--- /dev/null
+From 322f74ede933b3e2cb78768b6a6fdbfbf478a0c1 Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Fri, 22 Dec 2017 11:17:44 +0800
+Subject: ALSA: hda - Add MIC_NO_PRESENCE fixup for 2 HP machines
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit 322f74ede933b3e2cb78768b6a6fdbfbf478a0c1 upstream.
+
+There is a headset jack on the front panel, when we plug a headset
+into it, the headset mic can't trigger unsol events, and
+read_pin_sense() can't detect its presence too. So add this fixup
+to fix this issue.
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_conexant.c | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -271,6 +271,8 @@ enum {
+ CXT_FIXUP_HP_SPECTRE,
+ CXT_FIXUP_HP_GATE_MIC,
+ CXT_FIXUP_MUTE_LED_GPIO,
++ CXT_FIXUP_HEADSET_MIC,
++ CXT_FIXUP_HP_MIC_NO_PRESENCE,
+ };
+
+ /* for hda_fixup_thinkpad_acpi() */
+@@ -350,6 +352,18 @@ static void cxt_fixup_headphone_mic(stru
+ }
+ }
+
++static void cxt_fixup_headset_mic(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ struct conexant_spec *spec = codec->spec;
++
++ switch (action) {
++ case HDA_FIXUP_ACT_PRE_PROBE:
++ spec->parse_flags |= HDA_PINCFG_HEADSET_MIC;
++ break;
++ }
++}
++
+ /* OPLC XO 1.5 fixup */
+
+ /* OLPC XO-1.5 supports DC input mode (e.g. for use with analog sensors)
+@@ -880,6 +894,19 @@ static const struct hda_fixup cxt_fixups
+ .type = HDA_FIXUP_FUNC,
+ .v.func = cxt_fixup_mute_led_gpio,
+ },
++ [CXT_FIXUP_HEADSET_MIC] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = cxt_fixup_headset_mic,
++ },
++ [CXT_FIXUP_HP_MIC_NO_PRESENCE] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x1a, 0x02a1113c },
++ { }
++ },
++ .chained = true,
++ .chain_id = CXT_FIXUP_HEADSET_MIC,
++ },
+ };
+
+ static const struct snd_pci_quirk cxt5045_fixups[] = {
+@@ -934,6 +961,8 @@ static const struct snd_pci_quirk cxt506
+ SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC),
+ SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO),
+ SND_PCI_QUIRK(0x103c, 0x822e, "HP ProBook 440 G4", CXT_FIXUP_MUTE_LED_GPIO),
++ SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN),
+ SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO),
+ SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
--- /dev/null
+From 8da5bbfc7cbba909f4f32d5e1dda3750baa5d853 Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Fri, 22 Dec 2017 11:17:46 +0800
+Subject: ALSA: hda - change the location for one mic on a Lenovo machine
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit 8da5bbfc7cbba909f4f32d5e1dda3750baa5d853 upstream.
+
+There are two front mics on this machine, and current driver assign
+the same name Mic to both of them, but pulseaudio can't handle them.
+As a workaround, we change the location for one of them, then the
+driver will assign "Front Mic" and "Mic" for them.
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6305,6 +6305,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
++ SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+ SND_PCI_QUIRK(0x17aa, 0x3112, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
+ SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
--- /dev/null
+From a36c2638380c0a4676647a1f553b70b20d3ebce1 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 22 Dec 2017 10:45:07 +0100
+Subject: ALSA: hda: Drop useless WARN_ON()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit a36c2638380c0a4676647a1f553b70b20d3ebce1 upstream.
+
+Since the commit 97cc2ed27e5a ("ALSA: hda - Fix yet another i915
+pointer leftover in error path") cleared hdac_acomp pointer, the
+WARN_ON() non-NULL check in snd_hdac_i915_register_notifier() may give
+a false-positive warning, as the function gets called no matter
+whether the component is registered or not. For fixing it, let's get
+rid of the spurious WARN_ON().
+
+Fixes: 97cc2ed27e5a ("ALSA: hda - Fix yet another i915 pointer leftover in error path")
+Reported-by: Kouta Okamoto <kouta.okamoto@toshiba.co.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/hda/hdac_i915.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/hda/hdac_i915.c
++++ b/sound/hda/hdac_i915.c
+@@ -325,7 +325,7 @@ static int hdac_component_master_match(s
+ */
+ int snd_hdac_i915_register_notifier(const struct i915_audio_component_audio_ops *aops)
+ {
+- if (WARN_ON(!hdac_acomp))
++ if (!hdac_acomp)
+ return -ENODEV;
+
+ hdac_acomp->audio_ops = aops;
--- /dev/null
+From 285d5ddcffafa5d5e68c586f4c9eaa8b24a2897d Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Fri, 22 Dec 2017 11:17:45 +0800
+Subject: ALSA: hda - fix headset mic detection issue on a Dell machine
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit 285d5ddcffafa5d5e68c586f4c9eaa8b24a2897d upstream.
+
+It has the codec alc256, and add its pin definition to pin quirk
+table to let it apply ALC255_FIXUP_DELL1_MIC_NO_PRESENCE.
