From fe709bf452e420d15fdcb6bffe97824eea66f40d Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 12 Sep 2018 21:41:00 +0200 Subject: [PATCH] 4.14-stable patches added patches: drm-i915-increase-lspcon-timeout.patch hid-add-quirk-for-another-pixart-oem-mouse-used-by-hp.patch lightnvm-pblk-free-padded-entries-in-write-buffer.patch mm-fix-devm_memremap_pages-collision-handling.patch sched-deadline-fix-switching-to-deadline.patch usb-dwc3-core-fix-ulpi-phys-and-prevent-phy_get-ulpi_init-during-suspend-resume.patch x86-pae-use-64-bit-atomic-xchg-function-in-native_ptep_get_and_clear.patch x86-xen-don-t-write-ptes-directly-in-32-bit-pv-guests.patch --- .../drm-i915-increase-lspcon-timeout.patch | 56 ++++++ ...-another-pixart-oem-mouse-used-by-hp.patch | 60 +++++++ ...-free-padded-entries-in-write-buffer.patch | 66 +++++++ ...vm_memremap_pages-collision-handling.patch | 70 ++++++++ ...d-deadline-fix-switching-to-deadline.patch | 73 ++++++++ queue-4.14/series | 8 + ..._get-ulpi_init-during-suspend-resume.patch | 166 ++++++++++++++++++ ...unction-in-native_ptep_get_and_clear.patch | 62 +++++++ ...te-ptes-directly-in-32-bit-pv-guests.patch | 53 ++++++ 9 files changed, 614 insertions(+) create mode 100644 queue-4.14/drm-i915-increase-lspcon-timeout.patch create mode 100644 queue-4.14/hid-add-quirk-for-another-pixart-oem-mouse-used-by-hp.patch create mode 100644 queue-4.14/lightnvm-pblk-free-padded-entries-in-write-buffer.patch create mode 100644 queue-4.14/mm-fix-devm_memremap_pages-collision-handling.patch create mode 100644 queue-4.14/sched-deadline-fix-switching-to-deadline.patch create mode 100644 queue-4.14/usb-dwc3-core-fix-ulpi-phys-and-prevent-phy_get-ulpi_init-during-suspend-resume.patch create mode 100644 queue-4.14/x86-pae-use-64-bit-atomic-xchg-function-in-native_ptep_get_and_clear.patch create mode 100644 queue-4.14/x86-xen-don-t-write-ptes-directly-in-32-bit-pv-guests.patch diff --git a/queue-4.14/drm-i915-increase-lspcon-timeout.patch b/queue-4.14/drm-i915-increase-lspcon-timeout.patch new file mode 100644 index 00000000000..eb812f3edfd --- /dev/null +++ b/queue-4.14/drm-i915-increase-lspcon-timeout.patch @@ -0,0 +1,56 @@ +From 299c2a904b1e8d5096d4813df6371357d97a6cd1 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Fredrik=20Sch=C3=B6n?= +Date: Fri, 17 Aug 2018 22:07:28 +0200 +Subject: drm/i915: Increase LSPCON timeout +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fredrik Schön + +commit 299c2a904b1e8d5096d4813df6371357d97a6cd1 upstream. + +100 ms is not enough time for the LSPCON adapter on Intel NUC devices to +settle. This causes dropped display modes at boot or screen reconfiguration. +Empirical testing can reproduce the error up to a timeout of 190 ms. Basic +boot and stress testing at 200 ms has not (yet) failed. + +Increase timeout to 400 ms to get some margin of error. + +Changes from v1: +The initial suggestion of 1000 ms was lowered due to concerns about delaying +valid timeout cases. +Update patch metadata. + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107503 +Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1570392 +Fixes: 357c0ae9198a ("drm/i915/lspcon: Wait for expected LSPCON mode to