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, ++ ALC295_FIXUP_DISABLE_DAC3, + ALC280_FIXUP_HP_HEADSET_MIC, + ALC221_FIXUP_HP_FRONT_MIC, + ALC292_FIXUP_TPT460, +@@ -6078,6 +6089,10 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE, + }, ++ [ALC295_FIXUP_DISABLE_DAC3] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc295_fixup_disable_dac3, ++ }, + [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -6268,6 +6283,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE), + SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), + SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME), ++ SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3), + SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), + SND_PCI_QUIRK(0x1028, 0x080c, "Dell WYSE", ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), diff --git a/queue-4.15/alsa-hda-realtek-limit-mic-boost-on-t480.patch b/queue-4.15/alsa-hda-realtek-limit-mic-boost-on-t480.patch new file mode 100644 index 00000000000..98c3f84fbd3 --- /dev/null +++ b/queue-4.15/alsa-hda-realtek-limit-mic-boost-on-t480.patch @@ -0,0 +1,32 @@ +From 85981dfd6b0a0fd9ed87ca4a525981b67c21f098 Mon Sep 17 00:00:00 2001 +From: Benjamin Berg +Date: Wed, 14 Feb 2018 13:29:39 +0100 +Subject: ALSA: hda/realtek: Limit mic boost on T480 + +From: Benjamin Berg + +commit 85981dfd6b0a0fd9ed87ca4a525981b67c21f098 upstream. + +The internal mic boost on the T480 is too high. Fix this by applying the +ALC269_FIXUP_LIMIT_INT_MIC_BOOST fixup to the machine to limit the gain. + +Signed-off-by: Benjamin Berg +Tested-by: Benjamin Berg +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6414,6 +6414,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x17aa, 0x224b, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), ++ SND_PCI_QUIRK(0x17aa, 0x225d, "Thinkpad T480", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), diff --git a/queue-4.15/alsa-hda-realtek-make-dock-sound-work-on-thinkpad-l570.patch b/queue-4.15/alsa-hda-realtek-make-dock-sound-work-on-thinkpad-l570.patch new file mode 100644 index 00000000000..f2a00c76109 --- /dev/null +++ b/queue-4.15/alsa-hda-realtek-make-dock-sound-work-on-thinkpad-l570.patch @@ -0,0 +1,33 @@ +From e4c07b3b66b7d6a24c2fe3b1ddeff5cd9b378b3a Mon Sep 17 00:00:00 2001 +From: Dennis Wassenberg +Date: Thu, 8 Mar 2018 13:17:54 +0100 +Subject: ALSA: hda/realtek - Make dock sound work on ThinkPad L570 + +From: Dennis Wassenberg + +commit e4c07b3b66b7d6a24c2fe3b1ddeff5cd9b378b3a upstream. + +One version of Lenovo Thinkpad T570 did not use ALC298 +(like other Kaby Lake devices). Instead it uses ALC292. +In order to make the Lenovo dock working with that codec +the dock quirk for ALC292 will be used. + +Signed-off-by: Dennis Wassenberg +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6427,6 +6427,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x17aa, 0x2245, "Thinkpad T470", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x2246, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x2247, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), ++ SND_PCI_QUIRK(0x17aa, 0x2249, "Thinkpad", ALC292_FIXUP_TPT460), + SND_PCI_QUIRK(0x17aa, 0x224b, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), diff --git a/queue-4.15/alsa-seq-don-t-allow-resizing-pool-in-use.patch b/queue-4.15/alsa-seq-don-t-allow-resizing-pool-in-use.patch new file mode 100644 index 00000000000..dcd71816db1 --- /dev/null +++ b/queue-4.15/alsa-seq-don-t-allow-resizing-pool-in-use.patch @@ -0,0 +1,45 @@ +From d85739367c6d56e475c281945c68fdb05ca74b4c Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 5 Mar 2018 22:00:55 +0100 +Subject: ALSA: seq: Don't allow resizing pool in use +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Takashi Iwai + +commit d85739367c6d56e475c281945c68fdb05ca74b4c upstream. + +This is a fix for a (sort of) fallout in the recent commit +d15d662e89fc ("ALSA: seq: Fix racy pool initializations") for +CVE-2018-1000004. +As the pool resize deletes the existing cells, it may lead to a race +when another thread is writing concurrently, eventually resulting a +UAF. + +A simple workaround is not to allow the pool resizing when the pool is +in use. It's an invalid behavior in anyway. + +Fixes: d15d662e89fc ("ALSA: seq: Fix racy pool initializations") +Reported-by: 范龙飞 +Reported-by: Nicolai Stange +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/seq/seq_clientmgr.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/sound/core/seq/seq_clientmgr.c ++++ b/sound/core/seq/seq_clientmgr.c +@@ -1838,6 +1838,9 @@ static int snd_seq_ioctl_set_client_pool + (! snd_seq_write_pool_allocated(client) || + info->output_pool != client->pool->size)) { + if (snd_seq_write_pool_allocated(client)) { ++ /* is the pool in use? */ ++ if (atomic_read(&client->pool->counter)) ++ return -EBUSY; + /* remove all existing cells */ + snd_seq_pool_mark_closing(client->pool); + snd_seq_queue_client_leave_cells(client->number); diff --git a/queue-4.15/alsa-seq-more-protection-for-concurrent-write-and-ioctl-races.patch b/queue-4.15/alsa-seq-more-protection-for-concurrent-write-and-ioctl-races.patch new file mode 100644 index 00000000000..99da61b97c4 --- /dev/null +++ b/queue-4.15/alsa-seq-more-protection-for-concurrent-write-and-ioctl-races.patch @@ -0,0 +1,179 @@ +From 7bd80091567789f1c0cb70eb4737aac8bcd2b6b9 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 5 Mar 2018 22:06:09 +0100 +Subject: ALSA: seq: More protection for concurrent write and ioctl races +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Takashi Iwai + +commit 7bd80091567789f1c0cb70eb4737aac8bcd2b6b9 upstream. + +This patch is an attempt for further hardening against races between +the concurrent write and ioctls. The previous fix d15d662e89fc +("ALSA: seq: Fix racy pool initializations") covered the race of the +pool initialization at writer and the pool resize ioctl by the +client->ioctl_mutex (CVE-2018-1000004). However, basically this mutex +should be applied more widely to the whole write operation for +avoiding the unexpected pool operations by another thread. + +The only change outside snd_seq_write() is the additional mutex +argument to helper functions, so that we can unlock / relock the given +mutex temporarily during schedule() call for blocking write. + +Fixes: d15d662e89fc ("ALSA: seq: Fix racy pool initializations") +Reported-by: 范龙飞 +Reported-by: Nicolai Stange +Reviewed-and-tested-by: Nicolai Stange +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/seq/seq_clientmgr.c | 18 +++++++++++------- + sound/core/seq/seq_fifo.c | 2 +- + sound/core/seq/seq_memory.c | 14 ++++++++++---- + sound/core/seq/seq_memory.h | 3 ++- + 4 files changed, 24 insertions(+), 13 deletions(-) + +--- a/sound/core/seq/seq_clientmgr.c ++++ b/sound/core/seq/seq_clientmgr.c +@@ -910,7 +910,8 @@ int snd_seq_dispatch_event(struct snd_se + static int snd_seq_client_enqueue_event(struct snd_seq_client *client, + struct snd_seq_event *event, + struct file *file, int blocking, +- int atomic, int hop) ++ int atomic, int hop, ++ struct mutex *mutexp) + { + struct snd_seq_event_cell *cell; + int err; +@@ -948,7 +949,8 @@ static int snd_seq_client_enqueue_event( + return -ENXIO; /* queue is not allocated */ + + /* allocate an event cell */ +- err = snd_seq_event_dup(client->pool, event, &cell, !blocking || atomic, file); ++ err = snd_seq_event_dup(client->pool, event, &cell, !blocking || atomic, ++ file, mutexp); + if (err < 0) + return err; + +@@ -1017,12 +1019,11 @@ static ssize_t snd_seq_write(struct file + return -ENXIO; + + /* allocate the pool now if the pool is not allocated yet */ ++ mutex_lock(&client->ioctl_mutex); + if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) { +- mutex_lock(&client->ioctl_mutex); + err = snd_seq_pool_init(client->pool); +- mutex_unlock(&client->ioctl_mutex); + if (err < 0) +- return -ENOMEM; ++ goto out; + } + + /* only process whole events */ +@@ -1073,7 +1074,7 @@ static ssize_t snd_seq_write(struct file + /* ok, enqueue it */ + err = snd_seq_client_enqueue_event(client, &event, file, + !(file->f_flags & O_NONBLOCK), +- 0, 0); ++ 0, 0, &client->ioctl_mutex); + if (err < 0) + break; + +@@ -1084,6 +1085,8 @@ static ssize_t snd_seq_write(struct file + written += len; + } + ++ out: ++ mutex_unlock(&client->ioctl_mutex); + return written ? written : err; + } + +@@ -2263,7 +2266,8 @@ static int kernel_client_enqueue(int cli + if (! cptr->accept_output) + result = -EPERM; + else /* send it */ +- result = snd_seq_client_enqueue_event(cptr, ev, file, blocking, atomic, hop); ++ result = snd_seq_client_enqueue_event(cptr, ev, file, blocking, ++ atomic, hop, NULL); + + snd_seq_client_unlock(cptr); + return result; +--- a/sound/core/seq/seq_fifo.c ++++ b/sound/core/seq/seq_fifo.c +@@ -125,7 +125,7 @@ int snd_seq_fifo_event_in(struct snd_seq + return -EINVAL; + + snd_use_lock_use(&f->use_lock); +- err = snd_seq_event_dup(f->pool, event, &cell, 1, NULL); /* always non-blocking */ ++ err = snd_seq_event_dup(f->pool, event, &cell, 1, NULL, NULL); /* always non-blocking */ + if (err < 0) { + if ((err == -ENOMEM) || (err == -EAGAIN)) + atomic_inc(&f->overflow); +--- a/sound/core/seq/seq_memory.c ++++ b/sound/core/seq/seq_memory.c +@@ -220,7 +220,8 @@ void snd_seq_cell_free(struct snd_seq_ev + */ + static int snd_seq_cell_alloc(struct snd_seq_pool *pool, + struct snd_seq_event_cell **cellp, +- int nonblock, struct file *file) ++ int nonblock, struct file *file, ++ struct mutex *mutexp) + { + struct snd_seq_event_cell *cell; + unsigned long flags; +@@ -244,7 +245,11 @@ static int snd_seq_cell_alloc(struct snd + set_current_state(TASK_INTERRUPTIBLE); + add_wait_queue(&pool->output_sleep, &wait); + spin_unlock_irq(&pool->lock); ++ if (mutexp) ++ mutex_unlock(mutexp); + schedule(); ++ if (mutexp) ++ mutex_lock(mutexp); + spin_lock_irq(&pool->lock); + remove_wait_queue(&pool->output_sleep, &wait); + /* interrupted? */ +@@ -287,7 +292,7 @@ __error: + */ + int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event, + struct snd_seq_event_cell **cellp, int nonblock, +- struct file *file) ++ struct file *file, struct mutex *mutexp) + { + int ncells, err; + unsigned int extlen; +@@ -304,7 +309,7 @@ int snd_seq_event_dup(struct snd_seq_poo + if (ncells >= pool->total_elements) + return -ENOMEM; + +- err = snd_seq_cell_alloc(pool, &cell, nonblock, file); ++ err = snd_seq_cell_alloc(pool, &cell, nonblock, file, mutexp); + if (err < 0) + return err; + +@@ -330,7 +335,8 @@ int snd_seq_event_dup(struct snd_seq_poo + int size = sizeof(struct snd_seq_event); + if (len < size) + size = len; +- err = snd_seq_cell_alloc(pool, &tmp, nonblock, file); ++ err = snd_seq_cell_alloc(pool, &tmp, nonblock, file, ++ mutexp); + if (err < 0) + goto __error; + if (cell->event.data.ext.ptr == NULL) +--- a/sound/core/seq/seq_memory.h ++++ b/sound/core/seq/seq_memory.h +@@ -66,7 +66,8 @@ struct snd_seq_pool { + void snd_seq_cell_free(struct snd_seq_event_cell *cell); + + int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event, +- struct snd_seq_event_cell **cellp, int nonblock, struct file *file); ++ struct snd_seq_event_cell **cellp, int nonblock, ++ struct file *file, struct mutex *mutexp); + + /* return number of unused (free) cells */ + static inline int snd_seq_unused_cells(struct snd_seq_pool *pool) diff --git a/queue-4.15/arm64-mm-fix-thinko-in-non-global-page-table-attribute-check.patch b/queue-4.15/arm64-mm-fix-thinko-in-non-global-page-table-attribute-check.patch new file mode 100644 index 00000000000..5177fccbc1c --- /dev/null +++ b/queue-4.15/arm64-mm-fix-thinko-in-non-global-page-table-attribute-check.patch @@ -0,0 +1,53 @@ +From 753e8abc36b2c966caea075db0c845563c8a19bf Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Fri, 23 Feb 2018 18:04:48 +0000 +Subject: arm64: mm: fix thinko in non-global page table attribute check + +From: Ard Biesheuvel + +commit 753e8abc36b2c966caea075db0c845563c8a19bf upstream. + +The routine pgattr_change_is_safe() was extended in commit 4e6020565596 +("arm64: mm: Permit transitioning from Global to Non-Global without BBM") +to permit changing the nG attribute from not set to set, but did so in a +way that inadvertently disallows such changes if other permitted attribute +changes take place at the same time. So update the code to take this into +account. + +Fixes: 4e6020565596 ("arm64: mm: Permit transitioning from Global to ...") +Cc: # 4.14.x- +Acked-by: Mark Rutland +Reviewed-by: Marc Zyngier +Acked-by: Will Deacon +Signed-off-by: Ard Biesheuvel +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/mm/mmu.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/arm64/mm/mmu.c ++++ b/arch/arm64/mm/mmu.c +@@ -107,7 +107,7 @@ static bool pgattr_change_is_safe(u64 ol + * The following mapping attributes may be updated in live + * kernel mappings without the need for break-before-make. + */ +- static const pteval_t mask = PTE_PXN | PTE_RDONLY | PTE_WRITE; ++ static const pteval_t mask = PTE_PXN | PTE_RDONLY | PTE_WRITE | PTE_NG; + + /* creating or taking down mappings is always safe */ + if (old == 0 || new == 0) +@@ -117,9 +117,9 @@ static bool pgattr_change_is_safe(u64 ol + if ((old | new) & PTE_CONT) + return false; + +- /* Transitioning from Global to Non-Global is safe */ +- if (((old ^ new) == PTE_NG) && (new & PTE_NG)) +- return true; ++ /* Transitioning from Non-Global to Global is unsafe */ ++ if (old & ~new & PTE_NG) ++ return false; + + return ((old ^ new) & ~mask) == 0; + } diff --git a/queue-4.15/bcache-don-t-attach-backing-with-duplicate-uuid.patch b/queue-4.15/bcache-don-t-attach-backing-with-duplicate-uuid.patch new file mode 100644 index 00000000000..7e396b4ba21 --- /dev/null +++ b/queue-4.15/bcache-don-t-attach-backing-with-duplicate-uuid.patch @@ -0,0 +1,65 @@ +From 86755b7a96faed57f910f9e6b8061e019ac1ec08 Mon Sep 17 00:00:00 2001 +From: Michael Lyle +Date: Mon, 5 Mar 2018 13:41:55 -0800 +Subject: bcache: don't attach backing with duplicate UUID + +From: Michael Lyle + +commit 86755b7a96faed57f910f9e6b8061e019ac1ec08 upstream. + +This can happen e.g. during disk cloning. + +This is an incomplete fix: it does not catch duplicate UUIDs earlier +when things are still unattached. It does not unregister the device. +Further changes to cope better with this are planned but conflict with +Coly's ongoing improvements to handling device errors. In the meantime, +one can manually stop the device after this has happened. + +Attempts to attach a duplicate device result in: + +[ 136.372404] loop: module loaded +[ 136.424461] bcache: register_bdev() registered backing device loop0 +[ 136.424464] bcache: bch_cached_dev_attach() Tried to attach loop0 but duplicate UUID already attached + +My test procedure is: + + dd if=/dev/sdb1 of=imgfile bs=1024 count=262144 + losetup -f imgfile + +Signed-off-by: Michael Lyle +Reviewed-by: Tang Junhui +Cc: +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bcache/super.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -951,6 +951,7 @@ int bch_cached_dev_attach(struct cached_ + uint32_t rtime = cpu_to_le32(get_seconds()); + struct uuid_entry *u; + char buf[BDEVNAME_SIZE]; ++ struct cached_dev *exist_dc, *t; + + bdevname(dc->bdev, buf); + +@@ -974,6 +975,16 @@ int bch_cached_dev_attach(struct cached_ + return -EINVAL; + } + ++ /* Check whether already attached */ ++ list_for_each_entry_safe(exist_dc, t, &c->cached_devs, list) { ++ if (!memcmp(dc->sb.uuid, exist_dc->sb.uuid, 16)) { ++ pr_err("Tried to attach %s but duplicate UUID already attached", ++ buf); ++ ++ return -EINVAL; ++ } ++ } ++ + u = uuid_find(c, dc->sb.uuid); + + if (u && diff --git a/queue-4.15/bcache-fix-crashes-in-duplicate-cache-device-register.patch b/queue-4.15/bcache-fix-crashes-in-duplicate-cache-device-register.patch new file mode 100644 index 00000000000..79b62230348 --- /dev/null +++ b/queue-4.15/bcache-fix-crashes-in-duplicate-cache-device-register.patch @@ -0,0 +1,165 @@ +From cc40daf91bdddbba72a4a8cd0860640e06668309 Mon Sep 17 00:00:00 2001 +From: Tang Junhui +Date: Mon, 5 Mar 2018 13:41:54 -0800 +Subject: bcache: fix crashes in duplicate cache device register + +From: Tang Junhui + +commit cc40daf91bdddbba72a4a8cd0860640e06668309 upstream. + +Kernel crashed when register a duplicate cache device, the call trace is +bellow: +[ 417.643790] CPU: 1 PID: 16886 Comm: bcache-register Tainted: G + W OE 4.15.5-amd64-preempt-sysrq-20171018 #2 +[ 417.643861] Hardware name: LENOVO 20ERCTO1WW/20ERCTO1WW, BIOS +N1DET41W (1.15 ) 12/31/2015 +[ 417.643870] RIP: 0010:bdevname+0x13/0x1e +[ 417.643876] RSP: 0018:ffffa3aa9138fd38 EFLAGS: 00010282 +[ 417.643884] RAX: 0000000000000000 RBX: ffff8c8f2f2f8000 RCX: ffffd6701f8 +c7edf +[ 417.643890] RDX: ffffa3aa9138fd88 RSI: ffffa3aa9138fd88 RDI: 00000000000 +00000 +[ 417.643895] RBP: ffffa3aa9138fde0 R08: ffffa3aa9138fae8 R09: 00000000000 +1850e +[ 417.643901] R10: ffff8c8eed34b271 R11: ffff8c8eed34b250 R12: 00000000000 +00000 +[ 417.643906] R13: ffffd6701f78f940 R14: ffff8c8f38f80000 R15: ffff8c8ea7d +90000 +[ 417.643913] FS: 00007fde7e66f500(0000) GS:ffff8c8f61440000(0000) knlGS: +0000000000000000 +[ 417.643919] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 417.643925] CR2: 0000000000000314 CR3: 00000007e6fa0001 CR4: 00000000003 +606e0 +[ 417.643931] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 00000000000 +00000 +[ 417.643938] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 00000000000 +00400 +[ 417.643946] Call Trace: +[ 417.643978] register_bcache+0x1117/0x1270 [bcache] +[ 417.643994] ? slab_pre_alloc_hook+0x15/0x3c +[ 417.644001] ? slab_post_alloc_hook.isra.44+0xa/0x1a +[ 417.644013] ? kernfs_fop_write+0xf6/0x138 +[ 417.644020] kernfs_fop_write+0xf6/0x138 +[ 417.644031] __vfs_write+0x31/0xcc +[ 417.644043] ? current_kernel_time64+0x10/0x36 +[ 417.644115] ? __audit_syscall_entry+0xbf/0xe3 +[ 417.644124] vfs_write+0xa5/0xe2 +[ 417.644133] SyS_write+0x5c/0x9f +[ 417.644144] do_syscall_64+0x72/0x81 +[ 417.644161] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 +[ 417.644169] RIP: 0033:0x7fde7e1c1974 +[ 417.644175] RSP: 002b:00007fff13009a38 EFLAGS: 00000246 ORIG_RAX: 0000000 +000000001 +[ 417.644183] RAX: ffffffffffffffda RBX: 0000000001658280 RCX: 00007fde7e1c +1974 +[ 417.644188] RDX: 000000000000000a RSI: 0000000001658280 RDI: 000000000000 +0001 +[ 417.644193] RBP: 000000000000000a R08: 0000000000000003 R09: 000000000000 +0077 +[ 417.644198] R10: 000000000000089e R11: 0000000000000246 R12: 000000000000 +0001 +[ 417.644203] R13: 000000000000000a R14: 7fffffffffffffff R15: 000000000000 +0000 +[ 417.644213] Code: c7 c2 83 6f ee 98 be 20 00 00 00 48 89 df e8 6c 27 3b 0 +0 48 89 d8 5b c3 0f 1f 44 00 00 48 8b 47 70 48 89 f2 48 8b bf 80 00 00 00 <8 +b> b0 14 03 00 00 e9 73 ff ff ff 0f 1f 44 00 00 48 8b 47 40 39 +[ 417.644302] RIP: bdevname+0x13/0x1e RSP: ffffa3aa9138fd38 +[ 417.644306] CR2: 0000000000000314 + +When registering duplicate cache device in register_cache(), after failure +on calling register_cache_set(), bch_cache_release() will be called, then +bdev will be freed, so bdevname(bdev, name) caused kernel crash. + +Since bch_cache_release() will free bdev, so in this patch we make sure +bdev being freed if register_cache() fail, and do not free bdev again in +register_bcache() when register_cache() fail. + +Signed-off-by: Tang Junhui +Reported-by: Marc MERLIN +Tested-by: Michael Lyle +Reviewed-by: Michael Lyle +Cc: +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bcache/super.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -1191,7 +1191,7 @@ static void register_bdev(struct cache_s + + return; + err: +- pr_notice("error opening %s: %s", bdevname(bdev, name), err); ++ pr_notice("error %s: %s", bdevname(bdev, name), err); + bcache_device_stop(&dc->disk); + } + +@@ -1859,6 +1859,8 @@ static int register_cache(struct cache_s + const char *err = NULL; /* must be set for any error case */ + int ret = 0; + ++ bdevname(bdev, name); ++ + memcpy(&ca->sb, sb, sizeof(struct cache_sb)); + ca->bdev = bdev; + ca->bdev->bd_holder = ca; +@@ -1867,11 +1869,12 @@ static int register_cache(struct cache_s + ca->sb_bio.bi_io_vec[0].bv_page = sb_page; + get_page(sb_page); + +- if (blk_queue_discard(bdev_get_queue(ca->bdev))) ++ if (blk_queue_discard(bdev_get_queue(bdev))) + ca->discard = CACHE_DISCARD(&ca->sb); + + ret = cache_alloc(ca); + if (ret != 0) { ++ blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL); + if (ret == -ENOMEM) + err = "cache_alloc(): -ENOMEM"; + else +@@ -1894,14 +1897,14 @@ static int register_cache(struct cache_s + goto out; + } + +- pr_info("registered cache device %s", bdevname(bdev, name)); ++ pr_info("registered cache device %s", name); + + out: + kobject_put(&ca->kobj); + + err: + if (err) +- pr_notice("error opening %s: %s", bdevname(bdev, name), err); ++ pr_notice("error %s: %s", name, err); + + return ret; + } +@@ -1990,6 +1993,7 @@ static ssize_t register_bcache(struct ko + if (err) + goto err_close; + ++ err = "failed to register device"; + if (SB_IS_BDEV(sb)) { + struct cached_dev *dc = kzalloc(sizeof(*dc), GFP_KERNEL); + if (!dc) +@@ -2004,7 +2008,7 @@ static ssize_t register_bcache(struct ko + goto err_close; + + if (register_cache(sb, sb_page, bdev, ca) != 0) +- goto err_close; ++ goto err; + } + out: + if (sb_page) +@@ -2017,7 +2021,7 @@ out: + err_close: + blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL); + err: +- pr_info("error opening %s: %s", path, err); ++ pr_info("error %s: %s", path, err); + ret = -EINVAL; + goto out; + } diff --git a/queue-4.15/bug-use-pb-in-bug-and-stack-protector-failure.patch b/queue-4.15/bug-use-pb-in-bug-and-stack-protector-failure.patch new file mode 100644 index 00000000000..eeb5a834b86 --- /dev/null +++ b/queue-4.15/bug-use-pb-in-bug-and-stack-protector-failure.patch @@ -0,0 +1,53 @@ +From 0862ca422b79cb5aa70823ee0f07f6b468f86070 Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Fri, 9 Mar 2018 15:50:59 -0800 +Subject: bug: use %pB in BUG and stack protector failure + +From: Kees Cook + +commit 0862ca422b79cb5aa70823ee0f07f6b468f86070 upstream. + +The BUG and stack protector reports were still using a raw %p. This +changes it to %pB for more meaningful output. + +Link: http://lkml.kernel.org/r/20180301225704.GA34198@beast +Fixes: ad67b74d2469 ("printk: hash addresses printed with %p") +Signed-off-by: Kees Cook +Reviewed-by: Andrew Morton +Cc: Ingo Molnar +Cc: Thomas Gleixner +Cc: Peter Zijlstra +Cc: Borislav Petkov +Cc: Richard Weinberger , +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/panic.c | 2 +- + lib/bug.