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6559,6 +6559,11 @@ static const struct snd_hda_pin_quirk al
+ {0x1b, 0x01011020},
+ {0x21, 0x02211010}),
+ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++ {0x12, 0x90a60130},
++ {0x14, 0x90170110},
++ {0x1b, 0x01011020},
++ {0x21, 0x0221101f}),
++ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+ {0x12, 0x90a60160},
+ {0x14, 0x90170120},
+ {0x21, 0x02211030}),
--- /dev/null
+From 44be77c590f381bc629815ac789b8b15ecc4ddcf Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 27 Dec 2017 08:53:59 +0100
+Subject: ALSA: hda - Fix missing COEF init for ALC225/295/299
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 44be77c590f381bc629815ac789b8b15ecc4ddcf upstream.
+
+There was a long-standing problem on HP Spectre X360 with Kabylake
+where it lacks of the front speaker output in some situations. Also
+there are other products showing the similar behavior. The culprit
+seems to be the missing COEF setup on ALC codecs, ALC225/295/299,
+which are all compatible.
+
+This patch adds the proper COEF setup (to initialize idx 0x67 / bits
+0x3000) for addressing the issue.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=195457
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -324,8 +324,12 @@ static void alc_fill_eapd_coef(struct hd
+ case 0x10ec0292:
+ alc_update_coef_idx(codec, 0x4, 1<<15, 0);
+ break;
+- case 0x10ec0215:
+ case 0x10ec0225:
++ case 0x10ec0295:
++ case 0x10ec0299:
++ alc_update_coef_idx(codec, 0x67, 0xf000, 0x3000);
++ /* fallthrough */
++ case 0x10ec0215:
+ case 0x10ec0233:
+ case 0x10ec0236:
+ case 0x10ec0255:
+@@ -336,10 +340,8 @@ static void alc_fill_eapd_coef(struct hd
+ case 0x10ec0286:
+ case 0x10ec0288:
+ case 0x10ec0285:
+- case 0x10ec0295:
+ case 0x10ec0298:
+ case 0x10ec0289:
+- case 0x10ec0299:
+ alc_update_coef_idx(codec, 0x10, 1<<9, 0);
+ break;
+ case 0x10ec0275:
--- /dev/null
+From 51f493ae71adc2c49a317a13c38e54e1cdf46005 Mon Sep 17 00:00:00 2001
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Date: Thu, 30 Nov 2017 10:15:02 +0000
+Subject: ASoC: codecs: msm8916-wcd: Fix supported formats
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+commit 51f493ae71adc2c49a317a13c38e54e1cdf46005 upstream.
+
+This codec is configurable for only 16 bit and 32 bit samples, so reflect
+this in the supported formats also remove 24bit sample from supported list.
+
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/msm8916-wcd-analog.c | 2 +-
+ sound/soc/codecs/msm8916-wcd-digital.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/codecs/msm8916-wcd-analog.c
++++ b/sound/soc/codecs/msm8916-wcd-analog.c
+@@ -267,7 +267,7 @@
+ #define MSM8916_WCD_ANALOG_RATES (SNDRV_PCM_RATE_8000 | SNDRV_PCM_RATE_16000 |\
+ SNDRV_PCM_RATE_32000 | SNDRV_PCM_RATE_48000)
+ #define MSM8916_WCD_ANALOG_FORMATS (SNDRV_PCM_FMTBIT_S16_LE |\
+- SNDRV_PCM_FMTBIT_S24_LE)
++ SNDRV_PCM_FMTBIT_S32_LE)
+
+ static int btn_mask = SND_JACK_BTN_0 | SND_JACK_BTN_1 |
+ SND_JACK_BTN_2 | SND_JACK_BTN_3 | SND_JACK_BTN_4;
+--- a/sound/soc/codecs/msm8916-wcd-digital.c
++++ b/sound/soc/codecs/msm8916-wcd-digital.c
+@@ -194,7 +194,7 @@
+ SNDRV_PCM_RATE_32000 | \
+ SNDRV_PCM_RATE_48000)
+ #define MSM8916_WCD_DIGITAL_FORMATS (SNDRV_PCM_FMTBIT_S16_LE |\
+- SNDRV_PCM_FMTBIT_S24_LE)
++ SNDRV_PCM_FMTBIT_S32_LE)
+
+ struct msm8916_wcd_digital_priv {
+ struct clk *ahbclk, *mclk;
+@@ -645,7 +645,7 @@ static int msm8916_wcd_digital_hw_params
+ RX_I2S_CTL_RX_I2S_MODE_MASK,
+ RX_I2S_CTL_RX_I2S_MODE_16);
+ break;
+- case SNDRV_PCM_FORMAT_S24_LE:
++ case SNDRV_PCM_FORMAT_S32_LE:
+ snd_soc_update_bits(dai->codec, LPASS_CDC_CLK_TX_I2S_CTL,
+ TX_I2S_CTL_TX_I2S_MODE_MASK,
+ TX_I2S_CTL_TX_I2S_MODE_32);
--- /dev/null
+From bc6476d6c1edcb9b97621b5131bd169aa81f27db Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 13 Nov 2017 12:12:55 +0100
+Subject: ASoC: da7218: fix fix child-node lookup
+
+From: Johan Hovold <johan@kernel.org>
+
+commit bc6476d6c1edcb9b97621b5131bd169aa81f27db upstream.
+
+Fix child-node lookup during probe, which ended up searching the whole
+device tree depth-first starting at the parent rather than just matching
+on its children.
+
+To make things worse, the parent codec node was also prematurely freed.