settle") +Cc: Shashank Sharma +Cc: Imre Deak +Cc: Jani Nikula +Cc: # v4.11+ +Reviewed-by: Rodrigo Vivi +Reviewed-by: Shashank Sharma +Signed-off-by: Fredrik Schön +Signed-off-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20180817200728.8154-1-fredrik.schon@gmail.com +(cherry picked from commit 59f1c8ab30d6f9042562949f42cbd3f3cf69de94) +Signed-off-by: Rodrigo Vivi +Reviewed-by: Shashank Sharma +Signed-off-by: Fredrik Schön +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/intel_lspcon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/intel_lspcon.c ++++ b/drivers/gpu/drm/i915/intel_lspcon.c +@@ -75,7 +75,7 @@ static enum drm_lspcon_mode lspcon_wait_ + lspcon_mode_name(mode)); + + wait_for((current_mode = lspcon_get_current_mode(lspcon)) == mode || +- current_mode == DRM_LSPCON_MODE_INVALID, 100); ++ current_mode == DRM_LSPCON_MODE_INVALID, 400); + if (current_mode != mode) + DRM_DEBUG_KMS("LSPCON mode hasn't settled\n"); + diff --git a/queue-4.14/hid-add-quirk-for-another-pixart-oem-mouse-used-by-hp.patch b/queue-4.14/hid-add-quirk-for-another-pixart-oem-mouse-used-by-hp.patch new file mode 100644 index 00000000000..912809fc51b --- /dev/null +++ b/queue-4.14/hid-add-quirk-for-another-pixart-oem-mouse-used-by-hp.patch @@ -0,0 +1,60 @@ +From 01cffe9ded15c0d664e0beb33c594e00c0d57bba Mon Sep 17 00:00:00 2001 +From: Dave Young +Date: Fri, 1 Dec 2017 20:19:34 +0800 +Subject: HID: add quirk for another PIXART OEM mouse used by HP + +From: Dave Young + +commit 01cffe9ded15c0d664e0beb33c594e00c0d57bba upstream. + +This mouse keep disconnecting in runleve 3 like below, add it needs the +quirk to mute the anoying messages. + +[ 111.230555] usb 2-2: USB disconnect, device number 6 +[ 112.718156] usb 2-2: new low-speed USB device number 7 using xhci_hcd +[ 112.941594] usb 2-2: New USB device found, idVendor=03f0, idProduct=094a +[ 112.984866] usb 2-2: New USB device strings: Mfr=1, Product=2, SerialNumber=0 +[ 113.027731] usb 2-2: Product: HP USB Optical Mouse +[ 113.069977] usb 2-2: Manufacturer: PixArt +[ 113.113500] input: PixArt HP USB Optical Mouse as /devices/pci0000:00/0000:00:14.0/usb2/2-2/2-2:1.0/0003:03F0:094A.0002/input/input14 +[ 113.156787] hid-generic 0003:03F0:094A.0002: input: USB HID v1.11 Mouse [PixArt HP USB Optical Mouse] on usb-0000:00:14.0-2/input0 +[ 173.262642] usb 2-2: USB disconnect, device number 7 +[ 174.750244] usb 2-2: new low-speed USB device number 8 using xhci_hcd +[ 174.935740] usb 2-2: New USB device found, idVendor=03f0, idProduct=094a +[ 174.990435] usb 2-2: New USB device strings: Mfr=1, Product=2, SerialNumber=0 +[ 175.014984] usb 2-2: Product: HP USB Optical Mouse +[ 175.037886] usb 2-2: Manufacturer: PixArt +[ 175.061794] input: PixArt HP USB Optical Mouse as /devices/pci0000:00/0000:00:14.0/usb2/2-2/2-2:1.0/0003:03F0:094A.0003/input/input15 +[ 175.084946] hid-generic 0003:03F0:094A.0003: input: USB HID v1.11 Mouse [PixArt HP USB Optical Mouse] on usb-0000:00:14.0-2/input0 + +Signed-off-by: Dave Young +Cc: stable@vger.kernel.org +Reviewed-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Sudip Mukherjee +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/usbhid/hid-quirks.