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/kernel/panic.c ++++ b/kernel/panic.c +@@ -640,7 +640,7 @@ device_initcall(register_warn_debugfs); + */ + __visible void __stack_chk_fail(void) + { +- panic("stack-protector: Kernel stack is corrupted in: %p\n", ++ panic("stack-protector: Kernel stack is corrupted in: %pB\n", + __builtin_return_address(0)); + } + EXPORT_SYMBOL(__stack_chk_fail); +--- a/lib/bug.c ++++ b/lib/bug.c +@@ -191,7 +191,7 @@ enum bug_trap_type report_bug(unsigned l + if (file) + pr_crit("kernel BUG at %s:%u!\n", file, line); + else +- pr_crit("Kernel BUG at %p [verbose debug info unavailable]\n", ++ pr_crit("Kernel BUG at %pB [verbose debug info unavailable]\n", + (void *)bugaddr); + + return BUG_TRAP_TYPE_BUG; diff --git a/queue-4.15/dm-bufio-avoid-false-positive-wmaybe-uninitialized-warning.patch b/queue-4.15/dm-bufio-avoid-false-positive-wmaybe-uninitialized-warning.patch new file mode 100644 index 00000000000..af9fe21b0dd --- /dev/null +++ b/queue-4.15/dm-bufio-avoid-false-positive-wmaybe-uninitialized-warning.patch @@ -0,0 +1,73 @@ +From 590347e4000356f55eb10b03ced2686bd74dab40 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Thu, 22 Feb 2018 16:56:16 +0100 +Subject: dm bufio: avoid false-positive Wmaybe-uninitialized warning + +From: Arnd Bergmann + +commit 590347e4000356f55eb10b03ced2686bd74dab40 upstream. + +gcc-6.3 and earlier show a new warning after a seemingly unrelated +change to the arm64 PAGE_KERNEL definition: + +In file included from drivers/md/dm-bufio.c:14:0: +drivers/md/dm-bufio.c: In function 'alloc_buffer': +include/linux/sched/mm.h:182:56: warning: 'noio_flag' may be used uninitialized in this function [-Wmaybe-uninitialized] + current->flags = (current->flags & ~PF_MEMALLOC_NOIO) | flags; + ^ + +The same warning happened earlier on linux-3.18 for MIPS and I did a +workaround for that, but now it's come back. + +gcc-7 and newer are apparently smart enough to figure this out, and +other architectures don't show it, so the best I could come up with is +to rework the caller slightly in a way that makes it obvious enough to +all arm64 compilers what is happening here. + +Fixes: 41acec624087 ("arm64: kpti: Make use of nG dependent on arm64_kernel_unmapped_at_el0()") +Link: https://patchwork.kernel.org/patch/9692829/ +Cc: stable@vger.kernel.org +Signed-off-by: Arnd Bergmann +[snitzer: moved declarations inside conditional, altered vmalloc return] +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-bufio.c | 16 ++++++---------- + 1 file changed, 6 insertions(+), 10 deletions(-) + +--- a/drivers/md/dm-bufio.c ++++ b/drivers/md/dm-bufio.c +@@ -386,9 +386,6 @@ static void __cache_size_refresh(void) + static void *alloc_buffer_data(struct dm_bufio_client *c, gfp_t gfp_mask, + enum data_mode *data_mode) + { +- unsigned noio_flag; +- void *ptr; +- + if (c->block_size <= DM_BUFIO_BLOCK_SIZE_SLAB_LIMIT) { + *data_mode = DATA_MODE_SLAB; + return kmem_cache_alloc(DM_BUFIO_CACHE(c), gfp_mask); +@@ -412,16 +409,15 @@ static void *alloc_buffer_data(struct dm + * all allocations done by this process (including pagetables) are done + * as if GFP_NOIO was specified. + */ ++ if (gfp_mask & __GFP_NORETRY) { ++ unsigned noio_flag = memalloc_noio_save(); ++ void *ptr = __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL); + +- if (gfp_mask & __GFP_NORETRY) +- noio_flag = memalloc_noio_save(); +- +- ptr = __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL); +- +- if (gfp_mask & __GFP_NORETRY) + memalloc_noio_restore(noio_flag); ++ return ptr; ++ } + +- return ptr; ++ return __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL); + } + + /* diff --git a/queue-4.15/documentation-sphinx-fix-directive-import-error.patch b/queue-4.15/documentation-sphinx-fix-directive-import-error.patch new file mode 100644 index 00000000000..5cafcb8b02e --- /dev/null +++ b/queue-4.15/documentation-sphinx-fix-directive-import-error.patch @@ -0,0 +1,38 @@ +From ff690eeed804f112242f9a0614eafdf559f9276a Mon Sep 17 00:00:00 2001 +From: Matthew Wilcox +Date: Fri, 2 Mar 2018 10:40:14 -0800 +Subject: Documentation/sphinx: Fix Directive import error + +From: Matthew Wilcox + +commit ff690eeed804f112242f9a0614eafdf559f9276a upstream. + +Sphinx 1.7 removed sphinx.util.compat.Directive so people +who have upgraded cannot build the documentation. Switch to +docutils.parsers.rst.Directive which has been available since +docutils 0.5 released in 2009. + +Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=1083694 +Co-developed-by: Takashi Iwai +Acked-by: Jani Nikula +Cc: stable@vger.kernel.org +Signed-off-by: Matthew Wilcox +Signed-off-by: Jonathan Corbet +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/sphinx/kerneldoc.py | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/Documentation/sphinx/kerneldoc.py ++++ b/Documentation/sphinx/kerneldoc.py +@@ -36,8 +36,7 @@ import glob + + from docutils import nodes, statemachine + from docutils.statemachine import ViewList +-from docutils.parsers.rst import directives +-from sphinx.util.compat import Directive ++from docutils.parsers.rst import directives, Directive + from sphinx.ext.autodoc import AutodocReporter + + __version__ = '1.0' diff --git a/queue-4.15/drm-allow-determining-if-current-task-is-output-poll-worker.patch b/queue-4.15/drm-allow-determining-if-current-task-is-output-poll-worker.patch new file mode 100644 index 00000000000..6537447e890 --- /dev/null +++ b/queue-4.15/drm-allow-determining-if-current-task-is-output-poll-worker.patch @@ -0,0 +1,74 @@ +From 25c058ccaf2ebbc3e250ec1e199e161f91fe27d4 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Wed, 14 Feb 2018 06:41:25 +0100 +Subject: drm: Allow determining if current task is output poll worker + +From: Lukas Wunner + +commit 25c058ccaf2ebbc3e250ec1e199e161f91fe27d4 upstream. + +Introduce a helper to determine if the current task is an output poll +worker. + +This allows us to fix a long-standing deadlock in several DRM drivers +wherein the ->runtime_suspend callback waits for the output poll worker +to finish and the worker in turn calls a ->detect callback which waits +for runtime suspend to finish. The ->detect callback is invoked from +multiple call sites and waiting for runtime suspend to finish is the +correct thing to do except if it's executing in the context of the +worker. + +v2: Expand kerneldoc to specifically mention deadlock between + output poll worker and autosuspend worker as use case. (Lyude) + +Cc: Dave Airlie +Cc: Ben Skeggs +Cc: Alex Deucher +Reviewed-by: Lyude Paul +Signed-off-by: Lukas Wunner +Link: https://patchwork.freedesktop.org/patch/msgid/3549ce32e7f1467102e70d3e9cbf70c46bfe108e.1518593424.git.lukas@wunner.de +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_probe_helper.c | 20 ++++++++++++++++++++ + include/drm/drm_crtc_helper.h | 1 + + 2 files changed, 21 insertions(+) + +--- a/drivers/gpu/drm/drm_probe_helper.c ++++ b/drivers/gpu/drm/drm_probe_helper.c +@@ -655,6 +655,26 @@ out: + } + + /** ++ * drm_kms_helper_is_poll_worker - is %current task an output poll worker? ++ * ++ * Determine if %current task is an output poll worker. This can be used ++ * to select distinct code paths for output polling versus other contexts. ++ * ++ * One use case is to avoid a deadlock between the output poll worker and ++ * the autosuspend worker wherein the latter waits for polling to finish ++ * upon calling drm_kms_helper_poll_disable(), while the former waits for ++ * runtime suspend to finish upon calling pm_runtime_get_sync() in a ++ * connector ->detect hook. ++ */ ++bool drm_kms_helper_is_poll_worker(void) ++{ ++ struct work_struct *work = current_work(); ++ ++ return work && work->func == output_poll_execute; ++} ++EXPORT_SYMBOL(drm_kms_helper_is_poll_worker); ++ ++/** + * drm_kms_helper_poll_disable - disable output polling + * @dev: drm_device + * +--- a/include/drm/drm_crtc_helper.h ++++ b/include/drm/drm_crtc_helper.h +@@ -77,5 +77,6 @@ void drm_kms_helper_hotplug_event(struct + + void drm_kms_helper_poll_disable(struct drm_device *dev); + void drm_kms_helper_poll_enable(struct drm_device *dev); ++bool drm_kms_helper_is_poll_worker(void); + + #endif diff --git a/queue-4.15/drm-amd-display-check-for-ipp-before-calling-cursor-operations.patch b/queue-4.15/drm-amd-display-check-for-ipp-before-calling-cursor-operations.patch new file mode 100644 index 00000000000..e3d4bf29da9 --- /dev/null +++ b/queue-4.15/drm-amd-display-check-for-ipp-before-calling-cursor-operations.patch @@ -0,0 +1,50 @@ +From d6b6669762898dfc99e9273b8d8603bc47014aa9 Mon Sep 17 00:00:00 2001 +From: Shirish S +Date: Wed, 21 Feb 2018 16:10:33 +0530 +Subject: drm/amd/display: check for ipp before calling cursor operations + +From: Shirish S + +commit d6b6669762898dfc99e9273b8d8603bc47014aa9 upstream. + +Currently all cursor related functions are made to all +pipes that are attached to a particular stream. +This is not applicable to pipes that do not have cursor plane +initialised like underlay. +Hence this patch allows cursor related operations on a pipe +only if ipp in available on that particular pipe. + +The check is added to set_cursor_position & set_cursor_attribute. + +Signed-off-by: Shirish S +Reviewed-by: Harry Wentland +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c +@@ -200,7 +200,8 @@ bool dc_stream_set_cursor_attributes( + for (i = 0; i < MAX_PIPES; i++) { + struct pipe_ctx *pipe_ctx = &res_ctx->pipe_ctx[i]; + +- if (pipe_ctx->stream != stream || (!pipe_ctx->plane_res.xfm && !pipe_ctx->plane_res.dpp)) ++ if (pipe_ctx->stream != stream || (!pipe_ctx->plane_res.xfm && ++ !pipe_ctx->plane_res.dpp) || !pipe_ctx->plane_res.ipp) + continue; + if (pipe_ctx->top_pipe && pipe_ctx->plane_state != pipe_ctx->top_pipe->plane_state) + continue; +@@ -276,7 +277,8 @@ bool dc_stream_set_cursor_position( + if (pipe_ctx->stream != stream || + (!pipe_ctx->plane_res.mi && !pipe_ctx->plane_res.hubp) || + !pipe_ctx->plane_state || +- (!pipe_ctx->plane_res.xfm && !pipe_ctx->plane_res.dpp)) ++ (!pipe_ctx->plane_res.xfm && !pipe_ctx->plane_res.dpp) || ++ !pipe_ctx->plane_res.ipp) + continue; + + if (pipe_ctx->plane_state->address.type diff --git a/queue-4.15/drm-amd-display-default-hdmi6g-support-to-true.-log-vbios-table-error.patch b/queue-4.15/drm-amd-display-default-hdmi6g-support-to-true.-log-vbios-table-error.patch new file mode 100644 index 00000000000..d9270a55045 --- /dev/null +++ b/queue-4.15/drm-amd-display-default-hdmi6g-support-to-true.-log-vbios-table-error.patch @@ -0,0 +1,69 @@ +From caf0a9030d75509f3cacefe466d6d69d26e3dee6 Mon Sep 17 00:00:00 2001 +From: Harry Wentland +Date: Tue, 20 Feb 2018 13:36:23 -0500 +Subject: drm/amd/display: Default HDMI6G support to true. Log VBIOS table error. + +From: Harry Wentland + +commit caf0a9030d75509f3cacefe466d6d69d26e3dee6 upstream. + +There have been many reports of Ellesmere and Baffin systems not being +able to drive HDMI 4k60 due to the fact that we check the HDMI_6GB_EN +bit from VBIOS table. Windows seems to not have this issue. + +On some systems we fail to the encoder cap info from VBIOS. In that case +we should default to enabling HDMI6G support. + +This was tested by dwagner on +https://bugs.freedesktop.org/show_bug.cgi?id=102820 + +Signed-off-by: Harry Wentland +Reviewed-by: Roman Li +Reviewed-by: Tony Cheng +Acked-by: Harry Wentland +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c +@@ -683,6 +683,7 @@ void dce110_link_encoder_construct( + { + struct bp_encoder_cap_info bp_cap_info = {0}; + const struct dc_vbios_funcs *bp_funcs = init_data->ctx->dc_bios->funcs; ++ enum bp_result result = BP_RESULT_OK; + + enc110->base.funcs = &dce110_lnk_enc_funcs; + enc110->base.ctx = init_data->ctx; +@@ -757,15 +758,24 @@ void dce110_link_encoder_construct( + enc110->base.preferred_engine = ENGINE_ID_UNKNOWN; + } + ++ /* default to one to mirror Windows behavior */ ++ enc110->base.features.flags.bits.HDMI_6GB_EN = 1; ++ ++ result = bp_funcs->get_encoder_cap_info(enc110->base.ctx->dc_bios, ++ enc110->base.id, &bp_cap_info); ++ + /* Override features with DCE-specific values */ +- if (BP_RESULT_OK == bp_funcs->get_encoder_cap_info( +- enc110->base.ctx->dc_bios, enc110->base.id, +- &bp_cap_info)) { ++ if (BP_RESULT_OK == result) { + enc110->base.features.flags.bits.IS_HBR2_CAPABLE = + bp_cap_info.DP_HBR2_EN; + enc110->base.features.flags.bits.IS_HBR3_CAPABLE = + bp_cap_info.DP_HBR3_EN; + enc110->base.features.flags.bits.HDMI_6GB_EN = bp_cap_info.HDMI_6GB_EN; ++ } else { ++ dm_logger_write(enc110->base.ctx->logger, LOG_WARNING, ++ "%s: Failed to get encoder_cap_info from VBIOS with error code %d!\n", ++ __func__, ++ result); + } + } + diff --git a/queue-4.15/drm-amd-powerplay-fix-power-over-limit-on-fiji.patch b/queue-4.15/drm-amd-powerplay-fix-power-over-limit-on-fiji.patch new file mode 100644 index 00000000000..b2d846cfd29 --- /dev/null +++ b/queue-4.15/drm-amd-powerplay-fix-power-over-limit-on-fiji.patch @@ -0,0 +1,40 @@ +From a0aaa03062be252aacad60a776f3374dd53e3f98 Mon Sep 17 00:00:00 2001 +From: Eric Huang +Date: Mon, 26 Feb 2018 17:36:19 -0500 +Subject: drm/amd/powerplay: fix power over limit on Fiji + +From: Eric Huang + +commit a0aaa03062be252aacad60a776f3374dd53e3f98 upstream. + +power containment disabled only on Fiji and compute +power profile. It violates PCIe spec and may cause power +supply failed. Enabling it will fix the issue, even the +fix will drop performance of some compute tests. + +Signed-off-by: Eric Huang +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 7 ------- + 1 file changed, 7 deletions(-) + +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c +@@ -4572,13 +4572,6 @@ static int smu7_set_power_profile_state( + int tmp_result, result = 0; + uint32_t sclk_mask = 0, mclk_mask = 0; + +- if (hwmgr->chip_id == CHIP_FIJI) { +- if (request->type == AMD_PP_GFX_PROFILE) +- smu7_enable_power_containment(hwmgr); +- else if (request->type == AMD_PP_COMPUTE_PROFILE) +- smu7_disable_power_containment(hwmgr); +- } +- + if (hwmgr->dpm_level != AMD_DPM_FORCED_LEVEL_AUTO) + return -EINVAL; + diff --git a/queue-4.15/drm-amd-powerplay-smu7-allow-mclk-switching-with-no-displays.patch b/queue-4.15/drm-amd-powerplay-smu7-allow-mclk-switching-with-no-displays.patch new file mode 100644 index 00000000000..2a86f778b5f --- /dev/null +++ b/queue-4.15/drm-amd-powerplay-smu7-allow-mclk-switching-with-no-displays.patch @@ -0,0 +1,43 @@ +From 51954e17914aaadf18d97b21c2a2cee16fa29513 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Tue, 13 Feb 2018 14:26:54 -0500 +Subject: drm/amd/powerplay/smu7: allow mclk switching with no displays + +From: Alex Deucher + +commit 51954e17914aaadf18d97b21c2a2cee16fa29513 upstream. + +If there are no displays attached, there is no reason to disable +mclk switching. + +Fixes mclks getting set to high when there are no displays attached. + +Reviewed-by: Eric Huang +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c +@@ -2791,10 +2791,13 @@ static int smu7_apply_state_adjust_rules + PHM_PlatformCaps_DisableMclkSwitchingForFrameLock); + + +- disable_mclk_switching = ((1 < info.display_count) || +- disable_mclk_switching_for_frame_lock || +- smu7_vblank_too_short(hwmgr, mode_info.vblank_time_us) || +- (mode_info.refresh_rate > 120)); ++ if (info.display_count == 0) ++ disable_mclk_switching = false; ++ else ++ disable_mclk_switching = ((1 < info.display_count) || ++ disable_mclk_switching_for_frame_lock || ++ smu7_vblank_too_short(hwmgr, mode_info.vblank_time_us) || ++ (mode_info.refresh_rate > 120)); + + sclk = smu7_ps->performance_levels[0].engine_clock; + mclk = smu7_ps->performance_levels[0].memory_clock; diff --git a/queue-4.15/drm-amd-powerplay-vega10-allow-mclk-switching-with-no-displays.patch b/queue-4.15/drm-amd-powerplay-vega10-allow-mclk-switching-with-no-displays.patch new file mode 100644 index 00000000000..c12d3ba4208 --- /dev/null +++ b/queue-4.15/drm-amd-powerplay-vega10-allow-mclk-switching-with-no-displays.patch @@ -0,0 +1,43 @@ +From 5825acf5c958a6820b04e9811caeb2f5e572bcd8 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Tue, 13 Feb 2018 14:25:11 -0500 +Subject: drm/amd/powerplay/vega10: allow mclk switching with no displays + +From: Alex Deucher + +commit 5825acf5c958a6820b04e9811caeb2f5e572bcd8 upstream. + +If there are no displays attached, there is no reason to disable +mclk switching. + +Fixes mclks getting set to high when there are no displays attached. + +Reviewed-by: Eric Huang +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c +@@ -3208,10 +3208,13 @@ static int vega10_apply_state_adjust_rul + disable_mclk_switching_for_vr = PP_CAP(PHM_PlatformCaps_DisableMclkSwitchForVR); + force_mclk_high = PP_CAP(PHM_PlatformCaps_ForceMclkHigh); + +- disable_mclk_switching = (info.display_count > 1) || +- disable_mclk_switching_for_frame_lock || +- disable_mclk_switching_for_vr || +- force_mclk_high; ++ if (info.display_count == 0) ++ disable_mclk_switching = false; ++ else ++ disable_mclk_switching = (info.display_count > 1) || ++ disable_mclk_switching_for_frame_lock || ++ disable_mclk_switching_for_vr || ++ force_mclk_high; + + sclk = vega10_ps->performance_levels[0].gfx_clock; + mclk = vega10_ps->performance_levels[0].mem_clock; diff --git a/queue-4.15/drm-amdgpu-always-save-uvd-vcpu_bo-in-vm-mode.patch b/queue-4.15/drm-amdgpu-always-save-uvd-vcpu_bo-in-vm-mode.patch new file mode 100644 index 00000000000..0b243d3e7d0 --- /dev/null +++ b/queue-4.15/drm-amdgpu-always-save-uvd-vcpu_bo-in-vm-mode.patch @@ -0,0 +1,51 @@ +From f8bee6135e167f5b35b7789c74c2956dad14d0d5 Mon Sep 17 00:00:00 2001 +From: James Zhu +Date: Tue, 6 Mar 2018 14:52:35 -0500 +Subject: drm/amdgpu:Always save uvd vcpu_bo in VM Mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: James Zhu + +commit f8bee6135e167f5b35b7789c74c2956dad14d0d5 upstream. + +When UVD is in VM mode, there is not uvd handle exchanged, +uvd.handles are always 0. So vcpu_bo always need save, +Otherwise amdgpu driver will fail during suspend/resume. + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105021 +Signed-off-by: James Zhu +Reviewed-by: Leo Liu +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c +@@ -297,12 +297,15 @@ int amdgpu_uvd_suspend(struct amdgpu_dev + if (adev->uvd.vcpu_bo == NULL) + return 0; + +- for (i = 0; i < adev->uvd.max_handles; ++i) +- if (atomic_read(&adev->uvd.handles[i])) +- break; ++ /* only valid for physical mode */ ++ if (adev->asic_type < CHIP_POLARIS10) { ++ for (i = 0; i < adev->uvd.max_handles; ++i) ++ if (atomic_read(&adev->uvd.handles[i])) ++ break; + +- if (i == adev->uvd.max_handles) +- return 0; ++ if (i == adev->uvd.max_handles) ++ return 0; ++ } + + cancel_delayed_work_sync(&adev->uvd.idle_work); + diff --git a/queue-4.15/drm-amdgpu-correct-max-uvd-handles.patch b/queue-4.15/drm-amdgpu-correct-max-uvd-handles.patch new file mode 100644 index 00000000000..b5f18c7e823 --- /dev/null +++ b/queue-4.15/drm-amdgpu-correct-max-uvd-handles.patch @@ -0,0 +1,37 @@ +From 0e5ee33d2a54e4c55fe92857f23e1cbb0440d6de Mon Sep 17 00:00:00 2001 +From: James Zhu +Date: Tue, 6 Mar 2018 14:43:50 -0500 +Subject: drm/amdgpu:Correct max uvd handles +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: James Zhu + +commit 0e5ee33d2a54e4c55fe92857f23e1cbb0440d6de upstream. + +Max uvd handles should use adev->uvd.max_handles instead of +AMDGPU_MAX_UVD_HANDLES here. + +Signed-off-by: James Zhu +Reviewed-by: Leo Liu +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c +@@ -301,7 +301,7 @@ int amdgpu_uvd_suspend(struct amdgpu_dev + if (atomic_read(&adev->uvd.handles[i])) + break; + +- if (i == AMDGPU_MAX_UVD_HANDLES) ++ if (i == adev->uvd.max_handles) + return 0; + + cancel_delayed_work_sync(&adev->uvd.idle_work); diff --git a/queue-4.15/drm-amdgpu-fix-deadlock-on-runtime-suspend.patch b/queue-4.15/drm-amdgpu-fix-deadlock-on-runtime-suspend.patch new file mode 