+
+Fixes: 4d50934abd22 ("ASoC: da7218: Add da7218 codec driver")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/da7218.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/da7218.c
++++ b/sound/soc/codecs/da7218.c
+@@ -2520,7 +2520,7 @@ static struct da7218_pdata *da7218_of_to
+ }
+
+ if (da7218->dev_id == DA7218_DEV_ID) {
+- hpldet_np = of_find_node_by_name(np, "da7218_hpldet");
++ hpldet_np = of_get_child_by_name(np, "da7218_hpldet");
+ if (!hpldet_np)
+ return pdata;
+
--- /dev/null
+From 695b78b548d8a26288f041e907ff17758df9e1d5 Mon Sep 17 00:00:00 2001
+From: "Maciej S. Szmigiero" <mail@maciej.szmigiero.name>
+Date: Mon, 20 Nov 2017 23:14:55 +0100
+Subject: ASoC: fsl_ssi: AC'97 ops need regmap, clock and cleaning up on failure
+
+From: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
+
+commit 695b78b548d8a26288f041e907ff17758df9e1d5 upstream.
+
+AC'97 ops (register read / write) need SSI regmap and clock, so they have
+to be set after them.
+
+We also need to set these ops back to NULL if we fail the probe.
+
+Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
+Acked-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/fsl/fsl_ssi.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/sound/soc/fsl/fsl_ssi.c
++++ b/sound/soc/fsl/fsl_ssi.c
+@@ -1452,12 +1452,6 @@ static int fsl_ssi_probe(struct platform
+ sizeof(fsl_ssi_ac97_dai));
+
+ fsl_ac97_data = ssi_private;
+-
+- ret = snd_soc_set_ac97_ops_of_reset(&fsl_ssi_ac97_ops, pdev);
+- if (ret) {
+- dev_err(&pdev->dev, "could not set AC'97 ops\n");
+- return ret;
+- }
+ } else {
+ /* Initialize this copy of the CPU DAI driver structure */
+ memcpy(&ssi_private->cpu_dai_drv, &fsl_ssi_dai_template,
+@@ -1568,6 +1562,14 @@ static int fsl_ssi_probe(struct platform
+ return ret;
+ }
+
++ if (fsl_ssi_is_ac97(ssi_private)) {
++ ret = snd_soc_set_ac97_ops_of_reset(&fsl_ssi_ac97_ops, pdev);
++ if (ret) {
++ dev_err(&pdev->dev, "could not set AC'97 ops\n");
++ goto error_ac97_ops;
++ }
++ }
++
+ ret = devm_snd_soc_register_component(&pdev->dev, &fsl_ssi_component,
+ &ssi_private->cpu_dai_drv, 1);
+ if (ret) {
+@@ -1651,6 +1653,10 @@ error_sound_card:
+ fsl_ssi_debugfs_remove(&ssi_private->dbg_stats);
+
+ error_asoc_register:
++ if (fsl_ssi_is_ac97(ssi_private))
++ snd_soc_set_ac97_ops(NULL);
++
++error_ac97_ops:
+ if (ssi_private->soc->imx)
+ fsl_ssi_imx_clean(pdev, ssi_private);
+
--- /dev/null
+From 737e0b7b67bdfe24090fab2852044bb283282fc5 Mon Sep 17 00:00:00 2001
+From: "Andrew F. Davis" <afd@ti.com>
+Date: Wed, 29 Nov 2017 15:32:46 -0600
+Subject: ASoC: tlv320aic31xx: Fix GPIO1 register definition
+
+From: Andrew F. Davis <afd@ti.com>
+
+commit 737e0b7b67bdfe24090fab2852044bb283282fc5 upstream.
+
+GPIO1 control register is number 51, fix this here.
+
+Fixes: bafcbfe429eb ("ASoC: tlv320aic31xx: Make the register values human readable")
+Signed-off-by: Andrew F. Davis <afd@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/tlv320aic31xx.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/tlv320aic31xx.h
++++ b/sound/soc/codecs/tlv320aic31xx.h
+@@ -116,7 +116,7 @@ struct aic31xx_pdata {
+ /* INT2 interrupt control */
+ #define AIC31XX_INT2CTRL AIC31XX_REG(0, 49)
+ /* GPIO1 control */
+-#define AIC31XX_GPIO1 AIC31XX_REG(0, 50)
++#define AIC31XX_GPIO1 AIC31XX_REG(0, 51)
+
+ #define AIC31XX_DACPRB AIC31XX_REG(0, 60)
+ /* ADC Instruction Set Register */
--- /dev/null
+From 15f8c5f2415bfac73f33a14bcd83422bcbfb5298 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 13 Nov 2017 12:12:56 +0100
+Subject: ASoC: twl4030: fix child-node lookup
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 15f8c5f2415bfac73f33a14bcd83422bcbfb5298 upstream.
+
+Fix child-node lookup during probe, which ended up searching the whole
+device tree depth-first starting at the parent rather than just matching
+on its children.
+
+To make things worse, the parent codec node was also prematurely freed,
+while the child node was leaked.