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -528,6 +528,7 @@ + #define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A 0x0a4a + #define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A 0x0b4a + #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE 0x134a ++#define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A 0x094a + + #define USB_VENDOR_ID_HUION 0x256c + #define USB_DEVICE_ID_HUION_TABLET 0x006e +--- a/drivers/hid/usbhid/hid-quirks.c ++++ b/drivers/hid/usbhid/hid-quirks.c +@@ -99,6 +99,7 @@ static const struct hid_blacklist { + { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A, HID_QUIRK_ALWAYS_POLL }, + { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A, HID_QUIRK_ALWAYS_POLL }, + { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL }, ++ { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A, HID_QUIRK_ALWAYS_POLL }, + { USB_VENDOR_ID_IDEACOM, USB_DEVICE_ID_IDEACOM_IDC6680, HID_QUIRK_MULTI_INPUT }, + { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C007, HID_QUIRK_ALWAYS_POLL }, + { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077, HID_QUIRK_ALWAYS_POLL }, diff --git a/queue-4.14/lightnvm-pblk-free-padded-entries-in-write-buffer.patch b/queue-4.14/lightnvm-pblk-free-padded-entries-in-write-buffer.patch new file mode 100644 index 00000000000..df1b7189d69 --- /dev/null +++ b/queue-4.14/lightnvm-pblk-free-padded-entries-in-write-buffer.patch @@ -0,0 +1,66 @@ +From cd8ddbf7a5e206fe6995ab0aee245d597dd6a7f2 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Javier=20Gonz=C3=A1lez?= +Date: Fri, 13 Oct 2017 14:46:03 +0200 +Subject: lightnvm: pblk: free padded entries in write buffer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Javier González + +commit cd8ddbf7a5e206fe6995ab0aee245d597dd6a7f2 upstream. + +When a REQ_FLUSH reaches pblk, the bio cannot be directly completed. +Instead, data on the write buffer is flushed and the bio is completed on +the completion pah. This might require some sectors to be padded in +order to guarantee a successful write. + +This patch fixes a memory leak on the padded pages. A consequence of +this bad free was that internal bios not containing data (only a flush) +were not being completed. + +Fixes: a4bd217b4326 ("lightnvm: physical block device (pblk) target") +Signed-off-by: Javier González +Signed-off-by: Matias Bjørling +Signed-off-by: Jens Axboe +Signed-off-by: Sudip Mukherjee +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/lightnvm/pblk-core.c | 1 - + drivers/lightnvm/pblk-write.c | 7 ++++++- + 2 files changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/lightnvm/pblk-core.c ++++ b/drivers/lightnvm/pblk-core.c +@@ -190,7 +190,6 @@ void pblk_bio_free_pages(struct pblk *pb + + WARN_ON(off + nr_pages != bio->bi_vcnt); + +- bio_advance(bio, off * PBLK_EXPOSED_PAGE_SIZE); + for (i = off; i < nr_pages + off; i++) { + bv = bio->bi_io_vec[i]; + mempool_free(bv.bv_page, pblk->page_bio_pool); +--- a/drivers/lightnvm/pblk-write.c ++++ b/drivers/lightnvm/pblk-write.c +@@ -33,6 +33,10 @@ static unsigned long pblk_end_w_bio(stru + bio_endio(original_bio); + } + ++ if (c_ctx->nr_padded) ++ pblk_bio_free_pages(pblk, rqd->bio, c_ctx->nr_valid, ++ c_ctx->nr_padded); ++ + #ifdef CONFIG_NVM_DEBUG + atomic_long_add(c_ctx->nr_valid, &pblk->sync_writes); + #endif +@@ -521,7 +525,8 @@ static void pblk_free_write_rqd(struct p + struct bio *bio = rqd->bio; + + if (c_ctx->nr_padded) +- pblk_bio_free_pages(pblk, bio, rqd->nr_ppas, c_ctx->nr_padded); ++ pblk_bio_free_pages(pblk, bio, c_ctx->nr_valid, ++ c_ctx->nr_padded); + } + + static int pblk_submit_write(struct pblk *pblk) diff --git a/queue-4.14/mm-fix-devm_memremap_pages-collision-handling.patch b/queue-4.14/mm-fix-devm_memremap_pages-collision-handling.patch new file mode 100644 index 00000000000..a590e9eea32 --- /dev/null +++ b/queue-4.14/mm-fix-devm_memremap_pages-collision-handling.patch @@ -0,0 +1,70 @@ +From 77dd66a3c67c93ab401ccc15efff25578be281fd Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20H=2E=20Sch=C3=B6nherr?= +Date: Fri, 19 Jan 2018 16:26:33 -0800 +Subject: mm: Fix devm_memremap_pages() collision handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jan H. Schönherr + +commit 77dd66a3c67c93ab401ccc15efff25578be281fd upstream. + +If devm_memremap_pages() detects a collision while adding entries +to the radix-tree, we call pgmap_radix_release(). Unfortunately, +the function removes *all* entries for the range -- including the +entries that caused the collision in the first place. + +Modify pgmap_radix_release() to take an additional argument to +indicate where to stop, so that only newly added entries are removed +from the tree. + +Cc: +Fixes: 9476df7d80df ("mm: introduce find_dev_pagemap()") +Signed-off-by: Jan H. Schönherr +Signed-off-by: Dan Williams +Signed-off-by: Sudip Mukherjee +Signed-off-by: Greg Kroah-Hartman +--- + kernel/memremap.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/kernel/memremap.c ++++ b/kernel/memremap.c +@@ -248,13 +248,16 @@ int device_private_entry_fault(struct vm + EXPORT_SYMBOL(device_private_entry_fault); + #endif /* CONFIG_DEVICE_PRIVATE */ + +-static void pgmap_radix_release(struct resource *res) ++static void pgmap_radix_release(struct resource *res, unsigned long end_pgoff) + { + unsigned long pgoff, order; + + mutex_lock(&pgmap_lock); +- foreach_order_pgoff(res, order, pgoff) ++ foreach_order_pgoff(res, order, pgoff) { ++ if (pgoff >= end_pgoff) ++ break; + radix_tree_delete(&pgmap_radix, PHYS_PFN(res->start) + pgoff); ++ } + mutex_unlock(&pgmap_lock); + + synchronize_rcu(); +@@ -309,7 +312,7 @@ static void devm_memremap_pages_release( + mem_hotplug_done(); + + untrack_pfn(NULL, PHYS_PFN(align_start), align_size); +- pgmap_radix_release(res); ++ pgmap_radix_release(res, -1); + dev_WARN_ONCE(dev, pgmap->altmap && pgmap->altmap->alloc, + "%s: failed to free all reserved pages\n", __func__); + } +@@ -459,7 +462,7 @@ void *devm_memremap_pages(struct device + untrack_pfn(NULL, PHYS_PFN(align_start), align_size); + err_pfn_remap: + err_radix: +- pgmap_radix_release(res); ++ pgmap_radix_release(res, pgoff); + devres_free(page_map); + return ERR_PTR(error); + } diff --git a/queue-4.14/sched-deadline-fix-switching-to-deadline.patch b/queue-4.14/sched-deadline-fix-switching-to-deadline.patch new file mode 100644 index 00000000000..3d0f0cb4134 --- /dev/null +++ b/queue-4.14/sched-deadline-fix-switching-to-deadline.patch @@ -0,0 +1,73 @@ +From 295d6d5e373607729bcc8182c25afe964655714f Mon Sep 17 00:00:00 2001 +From: Luca Abeni +Date: Thu, 7 Sep 2017 12:09:29 +0200 +Subject: sched/deadline: Fix switching to -deadline + +From: Luca Abeni + +commit 295d6d5e373607729bcc8182c25afe964655714f upstream. + +Fix a bug introduced in: + + 72f9f3fdc928 ("sched/deadline: Remove dl_new from struct sched_dl_entity") + +After that commit, when switching to -deadline if the scheduling +deadline of a task is in the past then switched_to_dl() calls +setup_new_entity() to properly initialize the scheduling deadline +and runtime. + +The problem is that the task is enqueued _before_ having its parameters +initialized by setup_new_entity(), and this can cause problems. +For example, a task with its out-of-date deadline in the past will +potentially be enqueued as the highest priority one; however, its +adjusted deadline may not be the earliest one. + +This patch fixes the problem by initializing the task's parameters before +enqueuing it. + +Signed-off-by: luca abeni +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Daniel Bristot de Oliveira +Cc: Juri Lelli +Cc: Linus Torvalds +Cc: Mathieu Poirier +Cc: Mike Galbraith +Cc: Peter Zijlstra +Cc: Steven Rostedt +Cc: Thomas Gleixner +Link: http://lkml.kernel.org/r/1504778971-13573-3-git-send-email-luca.abeni@santannapisa.it +Signed-off-by: Ingo Molnar +Signed-off-by: Sudip Mukherjee +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/sched/deadline.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +--- a/kernel/sched/deadline.c ++++ b/kernel/sched/deadline.c +@@ -1365,6 +1365,10 @@ enqueue_dl_entity(struct sched_dl_entity + update_dl_entity(dl_se, pi_se); + } else if (flags & ENQUEUE_REPLENISH) { + replenish_dl_entity(dl_se, pi_se); ++ } else if ((flags & ENQUEUE_RESTORE) && ++ dl_time_before(dl_se->deadline, ++ rq_clock(rq_of_dl_rq(dl_rq_of_se(dl_se))))) { ++ setup_new_dl_entity(dl_se); + } + + __enqueue_dl_entity(dl_se); +@@ -2256,13 +2260,6 @@ static void switched_to_dl(struct rq *rq + + return; + } +- /* +- * If p is boosted we already updated its params in +- * rt_mutex_setprio()->enqueue_task(..., ENQUEUE_REPLENISH), +- * p's deadline being now already after rq_clock(rq). +- */ +- if (dl_time_before(p->dl.deadline, rq_clock(rq))) +- setup_new_dl_entity(&p->dl); + + if (rq->curr != p) { + #ifdef CONFIG_SMP diff --git a/queue-4.14/series b/queue-4.14/series index dfcd0fbcf73..7c38abd7c7b 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -94,3 +94,11 @@ drm-amdgpu-add-vcn-support-in-psp-driver.patch drm-amdgpu-add-vcn-booting-with-firmware-loaded-by-psp.patch uapi-linux-keyctl.h-don-t-use-c-reserved-keyword-as-a-struct-member-name.patch debugobjects-make-stack-check-warning-more-informative.patch +sched-deadline-fix-switching-to-deadline.patch +lightnvm-pblk-free-padded-entries-in-write-buffer.patch +mm-fix-devm_memremap_pages-collision-handling.patch +hid-add-quirk-for-another-pixart-oem-mouse-used-by-hp.patch +usb-dwc3-core-fix-ulpi-phys-and-prevent-phy_get-ulpi_init-during-suspend-resume.patch +x86-pae-use-64-bit-atomic-xchg-function-in-native_ptep_get_and_clear.patch +x86-xen-don-t-write-ptes-directly-in-32-bit-pv-guests.patch +drm-i915-increase-lspcon-timeout.patch diff --git a/queue-4.14/usb-dwc3-core-fix-ulpi-phys-and-prevent-phy_get-ulpi_init-during-suspend-resume.patch b/queue-4.14/usb-dwc3-core-fix-ulpi-phys-and-prevent-phy_get-ulpi_init-during-suspend-resume.patch new file mode 100644 index 00000000000..8211aa9a895 --- /dev/null +++ b/queue-4.14/usb-dwc3-core-fix-ulpi-phys-and-prevent-phy_get-ulpi_init-during-suspend-resume.patch @@ -0,0 +1,166 @@ +From 98112041bcca164676367e261c8c1073ef70cb51 Mon Sep 17 00:00:00 2001 +From: Roger Quadros +Date: Mon, 12 Feb 2018 15:30:08 +0200 +Subject: usb: dwc3: core: Fix ULPI PHYs and prevent phy_get/ulpi_init during suspend/resume + +From: Roger Quadros + +commit 98112041bcca164676367e261c8c1073ef70cb51 upstream. + +In order for ULPI PHYs to work, dwc3_phy_setup() and dwc3_ulpi_init() +must be doene before dwc3_core_get_phy(). + +commit 541768b08a40 ("usb: dwc3: core: Call dwc3_core_get_phy() before initializing phys") +broke this. + +The other issue is that dwc3_core_get_phy() and dwc3_ulpi_init() should +be called only once during the life cycle of the driver. However, +as dwc3_core_init() is called during system suspend/resume it will +result in multiple calls to dwc3_core_get_phy() and dwc3_ulpi_init() +which is wrong. + +Fix this by moving dwc3_ulpi_init() out of dwc3_phy_setup() +into dwc3_core_ulpi_init(). Use a flag 'ulpi_ready' to ensure that +dwc3_core_ulpi_init() is called only once from dwc3_core_init(). + +Use another flag 'phys_ready' to call dwc3_core_get_phy() only once from +dwc3_core_init(). + +Fixes: 541768b08a40 ("usb: dwc3: core: Call dwc3_core_get_phy() before initializing phys") +Fixes: f54edb539c11 ("usb: dwc3: core: initialize ULPI before trying to get the PHY") +Cc: linux-stable # >= v4.13 +Signed-off-by: Roger Quadros +Signed-off-by: Felipe Balbi +Signed-off-by: Sudip Mukherjee +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.c | 47 ++++++++++++++++++++++++++++++++++++----------- + drivers/usb/dwc3/core.h | 5 +++++ + 2 files changed, 41 insertions(+), 11 deletions(-) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -511,6 +511,22 @@ static void dwc3_cache_hwparams(struct d + parms->hwparams8 = dwc3_readl(dwc->regs, DWC3_GHWPARAMS8); + } + ++static int dwc3_core_ulpi_init(struct dwc3 *dwc) ++{ ++ int intf; ++ int ret = 0; ++ ++ intf = DWC3_GHWPARAMS3_HSPHY_IFC(dwc->hwparams.hwparams3); ++ ++ if (intf == DWC3_GHWPARAMS3_HSPHY_IFC_ULPI || ++ (intf == DWC3_GHWPARAMS3_HSPHY_IFC_UTMI_ULPI && ++ dwc->hsphy_interface && ++ !strncmp(dwc->hsphy_interface, "ulpi", 4))) ++ ret = dwc3_ulpi_init(dwc); ++ ++ return ret; ++} ++ + /** + * dwc3_phy_setup - Configure USB PHY Interface of DWC3 Core + * @dwc: Pointer to our controller context structure +@@ -522,7 +538,6 @@ static void dwc3_cache_hwparams(struct d + static int dwc3_phy_setup(struct dwc3 *dwc) + { + u32 reg; +- int ret; + + reg = dwc3_readl(dwc->regs, DWC3_GUSB3PIPECTL(0)); + +@@ -593,9 +608,6 @@ static int dwc3_phy_setup(struct dwc3 *d + } + /* FALLTHROUGH */ + case DWC3_GHWPARAMS3_HSPHY_IFC_ULPI: +- ret = dwc3_ulpi_init(dwc); +- if (ret) +- return