100644 index 00000000000..a8ee8ffb05e --- /dev/null +++ b/queue-4.15/drm-amdgpu-fix-deadlock-on-runtime-suspend.patch @@ -0,0 +1,151 @@ +From aa0aad57909eb321746325951d66af88a83bc956 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Sun, 11 Feb 2018 10:38:28 +0100 +Subject: drm/amdgpu: Fix deadlock on runtime suspend + +From: Lukas Wunner + +commit aa0aad57909eb321746325951d66af88a83bc956 upstream. + +amdgpu's ->runtime_suspend hook calls drm_kms_helper_poll_disable(), +which waits for the output poll worker to finish if it's running. + +The output poll worker meanwhile calls pm_runtime_get_sync() in +amdgpu's ->detect hooks, which waits for the ongoing suspend to finish, +causing a deadlock. + +Fix by not acquiring a runtime PM ref if the ->detect hooks are called +in the output poll worker's context. This is safe because the poll +worker is only enabled while runtime active and we know that +->runtime_suspend waits for it to finish. + +Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)") +Cc: stable@vger.kernel.org # v4.2+: 27d4ee03078a: workqueue: Allow retrieval of current task's work struct +Cc: stable@vger.kernel.org # v4.2+: 25c058ccaf2e: drm: Allow determining if current task is output poll worker +Cc: Alex Deucher +Tested-by: Mike Lothian +Reviewed-by: Lyude Paul +Signed-off-by: Lukas Wunner +Link: https://patchwork.freedesktop.org/patch/msgid/4c9bf72aacae1eef062bd134cd112e0770a7f121.1518338789.git.lukas@wunner.de +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 58 ++++++++++++++++--------- + 1 file changed, 38 insertions(+), 20 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +@@ -737,9 +737,11 @@ amdgpu_connector_lvds_detect(struct drm_ + enum drm_connector_status ret = connector_status_disconnected; + int r; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (encoder) { + struct amdgpu_encoder *amdgpu_encoder = to_amdgpu_encoder(encoder); +@@ -758,8 +760,12 @@ amdgpu_connector_lvds_detect(struct drm_ + /* check acpi lid status ??? */ + + amdgpu_connector_update_scratch_regs(connector, ret); +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } ++ + return ret; + } + +@@ -869,9 +875,11 @@ amdgpu_connector_vga_detect(struct drm_c + enum drm_connector_status ret = connector_status_disconnected; + int r; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + encoder = amdgpu_connector_best_single_encoder(connector); + if (!encoder) +@@ -925,8 +933,10 @@ amdgpu_connector_vga_detect(struct drm_c + amdgpu_connector_update_scratch_regs(connector, ret); + + out: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } +@@ -989,9 +999,11 @@ amdgpu_connector_dvi_detect(struct drm_c + enum drm_connector_status ret = connector_status_disconnected; + bool dret = false, broken_edid = false; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) { + ret = connector->status; +@@ -1116,8 +1128,10 @@ out: + amdgpu_connector_update_scratch_regs(connector, ret); + + exit: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } +@@ -1360,9 +1374,11 @@ amdgpu_connector_dp_detect(struct drm_co + struct drm_encoder *encoder = amdgpu_connector_best_single_encoder(connector); + int r; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) { + ret = connector->status; +@@ -1430,8 +1446,10 @@ amdgpu_connector_dp_detect(struct drm_co + + amdgpu_connector_update_scratch_regs(connector, ret); + out: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } diff --git a/queue-4.15/drm-amdgpu-fix-kv-harvesting.patch b/queue-4.15/drm-amdgpu-fix-kv-harvesting.patch new file mode 100644 index 00000000000..99b7bd10962 --- /dev/null +++ b/queue-4.15/drm-amdgpu-fix-kv-harvesting.patch @@ -0,0 +1,65 @@ +From 545b0bcde7fbd3ee408fa842ea0731451dc4bd0a Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Thu, 1 Mar 2018 11:05:31 -0500 +Subject: drm/amdgpu: fix KV harvesting +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit 545b0bcde7fbd3ee408fa842ea0731451dc4bd0a upstream. + +Always set the graphics values to the max for the +asic type. E.g., some 1 RB chips are actually 1 RB chips, +others are actually harvested 2 RB chips. + +Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=99353 +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 30 ++---------------------------- + 1 file changed, 2 insertions(+), 28 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +@@ -4403,34 +4403,8 @@ static void gfx_v7_0_gpu_early_init(stru + case CHIP_KAVERI: + adev->gfx.config.max_shader_engines = 1; + adev->gfx.config.max_tile_pipes = 4; +- if ((adev->pdev->device == 0x1304) || +- (adev->pdev->device == 0x1305) || +- (adev->pdev->device == 0x130C) || +- (adev->pdev->device == 0x130F) || +- (adev->pdev->device == 0x1310) || +- (adev->pdev->device == 0x1311) || +- (adev->pdev->device == 0x131C)) { +- adev->gfx.config.max_cu_per_sh = 8; +- adev->gfx.config.max_backends_per_se = 2; +- } else if ((adev->pdev->device == 0x1309) || +- (adev->pdev->device == 0x130A) || +- (adev->pdev->device == 0x130D) || +- (adev->pdev->device == 0x1313) || +- (adev->pdev->device == 0x131D)) { +- adev->gfx.config.max_cu_per_sh = 6; +- adev->gfx.config.max_backends_per_se = 2; +- } else if ((adev->pdev->device == 0x1306) || +- (adev->pdev->device == 0x1307) || +- (adev->pdev->device == 0x130B) || +- (adev->pdev->device == 0x130E) || +- (adev->pdev->device == 0x1315) || +- (adev->pdev->device == 0x131B)) { +- adev->gfx.config.max_cu_per_sh = 4; +- adev->gfx.config.max_backends_per_se = 1; +- } else { +- adev->gfx.config.max_cu_per_sh = 3; +- adev->gfx.config.max_backends_per_se = 1; +- } ++ adev->gfx.config.max_cu_per_sh = 8; ++ adev->gfx.config.max_backends_per_se = 2; + adev->gfx.config.max_sh_per_se = 1; + adev->gfx.config.max_texture_channel_caches = 4; + adev->gfx.config.max_gprs = 256; diff --git a/queue-4.15/drm-amdgpu-notify-sbios-device-ready-before-send-request.patch b/queue-4.15/drm-amdgpu-notify-sbios-device-ready-before-send-request.patch new file mode 100644 index 00000000000..49cc1284665 --- /dev/null +++ b/queue-4.15/drm-amdgpu-notify-sbios-device-ready-before-send-request.patch @@ -0,0 +1,35 @@ +From 1bced75f4ab04bec55aecb57d99435dc6d0ae5a0 Mon Sep 17 00:00:00 2001 +From: Rex Zhu +Date: Tue, 27 Feb 2018 18:20:53 +0800 +Subject: drm/amdgpu: Notify sbios device ready before send request + +From: Rex Zhu + +commit 1bced75f4ab04bec55aecb57d99435dc6d0ae5a0 upstream. + +it is required if a platform supports PCIe root complex +core voltage reduction. After receiving this notification, +SBIOS can apply default PCIe root complex power policy. + +Reviewed-by: Alex Deucher +Signed-off-by: Rex Zhu +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +@@ -540,6 +540,9 @@ int amdgpu_acpi_pcie_performance_request + size_t size; + u32 retry = 3; + ++ if (amdgpu_acpi_pcie_notify_device_ready(adev)) ++ return -EINVAL; ++ + /* Get the device handle */ + handle = ACPI_HANDLE(&adev->pdev->dev); + if (!handle) diff --git a/queue-4.15/drm-amdgpu-used-cached-pcie-gen-info-for-si-v2.patch b/queue-4.15/drm-amdgpu-used-cached-pcie-gen-info-for-si-v2.patch new file mode 100644 index 00000000000..00641eb88dd --- /dev/null +++ b/queue-4.15/drm-amdgpu-used-cached-pcie-gen-info-for-si-v2.patch @@ -0,0 +1,195 @@ +From 05656e5e4917a08296300dc0530aed1539202c25 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 26 Feb 2018 11:05:10 -0500 +Subject: drm/amdgpu: used cached pcie gen info for SI (v2) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit 05656e5e4917a08296300dc0530aed1539202c25 upstream. + +Rather than querying it every time we need it. +Also fixes a crash in VM pass through if there is no +root bridge because the cached value fetch already checks +this properly. + +v2: fix includes + +Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=105244 +Acked-by: Christian König +Reviewed-by: Rex Zhu +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/si.c | 22 +++++++-------- + drivers/gpu/drm/amd/amdgpu/si_dpm.c | 50 +++++++++--------------------------- + 2 files changed, 23 insertions(+), 49 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/si.c ++++ b/drivers/gpu/drm/amd/amdgpu/si.c +@@ -31,6 +31,7 @@ + #include "amdgpu_uvd.h" + #include "amdgpu_vce.h" + #include "atom.h" ++#include "amd_pcie.h" + #include "amdgpu_powerplay.h" + #include "sid.h" + #include "si_ih.h" +@@ -1461,8 +1462,8 @@ static void si_pcie_gen3_enable(struct a + { + struct pci_dev *root = adev->pdev->bus->self; + int bridge_pos, gpu_pos; +- u32 speed_cntl, mask, current_data_rate; +- int ret, i; ++ u32 speed_cntl, current_data_rate; ++ int i; + u16 tmp16; + + if (pci_is_root_bus(adev->pdev->bus)) +@@ -1474,23 +1475,20 @@ static void si_pcie_gen3_enable(struct a + if (adev->flags & AMD_IS_APU) + return; + +- ret = drm_pcie_get_speed_cap_mask(adev->ddev, &mask); +- if (ret != 0) +- return; +- +- if (!(mask & (DRM_PCIE_SPEED_50 | DRM_PCIE_SPEED_80))) ++ if (!(adev->pm.pcie_gen_mask & (CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2 | ++ CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3))) + return; + + speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL); + current_data_rate = (speed_cntl & LC_CURRENT_DATA_RATE_MASK) >> + LC_CURRENT_DATA_RATE_SHIFT; +- if (mask & DRM_PCIE_SPEED_80) { ++ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) { + if (current_data_rate == 2) { + DRM_INFO("PCIE gen 3 link speeds already enabled\n"); + return; + } + DRM_INFO("enabling PCIE gen 3 link speeds, disable with amdgpu.pcie_gen2=0\n"); +- } else if (mask & DRM_PCIE_SPEED_50) { ++ } else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2) { + if (current_data_rate == 1) { + DRM_INFO("PCIE gen 2 link speeds already enabled\n"); + return; +@@ -1506,7 +1504,7 @@ static void si_pcie_gen3_enable(struct a + if (!gpu_pos) + return; + +- if (mask & DRM_PCIE_SPEED_80) { ++ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) { + if (current_data_rate != 2) { + u16 bridge_cfg, gpu_cfg; + u16 bridge_cfg2, gpu_cfg2; +@@ -1589,9 +1587,9 @@ static void si_pcie_gen3_enable(struct a + + pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); + tmp16 &= ~0xf; +- if (mask & DRM_PCIE_SPEED_80) ++ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) + tmp16 |= 3; +- else if (mask & DRM_PCIE_SPEED_50) ++ else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2) + tmp16 |= 2; + else + tmp16 |= 1; +--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c ++++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c +@@ -26,6 +26,7 @@ + #include "amdgpu_pm.h" + #include "amdgpu_dpm.h" + #include "amdgpu_atombios.h" ++#include "amd_pcie.h" + #include "sid.h" + #include "r600_dpm.h" + #include "si_dpm.h" +@@ -3331,29 +3332,6 @@ static void btc_apply_voltage_delta_rule + } + } + +-static enum amdgpu_pcie_gen r600_get_pcie_gen_support(struct amdgpu_device *adev, +- u32 sys_mask, +- enum amdgpu_pcie_gen asic_gen, +- enum amdgpu_pcie_gen default_gen) +-{ +- switch (asic_gen) { +- case AMDGPU_PCIE_GEN1: +- return AMDGPU_PCIE_GEN1; +- case AMDGPU_PCIE_GEN2: +- return AMDGPU_PCIE_GEN2; +- case AMDGPU_PCIE_GEN3: +- return AMDGPU_PCIE_GEN3; +- default: +- if ((sys_mask & DRM_PCIE_SPEED_80) && (default_gen == AMDGPU_PCIE_GEN3)) +- return AMDGPU_PCIE_GEN3; +- else if ((sys_mask & DRM_PCIE_SPEED_50) && (default_gen == AMDGPU_PCIE_GEN2)) +- return AMDGPU_PCIE_GEN2; +- else +- return AMDGPU_PCIE_GEN1; +- } +- return AMDGPU_PCIE_GEN1; +-} +- + static void r600_calculate_u_and_p(u32 i, u32 r_c, u32 p_b, + u32 *p, u32 *u) + { +@@ -5028,10 +5006,11 @@ static int si_populate_smc_acpi_state(st + table->ACPIState.levels[0].vddc.index, + &table->ACPIState.levels[0].std_vddc); + } +- table->ACPIState.levels[0].gen2PCIE = (u8)r600_get_pcie_gen_support(adev, +- si_pi->sys_pcie_mask, +- si_pi->boot_pcie_gen, +- AMDGPU_PCIE_GEN1); ++ table->ACPIState.levels[0].gen2PCIE = ++ (u8)amdgpu_get_pcie_gen_support(adev, ++ si_pi->sys_pcie_mask, ++ si_pi->boot_pcie_gen, ++ AMDGPU_PCIE_GEN1); + + if (si_pi->vddc_phase_shed_control) + si_populate_phase_shedding_value(adev, +@@ -7172,10 +7151,10 @@ static void si_parse_pplib_clock_info(st + pl->vddc = le16_to_cpu(clock_info->si.usVDDC); + pl->vddci = le16_to_cpu(clock_info->si.usVDDCI); + pl->flags = le32_to_cpu(clock_info->si.ulFlags); +- pl->pcie_gen = r600_get_pcie_gen_support(adev, +- si_pi->sys_pcie_mask, +- si_pi->boot_pcie_gen, +- clock_info->si.ucPCIEGen); ++ pl->pcie_gen = amdgpu_get_pcie_gen_support(adev, ++ si_pi->sys_pcie_mask, ++ si_pi->boot_pcie_gen, ++ clock_info->si.ucPCIEGen); + + /* patch up vddc if necessary */ + ret = si_get_leakage_voltage_from_leakage_index(adev, pl->vddc, +@@ -7330,7 +7309,6 @@ static int si_dpm_init(struct amdgpu_dev + struct si_power_info *si_pi; + struct atom_clock_dividers dividers; + int ret; +- u32 mask; + + si_pi = kzalloc(sizeof(struct si_power_info), GFP_KERNEL); + if (si_pi == NULL) +@@ -7340,11 +7318,9 @@ static int si_dpm_init(struct amdgpu_dev + eg_pi = &ni_pi->eg; + pi = &eg_pi->rv7xx; + +- ret = drm_pcie_get_speed_cap_mask(adev->ddev, &mask); +- if (ret) +- si_pi->sys_pcie_mask = 0; +- else +- si_pi->sys_pcie_mask = mask; ++ si_pi->sys_pcie_mask = ++ (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_MASK) >> ++ CAIL_PCIE_LINK_SPEED_SUPPORT_SHIFT; + si_pi->force_pcie_gen = AMDGPU_PCIE_GEN_INVALID; + si_pi->boot_pcie_gen = si_get_current_pcie_speed(adev); + diff --git a/queue-4.15/drm-i915-always-call-to-intel_display_set_init_power-in-resume_early.patch b/queue-4.15/drm-i915-always-call-to-intel_display_set_init_power-in-resume_early.patch new file mode 100644 index 00000000000..7d6d9661d49 --- /dev/null +++ b/queue-4.15/drm-i915-always-call-to-intel_display_set_init_power-in-resume_early.patch @@ -0,0 +1,44 @@ +From d13a8479f3584613b6aacbb793eae64578b8f69a Mon Sep 17 00:00:00 2001 +From: Maarten Lankhorst +Date: Tue, 16 Jan 2018 16:53:24 +0100 +Subject: drm/i915: Always call to intel_display_set_init_power() in resume_early. + +From: Maarten Lankhorst + +commit d13a8479f3584613b6aacbb793eae64578b8f69a upstream. + +intel_power_domains_init_hw() calls set_init_power, but when using +runtime power management this call is skipped. This prevents hw readout +from taking place. + +Signed-off-by: Maarten Lankhorst +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=104172 +Link: https://patchwork.freedesktop.org/patch/msgid/20180116155324.75120-1-maarten.lankhorst@linux.intel.com +Fixes: bc87229f323e ("drm/i915/skl: enable PC9/10 power states during suspend-to-idle") +Cc: Nivedita Swaminathan +Cc: Imre Deak +Cc: Patrik Jakobsson +Cc: Jani Nikula +Cc: Joonas Lahtinen +Cc: Rodrigo Vivi +Cc: # v4.5+ +Reviewed-by: Imre Deak +(cherry picked from commit ac25dfed15d470d7f23dd817e965b54aa3f94a1e) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_drv.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/i915/i915_drv.c ++++ b/drivers/gpu/drm/i915/i915_drv.c +@@ -1827,6 +1827,8 @@ static int i915_drm_resume_early(struct + if (IS_GEN9_LP(dev_priv) || + !(dev_priv->suspended_to_idle && dev_priv->csr.dmc_payload)) + intel_power_domains_init_hw(dev_priv, true); ++ else ++ intel_display_set_init_power(dev_priv, true); + + i915_gem_sanitize(dev_priv); + diff --git a/queue-4.15/drm-i915-audio-fix-check-for-av_enc_map-overflow.patch b/queue-4.15/drm-i915-audio-fix-check-for-av_enc_map-overflow.patch new file mode 100644 index 00000000000..4e99085f9a0 --- /dev/null +++ b/queue-4.15/drm-i915-audio-fix-check-for-av_enc_map-overflow.patch @@ -0,0 +1,50 @@ +From 72a6d72c2cd03bba7b70117b63dea83d2de88057 Mon Sep 17 00:00:00 2001 +From: Jani Nikula +Date: Wed, 14 Feb 2018 19:38:40 +0200 +Subject: drm/i915/audio: fix check for av_enc_map overflow + +From: Jani Nikula + +commit 72a6d72c2cd03bba7b70117b63dea83d2de88057 upstream. + +Turns out -1 >= ARRAY_SIZE() is always true. Move the bounds check where +we know pipe >= 0 and next to the array indexing where it makes most +sense. + +Fixes: 9965db26ac05 ("drm/i915: Check for fused or unused pipes") +Fixes: 0b7029b7e43f ("drm/i915: Check for fused or unused pipes") +Cc: # v4.10+ +Cc: Mika Kahola +Cc: Rodrigo Vivi +Cc: Jani Nikula +Cc: Joonas Lahtinen +Cc: intel-gfx@lists.freedesktop.org +Reviewed-by: Dhinakaran Pandiyan +Reviewed-by: Mika Kahola +Signed-off-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20180214173840.25360-1-jani.nikula@intel.com +(cherry picked from commit cdb3db8542d854bd678d60cd28861b042e191672) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_audio.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_audio.c ++++ b/drivers/gpu/drm/i915/intel_audio.c +@@ -754,11 +754,11 @@ static struct intel_encoder *get_saved_e + { + struct intel_encoder *encoder; + +- if (WARN_ON(pipe >= ARRAY_SIZE(dev_priv->av_enc_map))) +- return NULL; +- + /* MST */ + if (pipe >= 0) { ++ if (WARN_ON(pipe >= ARRAY_SIZE(dev_priv->av_enc_map))) ++ return NULL; ++ + encoder = dev_priv->av_enc_map[pipe]; + /* + * when bootup, audio driver may not know it is diff --git a/queue-4.15/drm-i915-check-for-fused-or-unused-pipes.patch b/queue-4.15/drm-i915-check-for-fused-or-unused-pipes.patch new file mode 100644 index 00000000000..753bab44ff9 --- /dev/null +++ b/queue-4.15/drm-i915-check-for-fused-or-unused-pipes.patch @@ -0,0 +1,43 @@ +From 9965db26ac0548648309f506dc155a92daa2158f Mon Sep 17 00:00:00 2001 +From: Mika Kahola +Date: Mon, 18 Dec 2017 10:04:03 +0200 +Subject: drm/i915: Check for fused or unused pipes + +From: Mika Kahola + +commit 9965db26ac0548648309f506dc155a92daa2158f upstream. + +We may have fused or unused pipes in our system. Let's check that the pipe +in question is within limits of accessible pipes. In case, that we are not +able to access the pipe, we return early with a warning. + +v2: Rephrasing of the commit message (Jani) + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=103206 +Reported-by: Thomas Gleixner +Tested-by: Jaswinder Singh Rajput +Suggested-by: Jani Nikula +Reviewed-by: Jani Nikula +Signed-off-by: Mika Kahola +Signed-off-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/1513584243-12607-1-git-send-email-mika.kahola@intel.com +(cherry picked from commit 0b7029b7e43fda1304c181a3ade0b429b9edcd9d) +Signed-off-by: Rodrigo Vivi +Cc: # v4.10+ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_audio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/intel_audio.c ++++ b/drivers/gpu/drm/i915/intel_audio.c +@@ -754,7 +754,7 @@ static struct intel_encoder *get_saved_e + { + struct intel_encoder *encoder; + +- if (WARN_ON(pipe >= INTEL_INFO(dev_priv)->num_pipes)) ++ if (WARN_ON(pipe >= ARRAY_SIZE(dev_priv->av_enc_map))) + return NULL; + + /* MST */ diff --git a/queue-4.15/drm-i915-clear-the-in-use-marker-on-execbuf-failure.patch b/queue-4.15/drm-i915-clear-the-in-use-marker-on-execbuf-failure.patch new file mode 100644 index 00000000000..7b92f60f821 --- /dev/null +++ b/queue-4.15/drm-i915-clear-the-in-use-marker-on-execbuf-failure.patch @@ -0,0 +1,40 @@ +From e659d14ed48096f87a678e7ebbdf286a817b4d0e Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Mon, 19 Feb 2018 14:01:44 +0000 +Subject: drm/i915: Clear the in-use marker on execbuf failure + +From: Chris Wilson + +commit e659d14ed48096f87a678e7ebbdf286a817b4d0e upstream. + +If we fail to unbind the vma (due to a signal on an active buffer that +needs to be moved for the next execbuf), then we need to clear the +persistent tracking state we setup for this execbuf. + +Fixes: c7c6e46f913b ("drm/i915: Convert execbuf to use struct-of-array packing for critical fields") +Testcase: igt/gem_fenced_exec_thrash/no-spare-fences-busy* +Signed-off-by: Chris Wilson +Cc: Tvrtko Ursulin +Cc: Joonas Lahtinen +Cc: # v4.14+ +Reviewed-by: Tvrtko Ursulin +Link: https://patchwork.freedesktop.org/patch/msgid/20180219140144.24004-1-chris@chris-wilson.co.uk +(cherry picked from commit ed2f3532321083cf40e4da4e36234880e0136136) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_gem_execbuffer.