+
+Fixes: 2d6d649a2e0f ("ASoC: twl4030: Support for DT booted kernel")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/twl4030.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/twl4030.c
++++ b/sound/soc/codecs/twl4030.c
+@@ -232,7 +232,7 @@ static struct twl4030_codec_data *twl403
+ struct twl4030_codec_data *pdata = dev_get_platdata(codec->dev);
+ struct device_node *twl4030_codec_node = NULL;
+
+- twl4030_codec_node = of_find_node_by_name(codec->dev->parent->of_node,
++ twl4030_codec_node = of_get_child_by_name(codec->dev->parent->of_node,
+ "codec");
+
+ if (!pdata && twl4030_codec_node) {
+@@ -241,9 +241,11 @@ static struct twl4030_codec_data *twl403
+ GFP_KERNEL);
+ if (!pdata) {
+ dev_err(codec->dev, "Can not allocate memory\n");
++ of_node_put(twl4030_codec_node);
+ return NULL;
+ }
+ twl4030_setup_pdata_of(pdata, twl4030_codec_node);
++ of_node_put(twl4030_codec_node);
+ }
+
+ return pdata;
--- /dev/null
+From 50dd2ea8ef67a1617e0c0658bcbec4b9fb03b936 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Date: Fri, 8 Dec 2017 16:15:20 +0000
+Subject: ASoC: wm_adsp: Fix validation of firmware and coeff lengths
+
+From: Ben Hutchings <ben.hutchings@codethink.co.uk>
+
+commit 50dd2ea8ef67a1617e0c0658bcbec4b9fb03b936 upstream.
+
+The checks for whether another region/block header could be present
+are subtracting the size from the current offset. Obviously we should
+instead subtract the offset from the size.
+
+The checks for whether the region/block data fit in the file are
+adding the data size to the current offset and header size, without
+checking for integer overflow. Rearrange these so that overflow is
+impossible.
+
+Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Tested-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm_adsp.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -1733,7 +1733,7 @@ static int wm_adsp_load(struct wm_adsp *
+ le64_to_cpu(footer->timestamp));
+
+ while (pos < firmware->size &&
+- pos - firmware->size > sizeof(*region)) {
++ sizeof(*region) < firmware->size - pos) {
+ region = (void *)&(firmware->data[pos]);
+ region_name = "Unknown";
+ reg = 0;
+@@ -1782,8 +1782,8 @@ static int wm_adsp_load(struct wm_adsp *
+ regions, le32_to_cpu(region->len), offset,
+ region_name);
+
+- if ((pos + le32_to_cpu(region->len) + sizeof(*region)) >
+- firmware->size) {
++ if (le32_to_cpu(region->len) >
++ firmware->size - pos - sizeof(*region)) {
+ adsp_err(dsp,
+ "%s.%d: %s region len %d bytes exceeds file length %zu\n",
+ file, regions, region_name,
+@@ -2253,7 +2253,7 @@ static int wm_adsp_load_coeff(struct wm_
+
+ blocks = 0;
+ while (pos < firmware->size &&
+- pos - firmware->size > sizeof(*blk)) {
++ sizeof(*blk) < firmware->size - pos) {
+ blk = (void *)(&firmware->data[pos]);
+
+ type = le16_to_cpu(blk->type);
+@@ -2327,8 +2327,8 @@ static int wm_adsp_load_coeff(struct wm_
+ }
+
+ if (reg) {
+- if ((pos + le32_to_cpu(blk->len) + sizeof(*blk)) >
+- firmware->size) {
++ if (le32_to_cpu(blk->len) >
++ firmware->size - pos - sizeof(*blk)) {
+ adsp_err(dsp,
+ "%s.%d: %s region len %d bytes exceeds file length %zu\n",
+ file, blocks, region_name,
--- /dev/null
+From 466a2b42d67644447a1765276259a3ea5531ddff Mon Sep 17 00:00:00 2001
+From: Joel Fernandes <joelaf@google.com>
+Date: Thu, 21 Dec 2017 02:22:45 +0100
+Subject: cpufreq: schedutil: Use idle_calls counter of the remote CPU
+
+From: Joel Fernandes <joelaf@google.com>
+
+commit 466a2b42d67644447a1765276259a3ea5531ddff upstream.
+
+Since the recent remote cpufreq callback work, its possible that a cpufreq
+update is triggered from a remote CPU. For single policies however, the current
+code uses the local CPU when trying to determine if the remote sg_cpu entered
+idle or is busy. This is incorrect. To remedy this, compare with the nohz tick
+idle_calls counter of the remote CPU.
+
+Fixes: 674e75411fc2 (sched: cpufreq: Allow remote cpufreq callbacks)
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Joel Fernandes <joelaf@google.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/tick.h | 1 +
+ kernel/sched/cpufreq_schedutil.c | 2 +-
+ kernel/time/tick-sched.c | 13 +++++++++++++
+ 3 files changed, 15 insertions(+), 1 deletion(-)
+
+--- a/include/linux/tick.h
++++ b/include/linux/tick.h
+@@ -119,6 +119,7 @@ extern void tick_nohz_idle_exit(void);
+ extern void tick_nohz_irq_exit(void);
+ extern ktime_t tick_nohz_get_sleep_length(void);
+ extern unsigned long tick_nohz_get_idle_calls(void);
++extern unsigned long tick_nohz_get_idle_calls_cpu(int cpu);
+ extern u64 get_cpu_idle_time_us(int cpu, u64 *last_update_time);
+ extern u64 get_cpu_iowait_time_us(int cpu, u64 *last_update_time);
+ #else /* !CONFIG_NO_HZ_COMMON */
+--- a/kernel/sched/cpufreq_schedutil.c
++++ b/kernel/sched/cpufreq_schedutil.c
+@@ -244,7 +244,7 @@ static void sugov_iowait_boost(struct su
+ #ifdef CONFIG_NO_HZ_COMMON
+ static bool sugov_cpu_is_busy(struct sugov_cpu *sg_cpu)
+ {
+- unsigned long idle_calls = tick_nohz_get_idle_calls();
++ unsigned long idle_calls = tick_nohz_get_idle_calls_cpu(sg_cpu->cpu);
+ bool ret = idle_calls == sg_cpu->saved_idle_calls;
+
+ sg_cpu->saved_idle_calls = idle_calls;
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -1010,6 +1010,19 @@ ktime_t tick_nohz_get_sleep_length(void)
+ }
+
+ /**
++ * tick_nohz_get_idle_calls_cpu - return the current idle calls counter value
++ * for a particular CPU.