ret; + /* FALLTHROUGH */ + default: + break; +@@ -752,6 +764,7 @@ static void dwc3_core_setup_global_contr + } + + static int dwc3_core_get_phy(struct dwc3 *dwc); ++static int dwc3_core_ulpi_init(struct dwc3 *dwc); + + /** + * dwc3_core_init - Low-level initialization of DWC3 Core +@@ -783,17 +796,27 @@ static int dwc3_core_init(struct dwc3 *d + dwc->maximum_speed = USB_SPEED_HIGH; + } + +- ret = dwc3_core_get_phy(dwc); ++ ret = dwc3_phy_setup(dwc); + if (ret) + goto err0; + +- ret = dwc3_core_soft_reset(dwc); +- if (ret) +- goto err0; ++ if (!dwc->ulpi_ready) { ++ ret = dwc3_core_ulpi_init(dwc); ++ if (ret) ++ goto err0; ++ dwc->ulpi_ready = true; ++ } + +- ret = dwc3_phy_setup(dwc); ++ if (!dwc->phys_ready) { ++ ret = dwc3_core_get_phy(dwc); ++ if (ret) ++ goto err0a; ++ dwc->phys_ready = true; ++ } ++ ++ ret = dwc3_core_soft_reset(dwc); + if (ret) +- goto err0; ++ goto err0a; + + dwc3_core_setup_global_control(dwc); + dwc3_core_num_eps(dwc); +@@ -866,6 +889,9 @@ err1: + phy_exit(dwc->usb2_generic_phy); + phy_exit(dwc->usb3_generic_phy); + ++err0a: ++ dwc3_ulpi_exit(dwc); ++ + err0: + return ret; + } +@@ -1256,7 +1282,6 @@ err4: + + err3: + dwc3_free_event_buffers(dwc); +- dwc3_ulpi_exit(dwc); + + err2: + pm_runtime_allow(&pdev->dev); +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -805,7 +805,9 @@ struct dwc3_scratchpad_array { + * @usb3_phy: pointer to USB3 PHY + * @usb2_generic_phy: pointer to USB2 PHY + * @usb3_generic_phy: pointer to USB3 PHY ++ * @phys_ready: flag to indicate that PHYs are ready + * @ulpi: pointer to ulpi interface ++ * @ulpi_ready: flag to indicate that ULPI is initialized + * @isoch_delay: wValue from Set Isochronous Delay request; + * @u2sel: parameter from Set SEL request. + * @u2pel: parameter from Set SEL request. +@@ -903,7 +905,10 @@ struct dwc3 { + struct phy *usb2_generic_phy; + struct phy *usb3_generic_phy; + ++ bool phys_ready; ++ + struct ulpi *ulpi; ++ bool ulpi_ready; + + void __iomem *regs; + size_t regs_size; diff --git a/queue-4.14/x86-pae-use-64-bit-atomic-xchg-function-in-native_ptep_get_and_clear.patch b/queue-4.14/x86-pae-use-64-bit-atomic-xchg-function-in-native_ptep_get_and_clear.patch new file mode 100644 index 00000000000..4d761679bb2 --- /dev/null +++ b/queue-4.14/x86-pae-use-64-bit-atomic-xchg-function-in-native_ptep_get_and_clear.patch @@ -0,0 +1,62 @@ +From b2d7a075a1ccef2fb321d595802190c8e9b39004 Mon Sep 17 00:00:00 2001 +From: Juergen Gross +Date: Tue, 21 Aug 2018 17:37:55 +0200 +Subject: x86/pae: use 64 bit atomic xchg function in native_ptep_get_and_clear + +From: Juergen Gross + +commit b2d7a075a1ccef2fb321d595802190c8e9b39004 upstream. + +Using only 32-bit writes for the pte will result in an intermediate +L1TF vulnerable PTE. When running as a Xen PV guest this will at once +switch the guest to shadow mode resulting in a loss of performance. + +Use arch_atomic64_xchg() instead which will perform the requested +operation atomically with all 64 bits. + +Some performance considerations according to: + +https://software.intel.com/sites/default/files/managed/ad/dc/Intel-Xeon-Scalable-Processor-throughput-latency.pdf + +The main number should be the latency, as there is no