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c ++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c +@@ -505,6 +505,8 @@ eb_add_vma(struct i915_execbuffer *eb, u + list_add_tail(&vma->exec_link, &eb->unbound); + if (drm_mm_node_allocated(&vma->node)) + err = i915_vma_unbind(vma); ++ if (unlikely(err)) ++ vma->exec_flags = NULL; + } + return err; + } diff --git a/queue-4.15/drm-i915-disable-dc-states-around-gmbus-on-glk.patch b/queue-4.15/drm-i915-disable-dc-states-around-gmbus-on-glk.patch new file mode 100644 index 00000000000..9195dfcc83b --- /dev/null +++ b/queue-4.15/drm-i915-disable-dc-states-around-gmbus-on-glk.patch @@ -0,0 +1,35 @@ +From 156961ae7bdf6feb72778e8da83d321b273343fd Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Fri, 8 Dec 2017 23:37:36 +0200 +Subject: drm/i915: Disable DC states around GMBUS on GLK +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 156961ae7bdf6feb72778e8da83d321b273343fd upstream. + +Prevent the DMC from destroying GMBUS transfers on GLK. GMBUS +lives in PG1 so DC off is all we need. + +Cc: stable@vger.kernel.org +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20171208213739.16388-1-ville.syrjala@linux.intel.com +Reviewed-by: Dhinakaran Pandiyan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_runtime_pm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/i915/intel_runtime_pm.c ++++ b/drivers/gpu/drm/i915/intel_runtime_pm.c +@@ -1844,6 +1844,7 @@ void intel_display_power_put(struct drm_ + CNL_DISPLAY_POWERWELL_2_POWER_DOMAINS | \ + BIT_ULL(POWER_DOMAIN_MODESET) | \ + BIT_ULL(POWER_DOMAIN_AUX_A) | \ ++ BIT_ULL(POWER_DOMAIN_GMBUS) | \ + BIT_ULL(POWER_DOMAIN_INIT)) + + static const struct i915_power_well_ops i9xx_always_on_power_well_ops = { diff --git a/queue-4.15/drm-i915-fix-rsvd2-mask-when-out-fence-is-returned.patch b/queue-4.15/drm-i915-fix-rsvd2-mask-when-out-fence-is-returned.patch new file mode 100644 index 00000000000..f8d5e5c6402 --- /dev/null +++ b/queue-4.15/drm-i915-fix-rsvd2-mask-when-out-fence-is-returned.patch @@ -0,0 +1,39 @@ +From b1b13780ab06ef8c770dd9cbe31dac549a11630e Mon Sep 17 00:00:00 2001 +From: Daniele Ceraolo Spurio +Date: Wed, 14 Feb 2018 11:18:25 -0800 +Subject: drm/i915: Fix rsvd2 mask when out-fence is returned + +From: Daniele Ceraolo Spurio + +commit b1b13780ab06ef8c770dd9cbe31dac549a11630e upstream. + +GENMASK_ULL wants the high bit of the mask first. The current value +cancels the in-fence when an out-fence is returned. + +Fixes: fec0445caa273 ("drm/i915: Support explicit fencing for execbuf") +Testcase: igt/gem_exec_fence/keep-in-fence* +Cc: Chris Wilson +Signed-off-by: Daniele Ceraolo Spurio +Reviewed-by: Chris Wilson +Signed-off-by: Chris Wilson +Link: https://patchwork.freedesktop.org/patch/msgid/20180214191827.8465-1-daniele.ceraolospurio@intel.com +Cc: # v4.12+ +(cherry picked from commit b6a88e4a804cf5a71159906e16df2c1fc7196f92) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_gem_execbuffer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c ++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c +@@ -2419,7 +2419,7 @@ err_request: + if (out_fence) { + if (err == 0) { + fd_install(out_fence_fd, out_fence->file); +- args->rsvd2 &= GENMASK_ULL(0, 31); /* keep in-fence */ ++ args->rsvd2 &= GENMASK_ULL(31, 0); /* keep in-fence */ + args->rsvd2 |= (u64)out_fence_fd << 32; + out_fence_fd = -1; + } else { diff --git a/queue-4.15/drm-i915-perf-fix-perf-stream-opening-lock.patch b/queue-4.15/drm-i915-perf-fix-perf-stream-opening-lock.patch new file mode 100644 index 00000000000..32fa7895b4b --- /dev/null +++ b/queue-4.15/drm-i915-perf-fix-perf-stream-opening-lock.patch @@ -0,0 +1,144 @@ +From f616f2830c1ed79245cfeca900f7e8a3b3c08c06 Mon Sep 17 00:00:00 2001 +From: Lionel Landwerlin +Date: Thu, 1 Mar 2018 11:06:13 +0000 +Subject: drm/i915/perf: fix perf stream opening lock + +From: Lionel Landwerlin + +commit f616f2830c1ed79245cfeca900f7e8a3b3c08c06 upstream. + +We're seeing on CI that some contexts don't have the programmed OA +period timer that directs the OA unit on how often to write reports. + +The issue is that we're not holding the drm lock from when we edit the +context images down to when we set the exclusive_stream variable. This +leaves a window for the deferred context allocation to call +i915_oa_init_reg_state() that will not program the expected OA timer +value, because we haven't set the exclusive_stream yet. + +v2: Drop need_lock from gen8_configure_all_contexts() (Matt) + +Signed-off-by: Lionel Landwerlin +Reviewed-by: Matthew Auld +Reviewed-by: Chris Wilson +Fixes: 701f8231a2f ("drm/i915/perf: prune OA configs") +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=102254 +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=103715 +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=103755 +Link: https://patchwork.freedesktop.org/patch/msgid/20180301110613.1737-1-lionel.g.landwerlin@intel.com +Cc: Jani Nikula +Cc: Joonas Lahtinen +Cc: Rodrigo Vivi +Cc: intel-gfx@lists.freedesktop.org +Cc: # v4.14+ +(cherry picked from commit 41d3fdcd15d5ecf29cc73e8b79c2327ebb54b960) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_perf.c | 38 ++++++++++++-------------------------- + 1 file changed, 12 insertions(+), 26 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_perf.c ++++ b/drivers/gpu/drm/i915/i915_perf.c +@@ -1301,9 +1301,8 @@ static void i915_oa_stream_destroy(struc + */ + mutex_lock(&dev_priv->drm.struct_mutex); + dev_priv->perf.oa.exclusive_stream = NULL; +- mutex_unlock(&dev_priv->drm.struct_mutex); +- + dev_priv->perf.oa.ops.disable_metric_set(dev_priv); ++ mutex_unlock(&dev_priv->drm.struct_mutex); + + free_oa_buffer(dev_priv); + +@@ -1755,22 +1754,13 @@ static int gen8_switch_to_updated_kernel + * Note: it's only the RCS/Render context that has any OA state. + */ + static int gen8_configure_all_contexts(struct drm_i915_private *dev_priv, +- const struct i915_oa_config *oa_config, +- bool interruptible) ++ const struct i915_oa_config *oa_config) + { + struct i915_gem_context *ctx; + int ret; + unsigned int wait_flags = I915_WAIT_LOCKED; + +- if (interruptible) { +- ret = i915_mutex_lock_interruptible(&dev_priv->drm); +- if (ret) +- return ret; +- +- wait_flags |= I915_WAIT_INTERRUPTIBLE; +- } else { +- mutex_lock(&dev_priv->drm.struct_mutex); +- } ++ lockdep_assert_held(&dev_priv->drm.struct_mutex); + + /* Switch away from any user context. */ + ret = gen8_switch_to_updated_kernel_context(dev_priv, oa_config); +@@ -1818,8 +1808,6 @@ static int gen8_configure_all_contexts(s + } + + out: +- mutex_unlock(&dev_priv->drm.struct_mutex); +- + return ret; + } + +@@ -1862,7 +1850,7 @@ static int gen8_enable_metric_set(struct + * to make sure all slices/subslices are ON before writing to NOA + * registers. + */ +- ret = gen8_configure_all_contexts(dev_priv, oa_config, true); ++ ret = gen8_configure_all_contexts(dev_priv, oa_config); + if (ret) + return ret; + +@@ -1877,7 +1865,7 @@ static int gen8_enable_metric_set(struct + static void gen8_disable_metric_set(struct drm_i915_private *dev_priv) + { + /* Reset all contexts' slices/subslices configurations. */ +- gen8_configure_all_contexts(dev_priv, NULL, false); ++ gen8_configure_all_contexts(dev_priv, NULL); + + I915_WRITE(GDT_CHICKEN_BITS, (I915_READ(GDT_CHICKEN_BITS) & + ~GT_NOA_ENABLE)); +@@ -2127,6 +2115,10 @@ static int i915_oa_stream_init(struct i9 + if (ret) + goto err_oa_buf_alloc; + ++ ret = i915_mutex_lock_interruptible(&dev_priv->drm); ++ if (ret) ++ goto err_lock; ++ + ret = dev_priv->perf.oa.ops.enable_metric_set(dev_priv, + stream->oa_config); + if (ret) +@@ -2134,23 +2126,17 @@ static int i915_oa_stream_init(struct i9 + + stream->ops = &i915_oa_stream_ops; + +- /* Lock device for exclusive_stream access late because +- * enable_metric_set() might lock as well on gen8+. +- */ +- ret = i915_mutex_lock_interruptible(&dev_priv->drm); +- if (ret) +- goto err_lock; +- + dev_priv->perf.oa.exclusive_stream = stream; + + mutex_unlock(&dev_priv->drm.struct_mutex); + + return 0; + +-err_lock: ++err_enable: + dev_priv->perf.oa.ops.disable_metric_set(dev_priv); ++ mutex_unlock(&dev_priv->drm.struct_mutex); + +-err_enable: ++err_lock: + free_oa_buffer(dev_priv); + + err_oa_buf_alloc: diff --git a/queue-4.15/drm-i915-try-edid-bitbanging-on-hdmi-after-failed-read.patch b/queue-4.15/drm-i915-try-edid-bitbanging-on-hdmi-after-failed-read.patch new file mode 100644 index 00000000000..dcb7297234b --- /dev/null +++ b/queue-4.15/drm-i915-try-edid-bitbanging-on-hdmi-after-failed-read.patch @@ -0,0 +1,71 @@ +From 90024a5951029685acc5396258f1b0de9b23cf4a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Stefan=20Br=C3=BCns?= +Date: Sun, 31 Dec 2017 23:34:54 +0100 +Subject: drm/i915: Try EDID bitbanging on HDMI after failed read +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stefan Brüns + +commit 90024a5951029685acc5396258f1b0de9b23cf4a upstream. + +The ACK/NACK implementation as found in e.g. the G965 has the falling +clock edge and the release of the data line after the ACK for the received +byte happen at the same time. + +This is conformant with the I2C specification, which allows a zero hold +time, see footnote [3]: "A device must internally provide a hold time of +at least 300 ns for the SDA signal (with respect to the V IH(min) of the +SCL signal) to bridge the undefined region of the falling edge of SCL." + +Some HDMI-to-VGA converters apparently fail to adhere to this requirement +and latch SDA at the falling clock edge, so instead of an ACK +sometimes a NACK is read and the slave (i.e. the EDID ROM) ends the +transfer. + +The bitbanging releases the data line for the ACK only 1/4 bit time after +the falling clock edge, so a slave will see the correct value no matter +if it samples at the rising or the falling clock edge or in the center. + +Fallback to bitbanging is already done for the CRT connector. + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92685 +Signed-off-by: Stefan Brüns +Cc: stable@vger.kernel.org +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/a39f080b-81a5-4c93-b3f7-7cb0a58daca3@rwthex-w2-a.rwth-ad.de +(cherry picked from commit cfb926e148e99acc02351d72e8b85e32b5f786ef) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_hdmi.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_hdmi.c ++++ b/drivers/gpu/drm/i915/intel_hdmi.c +@@ -1573,12 +1573,20 @@ intel_hdmi_set_edid(struct drm_connector + struct intel_hdmi *intel_hdmi = intel_attached_hdmi(connector); + struct edid *edid; + bool connected = false; ++ struct i2c_adapter *i2c; + + intel_display_power_get(dev_priv, POWER_DOMAIN_GMBUS); + +- edid = drm_get_edid(connector, +- intel_gmbus_get_adapter(dev_priv, +- intel_hdmi->ddc_bus)); ++ i2c = intel_gmbus_get_adapter(dev_priv, intel_hdmi->ddc_bus); ++ ++ edid = drm_get_edid(connector, i2c); ++ ++ if (!edid && !intel_gmbus_is_forced_bit(i2c)) { ++ DRM_DEBUG_KMS("HDMI GMBUS EDID read failed, retry using GPIO bit-banging\n"); ++ intel_gmbus_force_bit(i2c, true); ++ edid = drm_get_edid(connector, i2c); ++ intel_gmbus_force_bit(i2c, false); ++ } + + intel_hdmi_dp_dual_mode_detect(connector, edid != NULL); + diff --git a/queue-4.15/drm-i915-update-watermark-state-correctly-in-sanitize_watermarks.patch b/queue-4.15/drm-i915-update-watermark-state-correctly-in-sanitize_watermarks.patch new file mode 100644 index 00000000000..9915a726055 --- /dev/null +++ b/queue-4.15/drm-i915-update-watermark-state-correctly-in-sanitize_watermarks.patch @@ -0,0 +1,46 @@ +From 556fe36d09da5f82879e92bafa0371b4b79f7d6f Mon Sep 17 00:00:00 2001 +From: Maarten Lankhorst +Date: Fri, 10 Nov 2017 12:34:53 +0100 +Subject: drm/i915: Update watermark state correctly in sanitize_watermarks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maarten Lankhorst + +commit 556fe36d09da5f82879e92bafa0371b4b79f7d6f upstream. + +We no longer use intel_crtc->wm.active for watermarks any more, +which was incorrect. But this uncovered a bug in sanitize_watermarks(), +which meant that we wrote the correct watermarks, but the next +update would still use the wrong hw watermarks for calculating. +This caused all further updates to fail with -EINVAL and the +log would reveal an error like the one below: + +[ 10.043902] [drm:ilk_validate_wm_level.part.8 [i915]] Sprite WM0 too large 56 (max 0) +[ 10.043960] [drm:ilk_validate_pipe_wm [i915]] LP0 watermark invalid +[ 10.044030] [drm:intel_crtc_atomic_check [i915]] No valid intermediate pipe watermarks are possible + +Signed-off-by: Maarten Lankhorst +Fixes: b6b178a77210 ("drm/i915: Calculate ironlake intermediate watermarks correctly, v2.") +Cc: stable@vger.kernel.org #v4.8+ +Link: https://patchwork.freedesktop.org/patch/msgid/20171110113503.16253-1-maarten.lankhorst@linux.intel.com +Signed-off-by: Maarten Lankhorst +Reviewed-by: Ville Syrjälä +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_display.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -14463,6 +14463,8 @@ retry: + + cs->wm.need_postvbl_update = true; + dev_priv->display.optimize_watermarks(intel_state, cs); ++ ++ to_intel_crtc_state(crtc->state)->wm = cs->wm; + } + + put_state: diff --git a/queue-4.15/drm-nouveau-fix-deadlock-on-runtime-suspend.patch b/queue-4.15/drm-nouveau-fix-deadlock-on-runtime-suspend.patch new file mode 100644 index 00000000000..874a1132dc8 --- /dev/null +++ b/queue-4.15/drm-nouveau-fix-deadlock-on-runtime-suspend.patch @@ -0,0 +1,115 @@ +From d61a5c1063515e855bedb1b81e20e50b0ac3541e Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Sun, 11 Feb 2018 10:38:28 +0100 +Subject: drm/nouveau: Fix deadlock on runtime suspend + +From: Lukas Wunner + +commit d61a5c1063515e855bedb1b81e20e50b0ac3541e upstream. + +nouveau's ->runtime_suspend hook calls drm_kms_helper_poll_disable(), +which waits for the output poll worker to finish if it's running. + +The output poll worker meanwhile calls pm_runtime_get_sync() in +nouveau_connector_detect() which waits for the ongoing suspend to finish, +causing a deadlock. + +Fix by not acquiring a runtime PM ref if nouveau_connector_detect() is +called in the output poll worker's context. This is safe because +the poll worker is only enabled while runtime active and we know that +->runtime_suspend waits for it to finish. + +Other contexts calling nouveau_connector_detect() do require a runtime +PM ref, these comprise: + + status_store() drm sysfs interface + ->fill_modes drm callback + drm_fb_helper_probe_connector_modes() + drm_mode_getconnector() + nouveau_connector_hotplug() + nouveau_display_hpd_work() + nv17_tv_set_property() + +Stack trace for posterity: + + INFO: task kworker/0:1:58 blocked for more than 120 seconds. + Workqueue: events output_poll_execute [drm_kms_helper] + Call Trace: + schedule+0x28/0x80 + rpm_resume+0x107/0x6e0 + __pm_runtime_resume+0x47/0x70 + nouveau_connector_detect+0x7e/0x4a0 [nouveau] + nouveau_connector_detect_lvds+0x132/0x180 [nouveau] + drm_helper_probe_detect_ctx+0x85/0xd0 [drm_kms_helper] + output_poll_execute+0x11e/0x1c0 [drm_kms_helper] + process_one_work+0x184/0x380 + worker_thread+0x2e/0x390 + + INFO: task kworker/0:2:252 blocked for more than 120 seconds. + Workqueue: pm pm_runtime_work + Call Trace: + schedule+0x28/0x80 + schedule_timeout+0x1e3/0x370 + wait_for_completion+0x123/0x190 + flush_work+0x142/0x1c0 + nouveau_pmops_runtime_suspend+0x7e/0xd0 [nouveau] + pci_pm_runtime_suspend+0x5c/0x180 + vga_switcheroo_runtime_suspend+0x1e/0xa0 + __rpm_callback+0xc1/0x200 + rpm_callback+0x1f/0x70 + rpm_suspend+0x13c/0x640 + pm_runtime_work+0x6e/0x90 + process_one_work+0x184/0x380 + worker_thread+0x2e/0x390 + +Bugzilla: https://bugs.archlinux.org/task/53497 +Bugzilla: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870523 +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=70388#c33 +Fixes: 5addcf0a5f0f ("nouveau: add runtime PM support (v0.9)") +Cc: stable@vger.kernel.org # v3.12+: 27d4ee03078a: workqueue: Allow retrieval of current task's work struct +Cc: stable@vger.kernel.org # v3.12+: 25c058ccaf2e: drm: Allow determining if current task is output poll worker +Cc: Ben Skeggs +Cc: Dave Airlie +Reviewed-by: Lyude Paul +Signed-off-by: Lukas Wunner +Link: https://patchwork.freedesktop.org/patch/msgid/b7d2cbb609a80f59ccabfdf479b9d5907c603ea1.1518338789.git.lukas@wunner.de +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/nouveau/nouveau_connector.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/nouveau/nouveau_connector.c ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c +@@ -570,9 +570,15 @@ nouveau_connector_detect(struct drm_conn + nv_connector->edid = NULL; + } + +- ret = pm_runtime_get_sync(connector->dev->dev); +- if (ret < 0 && ret != -EACCES) +- return conn_status; ++ /* Outputs are only polled while runtime active, so acquiring a ++ * runtime PM ref here is unnecessary (and would deadlock upon ++ * runtime suspend because it waits for polling to finish). ++ */ ++ if (!drm_kms_helper_is_poll_worker()) { ++ ret = pm_runtime_get_sync(connector->dev->dev); ++ if (ret < 0 && ret != -EACCES) ++ return conn_status; ++ } + + nv_encoder = nouveau_connector_ddc_detect(connector); + if (nv_encoder && (i2c = nv_encoder->i2c) != NULL) { +@@ -647,8 +653,10 @@ detect_analog: + + out: + +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return conn_status; + } diff --git a/queue-4.15/drm-nouveau-prefer-xbgr2101010-for-addfb-ioctl.patch b/queue-4.15/drm-nouveau-prefer-xbgr2101010-for-addfb-ioctl.patch new file mode 100644 index 00000000000..0a89fcb236b --- /dev/null +++ b/queue-4.15/drm-nouveau-prefer-xbgr2101010-for-addfb-ioctl.patch @@ -0,0 +1,70 @@ +From c20bb155c2c5acb775f68be5d84fe679687c3c1e Mon Sep 17 00:00:00 2001 +From: Ilia Mirkin +Date: Sat, 3 Feb 2018 14:11:23 -0500 +Subject: drm/nouveau: prefer XBGR2101010 for addfb ioctl + +From: Ilia Mirkin + +commit c20bb155c2c5acb775f68be5d84fe679687c3c1e upstream. + +Nouveau only exposes support for XBGR2101010. Prior to the atomic +conversion, drm would pass in the wrong format in the framebuffer, but +it was always ignored -- both userspace (xf86-video-nouveau) and the +kernel driver agreed on the layout, so the fact that the format was +wrong didn't matter. + +With the atomic conversion, nouveau all of a sudden started caring about +the exact format, and so the previously-working code in +xf86-video-nouveau no longer functioned since the (internally-assigned) +format from the addfb ioctl was wrong. + +This change adds infrastructure to allow a drm driver to specify that it +prefers the XBGR format variant for the addfb ioctl, and makes nouveau's +nv50 display driver set it. (Prior gens had no support for 30bpp at all.) + +Signed-off-by: Ilia Mirkin +Cc: stable@vger.kernel.org # v4.10+ +Acked-by: Ben Skeggs +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20180203191123.31507-1-imirkin@alum.mit.edu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_framebuffer.c | 4 ++++ + drivers/gpu/drm/nouveau/nv50_display.c | 1 + + include/drm/drm_drv.h | 1 + + 3 files changed, 6 insertions(+) + +--- a/drivers/gpu/drm/drm_framebuffer.c ++++ b/drivers/gpu/drm/drm_framebuffer.c +@@ -118,6 +118,10 @@ int drm_mode_addfb(struct drm_device *de + r.pixel_format = drm_mode_legacy_fb_format(or->bpp, or->depth); + r.handles[0] = or->handle; + ++ if (r.pixel_format == DRM_FORMAT_XRGB2101010 && ++ dev->driver->driver_features & DRIVER_PREFER_XBGR_30BPP) ++ r.pixel_format = DRM_FORMAT_XBGR2101010; ++ + ret = drm_mode_addfb2(dev, &r, file_priv); + if (ret) + return ret; +--- a/drivers/gpu/drm/nouveau/nv50_display.c ++++ b/drivers/gpu/drm/nouveau/nv50_display.c +@@ -4426,6 +4426,7 @@ nv50_display_create(struct drm_device *d + nouveau_display(dev)->fini = nv50_display_fini; + disp->disp = &nouveau_display(dev)->disp; + dev->mode_config.funcs = &nv50_disp_func; ++ dev->driver->driver_features |= DRIVER_PREFER_XBGR_30BPP; + if (nouveau_atomic) + dev->driver->driver_features |= DRIVER_ATOMIC; + +--- a/include/drm/drm_drv.h ++++ b/include/drm/drm_drv.h +@@ -55,6 +55,7 @@ struct drm_mode_create_dumb; + #define DRIVER_ATOMIC 0x10000 + #define DRIVER_KMS_LEGACY_CONTEXT 0x20000 + #define DRIVER_SYNCOBJ 0x40000 ++#define DRIVER_PREFER_XBGR_30BPP 0x80000 + + /** + * struct drm_driver - DRM driver structure diff --git a/queue-4.15/drm-radeon-fix-deadlock-on-runtime-suspend.patch b/queue-4.15/drm-radeon-fix-deadlock-on-runtime-suspend.patch new file mode 100644 index 00000000000..81ff2b83b3f --- /dev/null +++ b/queue-4.15/drm-radeon-fix-deadlock-on-runtime-suspend.patch @@ -0,0 +1,217 @@ +From 15734feff2bdac24aa3266c437cffa42851990e3 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Sun, 11 Feb 2018 10:38:28 +0100 +Subject: drm/radeon: Fix deadlock on runtime suspend + +From: Lukas Wunner + +commit 15734feff2bdac24aa3266c437cffa42851990e3 upstream. + +radeon's ->runtime_suspend hook calls drm_kms_helper_poll_disable(), +which waits for the output poll worker to finish if it's running. + +The output poll worker meanwhile calls pm_runtime_get_sync() in +radeon's ->detect hooks, which waits for the ongoing suspend to finish, +causing a deadlock. + +Fix by not acquiring a runtime PM ref if the ->detect hooks are called +in the output poll worker's context. This is safe because the poll +worker is only enabled while runtime active and we know that +->runtime_suspend waits for it to finish. + +Stack trace for posterity: + + INFO: task kworker/0:3:31847 blocked for more than 120 seconds + Workqueue: events output_poll_execute [drm_kms_helper] + Call Trace: + schedule+0x3c/0x90 + rpm_resume+0x1e2/0x690 + __pm_runtime_resume+0x3f/0x60 + radeon_lvds_detect+0x39/0xf0 [radeon] + output_poll_execute+0xda/0x1e0 [drm_kms_helper] + process_one_work+0x14b/0x440 + worker_thread+0x48/0x4a0 + + INFO: task kworker/2:0:10493 blocked for more than 120 seconds. + Workqueue: pm pm_runtime_work + Call Trace: + schedule+0x3c/0x90 + schedule_timeout+0x1b3/0x240 + wait_for_common+0xc2/0x180 + wait_for_completion+0x1d/0x20 + flush_work+0xfc/0x1a0 + __cancel_work_timer+0xa5/0x1d0 + cancel_delayed_work_sync+0x13/0x20 + drm_kms_helper_poll_disable+0x1f/0x30 [drm_kms_helper] + radeon_pmops_runtime_suspend+0x3d/0xa0 [radeon] + pci_pm_runtime_suspend+0x61/0x1a0 + vga_switcheroo_runtime_suspend+0x21/0x70 + __rpm_callback+0x32/0x70 + rpm_callback+0x24/0x80 + rpm_suspend+0x12b/0x640 + pm_runtime_work+0x6f/0xb0 + process_one_work+0x14b/0x440 + worker_thread+0x48/0x4a0 + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=94147 +Fixes: 10ebc0bc0934 ("drm/radeon: add runtime PM support (v2)") +Cc: stable@vger.kernel.org # v3.13+: 27d4ee03078a: workqueue: Allow