++ *
++ * Called from the schedutil frequency scaling governor in scheduler context.
++ */
++unsigned long tick_nohz_get_idle_calls_cpu(int cpu)
++{
++ struct tick_sched *ts = tick_get_tick_sched(cpu);
++
++ return ts->idle_calls;
++}
++
++/**
+ * tick_nohz_get_idle_calls - return the current idle calls counter value
+ *
+ * Called from the schedutil frequency scaling governor in scheduler context.
--- /dev/null
+From 822703354774ec935169cbbc8d503236bcb54fda Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+Date: Fri, 15 Dec 2017 15:02:33 +0100
+Subject: gpio: fix "gpio-line-names" property retrieval
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+commit 822703354774ec935169cbbc8d503236bcb54fda upstream.
+
+Following commit 9427ecbed46cc ("gpio: Rework of_gpiochip_set_names()
+to use device property accessors"), "gpio-line-names" DT property is
+not retrieved anymore when chip->parent is not set by the driver.
+This is due to OF based property reads having been replaced by device
+based property reads.
+
+This patch fixes that by making use of
+fwnode_property_read_string_array() instead of
+device_property_read_string_array() and handing over either
+of_fwnode_handle(chip->of_node) or dev_fwnode(chip->parent)
+to that function.
+
+Fixes: 9427ecbed46cc ("gpio: Rework of_gpiochip_set_names() to use device property accessors")
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpiolib-acpi.c | 2 +-
+ drivers/gpio/gpiolib-devprop.c | 17 +++++++----------
+ drivers/gpio/gpiolib-of.c | 3 ++-
+ drivers/gpio/gpiolib.h | 3 ++-
+ 4 files changed, 12 insertions(+), 13 deletions(-)
+
+--- a/drivers/gpio/gpiolib-acpi.c
++++ b/drivers/gpio/gpiolib-acpi.c
+@@ -1074,7 +1074,7 @@ void acpi_gpiochip_add(struct gpio_chip
+ }
+
+ if (!chip->names)
+- devprop_gpiochip_set_names(chip);
++ devprop_gpiochip_set_names(chip, dev_fwnode(chip->parent));
+
+ acpi_gpiochip_request_regions(acpi_gpio);
+ acpi_gpiochip_scan_gpios(acpi_gpio);
+--- a/drivers/gpio/gpiolib-devprop.c
++++ b/drivers/gpio/gpiolib-devprop.c
+@@ -19,30 +19,27 @@
+ /**
+ * devprop_gpiochip_set_names - Set GPIO line names using device properties
+ * @chip: GPIO chip whose lines should be named, if possible
++ * @fwnode: Property Node containing the gpio-line-names property
+ *
+ * Looks for device property "gpio-line-names" and if it exists assigns
+ * GPIO line names for the chip. The memory allocated for the assigned
+ * names belong to the underlying firmware node and should not be released
+ * by the caller.