tight loop around +native_ptep_get_and_clear(). + +"lock cmpxchg8b" has a latency of 20 cycles, while "lock xchg" (with a +memory operand) isn't mentioned in that document. "lock xadd" (with xadd +having 3 cycles less latency than xchg) has a latency of 11, so we can +assume a latency of 14 for "lock xchg". + +Signed-off-by: Juergen Gross +Reviewed-by: Thomas Gleixner +Reviewed-by: Jan Beulich +Tested-by: Jason Andryuk +Signed-off-by: Boris Ostrovsky +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/pgtable-3level.h | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/arch/x86/include/asm/pgtable-3level.h ++++ b/arch/x86/include/asm/pgtable-3level.h +@@ -2,6 +2,8 @@ + #ifndef _ASM_X86_PGTABLE_3LEVEL_H + #define _ASM_X86_PGTABLE_3LEVEL_H + ++#include ++ + /* + * Intel Physical Address Extension (PAE) Mode - three-level page + * tables on PPro+ CPUs. +@@ -147,10 +149,7 @@ static inline pte_t native_ptep_get_and_ + { + pte_t res; + +- /* xchg acts as a barrier before the setting of the high bits */ +- res.pte_low = xchg(&ptep->pte_low, 0); +- res.pte_high = ptep->pte_high; +- ptep->pte_high = 0; ++ res.pte = (pteval_t)arch_atomic64_xchg((atomic64_t *)ptep, 0); + + return res; + } diff --git a/queue-4.14/x86-xen-don-t-write-ptes-directly-in-32-bit-pv-guests.patch b/queue-4.14/x86-xen-don-t-write-ptes-directly-in-32-bit-pv-guests.patch new file mode 100644 index 00000000000..5dbce54274e --- /dev/null +++ b/queue-4.14/x86-xen-don-t-write-ptes-directly-in-32-bit-pv-guests.patch @@ -0,0 +1,53 @@ +From f7c90c2aa4004808dff777ba6ae2c7294dd06851 Mon Sep 17 00:00:00 2001 +From: Juergen Gross +Date: Tue, 21 Aug 2018 17:37:54 +0200 +Subject: x86/xen: don't write ptes directly in 32-bit PV guests + +From: Juergen Gross + +commit f7c90c2aa4004808dff777ba6ae2c7294dd06851 upstream. + +In some cases 32-bit PAE PV guests still write PTEs directly instead of +using hypercalls. This is especially bad when clearing a PTE as this is +done via 32-bit writes which will produce intermediate L1TF attackable +PTEs. + +Change the code to use hypercalls instead. + +Signed-off-by: Juergen Gross +Reviewed-by: Jan Beulich +Signed-off-by: Boris Ostrovsky +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/xen/mmu_pv.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/arch/x86/xen/mmu_pv.c ++++ b/arch/x86/xen/mmu_pv.c +@@ -425,14 +425,13 @@ static void xen_set_pud(pud_t *ptr, pud_ + static void xen_set_pte_atomic(pte_t *ptep, pte_t pte) + { + trace_xen_mmu_set_pte_atomic(ptep, pte); +- set_64bit((u64 *)ptep, native_pte_val(pte)); ++ __xen_set_pte(ptep, pte); + } + + static void xen_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep) + { + trace_xen_mmu_pte_clear(mm, addr, ptep); +- if (!xen_batched_set_pte(ptep, native_make_pte(0))) +- native_pte_clear(mm, addr, ptep); ++ __xen_set_pte(ptep, native_make_pte(0)); + } + + static void xen_pmd_clear(pmd_t *pmdp) +@@ -1543,7 +1542,7 @@ static void __init xen_set_pte_init(pte_ + pte = __pte_ma(((pte_val_ma(*ptep) & _PAGE_RW) | ~_PAGE_RW) & + pte_val_ma(pte)); + #endif +- native_set_pte(ptep, pte); ++ __xen_set_pte(ptep, pte); + } + + /* Early in boot, while setting up the initial pagetable, assume -- 2.47.2