retrieval of current task's work struct +Cc: stable@vger.kernel.org # v3.13+: 25c058ccaf2e: drm: Allow determining if current task is output poll worker +Cc: Ismo Toijala +Cc: Alex Deucher +Cc: Dave Airlie +Reviewed-by: Lyude Paul +Signed-off-by: Lukas Wunner +Link: https://patchwork.freedesktop.org/patch/msgid/64ea02c44f91dda19bc563902b97bbc699040392.1518338789.git.lukas@wunner.de +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_connectors.c | 74 +++++++++++++++++++---------- + 1 file changed, 49 insertions(+), 25 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_connectors.c ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c +@@ -900,9 +900,11 @@ radeon_lvds_detect(struct drm_connector + enum drm_connector_status ret = connector_status_disconnected; + int r; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (encoder) { + struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder); +@@ -925,8 +927,12 @@ radeon_lvds_detect(struct drm_connector + /* check acpi lid status ??? */ + + radeon_connector_update_scratch_regs(connector, ret); +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } ++ + return ret; + } + +@@ -1040,9 +1046,11 @@ radeon_vga_detect(struct drm_connector * + enum drm_connector_status ret = connector_status_disconnected; + int r; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + encoder = radeon_best_single_encoder(connector); + if (!encoder) +@@ -1109,8 +1117,10 @@ radeon_vga_detect(struct drm_connector * + radeon_connector_update_scratch_regs(connector, ret); + + out: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } +@@ -1174,9 +1184,11 @@ radeon_tv_detect(struct drm_connector *c + if (!radeon_connector->dac_load_detect) + return ret; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + encoder = radeon_best_single_encoder(connector); + if (!encoder) +@@ -1188,8 +1200,12 @@ radeon_tv_detect(struct drm_connector *c + if (ret == connector_status_connected) + ret = radeon_connector_analog_encoder_conflict_solve(connector, encoder, ret, false); + radeon_connector_update_scratch_regs(connector, ret); +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } ++ + return ret; + } + +@@ -1252,9 +1268,11 @@ radeon_dvi_detect(struct drm_connector * + enum drm_connector_status ret = connector_status_disconnected; + bool dret = false, broken_edid = false; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (radeon_connector->detected_hpd_without_ddc) { + force = true; +@@ -1437,8 +1455,10 @@ out: + } + + exit: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } +@@ -1689,9 +1709,11 @@ radeon_dp_detect(struct drm_connector *c + if (radeon_dig_connector->is_mst) + return connector_status_disconnected; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (!force && radeon_check_hpd_status_unchanged(connector)) { + ret = connector->status; +@@ -1778,8 +1800,10 @@ radeon_dp_detect(struct drm_connector *c + } + + out: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } diff --git a/queue-4.15/drm-radeon-fix-kv-harvesting.patch b/queue-4.15/drm-radeon-fix-kv-harvesting.patch new file mode 100644 index 00000000000..0a1e613937e --- /dev/null +++ b/queue-4.15/drm-radeon-fix-kv-harvesting.patch @@ -0,0 +1,66 @@ +From 0b58d90f89545e021d188c289fa142e5ff9e708b Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Thu, 1 Mar 2018 11:03:27 -0500 +Subject: drm/radeon: fix KV harvesting +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit 0b58d90f89545e021d188c289fa142e5ff9e708b upstream. + +Always set the graphics values to the max for the +asic type. E.g., some 1 RB chips are actually 1 RB chips, +others are actually harvested 2 RB chips. + +Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=99353 +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/cik.c | 31 ++----------------------------- + 1 file changed, 2 insertions(+), 29 deletions(-) + +--- a/drivers/gpu/drm/radeon/cik.c ++++ b/drivers/gpu/drm/radeon/cik.c +@@ -3228,35 +3228,8 @@ static void cik_gpu_init(struct radeon_d + case CHIP_KAVERI: + rdev->config.cik.max_shader_engines = 1; + rdev->config.cik.max_tile_pipes = 4; +- if ((rdev->pdev->device == 0x1304) || +- (rdev->pdev->device == 0x1305) || +- (rdev->pdev->device == 0x130C) || +- (rdev->pdev->device == 0x130F) || +- (rdev->pdev->device == 0x1310) || +- (rdev->pdev->device == 0x1311) || +- (rdev->pdev->device == 0x131C)) { +- rdev->config.cik.max_cu_per_sh = 8; +- rdev->config.cik.max_backends_per_se = 2; +- } else if ((rdev->pdev->device == 0x1309) || +- (rdev->pdev->device == 0x130A) || +- (rdev->pdev->device == 0x130D) || +- (rdev->pdev->device == 0x1313) || +- (rdev->pdev->device == 0x131D)) { +- rdev->config.cik.max_cu_per_sh = 6; +- rdev->config.cik.max_backends_per_se = 2; +- } else if ((rdev->pdev->device == 0x1306) || +- (rdev->pdev->device == 0x1307) || +- (rdev->pdev->device == 0x130B) || +- (rdev->pdev->device == 0x130E) || +- (rdev->pdev->device == 0x1315) || +- (rdev->pdev->device == 0x1318) || +- (rdev->pdev->device == 0x131B)) { +- rdev->config.cik.max_cu_per_sh = 4; +- rdev->config.cik.max_backends_per_se = 1; +- } else { +- rdev->config.cik.max_cu_per_sh = 3; +- rdev->config.cik.max_backends_per_se = 1; +- } ++ rdev->config.cik.max_cu_per_sh = 8; ++ rdev->config.cik.max_backends_per_se = 2; + rdev->config.cik.max_sh_per_se = 1; + rdev->config.cik.max_texture_channel_caches = 4; + rdev->config.cik.max_gprs = 256; diff --git a/queue-4.15/drm-radeon-insist-on-32-bit-dma-for-cedar-on-ppc64-ppc64le.patch b/queue-4.15/drm-radeon-insist-on-32-bit-dma-for-cedar-on-ppc64-ppc64le.patch new file mode 100644 index 00000000000..6cd45964095 --- /dev/null +++ b/queue-4.15/drm-radeon-insist-on-32-bit-dma-for-cedar-on-ppc64-ppc64le.patch @@ -0,0 +1,46 @@ +From 2c83029cda55a5e7665c7c6326909427d6a01350 Mon Sep 17 00:00:00 2001 +From: Ben Crocker +Date: Thu, 22 Feb 2018 17:52:19 -0500 +Subject: drm/radeon: insist on 32-bit DMA for Cedar on PPC64/PPC64LE + +From: Ben Crocker + +commit 2c83029cda55a5e7665c7c6326909427d6a01350 upstream. + +In radeon_device_init, set the need_dma32 flag for Cedar chips +(e.g. FirePro 2270). This fixes, or at least works around, a bug +on PowerPC exposed by last year's commits + +8e3f1b1d8255105f31556aacf8aeb6071b00d469 (Russell Currey) + +and + +253fd51e2f533552ae35a0c661705da6c4842c1b (Alistair Popple) + +which enabled the 64-bit DMA iommu bypass. + +This caused the device to freeze, in some cases unrecoverably, and is +the subject of several bug reports internal to Red Hat. + +Signed-off-by: Ben Crocker +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_device.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/gpu/drm/radeon/radeon_device.c ++++ b/drivers/gpu/drm/radeon/radeon_device.c +@@ -1397,6 +1397,10 @@ int radeon_device_init(struct radeon_dev + if ((rdev->flags & RADEON_IS_PCI) && + (rdev->family <= CHIP_RS740)) + rdev->need_dma32 = true; ++#ifdef CONFIG_PPC64 ++ if (rdev->family == CHIP_CEDAR) ++ rdev->need_dma32 = true; ++#endif + + dma_bits = rdev->need_dma32 ? 32 : 40; + r = pci_set_dma_mask(rdev->pdev, DMA_BIT_MASK(dma_bits)); diff --git a/queue-4.15/ib-core-fix-missing-rdma-cgroups-release-in-case-of-failure-to-register-device.patch b/queue-4.15/ib-core-fix-missing-rdma-cgroups-release-in-case-of-failure-to-register-device.patch new file mode 100644 index 00000000000..c0294352043 --- /dev/null +++ b/queue-4.15/ib-core-fix-missing-rdma-cgroups-release-in-case-of-failure-to-register-device.patch @@ -0,0 +1,53 @@ +From 2fb4f4eadd180a50112618dd9c5fef7fc50d4f08 Mon Sep 17 00:00:00 2001 +From: Parav Pandit +Date: Sun, 25 Feb 2018 13:39:56 +0200 +Subject: IB/core: Fix missing RDMA cgroups release in case of failure to register device + +From: Parav Pandit + +commit 2fb4f4eadd180a50112618dd9c5fef7fc50d4f08 upstream. + +During IB device registration process, if query_device() fails or if +ib_core fails to registers sysfs entries, rdma cgroup cleanup is +skipped. + +Cc: # v4.2+ +Fixes: 4be3a4fa51f4 ("IB/core: Fix kernel crash during fail to initialize device") +Reviewed-by: Daniel Jurgens +Signed-off-by: Parav Pandit +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/core/device.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/core/device.c ++++ b/drivers/infiniband/core/device.c +@@ -534,14 +534,14 @@ int ib_register_device(struct ib_device + ret = device->query_device(device, &device->attrs, &uhw); + if (ret) { + pr_warn("Couldn't query the device attributes\n"); +- goto cache_cleanup; ++ goto cg_cleanup; + } + + ret = ib_device_register_sysfs(device, port_callback); + if (ret) { + pr_warn("Couldn't register device %s with driver model\n", + device->name); +- goto cache_cleanup; ++ goto cg_cleanup; + } + + device->reg_state = IB_DEV_REGISTERED; +@@ -557,6 +557,8 @@ int ib_register_device(struct ib_device + mutex_unlock(&device_mutex); + return 0; + ++cg_cleanup: ++ ib_device_unregister_rdmacg(device); + cache_cleanup: + ib_cache_cleanup_one(device); + ib_cache_release_one(device); diff --git a/queue-4.15/ib-mlx5-fix-incorrect-size-of-klms-in-the-memory-region.patch b/queue-4.15/ib-mlx5-fix-incorrect-size-of-klms-in-the-memory-region.patch new file mode 100644 index 00000000000..659e4411b07 --- /dev/null +++ b/queue-4.15/ib-mlx5-fix-incorrect-size-of-klms-in-the-memory-region.patch @@ -0,0 +1,50 @@ +From da343b6d90e11132f1e917d865d88ee35d6e6d00 Mon Sep 17 00:00:00 2001 +From: Sergey Gorenko +Date: Sun, 25 Feb 2018 13:39:48 +0200 +Subject: IB/mlx5: Fix incorrect size of klms in the memory region + +From: Sergey Gorenko + +commit da343b6d90e11132f1e917d865d88ee35d6e6d00 upstream. + +The value of mr->ndescs greater than mr->max_descs is set in the +function mlx5_ib_sg_to_klms() if sg_nents is greater than +mr->max_descs. This is an invalid value and it causes the +following error when registering mr: + +mlx5_0:dump_cqe:276:(pid 193): dump error cqe +00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +00000030: 00 00 00 00 0f 00 78 06 25 00 00 8b 08 1e 8f d3 + +Cc: # 4.5 +Fixes: b005d3164713 ("mlx5: Add arbitrary sg list support") +Signed-off-by: Sergey Gorenko +Tested-by: Laurence Oberman +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mlx5/mr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/mlx5/mr.c ++++ b/drivers/infiniband/hw/mlx5/mr.c +@@ -1813,7 +1813,6 @@ mlx5_ib_sg_to_klms(struct mlx5_ib_mr *mr + + mr->ibmr.iova = sg_dma_address(sg) + sg_offset; + mr->ibmr.length = 0; +- mr->ndescs = sg_nents; + + for_each_sg(sgl, sg, sg_nents, i) { + if (unlikely(i >= mr->max_descs)) +@@ -1825,6 +1824,7 @@ mlx5_ib_sg_to_klms(struct mlx5_ib_mr *mr + + sg_offset = 0; + } ++ mr->ndescs = i; + + if (sg_offset_p) + *sg_offset_p = sg_offset; diff --git a/queue-4.15/input-matrix_keypad-fix-race-when-disabling-interrupts.patch b/queue-4.15/input-matrix_keypad-fix-race-when-disabling-interrupts.patch new file mode 100644 index 00000000000..a9ee5aa019d --- /dev/null +++ b/queue-4.15/input-matrix_keypad-fix-race-when-disabling-interrupts.patch @@ -0,0 +1,40 @@ +From ea4f7bd2aca9f68470e9aac0fc9432fd180b1fe7 Mon Sep 17 00:00:00 2001 +From: Zhang Bo +Date: Mon, 5 Feb 2018 14:56:21 -0800 +Subject: Input: matrix_keypad - fix race when disabling interrupts + +From: Zhang Bo + +commit ea4f7bd2aca9f68470e9aac0fc9432fd180b1fe7 upstream. + +If matrix_keypad_stop() is executing and the keypad interrupt is triggered, +disable_row_irqs() may be called by both matrix_keypad_interrupt() and +matrix_keypad_stop() at the same time, causing interrupts to be disabled +twice and the keypad being "stuck" after resuming. + +Take lock when setting keypad->stopped to ensure that ISR will not race +with matrix_keypad_stop() disabling interrupts. + +Signed-off-by: Zhang Bo +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/keyboard/matrix_keypad.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/input/keyboard/matrix_keypad.c ++++ b/drivers/input/keyboard/matrix_keypad.c +@@ -218,8 +218,10 @@ static void matrix_keypad_stop(struct in + { + struct matrix_keypad *keypad = input_get_drvdata(dev); + ++ spin_lock_irq(&keypad->lock); + keypad->stopped = true; +- mb(); ++ spin_unlock_irq(&keypad->lock); ++ + flush_work(&keypad->work.work); + /* + * matrix_keypad_scan() will leave IRQs enabled; diff --git a/queue-4.15/kbuild-handle-builtin-dtb-file-names-containing-hyphens.patch b/queue-4.15/kbuild-handle-builtin-dtb-file-names-containing-hyphens.patch new file mode 100644 index 00000000000..71662d78de7 --- /dev/null +++ b/queue-4.15/kbuild-handle-builtin-dtb-file-names-containing-hyphens.patch @@ -0,0 +1,70 @@ +From 55fe6da9efba102866e2fb5b40b04b6a4b26c19e Mon Sep 17 00:00:00 2001 +From: James Hogan +Date: Thu, 8 Mar 2018 11:02:46 +0000 +Subject: kbuild: Handle builtin dtb file names containing hyphens + +From: James Hogan + +commit 55fe6da9efba102866e2fb5b40b04b6a4b26c19e upstream. + +cmd_dt_S_dtb constructs the assembly source to incorporate a devicetree +FDT (that is, the .dtb file) as binary data in the kernel image. This +assembly source contains labels before and after the binary data. The +label names incorporate the file name of the corresponding .dtb file. +Hyphens are not legal characters in labels, so .dtb files built into the +kernel with hyphens in the file name result in errors like the +following: + +bcm3368-netgear-cvg834g.dtb.S: Assembler messages: +bcm3368-netgear-cvg834g.dtb.S:5: Error: : no such section +bcm3368-netgear-cvg834g.dtb.S:5: Error: junk at end of line, first unrecognized character is `-' +bcm3368-netgear-cvg834g.dtb.S:6: Error: unrecognized opcode `__dtb_bcm3368-netgear-cvg834g_begin:' +bcm3368-netgear-cvg834g.dtb.S:8: Error: unrecognized opcode `__dtb_bcm3368-netgear-cvg834g_end:' +bcm3368-netgear-cvg834g.dtb.S:9: Error: : no such section +bcm3368-netgear-cvg834g.dtb.S:9: Error: junk at end of line, first unrecognized character is `-' + +Fix this by updating cmd_dt_S_dtb to transform all hyphens from the file +name to underscores when constructing the labels. + +As of v4.16-rc2, 1139 .dts files across ARM64, ARM, MIPS and PowerPC +contain hyphens in their names, but the issue only currently manifests +on Broadcom MIPS platforms, as that is the only place where such files +are built into the kernel. For example when CONFIG_DT_NETGEAR_CVG834G=y, +or on BMIPS kernels when the dtbs target is used (in the latter case it +admittedly shouldn't really build all the dtb.o files, but thats a +separate issue). + +Fixes: 695835511f96 ("MIPS: BMIPS: rename bcm96358nb4ser to bcm6358-neufbox4-sercom") +Signed-off-by: James Hogan +Reviewed-by: Frank Rowand +Cc: Rob Herring +Cc: Michal Marek +Cc: Ralf Baechle +Cc: Florian Fainelli +Cc: Kevin Cernekee +Cc: # 4.9+ +Signed-off-by: Masahiro Yamada +Signed-off-by: Greg Kroah-Hartman + +--- + scripts/Makefile.lib | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/scripts/Makefile.lib ++++ b/scripts/Makefile.lib +@@ -287,11 +287,11 @@ cmd_dt_S_dtb= \ + echo '\#include '; \ + echo '.section .dtb.init.rodata,"a"'; \ + echo '.balign STRUCT_ALIGNMENT'; \ +- echo '.global __dtb_$(*F)_begin'; \ +- echo '__dtb_$(*F)_begin:'; \ ++ echo '.global __dtb_$(subst -,_,$(*F))_begin'; \ ++ echo '__dtb_$(subst -,_,$(*F))_begin:'; \ + echo '.incbin "$<" '; \ +- echo '__dtb_$(*F)_end:'; \ +- echo '.global __dtb_$(*F)_end'; \ ++ echo '__dtb_$(subst -,_,$(*F))_end:'; \ ++ echo '.global __dtb_$(subst -,_,$(*F))_end'; \ + echo '.balign STRUCT_ALIGNMENT'; \ + ) > $@ + diff --git a/queue-4.15/kvm-s390-fix-memory-overwrites-when-not-using-sca-entries.patch b/queue-4.15/kvm-s390-fix-memory-overwrites-when-not-using-sca-entries.patch new file mode 100644 index 00000000000..f55a2a7703d --- /dev/null +++ b/queue-4.15/kvm-s390-fix-memory-overwrites-when-not-using-sca-entries.patch @@ -0,0 +1,43 @@ +From f07afa0462b76a5b9c4f3a43d5ac24fdb86a90c2 Mon Sep 17 00:00:00 2001 +From: David Hildenbrand +Date: Tue, 6 Mar 2018 14:27:58 +0100 +Subject: KVM: s390: fix memory overwrites when not using SCA entries + +From: David Hildenbrand + +commit f07afa0462b76a5b9c4f3a43d5ac24fdb86a90c2 upstream. + +Even if we don't have extended SCA support, we can have more than 64 CPUs +if we don't enable any HW features that might use the SCA entries. + +Now, this works just fine, but we missed a return, which is why we +would actually store the SCA entries. If we have more than 64 CPUs, this +means writing outside of the basic SCA - bad. + +Let's fix this. This allows > 64 CPUs when running nested (under vSIE) +without random crashes. + +Fixes: a6940674c384 ("KVM: s390: allow 255 VCPUs when sca entries aren't used") +Reported-by: Christian Borntraeger +Tested-by: Christian Borntraeger +Signed-off-by: David Hildenbrand +Message-Id: <20180306132758.21034-1-david@redhat.com> +Cc: stable@vger.kernel.org +Reviewed-by: Cornelia Huck +Signed-off-by: Christian Borntraeger +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/kvm/kvm-s390.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -2118,6 +2118,7 @@ static void sca_add_vcpu(struct kvm_vcpu + /* we still need the basic sca for the ipte control */ + vcpu->arch.sie_block->scaoh = (__u32)(((__u64)sca) >> 32); + vcpu->arch.sie_block->scaol = (__u32)(__u64)sca; ++ return; + } + read_lock(&vcpu->kvm->arch.sca_lock); + if (vcpu->kvm->arch.use_esca) { diff --git a/queue-4.15/lib-bug.c-exclude-non-bug-warn-exceptions-from-report_bug.patch b/queue-4.15/lib-bug.c-exclude-non-bug-warn-exceptions-from-report_bug.patch new file mode 100644 index 00000000000..c9c56039b56 --- /dev/null +++ b/queue-4.15/lib-bug.c-exclude-non-bug-warn-exceptions-from-report_bug.patch @@ -0,0 +1,74 @@ +From 1b4cfe3c0a30dde968fb43c577a8d7e262a145ee Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Fri, 9 Mar 2018 15:51:02 -0800 +Subject: lib/bug.c: exclude non-BUG/WARN exceptions from report_bug() + +From: Kees Cook + +commit 1b4cfe3c0a30dde968fb43c577a8d7e262a145ee upstream. + +Commit b8347c219649 ("x86/debug: Handle warnings before the notifier +chain, to fix KGDB crash") changed the ordering of fixups, and did not +take into account the case of x86 processing non-WARN() and non-BUG() +exceptions. This would lead to output of a false BUG line with no other +information. + +In the case of a refcount exception, it would be immediately followed by +the refcount WARN(), producing very strange double-"cut here": + + lkdtm: attempting bad refcount_inc() overflow + ------------[ cut here ]------------ + Kernel BUG at 0000000065f29de5 [verbose debug info unavailable] + ------------[ cut here ]------------ + refcount_t overflow at lkdtm_REFCOUNT_INC_OVERFLOW+0x6b/0x90 in cat[3065], uid/euid: 0/0 + WARNING: CPU: 0 PID: 3065 at kernel/panic.c:657 refcount_error_report+0x9a/0xa4 + ... + +In the prior ordering, exceptions were searched first: + + do_trap_no_signal(struct task_struct *tsk, int trapnr, char *str, + ... + if (fixup_exception(regs, trapnr)) + return 0; + + - if (fixup_bug(regs, trapnr)) + - return 0; + - + +As a result, fixup_bugs()'s is_valid_bugaddr() didn't take into account +needing to search the exception list first, since that had already +happened. + +So, instead of searching the exception list twice (once in +is_valid_bugaddr() and then again in fixup_exception()), just add a +simple sanity check to report_bug() that will immediately bail out if a +BUG() (or WARN()) entry is not found. + +Link: http://lkml.kernel.org/r/20180301225934.GA34350@beast +Fixes: b8347c219649 ("x86/debug: Handle warnings before the notifier chain, to fix KGDB crash") +Signed-off-by: Kees Cook +Cc: Ingo Molnar +Cc: Thomas Gleixner +Cc: Peter Zijlstra +Cc: Borislav Petkov +Cc: Richard Weinberger +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + lib/bug.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/lib/bug.c ++++ b/lib/bug.c +@@ -150,6 +150,8 @@ enum bug_trap_type report_bug(unsigned l + return BUG_TRAP_TYPE_NONE; + + bug = find_bug(bugaddr); ++ if (!bug) ++ return BUG_TRAP_TYPE_NONE; + + file = NULL; + line = 0; diff --git a/queue-4.15/loop-fix-lost-writes-caused-by-missing-flag.patch b/queue-4.15/loop-fix-lost-writes-caused-by-missing-flag.patch new file mode 100644 index 00000000000..388042ea063 --- /dev/null +++ b/queue-4.15/loop-fix-lost-writes-caused-by-missing-flag.patch @@ -0,0 +1,68 @@ +From 1d037577c323e5090ce281e96bc313ab2eee5be2 Mon Sep 17 00:00:00 2001 +From: Ross Zwisler +Date: Fri, 9 Mar 2018 08:36:36 -0700 +Subject: loop: Fix lost writes caused by missing flag + +From: Ross Zwisler + +commit 1d037577c323e5090ce281e96bc313ab2eee5be2 upstream. + +The following commit: + +commit aa4d86163e4e ("block: loop: switch to VFS ITER_BVEC") + +replaced __do_lo_send_write(), which used ITER_KVEC iterators, with +lo_write_bvec() which uses ITER_BVEC iterators. In this change, though, +the WRITE flag was lost: + +- iov_iter_kvec(&from, ITER_KVEC | WRITE, &kvec, 1, len); ++ iov_iter_bvec(&i, ITER_BVEC, bvec, 1, bvec->bv_len); + +This flag is necessary for the DAX case because we make decisions based on +whether or not the iterator is a READ or a WRITE in dax_iomap_actor() and +in dax_iomap_rw(). + +We end up going through this path in configurations where we combine a PMEM +device with 4k sectors, a loopback device and DAX. The consequence of this +missed flag is that what we intend as a write actually turns into a read in +the DAX code, so no data is ever written. + +The very simplest test case is to create a loopback device and try and +write a small string to it, then hexdump a few bytes of the device to see +if the write took. Without this patch you read back all zeros, with this +you read back the string you wrote. + +For XFS this causes us to fail or panic during the following xfstests: + + xfs/074 xfs/078 xfs/216 xfs/217 xfs/250 + +For ext4 we have a similar issue where writes never happen, but we don't +currently have any xfstests that use loopback and show this issue. + +Fix this by restoring the WRITE flag argument to iov_iter_bvec(). This +causes the xfstests to all pass. + +Cc: Al Viro +Cc: stable@vger.kernel.org +Fixes: commit aa4d86163e4e ("block: loop: switch to VFS ITER_BVEC") +Reviewed-by: Christoph Hellwig +Reviewed-by: Ming Lei +Signed-off-by: Ross Zwisler +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/loop.