+ */
+-void devprop_gpiochip_set_names(struct gpio_chip *chip)
++void devprop_gpiochip_set_names(struct gpio_chip *chip,
++ const struct fwnode_handle *fwnode)
+ {
+ struct gpio_device *gdev = chip->gpiodev;
+ const char **names;
+ int ret, i;
+
+- if (!chip->parent) {
+- dev_warn(&gdev->dev, "GPIO chip parent is NULL\n");
+- return;
+- }
+-
+- ret = device_property_read_string_array(chip->parent, "gpio-line-names",
++ ret = fwnode_property_read_string_array(fwnode, "gpio-line-names",
+ NULL, 0);
+ if (ret < 0)
+ return;
+
+ if (ret != gdev->ngpio) {
+- dev_warn(chip->parent,
++ dev_warn(&gdev->dev,
+ "names %d do not match number of GPIOs %d\n", ret,
+ gdev->ngpio);
+ return;
+@@ -52,10 +49,10 @@ void devprop_gpiochip_set_names(struct g
+ if (!names)
+ return;
+
+- ret = device_property_read_string_array(chip->parent, "gpio-line-names",
++ ret = fwnode_property_read_string_array(fwnode, "gpio-line-names",
+ names, gdev->ngpio);
+ if (ret < 0) {
+- dev_warn(chip->parent, "failed to read GPIO line names\n");
++ dev_warn(&gdev->dev, "failed to read GPIO line names\n");
+ kfree(names);
+ return;
+ }
+--- a/drivers/gpio/gpiolib-of.c
++++ b/drivers/gpio/gpiolib-of.c
+@@ -493,7 +493,8 @@ int of_gpiochip_add(struct gpio_chip *ch
+
+ /* If the chip defines names itself, these take precedence */
+ if (!chip->names)
+- devprop_gpiochip_set_names(chip);
++ devprop_gpiochip_set_names(chip,
++ of_fwnode_handle(chip->of_node));
+
+ of_node_get(chip->of_node);
+
+--- a/drivers/gpio/gpiolib.h
++++ b/drivers/gpio/gpiolib.h
+@@ -224,7 +224,8 @@ static inline int gpio_chip_hwgpio(const
+ return desc - &desc->gdev->descs[0];
+ }
+
+-void devprop_gpiochip_set_names(struct gpio_chip *chip);
++void devprop_gpiochip_set_names(struct gpio_chip *chip,
++ const struct fwnode_handle *fwnode);
+
+ /* With descriptor prefix */
+
--- /dev/null
+From 4a50881bbac309e6f0684816a180bc3c14e1485d Mon Sep 17 00:00:00 2001
+From: Moni Shoua <monis@mellanox.com>
+Date: Sun, 24 Dec 2017 13:54:58 +0200
+Subject: IB/core: Verify that QP is security enabled in create and destroy
+
+From: Moni Shoua <monis@mellanox.com>
+
+commit 4a50881bbac309e6f0684816a180bc3c14e1485d upstream.
+
+The XRC target QP create flow sets up qp_sec only if there is an IB link with
+LSM security enabled. However, several other related uAPI entry points blindly
+follow the qp_sec NULL pointer, resulting in a possible oops.
+
+Check for NULL before using qp_sec.
+
+Fixes: d291f1a65232 ("IB/core: Enforce PKey security on QPs")
+Reviewed-by: Daniel Jurgens <danielj@mellanox.com>
+Signed-off-by: Moni Shoua <monis@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/security.c | 3 +++
+ drivers/infiniband/core/verbs.c | 3 ++-
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/core/security.c
++++ b/drivers/infiniband/core/security.c
+@@ -386,6 +386,9 @@ int ib_open_shared_qp_security(struct ib
+ if (ret)
+ return ret;
+
++ if (!qp->qp_sec)
++ return 0;
++
+ mutex_lock(&real_qp->qp_sec->mutex);
+ ret = check_qp_port_pkey_settings(real_qp->qp_sec->ports_pkeys,
+ qp->qp_sec);
+--- a/drivers/infiniband/core/verbs.c
++++ b/drivers/infiniband/core/verbs.c
+@@ -1400,7 +1400,8 @@ int ib_close_qp(struct ib_qp *qp)
+ spin_unlock_irqrestore(&real_qp->device->event_handler_lock, flags);
+
+ atomic_dec(&real_qp->usecnt);
+- ib_close_shared_qp_security(qp->qp_sec);
++ if (qp->qp_sec)
++ ib_close_shared_qp_security(qp->qp_sec);
+ kfree(qp);
+
+ return 0;
--- /dev/null
+From 4c009af473b2026caaa26107e34d7cc68dad7756 Mon Sep 17 00:00:00 2001
+From: "Michael J. Ruhl" <michael.j.ruhl@intel.com>
+Date: Fri, 22 Dec 2017 08:47:20 -0800
+Subject: IB/hfi: Only read capability registers if the capability exists
+
+From: Michael J. Ruhl <michael.j.ruhl@intel.com>
+
+commit 4c009af473b2026caaa26107e34d7cc68dad7756 upstream.
+
+During driver init, various registers are saved to allow restoration
+after an FLR or gen3 bump. Some of these registers are not available
+in some circumstances (i.e. Virtual machines).
+
+This bug makes the driver unusable when the PCI device is passed into
+a VM, it fails during probe.
+
+Delete unnecessary register read/write, and only access register if
+the capability exists.
+
+Fixes: a618b7e40af2 ("IB/hfi1: Move saving PCI values to a separate function")
+Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/hfi1/hfi.h | 1 -
+ drivers/infiniband/hw/hfi1/pcie.c | 30 ++++++++++++------------------
+ 2 files changed, 12 insertions(+), 19 deletions(-)
+
+--- a/drivers/infiniband/hw/hfi1/hfi.h
++++ b/drivers/infiniband/hw/hfi1/hfi.h
+@@ -1129,7 +1129,6 @@ struct hfi1_devdata {
+ u16 pcie_lnkctl;
+ u16 pcie_devctl2;
+ u32 pci_msix0;
+- u32 pci_lnkctl3;
+ u32 pci_tph2;
+
+ /*
+--- a/drivers/infiniband/hw/hfi1/pcie.c
++++ b/drivers/infiniband/hw/hfi1/pcie.c
+@@ -411,15 +411,12 @@ int restore_pci_variables(struct hfi1_de
+ if (ret)
+ goto error;
+
+- ret = pci_write_config_dword(dd->pcidev, PCIE_CFG_SPCIE1,
+- dd->pci_lnkctl3);
+- if (ret)
+- goto error;
+-
+- ret = pci_write_config_dword(dd->pcidev, PCIE_CFG_TPH2, dd->pci_tph2);
+- if (ret)
+- goto error;
+-
++ if (pci_find_ext_capability(dd->pcidev, PCI_EXT_CAP_ID_TPH)) {
++ ret = pci_write_config_dword(dd->pcidev, PCIE_CFG_TPH2,
++ dd->pci_tph2);
++ if (ret)
++ goto error;
++ }
+ return 0;
+
+ error:
+@@ -469,15 +466,12 @@ int save_pci_variables(struct hfi1_devda
+ if (ret)
+ goto error;
+
+- ret = pci_read_config_dword(dd->pcidev, PCIE_CFG_SPCIE1,
+- &dd->pci_lnkctl3);
+- if (ret)
+- goto error;
+-
+- ret = pci_read_config_dword(dd->pcidev, PCIE_CFG_TPH2, &dd->pci_tph2);
+- if (ret)
+- goto error;
+-
++ if (pci_find_ext_capability(dd->pcidev, PCI_EXT_CAP_ID_TPH)) {
++ ret = pci_read_config_dword(dd->pcidev, PCIE_CFG_TPH2,
++ &dd->pci_tph2);
++ if (ret)
++ goto error;
++ }
+ return 0;
+
+ error:
--- /dev/null
+From ad9a3668a434faca1339789ed2f043d679199309 Mon Sep 17 00:00:00 2001
+From: Majd Dibbiny <majd@mellanox.com>
+Date: Sun, 24 Dec 2017 13:54:56 +0200
+Subject: IB/mlx5: Serialize access to the VMA list
+
+From: Majd Dibbiny <majd@mellanox.com>
+
+commit ad9a3668a434faca1339789ed2f043d679199309 upstream.
+
+User-space applications can do mmap and munmap directly at
+any time.
+
+Since the VMA list is not protected with a mutex, concurrent
+accesses to the VMA list from the mmap and munmap can cause
+data corruption. Add a mutex around the list.
+
+Fixes: 7c2344c3bbf9 ("IB/mlx5: Implements disassociate_ucontext API")
+Reviewed-by: Yishai Hadas <yishaih@mellanox.com>
+Signed-off-by: Majd Dibbiny <majd@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx5/main.c | 8 ++++++++
+ drivers/infiniband/hw/mlx5/mlx5_ib.h | 4 ++++
+ 2 files changed, 12 insertions(+)
+
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -1415,6 +1415,7 @@ static struct ib_ucontext *mlx5_ib_alloc
+ }
+
+ INIT_LIST_HEAD(&context->vma_private_list);
++ mutex_init(&context->vma_private_list_mutex);
+ INIT_LIST_HEAD(&context->db_page_list);
+ mutex_init(&context->db_page_mutex);
+
+@@ -1576,7 +1577,9 @@ static void mlx5_ib_vma_close(struct vm
+ * mlx5_ib_disassociate_ucontext().
+ */
+ mlx5_ib_vma_priv_data->vma = NULL;
++ mutex_lock(mlx5_ib_vma_priv_data->vma_private_list_mutex);
+ list_del(&mlx5_ib_vma_priv_data->list);
++ mutex_unlock(mlx5_ib_vma_priv_data->vma_private_list_mutex);
+ kfree(mlx5_ib_vma_priv_data);
+ }
+
+@@ -1596,10 +1599,13 @@ static int mlx5_ib_set_vma_data(struct v
+ return -ENOMEM;
+
+ vma_prv->vma = vma;
++ vma_prv->vma_private_list_mutex = &ctx->vma_private_list_mutex;
+ vma->vm_private_data = vma_prv;
+ vma->vm_ops = &mlx5_ib_vm_ops;
+
++ mutex_lock(&ctx->vma_private_list_mutex);
+ list_add(&vma_prv->list, vma_head);
++ mutex_unlock(&ctx->vma_private_list_mutex);
+
+ return 0;
+ }
+@@ -1642,6 +1648,7 @@ static void mlx5_ib_disassociate_ucontex
+ * mlx5_ib_vma_close.
+ */
+ down_write(&owning_mm->mmap_sem);
++ mutex_lock(&context->vma_private_list_mutex);
+ list_for_each_entry_safe(vma_private, n, &context->vma_private_list,
+ list) {
+ vma = vma_private->vma;
+@@ -1656,6 +1663,7 @@ static void mlx5_ib_disassociate_ucontex
+ list_del(&vma_private->list);
+ kfree(vma_private);
+ }
++ mutex_unlock(&context->vma_private_list_mutex);
+ up_write(&owning_mm->mmap_sem);
+ mmput(owning_mm);
+ put_task_struct(owning_process);
+--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+@@ -115,6 +115,8 @@ enum {
+ struct mlx5_ib_vma_private_data {
+ struct list_head list;
+ struct vm_area_struct *vma;
++ /* protect vma_private_list add/del */
++ struct mutex *vma_private_list_mutex;
+ };
+
+ struct mlx5_ib_ucontext {
+@@ -129,6 +131,8 @@ struct mlx5_ib_ucontext {
+ /* Transport Domain number */
+ u32 tdn;
+ struct list_head vma_private_list;
++ /* protect vma_private_list add/del */
++ struct mutex vma_private_list_mutex;
+
+ unsigned long upd_xlt_page;
+ /* protect ODP/KSM */
--- /dev/null
+From 05d14e7b0c138cb07ba30e464f47b39434f3fdef Mon Sep 17 00:00:00 2001
+From: Moni Shoua <monis@mellanox.com>
+Date: Sun, 24 Dec 2017 13:54:57 +0200
+Subject: IB/uverbs: Fix command checking as part of ib_uverbs_ex_modify_qp()
+
+From: Moni Shoua <monis@mellanox.com>
+
+commit 05d14e7b0c138cb07ba30e464f47b39434f3fdef upstream.