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -266,7 +266,7 @@ static int lo_write_bvec(struct file *fi + struct iov_iter i; + ssize_t bw; + +- iov_iter_bvec(&i, ITER_BVEC, bvec, 1, bvec->bv_len); ++ iov_iter_bvec(&i, ITER_BVEC | WRITE, bvec, 1, bvec->bv_len); + + file_start_write(file); + bw = vfs_iter_write(file, &i, ppos, 0); diff --git a/queue-4.15/mips-ath25-check-for-kzalloc-allocation-failure.patch b/queue-4.15/mips-ath25-check-for-kzalloc-allocation-failure.patch new file mode 100644 index 00000000000..8c03ef1363d --- /dev/null +++ b/queue-4.15/mips-ath25-check-for-kzalloc-allocation-failure.patch @@ -0,0 +1,37 @@ +From 1b22b4b28fd5fbc51855219e3238b3ab81da8466 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Thu, 22 Feb 2018 17:50:12 +0000 +Subject: MIPS: ath25: Check for kzalloc allocation failure + +From: Colin Ian King + +commit 1b22b4b28fd5fbc51855219e3238b3ab81da8466 upstream. + +Currently there is no null check on a failed allocation of board_data, +and hence a null pointer dereference will occurr. Fix this by checking +for the out of memory null pointer. + +Fixes: a7473717483e ("MIPS: ath25: add board configuration detection") +Signed-off-by: Colin Ian King +Cc: Ralf Baechle +Cc: linux-mips@linux-mips.org +Cc: # 3.19+ +Patchwork: https://patchwork.linux-mips.org/patch/18657/ +Signed-off-by: James Hogan +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/ath25/board.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/mips/ath25/board.c ++++ b/arch/mips/ath25/board.c +@@ -135,6 +135,8 @@ int __init ath25_find_config(phys_addr_t + } + + board_data = kzalloc(BOARD_CONFIG_BUFSZ, GFP_KERNEL); ++ if (!board_data) ++ goto error; + ath25_board.config = (struct ath25_boarddata *)board_data; + memcpy_fromio(board_data, bcfg, 0x100); + if (broken_boarddata) { diff --git a/queue-4.15/mips-bmips-do-not-mask-ipis-during-suspend.patch b/queue-4.15/mips-bmips-do-not-mask-ipis-during-suspend.patch new file mode 100644 index 00000000000..275aa1ae181 --- /dev/null +++ b/queue-4.15/mips-bmips-do-not-mask-ipis-during-suspend.patch @@ -0,0 +1,54 @@ +From 06a3f0c9f2725f5d7c63c4203839373c9bd00c28 Mon Sep 17 00:00:00 2001 +From: Justin Chen +Date: Wed, 27 Sep 2017 17:15:15 -0700 +Subject: MIPS: BMIPS: Do not mask IPIs during suspend + +From: Justin Chen + +commit 06a3f0c9f2725f5d7c63c4203839373c9bd00c28 upstream. + +Commit a3e6c1eff548 ("MIPS: IRQ: Fix disable_irq on CPU IRQs") fixes an +issue where disable_irq did not actually disable the irq. The bug caused +our IPIs to not be disabled, which actually is the correct behavior. + +With the addition of commit a3e6c1eff548 ("MIPS: IRQ: Fix disable_irq on +CPU IRQs"), the IPIs were getting disabled going into suspend, thus +schedule_ipi() was not being called. This caused deadlocks where +schedulable task were not being scheduled and other cpus were waiting +for them to do something. + +Add the IRQF_NO_SUSPEND flag so an irq_disable will not be called on the +IPIs during suspend. + +Signed-off-by: Justin Chen +Fixes: a3e6c1eff548 ("MIPS: IRQ: Fix disabled_irq on CPU IRQs") +Cc: Florian Fainelli +Cc: linux-mips@linux-mips.org +Cc: stable@vger.kernel.org +Patchwork: https://patchwork.linux-mips.org/patch/17385/ +[jhogan@kernel.org: checkpatch: wrap long lines and fix commit refs] +Signed-off-by: James Hogan +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kernel/smp-bmips.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/mips/kernel/smp-bmips.c ++++ b/arch/mips/kernel/smp-bmips.c +@@ -168,11 +168,11 @@ static void bmips_prepare_cpus(unsigned + return; + } + +- if (request_irq(IPI0_IRQ, bmips_ipi_interrupt, IRQF_PERCPU, +- "smp_ipi0", NULL)) ++ if (request_irq(IPI0_IRQ, bmips_ipi_interrupt, ++ IRQF_PERCPU | IRQF_NO_SUSPEND, "smp_ipi0", NULL)) + panic("Can't request IPI0 interrupt"); +- if (request_irq(IPI1_IRQ, bmips_ipi_interrupt, IRQF_PERCPU, +- "smp_ipi1", NULL)) ++ if (request_irq(IPI1_IRQ, bmips_ipi_interrupt, ++ IRQF_PERCPU | IRQF_NO_SUSPEND, "smp_ipi1", NULL)) + panic("Can't request IPI1 interrupt"); + } + diff --git a/queue-4.15/mips-octeon-irq-check-for-null-return-on-kzalloc-allocation.patch b/queue-4.15/mips-octeon-irq-check-for-null-return-on-kzalloc-allocation.patch new file mode 100644 index 00000000000..ff23e5bf1af --- /dev/null +++ b/queue-4.15/mips-octeon-irq-check-for-null-return-on-kzalloc-allocation.patch @@ -0,0 +1,39 @@ +From 902f4d067a50ccf645a58dd5fb1d113b6e0f9b5b Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Thu, 22 Feb 2018 18:08:53 +0000 +Subject: MIPS: OCTEON: irq: Check for null return on kzalloc allocation + +From: Colin Ian King + +commit 902f4d067a50ccf645a58dd5fb1d113b6e0f9b5b upstream. + +The allocation of host_data is not null checked, leading to a null +pointer dereference if the allocation fails. Fix this by adding a null +check and return with -ENOMEM. + +Fixes: 64b139f97c01 ("MIPS: OCTEON: irq: add CIB and other fixes") +Signed-off-by: Colin Ian King +Acked-by: David Daney +Cc: Ralf Baechle +Cc: "Steven J. Hill" +Cc: linux-mips@linux-mips.org +Cc: # 4.0+ +Patchwork: https://patchwork.linux-mips.org/patch/18658/ +Signed-off-by: James Hogan +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/cavium-octeon/octeon-irq.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/mips/cavium-octeon/octeon-irq.c ++++ b/arch/mips/cavium-octeon/octeon-irq.c +@@ -2277,6 +2277,8 @@ static int __init octeon_irq_init_cib(st + } + + host_data = kzalloc(sizeof(*host_data), GFP_KERNEL); ++ if (!host_data) ++ return -ENOMEM; + raw_spin_lock_init(&host_data->lock); + + addr = of_get_address(ciu_node, 0, NULL, NULL); diff --git a/queue-4.15/mm-memblock.c-hardcode-the-end_pfn-being-1.patch b/queue-4.15/mm-memblock.c-hardcode-the-end_pfn-being-1.patch new file mode 100644 index 00000000000..2fe5d7d66ba --- /dev/null +++ b/queue-4.15/mm-memblock.c-hardcode-the-end_pfn-being-1.patch @@ -0,0 +1,61 @@ +From 379b03b7fa05f7db521b7732a52692448a3c34fe Mon Sep 17 00:00:00 2001 +From: Daniel Vacek +Date: Fri, 9 Mar 2018 15:51:09 -0800 +Subject: mm/memblock.c: hardcode the end_pfn being -1 + +From: Daniel Vacek + +commit 379b03b7fa05f7db521b7732a52692448a3c34fe upstream. + +This is just a cleanup. It aids handling the special end case in the +next commit. + +[akpm@linux-foundation.org: make it work against current -linus, not against -mm] +[akpm@linux-foundation.org: make it work against current -linus, not against -mm some more] +Link: http://lkml.kernel.org/r/1ca478d4269125a99bcfb1ca04d7b88ac1aee924.1520011944.git.neelx@redhat.com +Signed-off-by: Daniel Vacek +Cc: Michal Hocko +Cc: Vlastimil Babka +Cc: Mel Gorman +Cc: Pavel Tatashin +Cc: Paul Burton +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/memblock.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/mm/memblock.c ++++ b/mm/memblock.c +@@ -1107,7 +1107,7 @@ unsigned long __init_memblock memblock_n + struct memblock_type *type = &memblock.memory; + unsigned int right = type->cnt; + unsigned int mid, left = 0; +- phys_addr_t addr = PFN_PHYS(pfn + 1); ++ phys_addr_t addr = PFN_PHYS(++pfn); + + do { + mid = (right + left) / 2; +@@ -1118,15 +1118,15 @@ unsigned long __init_memblock memblock_n + type->regions[mid].size)) + left = mid + 1; + else { +- /* addr is within the region, so pfn + 1 is valid */ +- return min(pfn + 1, max_pfn); ++ /* addr is within the region, so pfn is valid */ ++ return pfn; + } + } while (left < right); + + if (right == type->cnt) +- return max_pfn; ++ return -1UL; + else +- return min(PHYS_PFN(type->regions[right].base), max_pfn); ++ return PHYS_PFN(type->regions[right].base); + } + + /** diff --git a/queue-4.15/mm-page_alloc-fix-memmap_init_zone-pageblock-alignment.patch b/queue-4.15/mm-page_alloc-fix-memmap_init_zone-pageblock-alignment.patch new file mode 100644 index 00000000000..e1e6670a456 --- /dev/null +++ b/queue-4.15/mm-page_alloc-fix-memmap_init_zone-pageblock-alignment.patch @@ -0,0 +1,166 @@ +From 864b75f9d6b0100bb24fdd9a20d156e7cda9b5ae Mon Sep 17 00:00:00 2001 +From: Daniel Vacek +Date: Fri, 9 Mar 2018 15:51:13 -0800 +Subject: mm/page_alloc: fix memmap_init_zone pageblock alignment + +From: Daniel Vacek + +commit 864b75f9d6b0100bb24fdd9a20d156e7cda9b5ae upstream. + +Commit b92df1de5d28 ("mm: page_alloc: skip over regions of invalid pfns +where possible") introduced a bug where move_freepages() triggers a +VM_BUG_ON() on uninitialized page structure due to pageblock alignment. +To fix this, simply align the skipped pfns in memmap_init_zone() the +same way as in move_freepages_block(). + +Seen in one of the RHEL reports: + + crash> log | grep -e BUG -e RIP -e Call.Trace -e move_freepages_block -e rmqueue -e freelist -A1 + kernel BUG at mm/page_alloc.c:1389! + invalid opcode: 0000 [#1] SMP + -- + RIP: 0010:[] [] move_freepages+0x15e/0x160 + RSP: 0018:ffff88054d727688 EFLAGS: 00010087 + -- + Call Trace: + [] move_freepages_block+0x73/0x80 + [] __rmqueue+0x263/0x460 + [] get_page_from_freelist+0x7e1/0x9e0 + [] __alloc_pages_nodemask+0x176/0x420 + -- + RIP [] move_freepages+0x15e/0x160 + RSP + + crash> page_init_bug -v | grep RAM + 1000 - 9bfff System RAM (620.00 KiB) + 100000 - 430bffff System RAM ( 1.05 GiB = 1071.75 MiB = 1097472.00 KiB) + 4b0c8000 - 4bf9cfff System RAM ( 14.83 MiB = 15188.00 KiB) + 4bfac000 - 646b1fff System RAM (391.02 MiB = 400408.00 KiB) + 7b788000 - 7b7fffff System RAM (480.00 KiB) + 100000000 - 67fffffff System RAM ( 22.00 GiB) + + crash> page_init_bug | head -6 + 7b788000 - 7b7fffff System RAM (480.00 KiB) + 1fffff00000000 0 1 DMA32 4096 1048575 + 505736 505344 505855 + 0 0 0 DMA 1 4095 + 1fffff00000400 0 1 DMA32 4096 1048575 + BUG, zones differ! + +Note that this range follows two not populated sections +68000000-77ffffff in this zone. 7b788000-7b7fffff is the first one +after a gap. This makes memmap_init_zone() skip all the pfns up to the +beginning of this range. But this range is not pageblock (2M) aligned. +In fact no range has to be. + + crash> kmem -p 77fff000 78000000 7b5ff000 7b600000 7b787000 7b788000 + PAGE PHYSICAL MAPPING INDEX CNT FLAGS + ffffea0001e00000 78000000 0 0 0 0 + ffffea0001ed7fc0 7b5ff000 0 0 0 0 + ffffea0001ed8000 7b600000 0 0 0 0 <<<< + ffffea0001ede1c0 7b787000 0 0 0 0 + ffffea0001ede200 7b788000 0 0 1 1fffff00000000 + +Top part of page flags should contain nodeid and zonenr, which is not +the case for page ffffea0001ed8000 here (<<<<). + + crash> log | grep -o fffea0001ed[^\ ]* | sort -u + fffea0001ed8000 + fffea0001eded20 + fffea0001edffc0 + + crash> bt -r | grep -o fffea0001ed[^\ ]* | sort -u + fffea0001ed8000 + fffea0001eded00 + fffea0001eded20 + fffea0001edffc0 + +Initialization of the whole beginning of the section is skipped up to +the start of the range due to the commit b92df1de5d28. Now any code +calling move_freepages_block() (like reusing the page from a freelist as +in this example) with a page from the beginning of the range will get +the page rounded down to start_page ffffea0001ed8000 and passed to +move_freepages() which crashes on assertion getting wrong zonenr. + + > VM_BUG_ON(page_zone(start_page) != page_zone(end_page)); + +Note, page_zone() derives the zone from page flags here. + +From similar machine before commit b92df1de5d28: + + crash> kmem -p 77fff000 78000000 7b5ff000 7b600000 7b7fe000 7b7ff000 + PAGE PHYSICAL MAPPING INDEX CNT FLAGS + fffff73941e00000 78000000 0 0 1 1fffff00000000 + fffff73941ed7fc0 7b5ff000 0 0 1 1fffff00000000 + fffff73941ed8000 7b600000 0 0 1 1fffff00000000 + fffff73941edff80 7b7fe000 0 0 1 1fffff00000000 + fffff73941edffc0 7b7ff000 ffff8e67e04d3ae0 ad84 1 1fffff00020068 uptodate,lru,active,mappedtodisk + +All the pages since the beginning of the section are initialized. +move_freepages()' not gonna blow up. + +The same machine with this fix applied: + + crash> kmem -p 77fff000 78000000 7b5ff000 7b600000 7b7fe000 7b7ff000 + PAGE PHYSICAL MAPPING INDEX CNT FLAGS + ffffea0001e00000 78000000 0 0 0 0 + ffffea0001e00000 7b5ff000 0 0 0 0 + ffffea0001ed8000 7b600000 0 0 1 1fffff00000000 + ffffea0001edff80 7b7fe000 0 0 1 1fffff00000000 + ffffea0001edffc0 7b7ff000 ffff88017fb13720 8 2 1fffff00020068 uptodate,lru,active,mappedtodisk + +At least the bare minimum of pages is initialized preventing the crash +as well. + +Customers started to report this as soon as 7.4 (where b92df1de5d28 was +merged in RHEL) was released. I remember reports from +September/October-ish times. It's not easily reproduced and happens on +a handful of machines only. I guess that's why. But that does not make +it less serious, I think. + +Though there actually is a report here: + https://bugzilla.kernel.org/show_bug.cgi?id=196443 + +And there are reports for Fedora from July: + https://bugzilla.redhat.com/show_bug.cgi?id=1473242 +and CentOS: + https://bugs.centos.org/view.php?id=13964 +and we internally track several dozens reports for RHEL bug + https://bugzilla.redhat.com/show_bug.cgi?id=1525121 + +Link: http://lkml.kernel.org/r/0485727b2e82da7efbce5f6ba42524b429d0391a.1520011945.git.neelx@redhat.com +Fixes: b92df1de5d28 ("mm: page_alloc: skip over regions of invalid pfns where possible") +Signed-off-by: Daniel Vacek +Cc: Mel Gorman +Cc: Michal Hocko +Cc: Paul Burton +Cc: Pavel Tatashin +Cc: Vlastimil Babka +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/page_alloc.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -5353,9 +5353,14 @@ void __meminit memmap_init_zone(unsigned + /* + * Skip to the pfn preceding the next valid one (or + * end_pfn), such that we hit a valid pfn (or end_pfn) +- * on our next iteration of the loop. ++ * on our next iteration of the loop. Note that it needs ++ * to be pageblock aligned even when the region itself ++ * is not. move_freepages_block() can shift ahead of ++ * the valid region but still depends on correct page ++ * metadata. + */ +- pfn = memblock_next_valid_pfn(pfn, end_pfn) - 1; ++ pfn = (memblock_next_valid_pfn(pfn, end_pfn) & ++ ~(pageblock_nr_pages-1)) - 1; + #endif + continue; + } diff --git a/queue-4.15/ovl-redirect_dir-nofollow-should-not-follow-redirect-for-opaque-lower.patch b/queue-4.15/ovl-redirect_dir-nofollow-should-not-follow-redirect-for-opaque-lower.patch new file mode 100644 index 00000000000..ae0d758987d --- /dev/null +++ b/queue-4.15/ovl-redirect_dir-nofollow-should-not-follow-redirect-for-opaque-lower.patch @@ -0,0 +1,70 @@ +From d1fe96c0e4de78ba0cd336ea3df3b850d06b9b9a Mon Sep 17 00:00:00 2001 +From: Vivek Goyal +Date: Fri, 2 Feb 2018 10:23:24 -0500 +Subject: ovl: redirect_dir=nofollow should not follow redirect for opaque lower + +From: Vivek Goyal + +commit d1fe96c0e4de78ba0cd336ea3df3b850d06b9b9a upstream. + +redirect_dir=nofollow should not follow a redirect. But in a specific +configuration it can still follow it. For example try this. + +$ mkdir -p lower0 lower1/foo upper work merged +$ touch lower1/foo/lower-file.txt +$ setfattr -n "trusted.overlay.opaque" -v "y" lower1/foo +$ mount -t overlay -o lowerdir=lower1:lower0,workdir=work,upperdir=upper,redirect_dir=on none merged +$ cd merged +$ mv foo foo-renamed +$ umount merged + +# mount again. This time with redirect_dir=nofollow +$ mount -t overlay -o lowerdir=lower1:lower0,workdir=work,upperdir=upper,redirect_dir=nofollow none merged +$ ls merged/foo-renamed/ +# This lists lower-file.txt, while it should not have. + +Basically, we are doing redirect check after we check for d.stop. And +if this is not last lower, and we find an opaque lower, d.stop will be +set. + +ovl_lookup_single() + if (!d->last && ovl_is_opaquedir(this)) { + d->stop = d->opaque = true; + goto out; + } + +To fix this, first check redirect is allowed. And after that check if +d.stop has been set or not. + +Signed-off-by: Vivek Goyal +Fixes: 438c84c2f0c7 ("ovl: don't follow redirects if redirect_dir=off") +Cc: #v4.15 +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/overlayfs/namei.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/fs/overlayfs/namei.c ++++ b/fs/overlayfs/namei.c +@@ -678,9 +678,6 @@ struct dentry *ovl_lookup(struct inode * + stack[ctr].layer = lower.layer; + ctr++; + +- if (d.stop) +- break; +- + /* + * Following redirects can have security consequences: it's like + * a symlink into the lower layer without the permission checks. +@@ -697,6 +694,9 @@ struct dentry *ovl_lookup(struct inode * + goto out_put; + } + ++ if (d.stop) ++ break; ++ + if (d.redirect && d.redirect[0] == '/' && poe != roe) { + poe = roe; + diff --git a/queue-4.15/pci-dwc-fix-enumeration-end-when-reaching-root-subordinate.patch b/queue-4.15/pci-dwc-fix-enumeration-end-when-reaching-root-subordinate.patch new file mode 100644 index 00000000000..684a83bbdbb --- /dev/null +++ b/queue-4.15/pci-dwc-fix-enumeration-end-when-reaching-root-subordinate.patch @@ -0,0 +1,89 @@ +From fc110ebdd014dd1368c98e7685b47789c31fab42 Mon Sep 17 00:00:00 2001 +From: Koen Vandeputte +Date: Wed, 7 Mar 2018 10:46:39 -0600 +Subject: PCI: dwc: Fix enumeration end when reaching root subordinate + +From: Koen Vandeputte + +commit fc110ebdd014dd1368c98e7685b47789c31fab42 upstream. + +The subordinate value indicates the highest bus number which can be +reached downstream though a certain device. + +Commit a20c7f36bd3d ("PCI: Do not allocate more buses than available in +parent") ensures that downstream devices cannot assign busnumbers higher +than the upstream device subordinate number, which was indeed illogical. + +By default, dw_pcie_setup_rc() inits the Root Complex subordinate to a +value of 0x01. + +Due to this combined with above commit, enumeration stops digging deeper +downstream as soon as bus num 0x01 has been assigned, which is always the +case for a bridge device. + +This results in all devices behind a bridge bus remaining undetected, as +these would be connected to bus 0x02 or higher. + +Fix this by initializing the RC to a subordinate value of 0xff, which is +not altering hardware behaviour in any way, but informs probing function +pci_scan_bridge() later on which reads this value back from register. + +The following nasty errors during boot are also fixed by this: + + pci_bus 0000:02: busn_res: can not insert [bus 02-ff] under [bus 01] (conflicts with (null) [bus 01]) + ... + pci_bus 0000:03: [bus 03] partially hidden behind bridge 0000:01 [bus 01] + ... + pci_bus 0000:04: [bus 04] partially hidden behind bridge 0000:01 [bus 01] + ... + pci_bus 0000:05: [bus 05] partially hidden behind bridge 0000:01 [bus 01] + pci_bus 0000:02: busn_res: [bus 02-ff] end is updated to 05 + pci_bus 0000:02: busn_res: can not insert [bus 02-05] under [bus 01] (conflicts with (null) [bus 01]) + pci_bus 0000:02: [bus 02-05] partially hidden behind bridge 0000:01 [bus 01] + +Fixes: a20c7f36bd3d ("PCI: Do not allocate more buses than available in +parent") +Tested-by: Niklas Cassel +Tested-by: Fabio Estevam +Tested-by: Sebastian Reichel +Signed-off-by: Koen Vandeputte +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +Reviewed-by: Mika Westerberg +Acked-by: Lucas Stach +Cc: stable@vger.kernel.org # v4.15+ +Cc: Binghui Wang +Cc: Jesper Nilsson +Cc: Jianguo Sun +Cc: Jingoo Han +Cc: Kishon Vijay Abraham I +Cc: Lucas Stach +Cc: Mika Westerberg +Cc: Minghuan Lian +Cc: Mingkai Hu +Cc: Murali Karicheri +Cc: Pratyush Anand +Cc: Richard Zhu +Cc: Roy Zang +Cc: Shawn Guo +Cc: Stanimir Varbanov +Cc: Thomas Petazzoni +Cc: Xiaowei Song +Cc: Zhou Wang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/dwc/pcie-designware-host.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pci/dwc/pcie-designware-host.c ++++ b/drivers/pci/dwc/pcie-designware-host.c +@@ -607,7 +607,7 @@ void dw_pcie_setup_rc(struct pcie_port * + /* setup bus numbers */ + val = dw_pcie_readl_dbi(pci, PCI_PRIMARY_BUS); + val &= 0xff000000; +- val |= 0x00010100; ++ val |= 0x00ff0100; + dw_pcie_writel_dbi(pci, PCI_PRIMARY_BUS, val); + + /* setup command register */ diff --git a/queue-4.15/perf-tools-fix-trigger-class-trigger_on.patch b/queue-4.15/perf-tools-fix-trigger-class-trigger_on.patch new file mode 100644 index 00000000000..846340a4431 --- /dev/null +++ b/queue-4.15/perf-tools-fix-trigger-class-trigger_on.patch @@ -0,0 +1,81 @@ +From de19e5c3c51fdb1ff20d0f61d099db902ff7494b Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Wed, 28 Feb 2018 10:39:04 +0200 +Subject: perf tools: Fix trigger class trigger_on() + +From: Adrian Hunter + +commit de19e5c3c51fdb1ff20d0f61d099db902ff7494b upstream. + +trigger_on() means that the trigger is available but not ready, however +trigger_on() was making it ready. That can segfault if the signal comes +before trigger_ready(). e.g. (USR2 signal delivery not shown) + + $ perf record -e intel_pt//u -S sleep 1 + perf: Segmentation fault + Obtained 16 stack frames. + /home/ahunter/bin/perf(sighandler_dump_stack+0x40) [0x4ec550] + /lib/x86_64-linux-gnu/libc.so.6(+0x36caf) [0x7fa76411acaf] + /home/ahunter/bin/perf(perf_evsel__disable+0x26) [0x4b9dd6] + /home/ahunter/bin/perf() [0x43a45b] + /lib/x86_64-linux-gnu/libc.so.6(+0x36caf) [0x7fa76411acaf] + /lib/x86_64-linux-gnu/libc.so.6(__xstat64+0x15) [0x7fa7641d2cc5] + /home/ahunter/bin/perf() [0x4ec6c9] + /home/ahunter/bin/perf() [0x4ec73b] + /home/ahunter/bin/perf() [0x4ec73b] + /home/ahunter/bin/perf() [0x4ec73b] + /home/ahunter/bin/perf() [0x4eca15] + /home/ahunter/bin/perf(machine__create_kernel_maps+0x257) [0x4f0b77] + /home/ahunter/bin/perf(perf_session__new+0xc0) [0x4f86f0] + /home/ahunter/bin/perf(cmd_record+0x722) [0x43c132] + /home/ahunter/bin/perf() [0x4a11ae] + /home/ahunter/bin/perf(main+0x5d4) [0x427fb4] + +Note, for testing purposes, this is hard to hit unless you add some sleep() +in builtin-record.c before record__open(). + +Signed-off-by: Adrian Hunter +Acked-by: Jiri Olsa +Cc: Wang Nan +Cc: stable@vger.kernel.org +Fixes: 3dcc4436fa6f ("perf tools: Introduce trigger class") +Link: http://lkml.kernel.org/r/1519807144-30694-1-git-send-email-adrian.hunter@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman + +--- + tools/perf/util/trigger.h | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/tools/perf/util/trigger.h ++++ b/tools/perf/util/trigger.h +@@ -12,7 +12,7 @@ + * States and transits: + * + * +- * OFF--(on)--> READY --(hit)--> HIT ++ * OFF--> ON --> READY --(hit)--> HIT + * ^ | + * | (ready) + * | | +@@ -27,8 +27,9 @@ struct trigger { + volatile enum { + TRIGGER_ERROR = -2, + TRIGGER_OFF = -1, +- TRIGGER_READY = 0, +- TRIGGER_HIT = 1, ++ TRIGGER_ON = 0, ++ TRIGGER_READY = 1, ++ TRIGGER_HIT = 2, + } state; + const char *name; + }; +@@ -50,7 +51,7 @@ static inline bool trigger_is_error(stru + static inline void trigger_on(struct trigger *t) + { + TRIGGER_WARN_ONCE(t, TRIGGER_OFF); +- t->state = TRIGGER_READY; ++ t->state = TRIGGER_ON; + } + + static inline void trigger_ready(struct trigger *t) diff --git a/queue-4.15/regulator-stm32-vrefbuf-fix-check-on-ready-flag.patch b/queue-4.15/regulator-stm32-vrefbuf-fix-check-on-ready-flag.patch new file mode 100644 index 00000000000..52c7e2d0d97 --- /dev/null +++ b/queue-4.15/regulator-stm32-vrefbuf-fix-check-on-ready-flag.patch @@ -0,0 +1,35 @@ +From f63248fac563125fd5a2f0bc780ce7a299872cab Mon Sep 17 00:00:00 2001 +From: Fabrice Gasnier +Date: Thu, 8 Feb 2018 14:43:05 +0100 +Subject: regulator: stm32-vrefbuf: fix check on ready flag + +From: Fabrice Gasnier + +commit f63248fac563125fd5a2f0bc780ce7a299872cab upstream. + +stm32_vrefbuf_enable() wrongly checks VRR bit: 0 stands for not ready, +1 for ready. It currently checks the opposite. +This makes enable routine to exit immediately without waiting for ready +flag. + +Fixes: 0cdbf481e927 ("regulator: Add support for stm32-vrefbuf") +Signed-off-by: Fabrice Gasnier +Signed-off-by: Mark Brown +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/stm32-vrefbuf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/regulator/stm32-vrefbuf.c ++++ b/drivers/regulator/stm32-vrefbuf.c +@@ -51,7 +51,7 @@ static int stm32_vrefbuf_enable(struct r + * arbitrary timeout. + */ + ret = readl_poll_timeout(priv->base + STM32_VREFBUF_CSR, val, +- !(val & STM32_VRR), 650, 10000); ++ val & STM32_VRR, 650, 10000); + if (ret) { + dev_err(&rdev->dev, "stm32 vrefbuf timed out!\n"); + val = readl_relaxed(priv->base + STM32_VREFBUF_CSR); diff --git a/queue-4.15/revert-drm-radeon-pm-autoswitch-power-state-when-in-balanced-mode.patch b/queue-4.15/revert-drm-radeon-pm-autoswitch-power-state-when-in-balanced-mode.patch new file mode 100644 index 00000000000..bab675af119 --- /dev/null +++ b/queue-4.15/revert-drm-radeon-pm-autoswitch-power-state-when-in-balanced-mode.patch @@ -0,0 +1,51 @@ +From 53bf277b487eb5ae6695db01bede0fe406792119 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Thu, 15 Feb 2018 08:40:30 -0500 +Subject: Revert "drm/radeon/pm: autoswitch power state when in balanced mode" + +From: Alex Deucher + +commit 53bf277b487eb5ae6695db01bede0fe406792119 upstream. + +This reverts commit 1c331f75aa6ccbf64ebcc5a019183e617c9d818a. + +Breaks resume on some systems. + +Bug: https://bugs.freedesktop.org/show_bug.cgi?id=100759 +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_pm.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_pm.c ++++ b/drivers/gpu/drm/radeon/radeon_pm.c +@@ -47,7 +47,6 @@ static bool radeon_pm_in_vbl(struct rade + static bool radeon_pm_debug_check_in_vbl(struct radeon_device *rdev, bool finish); + static void radeon_pm_update_profile(struct radeon_device *rdev); + static void radeon_pm_set_clocks(struct radeon_device *rdev); +-static void radeon_pm_compute_clocks_dpm(struct radeon_device *rdev); + + int radeon_pm_get_type_index(struct radeon_device *rdev, + enum radeon_pm_state_type ps_type, +@@ -80,8 +79,6 @@ void radeon_pm_acpi_event_handler(struct + radeon_dpm_enable_bapm(rdev, rdev->pm.dpm.ac_power); + } + mutex_unlock(&rdev->pm.mutex); +- /* allow new DPM state to be picked */ +- radeon_pm_compute_clocks_dpm(rdev); + } else if (rdev->pm.pm_method == PM_METHOD_PROFILE) { + if (rdev->pm.profile == PM_PROFILE_AUTO) { + mutex_lock(&rdev->pm.mutex); +@@ -885,8 +882,7 @@ static struct radeon_ps *radeon_dpm_pick + dpm_state = POWER_STATE_TYPE_INTERNAL_3DPERF; + /* balanced states don't exist at the moment */ + if (dpm_state == POWER_STATE_TYPE_BALANCED) +- dpm_state = rdev->pm.dpm.ac_power ? +- POWER_STATE_TYPE_PERFORMANCE : POWER_STATE_TYPE_BATTERY; ++ dpm_state = POWER_STATE_TYPE_PERFORMANCE; + + restart_search: + /* Pick the best power state based on current conditions */ diff --git a/queue-4.15/revert-input-synaptics-lenovo-thinkpad-t460p-devices-should-use-rmi.patch b/queue-4.15/revert-input-synaptics-lenovo-thinkpad-t460p-devices-should-use-rmi.patch new file mode 100644 index 00000000000..dc19dd0e3cf --- /dev/null +++ b/queue-4.15/revert-input-synaptics-lenovo-thinkpad-t460p-devices-should-use-rmi.patch @@ -0,0 +1,71 @@ +From 5444a992b4a73aa5246a432c482b20b89bce93a5 Mon Sep 17 00:00:00 2001 +From: Arkadiusz Hiler +Date: Wed, 7 Mar 2018 15:40:28 -0800 +Subject: Revert "Input: synaptics - Lenovo Thinkpad T460p devices should use RMI" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arkadiusz Hiler + +commit 5444a992b4a73aa5246a432c482b20b89bce93a5 upstream. + +This reverts commit 48282969826b3d3c76e908182f69724d86d995fe which +caused the following issues: + +1. On T460p with BIOS version 2.22 touchpad and trackpoint stop working +after suspend-resume cycle. Due to strange state of the device another +suspend is impossible. + +The following dmesg errors can be observed: +thinkpad_acpi: EC reports that Thermal Table has changed +rmi4_smbus 7-002c: failed to get SMBus version number! +rmi4_physical rmi4-00: rmi_driver_reset_handler: Failed to read current IRQ mask. +rmi4_f01 rmi4-00.fn01: Failed to restore normal operation: -16. +rmi4_f01 rmi4-00.fn01: Resume failed with code -16. +rmi4_physical rmi4-00: Failed to suspend functions: -16 +rmi4_smbus 7-002c: Failed to resume device: -16 +PM: resume devices took 0.640 seconds +rmi4_f03 rmi4-00.fn03: rmi_f03_pt_write: Failed to write to F03 TX register (-16). +rmi4_physical rmi4-00: rmi_driver_clear_irq_bits: Failed to change enabled interrupts! +rmi4_physical rmi4-00: rmi_driver_set_irq_bits: Failed to change enabled interrupts! +psmouse: probe of serio3 failed with error -1 + +2. On another T460p with BIOS version 2.15 two finger scrolling gesture +on the touchpad stops working after suspend-resume cycle (about 75% +reproducibility, when it still works, the scrolling gesture becomes +laggy). Nothing suspicious appears in the dmesg. + +Analysis form Richard Schütz: + +"RMI is unreliable on the ThinkPad T460p because the device is affected +by the firmware behavior addressed in a7ae81952cda ("i2c: i801: Allow +ACPI SystemIO OpRegion to conflict with PCI BAR")." + +The affected devices often show: + +i801_smbus 0000:00:1f.4: BIOS is accessing SMBus registers +i801_smbus 0000:00:1f.4: Driver SMBus register access inhibited + +Reported-by: Richard Schütz +Signed-off-by: Arkadiusz Hiler +Tested-by: Martin Peres +Tested-by: Arkadiusz Hiler +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mouse/synaptics.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -173,7 +173,6 @@ static const char * const smbus_pnp_ids[ + "LEN0046", /* X250 */ + "LEN004a", /* W541 */ + "LEN200f", /* T450s */ +- "LEN2018", /* T460p */ + NULL + }; + diff --git a/queue-4.15/revert-nvme-create-slaves-and-holders-entries-for-hidden-controllers.patch b/queue-4.15/revert-nvme-create-slaves-and-holders-entries-for-hidden-controllers.patch new file mode 100644 index 00000000000..e8097178bed --- /dev/null +++ b/queue-4.15/revert-nvme-create-slaves-and-holders-entries-for-hidden-controllers.patch @@ -0,0 +1,114 @@ +From 8a30ecc6e0ecbb9ae95daf499b2680b885ed0349 Mon Sep 17 00:00:00 2001 +From: Christoph Hellwig +Date: Wed, 7 Mar 2018 14:13:58 +0100 +Subject: Revert "nvme: create 'slaves' and 'holders' entries for hidden controllers" + +From: Christoph Hellwig + +commit 8a30ecc6e0ecbb9ae95daf499b2680b885ed0349 upstream. + +This reverts commit e9a48034d7d1318ece7d4a235838a86c94db9d68. + +The slaves and holders link for the hidden gendisks confuse lsblk so that +it errors out on, or doesn't report the nvme multipath devices. Given +that we don't need holder relationships for something that can't even be +directly accessed we should just stop creating those links. + +Signed-off-by: Christoph Hellwig +Reported-by: Potnuri Bharat Teja +Cc: stable@vger.kernel.org +Signed-off-by: Keith Busch +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/nvme/host/core.c | 2 -- + drivers/nvme/host/multipath.c | 30 ------------------------------ + drivers/nvme/host/nvme.h | 8 -------- + 3 files changed, 40 deletions(-) + +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -2950,7 +2950,6 @@ static void nvme_alloc_ns(struct nvme_ct + + if (new) + nvme_mpath_add_disk(ns->head); +- nvme_mpath_add_disk_links(ns); + return; + out_unlink_ns: + mutex_lock(&ctrl->subsys->lock); +@@ -2970,7 +2969,6 @@ static void nvme_ns_remove(struct nvme_n + return; + + if (ns->disk && ns->disk->flags & GENHD_FL_UP) { +- nvme_mpath_remove_disk_links(ns); + sysfs_remove_group(&disk_to_dev(ns->disk)->kobj, + &nvme_ns_id_attr_group); + if (ns->ndev) +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -245,25 +245,6 @@ void nvme_mpath_add_disk(struct nvme_ns_ + head->disk->disk_name); + } + +-void nvme_mpath_add_disk_links(struct nvme_ns *ns) +-{ +- struct kobject *slave_disk_kobj, *holder_disk_kobj; +- +- if (!ns->head->disk) +- return; +- +- slave_disk_kobj = &disk_to_dev(ns->disk)->kobj; +- if (sysfs_create_link(ns->head->disk->slave_dir, slave_disk_kobj, +- kobject_name(slave_disk_kobj))) +- return; +- +- holder_disk_kobj = &disk_to_dev(ns->head->disk)->kobj; +- if (sysfs_create_link(ns->disk->part0.holder_dir, holder_disk_kobj, +- kobject_name(holder_disk_kobj))) +- sysfs_remove_link(ns->head->disk->slave_dir, +- kobject_name(slave_disk_kobj)); +-} +- + void nvme_mpath_remove_disk(struct nvme_ns_head *head) + { + if (!head->disk) +@@ -278,14 +259,3 @@ void nvme_mpath_remove_disk(struct nvme_ + blk_cleanup_queue(head->disk->queue); + put_disk(head->disk); + } +- +-void nvme_mpath_remove_disk_links(struct nvme_ns *ns) +-{ +- if (!ns->head->disk) +- return; +- +- sysfs_remove_link(ns->disk->part0.holder_dir, +- kobject_name(&disk_to_dev(ns->head->disk)->kobj)); +- sysfs_remove_link(ns->head->disk->slave_dir, +- kobject_name(&disk_to_dev(ns->disk)->kobj)); +-} +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -405,9 +405,7 @@ bool nvme_req_needs_failover(struct requ + void nvme_kick_requeue_lists(struct nvme_ctrl *ctrl); + int nvme_mpath_alloc_disk(struct nvme_ctrl *ctrl,struct nvme_ns_head *head); + void nvme_mpath_add_disk(struct nvme_ns_head *head); +-void nvme_mpath_add_disk_links(struct nvme_ns *ns); + void nvme_mpath_remove_disk(struct nvme_ns_head *head); +-void nvme_mpath_remove_disk_links(struct nvme_ns *ns); + + static inline void nvme_mpath_clear_current_path(struct nvme_ns *ns) + { +@@ -448,12 +446,6 @@ static inline void nvme_mpath_add_disk(s + static inline void nvme_mpath_remove_disk(struct nvme_ns_head *head) + { + } +-static inline void nvme_mpath_add_disk_links(struct nvme_ns *ns) +-{ +-} +-static inline void nvme_mpath_remove_disk_links(struct nvme_ns *ns) +-{ +-} + static inline void nvme_mpath_clear_current_path(struct nvme_ns *ns) + { + } diff --git a/queue-4.15/scsi-core-avoid-that-ata-error-handling-can-trigger-a-kernel-hang-or-oops.patch b/queue-4.15/scsi-core-avoid-that-ata-error-handling-can-trigger-a-kernel-hang-or-oops.patch new file mode 100644 index 00000000000..67440ba6383 --- /dev/null +++ b/queue-4.15/scsi-core-avoid-that-ata-error-handling-can-trigger-a-kernel-hang-or-oops.patch @@ -0,0 +1,118 @@ +From 3be8828fc507cdafe7040a3dcf361a2bcd8e305b Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Thu, 22 Feb 2018 11:30:20 -0800 +Subject: scsi: core: Avoid that ATA error handling can trigger a kernel hang or oops + +From: Bart Van Assche + +commit 3be8828fc507cdafe7040a3dcf361a2bcd8e305b upstream. + +Avoid that the recently introduced call_rcu() call in the SCSI core +triggers a double call_rcu() call. + +Reported-by: Natanael Copa +Reported-by: Damien Le Moal +References: https://bugzilla.kernel.org/show_bug.cgi?id=198861 +Fixes: 3bd6f43f5cb3 ("scsi: core: Ensure that the SCSI error handler gets woken up") +Signed-off-by: Bart Van Assche +Reviewed-by: Damien Le Moal +Tested-by: Damien Le Moal +Cc: Natanael Copa +Cc: Damien Le Moal +Cc: Alexandre Oliva +Cc: Pavel Tikhomirov +Cc: Hannes Reinecke +Cc: Johannes Thumshirn +Cc: +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/hosts.c | 3 --- + drivers/scsi/scsi_error.c | 5 +++-- + drivers/scsi/scsi_lib.c | 2 ++ + include/scsi/scsi_cmnd.h | 3 +++ + include/scsi/scsi_host.h | 2 -- + 5 files changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/scsi/hosts.c ++++ b/drivers/scsi/hosts.c +@@ -328,8 +328,6 @@ static void scsi_host_dev_release(struct + if (shost->work_q) + destroy_workqueue(shost->work_q); + +- destroy_rcu_head(&shost->rcu); +- + if (shost->shost_state == SHOST_CREATED) { + /* + * Free the shost_dev device name here if scsi_host_alloc() +@@ -404,7 +402,6 @@ struct Scsi_Host *scsi_host_alloc(struct + INIT_LIST_HEAD(&shost->starved_list); + init_waitqueue_head(&shost->host_wait); + mutex_init(&shost->scan_mutex); +- init_rcu_head(&shost->rcu); + + index = ida_simple_get(&host_index_ida, 0, 0, GFP_KERNEL); + if (index < 0) +--- a/drivers/scsi/scsi_error.c ++++ b/drivers/scsi/scsi_error.c +@@ -222,7 +222,8 @@ static void scsi_eh_reset(struct scsi_cm + + static void scsi_eh_inc_host_failed(struct rcu_head *head) + { +- struct Scsi_Host *shost = container_of(head, typeof(*shost), rcu); ++ struct scsi_cmnd *scmd = container_of(head, typeof(*scmd), rcu); ++ struct Scsi_Host *shost = scmd->device->host; + unsigned long flags; + + spin_lock_irqsave(shost->host_lock, flags); +@@ -258,7 +259,7 @@ void scsi_eh_scmd_add(struct scsi_cmnd * + * Ensure that all tasks observe the host state change before the + * host_failed change. + */ +- call_rcu(&shost->rcu, scsi_eh_inc_host_failed); ++ call_rcu(&scmd->rcu, scsi_eh_inc_host_failed); + } + + /** +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -670,6 +670,7 @@ static bool scsi_end_request(struct requ + if (!blk_rq_is_scsi(req)) { + WARN_ON_ONCE(!(cmd->flags & SCMD_INITIALIZED)); + cmd->flags &= ~SCMD_INITIALIZED; ++ destroy_rcu_head(&cmd->rcu); + } + + if (req->mq_ctx) { +@@ -1150,6 +1151,7 @@ void scsi_initialize_rq(struct request * + struct scsi_cmnd *cmd = blk_mq_rq_to_pdu(rq); + + scsi_req_init(&cmd->req); ++ init_rcu_head(&cmd->rcu); + cmd->jiffies_at_alloc = jiffies; + cmd->retries = 0; + } +--- a/include/scsi/scsi_cmnd.h ++++ b/include/scsi/scsi_cmnd.h +@@ -69,6 +69,9 @@ struct scsi_cmnd { + struct list_head list; /* scsi_cmnd participates in queue lists */ + struct list_head eh_entry; /* entry for the host eh_cmd_q */ + struct delayed_work abort_work; ++ ++ struct rcu_head rcu; ++ + int eh_eflags; /* Used by error handlr */ + + /* +--- a/include/scsi/scsi_host.h ++++ b/include/scsi/scsi_host.h +@@ -571,8 +571,6 @@ struct Scsi_Host { + struct blk_mq_tag_set tag_set; + }; + +- struct rcu_head rcu; +- + atomic_t host_busy; /* commands actually active on low-level */ + atomic_t host_blocked; + diff --git a/queue-4.15/scsi-qla2xxx-fix-null-pointer-crash-due-to-active-timer-for-abts.patch b/queue-4.15/scsi-qla2xxx-fix-null-pointer-crash-due-to-active-timer-for-abts.patch new file mode 100644 index 00000000000..37e4dffedf2 --- /dev/null +++ b/queue-4.15/scsi-qla2xxx-fix-null-pointer-crash-due-to-active-timer-for-abts.patch @@ -0,0 +1,120 @@ +From 1514839b366417934e2f1328edb50ed1e8a719f5 Mon Sep 17 00:00:00 2001 +From: "himanshu.madhani@cavium.com" +Date: Mon, 12 Feb 2018 10:28:14 -0800 +Subject: scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS + +From: himanshu.madhani@cavium.com + +commit 1514839b366417934e2f1328edb50ed1e8a719f5 upstream. + +This patch fixes NULL pointer crash due to active timer running for abort +IOCB. + +From crash dump analysis it was discoverd that get_next_timer_interrupt() +encountered a corrupted entry on the timer list. + + #9 [ffff95e1f6f0fd40] page_fault at ffffffff914fe8f8 + [exception RIP: get_next_timer_interrupt+440] + RIP: ffffffff90ea3088 RSP: ffff95e1f6f0fdf0 RFLAGS: 00010013 + RAX: ffff95e1f6451028 RBX: 000218e2389e5f40 RCX: 00000001232ad600 + RDX: 0000000000000001 RSI: ffff95e1f6f0fdf0 RDI: 0000000001232ad6 + RBP: ffff95e1f6f0fe40 R8: ffff95e1f6451188 R9: 0000000000000001 + R10: 0000000000000016 R11: 0000000000000016 R12: 00000001232ad5f6 + R13: ffff95e1f6450000 R14: ffff95e1f6f0fdf8 R15: ffff95e1f6f0fe10 + ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 + +Looking at the assembly of get_next_timer_interrupt(), address came +from %r8 (ffff95e1f6451188) which is pointing to list_head with single +entry at ffff95e5ff621178. + + 0xffffffff90ea307a : mov (%r8),%rdx + 0xffffffff90ea307d : cmp %r8,%rdx + 0xffffffff90ea3080 : je 0xffffffff90ea30a7 + 0xffffffff90ea3082 : nopw 0x0(%rax,%rax,1) + 0xffffffff90ea3088 : testb $0x1,0x18(%rdx) + + crash> rd ffff95e1f6451188 10 + ffff95e1f6451188: ffff95e5ff621178 ffff95e5ff621178 x.b.....x.b..... + ffff95e1f6451198: ffff95e1f6451198 ffff95e1f6451198 ..E.......E..... + ffff95e1f64511a8: ffff95e1f64511a8 ffff95e1f64511a8 ..E.......E..... + ffff95e1f64511b8: ffff95e77cf509a0 ffff95e77cf509a0 ...|.......|.... + ffff95e1f64511c8: ffff95e1f64511c8 ffff95e1f64511c8 ..E.......E..... + + crash> rd ffff95e5ff621178 10 + ffff95e5ff621178: 0000000000000001 ffff95e15936aa00 ..........6Y.... + ffff95e5ff621188: 0000000000000000 00000000ffffffff ................ + ffff95e5ff621198: 00000000000000a0 0000000000000010 ................ + ffff95e5ff6211a8: ffff95e5ff621198 000000000000000c ..b............. + ffff95e5ff6211b8: 00000f5800000000 ffff95e751f8d720 ....X... ..Q.... + + ffff95e5ff621178 belongs to freed mempool object at ffff95e5ff621080. + + CACHE NAME OBJSIZE ALLOCATED TOTAL SLABS SSIZE + ffff95dc7fd74d00 mnt_cache 384 19785 24948 594 16k + SLAB MEMORY NODE TOTAL ALLOCATED FREE + ffffdc5dabfd8800 ffff95e5ff620000 1 42 29 13 + FREE / [ALLOCATED] + ffff95e5ff621080 (cpu 6 cache) + +Examining the contents of that memory reveals a pointer to a constant string +in the driver, "abort\0", which is set by qla24xx_async_abort_cmd(). + + crash> rd ffffffffc059277c 20 + ffffffffc059277c: 6e490074726f6261 0074707572726574 abort.Interrupt. + ffffffffc059278c: 00676e696c6c6f50 6920726576697244 Polling.Driver i + ffffffffc059279c: 646f6d207325206e 6974736554000a65 n %s mode..Testi + ffffffffc05927ac: 636976656420676e 786c252074612065 ng device at %lx + ffffffffc05927bc: 6b63656843000a2e 646f727020676e69 ...Checking prod + ffffffffc05927cc: 6f20444920746375 0a2e706968632066 uct ID of chip.. + ffffffffc05927dc: 5120646e756f4600 204130303232414c .Found QLA2200A + ffffffffc05927ec: 43000a2e70696843 20676e696b636568 Chip...Checking + ffffffffc05927fc: 65786f626c69616d 6c636e69000a2e73 mailboxes...incl + ffffffffc059280c: 756e696c2f656475 616d2d616d642f78 ude/linux/dma-ma + + crash> struct -ox srb_iocb + struct srb_iocb { + union { + struct {...} logio; + struct {...} els_logo; + struct {...} tmf; + struct {...} fxiocb; + struct {...} abt; + struct ct_arg ctarg; + struct {...} mbx; + struct {...} nack; + [0x0 ] } u; + [0xb8] struct timer_list timer; + [0x108] void (*timeout)(void *); + } + SIZE: 0x110 + + crash> ! bc + ibase=16 + obase=10 + B8+40 + F8 + +The object is a srb_t, and at offset 0xf8 within that structure +(i.e. ffff95e5ff621080 + f8 -> ffff95e5ff621178) is a struct timer_list. + +Cc: #4.4+ +Fixes: 4440e46d5db7 ("[SCSI] qla2xxx: Add IOCB Abort command asynchronous handling.") +Signed-off-by: Himanshu Madhani +Reviewed-by: Johannes Thumshirn +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_init.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -1347,6 +1347,7 @@ qla24xx_abort_sp_done(void *ptr, int res + srb_t *sp = ptr; + struct srb_iocb *abt = &sp->u.iocb_cmd; + ++ del_timer(&sp->u.iocb_cmd.timer); + complete(&abt->u.abt.comp); + } + diff --git a/queue-4.15/scsi-qla2xxx-fix-null-pointer-crash-due-to-probe-failure.patch b/queue-4.15/scsi-qla2xxx-fix-null-pointer-crash-due-to-probe-failure.patch new file mode 100644 index 00000000000..d365c306eac --- /dev/null +++ b/queue-4.15/scsi-qla2xxx-fix-null-pointer-crash-due-to-probe-failure.patch @@ -0,0 +1,68 @@ +From d64d6c5671db5e693a0caaee79f2571b098749c9 Mon Sep 17 00:00:00 2001 +From: "himanshu.madhani@cavium.com" +Date: Mon, 15 Jan 2018 20:46:46 -0800 +Subject: scsi: qla2xxx: Fix NULL pointer crash due to probe failure + +From: himanshu.madhani@cavium.com + +commit d64d6c5671db5e693a0caaee79f2571b098749c9 upstream. + +This patch fixes regression added by commit d74595278f4ab +("scsi: qla2xxx: Add multiple queue pair functionality."). + +When driver is not able to get reqeusted IRQs from the system, driver will +attempt tp clean up memory before failing hardware probe. During this cleanup, +driver assigns NULL value to the pointer which has not been allocated by +driver yet. This results in a NULL pointer access. + +Log file will show following message and stack trace + +qla2xxx [0000:a3:00.1]-00c7:21: MSI-X: Failed to enable support, giving up -- 32/-1. +qla2xxx [0000:a3:00.1]-0037:21: Falling back-to MSI mode --1. +qla2xxx [0000:a3:00.1]-003a:21: Failed to reserve interrupt 821 already in use. +BUG: unable to handle kernel NULL pointer dereference at (null) +IP: [] qla2x00_probe_one+0x18b6/0x2730 [qla2xxx] +PGD 0 +Oops: 0002 [#1] SMP + +Fixes: d74595278f4ab ("scsi: qla2xxx: Add multiple queue pair functionality."). +Cc: # 4.10 +Signed-off-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_os.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -3011,9 +3011,6 @@ qla2x00_probe_one(struct pci_dev *pdev, + base_vha = qla2x00_create_host(sht, ha); + if (!base_vha) { + ret = -ENOMEM; +- qla2x00_mem_free(ha); +- qla2x00_free_req_que(ha, req); +- qla2x00_free_rsp_que(ha, rsp); + goto probe_hw_failed; + } + +@@ -3074,7 +3071,7 @@ qla2x00_probe_one(struct pci_dev *pdev, + /* Set up the irqs */ + ret = qla2x00_request_irqs(ha, rsp); + if (ret) +- goto probe_init_failed; ++ goto probe_hw_failed; + + /* Alloc arrays of request and response ring ptrs */ + if (!qla2x00_alloc_queues(ha, req, rsp)) { +@@ -3390,6 +3387,9 @@ probe_failed: + scsi_host_put(base_vha->host); + + probe_hw_failed: ++ qla2x00_mem_free(ha); ++ qla2x00_free_req_que(ha, req); ++ qla2x00_free_rsp_que(ha, rsp); + qla2x00_clear_drv_active(ha); + + iospace_config_failed: diff --git a/queue-4.15/scsi-qla2xxx-fix-recursion-while-sending-terminate-exchange.patch b/queue-4.15/scsi-qla2xxx-fix-recursion-while-sending-terminate-exchange.patch new file mode 100644 index 00000000000..04fa265d66b --- /dev/null +++ b/queue-4.15/scsi-qla2xxx-fix-recursion-while-sending-terminate-exchange.patch @@ -0,0 +1,44 @@ +From 3efc31f76dd7fc8a71cd86683909f637e9b7cadb Mon Sep 17 00:00:00 2001 +From: "himanshu.madhani@cavium.com" +Date: Mon, 15 Jan 2018 20:46:47 -0800 +Subject: scsi: qla2xxx: Fix recursion while sending terminate exchange + +From: himanshu.madhani@cavium.com + +commit 3efc31f76dd7fc8a71cd86683909f637e9b7cadb upstream. + +During error test case where switch port status is toggled from enable to +disable, following stack trace is seen which indicates recursion trying to +send terminate exchange. This regression was introduced by commit +82de802ad46e ("scsi: qla2xxx: Preparation for Target MQ.") + +BUG: stack guard page was hit at ffffb96488383ff8 (stack is ffffb96488384000..ffffb96488387fff) +BUG: stack guard page was hit at ffffb964886c3ff8 (stack is ffffb964886c4000..ffffb964886c7fff) +kernel stack overflow (double-fault): 0000 [#1] SMP +qlt_term_ctio_exchange+0x9c/0xb0 [qla2xxx] +qlt_term_ctio_exchange+0x9c/0xb0 [qla2xxx] +qlt_term_ctio_exchange+0x9c/0xb0 [qla2xxx] +qlt_term_ctio_exchange+0x9c/0xb0 [qla2xxx] +qlt_term_ctio_exchange+0x9c/0xb0 [qla2xxx] + +Fixes: 82de802ad46e ("scsi: qla2xxx: Preparation for Target MQ.") +Cc: #4.10 +Signed-off-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_target.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -3708,7 +3708,7 @@ static int qlt_term_ctio_exchange(struct + term = 1; + + if (term) +- qlt_term_ctio_exchange(qpair, ctio, cmd, status); ++ qlt_send_term_exchange(qpair, cmd, &cmd->atio, 1, 0); + + return term; + } diff --git a/queue-4.15/series b/queue-4.15/series index 4e3562869c4..6e1f3d48c34 100644 --- a/queue-4.15/series +++ b/queue-4.15/series @@ -5,3 +5,73 @@ bpf-cpumap-use-gfp_kernel-instead-of-gfp_atomic-in-__cpu_map_entry_alloc.patch ib-uverbs-improve-lockdep_check.patch mac80211_hwsim-don-t-use-wq_mem_reclaim.patch net-smc-fix-null-pointer-dereference-on-sock_create_kern-error-path.patch +regulator-stm32-vrefbuf-fix-check-on-ready-flag.patch +drm-i915-check-for-fused-or-unused-pipes.patch +drm-i915-audio-fix-check-for-av_enc_map-overflow.patch +drm-i915-fix-rsvd2-mask-when-out-fence-is-returned.patch +drm-i915-clear-the-in-use-marker-on-execbuf-failure.patch +drm-i915-disable-dc-states-around-gmbus-on-glk.patch +drm-i915-update-watermark-state-correctly-in-sanitize_watermarks.patch +drm-i915-try-edid-bitbanging-on-hdmi-after-failed-read.patch +drm-i915-perf-fix-perf-stream-opening-lock.patch +scsi-core-avoid-that-ata-error-handling-can-trigger-a-kernel-hang-or-oops.patch +scsi-qla2xxx-fix-null-pointer-crash-due-to-active-timer-for-abts.patch +drm-i915-always-call-to-intel_display_set_init_power-in-resume_early.patch +workqueue-allow-retrieval-of-current-task-s-work-struct.patch +drm-allow-determining-if-current-task-is-output-poll-worker.patch +drm-nouveau-fix-deadlock-on-runtime-suspend.patch +drm-radeon-fix-deadlock-on-runtime-suspend.patch +drm-amdgpu-fix-deadlock-on-runtime-suspend.patch +drm-nouveau-prefer-xbgr2101010-for-addfb-ioctl.patch +drm-amd-powerplay-smu7-allow-mclk-switching-with-no-displays.patch +drm-amd-powerplay-vega10-allow-mclk-switching-with-no-displays.patch +revert-drm-radeon-pm-autoswitch-power-state-when-in-balanced-mode.patch +drm-amd-display-check-for-ipp-before-calling-cursor-operations.patch +drm-radeon-insist-on-32-bit-dma-for-cedar-on-ppc64-ppc64le.patch +drm-amd-powerplay-fix-power-over-limit-on-fiji.patch +drm-amd-display-default-hdmi6g-support-to-true.-log-vbios-table-error.patch +drm-amdgpu-used-cached-pcie-gen-info-for-si-v2.patch +drm-amdgpu-notify-sbios-device-ready-before-send-request.patch +drm-radeon-fix-kv-harvesting.patch +drm-amdgpu-fix-kv-harvesting.patch +drm-amdgpu-correct-max-uvd-handles.patch +drm-amdgpu-always-save-uvd-vcpu_bo-in-vm-mode.patch +ovl-redirect_dir-nofollow-should-not-follow-redirect-for-opaque-lower.patch +mips-bmips-do-not-mask-ipis-during-suspend.patch +mips-ath25-check-for-kzalloc-allocation-failure.patch +mips-octeon-irq-check-for-null-return-on-kzalloc-allocation.patch +pci-dwc-fix-enumeration-end-when-reaching-root-subordinate.patch +input-matrix_keypad-fix-race-when-disabling-interrupts.patch +revert-input-synaptics-lenovo-thinkpad-t460p-devices-should-use-rmi.patch +bug-use-pb-in-bug-and-stack-protector-failure.patch +lib-bug.c-exclude-non-bug-warn-exceptions-from-report_bug.patch +mm-memblock.c-hardcode-the-end_pfn-being-1.patch +mm-page_alloc-fix-memmap_init_zone-pageblock-alignment.patch +documentation-sphinx-fix-directive-import-error.patch +loop-fix-lost-writes-caused-by-missing-flag.patch +virtio_ring-fix-num_free-handling-in-error-case.patch +kvm-s390-fix-memory-overwrites-when-not-using-sca-entries.patch +arm64-mm-fix-thinko-in-non-global-page-table-attribute-check.patch +ib-core-fix-missing-rdma-cgroups-release-in-case-of-failure-to-register-device.patch +revert-nvme-create-slaves-and-holders-entries-for-hidden-controllers.patch +kbuild-handle-builtin-dtb-file-names-containing-hyphens.patch +dm-bufio-avoid-false-positive-wmaybe-uninitialized-warning.patch +ib-mlx5-fix-incorrect-size-of-klms-in-the-memory-region.patch +bcache-fix-crashes-in-duplicate-cache-device-register.patch +bcache-don-t-attach-backing-with-duplicate-uuid.patch +x86-mce-save-microcode-revision-in-machine-check-records.patch +x86-mce-serialize-sysfs-changes.patch +perf-tools-fix-trigger-class-trigger_on.patch +x86-spectre_v2-don-t-check-microcode-versions-when-running-under-hypervisors.patch +alsa-hda-realtek-add-support-headset-mode-for-dell-wyse.patch +alsa-hda-realtek-add-headset-mode-support-for-dell-laptop.patch +alsa-hda-realtek-limit-mic-boost-on-t480.patch +alsa-hda-realtek-fix-dock-line-out-volume-on-dell-precision-7520.patch +alsa-hda-realtek-make-dock-sound-work-on-thinkpad-l570.patch +alsa-seq-don-t-allow-resizing-pool-in-use.patch +alsa-seq-more-protection-for-concurrent-write-and-ioctl-races.patch +alsa-hda-fix-a-wrong-fixup-for-alc289-on-dell-machines.patch +alsa-hda-add-dock-and-led-support-for-hp-elitebook-820-g3.patch +alsa-hda-add-dock-and-led-support-for-hp-probook-640-g2.patch +scsi-qla2xxx-fix-null-pointer-crash-due-to-probe-failure.patch +scsi-qla2xxx-fix-recursion-while-sending-terminate-exchange.patch diff --git a/queue-4.15/virtio_ring-fix-num_free-handling-in-error-case.patch b/queue-4.15/virtio_ring-fix-num_free-handling-in-error-case.patch new file mode 100644 index 00000000000..cf313ee6892 --- /dev/null +++ b/queue-4.15/virtio_ring-fix-num_free-handling-in-error-case.patch @@ -0,0 +1,35 @@ +From e82df670235138575b37ff0ec24412a471efd97f Mon Sep 17 00:00:00 2001 +From: Tiwei Bie +Date: Fri, 23 Feb 2018 19:41:30 +0800 +Subject: virtio_ring: fix num_free handling in error case + +From: Tiwei Bie + +commit e82df670235138575b37ff0ec24412a471efd97f upstream. + +The vq->vq.num_free hasn't been changed when error happens, +so it shouldn't be changed when handling the error. + +Fixes: 780bc7903a32 ("virtio_ring: Support DMA APIs") +Cc: Andy Lutomirski +Cc: Michael S. Tsirkin +Cc: stable@vger.kernel.org +Signed-off-by: Tiwei Bie +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/virtio/virtio_ring.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -428,8 +428,6 @@ unmap_release: + i = virtio16_to_cpu(_vq->vdev, vq->vring.desc[i].next); + } + +- vq->vq.num_free += total_sg; +- + if (indirect) + kfree(desc); + diff --git a/queue-4.15/workqueue-allow-retrieval-of-current-task-s-work-struct.patch b/queue-4.15/workqueue-allow-retrieval-of-current-task-s-work-struct.patch new file mode 100644 index 00000000000..4ae966e3e45 --- /dev/null +++ b/queue-4.15/workqueue-allow-retrieval-of-current-task-s-work-struct.patch @@ -0,0 +1,69 @@ +From 27d4ee03078aba88c5e07dcc4917e8d01d046f38 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Sun, 11 Feb 2018 10:38:28 +0100 +Subject: workqueue: Allow retrieval of current task's work struct + +From: Lukas Wunner + +commit 27d4ee03078aba88c5e07dcc4917e8d01d046f38 upstream. + +Introduce a helper to retrieve the current task's work struct if it is +a workqueue worker. + +This allows us to fix a long-standing deadlock in several DRM drivers +wherein the ->runtime_suspend callback waits for a specific worker to +finish and that worker in turn calls a function which waits for runtime +suspend to finish. That function is invoked from multiple call sites +and waiting for runtime suspend to finish is the correct thing to do +except if it's executing in the context of the worker. + +Cc: Lai Jiangshan +Cc: Dave Airlie +Cc: Ben Skeggs +Cc: Alex Deucher +Acked-by: Tejun Heo +Reviewed-by: Lyude Paul +Signed-off-by: Lukas Wunner +Link: https://patchwork.freedesktop.org/patch/msgid/2d8f603074131eb87e588d2b803a71765bd3a2fd.1518338788.git.lukas@wunner.de +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/workqueue.h | 1 + + kernel/workqueue.c | 16 ++++++++++++++++ + 2 files changed, 17 insertions(+) + +--- a/include/linux/workqueue.h ++++ b/include/linux/workqueue.h +@@ -465,6 +465,7 @@ extern bool cancel_delayed_work_sync(str + + extern void workqueue_set_max_active(struct workqueue_struct *wq, + int max_active); ++extern struct work_struct *current_work(void); + extern bool current_is_workqueue_rescuer(void); + extern bool workqueue_congested(int cpu, struct workqueue_struct *wq); + extern unsigned int work_busy(struct work_struct *work); +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -4169,6 +4169,22 @@ void workqueue_set_max_active(struct wor + EXPORT_SYMBOL_GPL(workqueue_set_max_active); + + /** ++ * current_work - retrieve %current task's work struct ++ * ++ * Determine if %current task is a workqueue worker and what it's working on. ++ * Useful to find out the context that the %current task is running in. ++ * ++ * Return: work struct if %current task is a workqueue worker, %NULL otherwise. ++ */ ++struct work_struct *current_work(void) ++{ ++ struct worker *worker = current_wq_worker(); ++ ++ return worker ? worker->current_work : NULL; ++} ++EXPORT_SYMBOL(current_work); ++ ++/** + * current_is_workqueue_rescuer - is %current workqueue rescuer? + * + * Determine whether %current is a workqueue rescuer. Can be used from diff --git a/queue-4.15/x86-mce-save-microcode-revision-in-machine-check-records.patch b/queue-4.15/x86-mce-save-microcode-revision-in-machine-check-records.patch new file mode 100644 index 00000000000..ae128e5ebfb --- /dev/null +++ b/queue-4.15/x86-mce-save-microcode-revision-in-machine-check-records.patch @@ -0,0 +1,60 @@ +From fa94d0c6e0f3431523f5701084d799c77c7d4a4f Mon Sep 17 00:00:00 2001 +From: Tony Luck +Date: Tue, 6 Mar 2018 15:21:41 +0100 +Subject: x86/MCE: Save microcode revision in machine check records + +From: Tony Luck + +commit fa94d0c6e0f3431523f5701084d799c77c7d4a4f upstream. + +Updating microcode used to be relatively rare. Now that it has become +more common we should save the microcode version in a machine check +record to make sure that those people looking at the error have this +important information bundled with the rest of the logged information. + +[ Borislav: Simplify a bit. ] + +Signed-off-by: Tony Luck +Signed-off-by: Borislav Petkov +Signed-off-by: Thomas Gleixner +Cc: Yazen Ghannam +Cc: linux-edac +Cc: stable@vger.kernel.org +Link: http://lkml.kernel.org/r/20180301233449.24311-1-tony.luck@intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/uapi/asm/mce.h | 1 + + arch/x86/kernel/cpu/mcheck/mce.c | 4 +++- + 2 files changed, 4 insertions(+), 1 deletion(-) + +--- a/arch/x86/include/uapi/asm/mce.h ++++ b/arch/x86/include/uapi/asm/mce.h +@@ -30,6 +30,7 @@ struct mce { + __u64 synd; /* MCA_SYND MSR: only valid on SMCA systems */ + __u64 ipid; /* MCA_IPID MSR: only valid on SMCA systems */ + __u64 ppin; /* Protected Processor Inventory Number */ ++ __u32 microcode;/* Microcode revision */ + }; + + #define MCE_GET_RECORD_LEN _IOR('M', 1, int) +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -131,6 +131,8 @@ void mce_setup(struct mce *m) + + if (this_cpu_has(X86_FEATURE_INTEL_PPIN)) + rdmsrl(MSR_PPIN, m->ppin); ++ ++ m->microcode = boot_cpu_data.microcode; + } + + DEFINE_PER_CPU(struct mce, injectm); +@@ -263,7 +265,7 @@ static void __print_mce(struct mce *m) + */ + pr_emerg(HW_ERR "PROCESSOR %u:%x TIME %llu SOCKET %u APIC %x microcode %x\n", + m->cpuvendor, m->cpuid, m->time, m->socketid, m->apicid, +- cpu_data(m->extcpu).microcode); ++ m->microcode); + } + + static void print_mce(struct mce *m) diff --git a/queue-4.15/x86-mce-serialize-sysfs-changes.patch b/queue-4.15/x86-mce-serialize-sysfs-changes.patch new file mode 100644 index 00000000000..a20df8321b3 --- /dev/null +++ b/queue-4.15/x86-mce-serialize-sysfs-changes.patch @@ -0,0 +1,115 @@ +From b3b7c4795ccab5be71f080774c45bbbcc75c2aaf Mon Sep 17 00:00:00 2001 +From: Seunghun Han +Date: Tue, 6 Mar 2018 15:21:43 +0100 +Subject: x86/MCE: Serialize sysfs changes + +From: Seunghun Han + +commit b3b7c4795ccab5be71f080774c45bbbcc75c2aaf upstream. + +The check_interval file in + + /sys/devices/system/machinecheck/machinecheck + +directory is a global timer value for MCE polling. If it is changed by one +CPU, mce_restart() broadcasts the event to other CPUs to delete and restart +the MCE polling timer and __mcheck_cpu_init_timer() reinitializes the +mce_timer variable. + +If more than one CPU writes a specific value to the check_interval file +concurrently, mce_timer is not protected from such concurrent accesses and +all kinds of explosions happen. Since only root can write to those sysfs +variables, the issue is not a big deal security-wise. + +However, concurrent writes to these configuration variables is void of +reason so the proper thing to do is to serialize the access with a mutex. + +Boris: + + - Make store_int_with_restart() use device_store_ulong() to filter out + negative intervals + - Limit min interval to 1 second + - Correct locking + - Massage commit message + +Signed-off-by: Seunghun Han +Signed-off-by: Borislav Petkov +Signed-off-by: Thomas Gleixner +Cc: Greg Kroah-Hartman +Cc: Tony Luck +Cc: linux-edac +Cc: stable@vger.kernel.org +Link: http://lkml.kernel.org/r/20180302202706.9434-1-kkamagui@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/mcheck/mce.c | 22 +++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -57,6 +57,9 @@ + + static DEFINE_MUTEX(mce_log_mutex); + ++/* sysfs synchronization */ ++static DEFINE_MUTEX(mce_sysfs_mutex); ++ + #define CREATE_TRACE_POINTS + #include + +@@ -2080,6 +2083,7 @@ static ssize_t set_ignore_ce(struct devi + if (kstrtou64(buf, 0, &new) < 0) + return -EINVAL; + ++ mutex_lock(&mce_sysfs_mutex); + if (mca_cfg.ignore_ce ^ !!new) { + if (new) { + /* disable ce features */ +@@ -2092,6 +2096,8 @@ static ssize_t set_ignore_ce(struct devi + on_each_cpu(mce_enable_ce, (void *)1, 1); + } + } ++ mutex_unlock(&mce_sysfs_mutex); ++ + return size; + } + +@@ -2104,6 +2110,7 @@ static ssize_t set_cmci_disabled(struct + if (kstrtou64(buf, 0, &new) < 0) + return -EINVAL; + ++ mutex_lock(&mce_sysfs_mutex); + if (mca_cfg.cmci_disabled ^ !!new) { + if (new) { + /* disable cmci */ +@@ -2115,6 +2122,8 @@ static ssize_t set_cmci_disabled(struct + on_each_cpu(mce_enable_ce, NULL, 1); + } + } ++ mutex_unlock(&mce_sysfs_mutex); ++ + return size; + } + +@@ -2122,8 +2131,19 @@ static ssize_t store_int_with_restart(st + struct device_attribute *attr, + const char *buf, size_t size) + { +- ssize_t ret = device_store_int(s, attr, buf, size); ++ unsigned long old_check_interval = check_interval; ++ ssize_t ret = device_store_ulong(s, attr, buf, size); ++ ++ if (check_interval == old_check_interval) ++ return ret; ++ ++ if (check_interval < 1) ++ check_interval = 1; ++ ++ mutex_lock(&mce_sysfs_mutex); + mce_restart(); ++ mutex_unlock(&mce_sysfs_mutex); ++ + return ret; + } + diff --git a/queue-4.15/x86-spectre_v2-don-t-check-microcode-versions-when-running-under-hypervisors.patch b/queue-4.15/x86-spectre_v2-don-t-check-microcode-versions-when-running-under-hypervisors.patch new file mode 100644 index 00000000000..1dbd226b61b --- /dev/null +++ b/queue-4.15/x86-spectre_v2-don-t-check-microcode-versions-when-running-under-hypervisors.patch @@ -0,0 +1,57 @@ +From 36268223c1e9981d6cfc33aff8520b3bde4b8114 Mon Sep 17 00:00:00 2001 +From: Konrad Rzeszutek Wilk +Date: Mon, 26 Feb 2018 09:35:01 -0500 +Subject: x86/spectre_v2: Don't check microcode versions when running under hypervisors +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Konrad Rzeszutek Wilk + +commit 36268223c1e9981d6cfc33aff8520b3bde4b8114 upstream. + +As: + + 1) It's known that hypervisors lie about the environment anyhow (host + mismatch) + + 2) Even if the hypervisor (Xen, KVM, VMWare, etc) provided a valid + "correct" value, it all gets to be very murky when migration happens + (do you provide the "new" microcode of the machine?). + +And in reality the cloud vendors are the ones that should make sure that +the microcode that is running is correct and we should just sing lalalala +and trust them. + +Signed-off-by: Konrad Rzeszutek Wilk +Signed-off-by: Thomas Gleixner +Reviewed-by: Paolo Bonzini +Cc: Wanpeng Li +Cc: kvm +Cc: Krčmář +Cc: Borislav Petkov +CC: "H. Peter Anvin" +CC: stable@vger.kernel.org +Link: https://lkml.kernel.org/r/20180226213019.GE9497@char.us.oracle.com +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/intel.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/arch/x86/kernel/cpu/intel.c ++++ b/arch/x86/kernel/cpu/intel.c +@@ -144,6 +144,13 @@ static bool bad_spectre_microcode(struct + { + int i; + ++ /* ++ * We know that the hypervisor lie to us on the microcode version so ++ * we may as well hope that it is running the correct version. ++ */ ++ if (cpu_has(c, X86_FEATURE_HYPERVISOR)) ++ return false; ++ + for (i = 0; i < ARRAY_SIZE(spectre_bad_microcodes); i++) { + if (c->x86_model == spectre_bad_microcodes[i].model && + c->x86_stepping == spectre_bad_microcodes[i].stepping) -- 2.47.3