+
+If the input command length is larger than the kernel supports an error should
+be returned in case the unsupported bytes are not cleared, instead of the
+other way aroudn. This matches what all other callers of ib_is_udata_cleared
+do and will avoid user ABI problems in the future.
+
+Fixes: 189aba99e700 ("IB/uverbs: Extend modify_qp and support packet pacing")
+Reviewed-by: Yishai Hadas <yishaih@mellanox.com>
+Signed-off-by: Moni Shoua <monis@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/uverbs_cmd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -2085,8 +2085,8 @@ int ib_uverbs_ex_modify_qp(struct ib_uve
+ return -EOPNOTSUPP;
+
+ if (ucore->inlen > sizeof(cmd)) {
+- if (ib_is_udata_cleared(ucore, sizeof(cmd),
+- ucore->inlen - sizeof(cmd)))
++ if (!ib_is_udata_cleared(ucore, sizeof(cmd),
++ ucore->inlen - sizeof(cmd)))
+ return -EOPNOTSUPP;
+ }
+
--- /dev/null
+From f55688c45442bc863f40ad678c638785b26cdce6 Mon Sep 17 00:00:00 2001
+From: Steve Wise <swise@opengridcomputing.com>
+Date: Mon, 18 Dec 2017 13:10:00 -0800
+Subject: iw_cxgb4: Only validate the MSN for successful completions
+
+From: Steve Wise <swise@opengridcomputing.com>
+
+commit f55688c45442bc863f40ad678c638785b26cdce6 upstream.
+
+If the RECV CQE is in error, ignore the MSN check. This was causing
+recvs that were flushed into the sw cq to be completed with the wrong
+status (BAD_MSN instead of FLUSHED).
+
+Signed-off-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/cxgb4/cq.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/infiniband/hw/cxgb4/cq.c
++++ b/drivers/infiniband/hw/cxgb4/cq.c
+@@ -586,10 +586,10 @@ static int poll_cq(struct t4_wq *wq, str
+ ret = -EAGAIN;
+ goto skip_cqe;
+ }
+- if (unlikely((CQE_WRID_MSN(hw_cqe) != (wq->rq.msn)))) {
++ if (unlikely(!CQE_STATUS(hw_cqe) &&
++ CQE_WRID_MSN(hw_cqe) != wq->rq.msn)) {
+ t4_set_wq_in_error(wq);
+- hw_cqe->header |= htonl(CQE_STATUS_V(T4_ERR_MSN));
+- goto proc_cqe;
++ hw_cqe->header |= cpu_to_be32(CQE_STATUS_V(T4_ERR_MSN));
+ }
+ goto proc_cqe;
+ }
--- /dev/null
+From ae415fa4c5248a8cf4faabd5a3c20576cb1ad607 Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Date: Fri, 22 Dec 2017 21:19:29 -0500
+Subject: ring-buffer: Do no reuse reader page if still in use
+
+From: Steven Rostedt (VMware) <rostedt@goodmis.org>
+
+commit ae415fa4c5248a8cf4faabd5a3c20576cb1ad607 upstream.
+
+To free the reader page that is allocated with ring_buffer_alloc_read_page(),
+ring_buffer_free_read_page() must be called. For faster performance, this
+page can be reused by the ring buffer to avoid having to free and allocate
+new pages.
+
+The issue arises when the page is used with a splice pipe into the
+networking code. The networking code may up the page counter for the page,
+and keep it active while sending it is queued to go to the network. The
+incrementing of the page ref does not prevent it from being reused in the
+ring buffer, and this can cause the page that is being sent out to the
+network to be modified before it is sent by reading new data.
+
+Add a check to the page ref counter, and only reuse the page if it is not
+being used anywhere else.
+
+Fixes: 73a757e63114d ("ring-buffer: Return reader page back into existing ring buffer")
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/ring_buffer.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -4443,8 +4443,13 @@ void ring_buffer_free_read_page(struct r
+ {
+ struct ring_buffer_per_cpu *cpu_buffer = buffer->buffers[cpu];
+ struct buffer_data_page *bpage = data;
++ struct page *page = virt_to_page(bpage);
+ unsigned long flags;
+
++ /* If the page is still in use someplace else, we can't reuse it */
++ if (page_ref_count(page) > 1)
++ goto out;
++
+ local_irq_save(flags);
+ arch_spin_lock(&cpu_buffer->lock);
+
+@@ -4456,6 +4461,7 @@ void ring_buffer_free_read_page(struct r
+ arch_spin_unlock(&cpu_buffer->lock);
+ local_irq_restore(flags);
+
++ out:
+ free_page((unsigned long)bpage);
+ }
+ EXPORT_SYMBOL_GPL(ring_buffer_free_read_page);
--- /dev/null
+From 45d8b80c2ac5d21cd1e2954431fb676bc2b1e099 Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Date: Fri, 22 Dec 2017 20:32:35 -0500
+Subject: ring-buffer: Mask out the info bits when returning buffer page length
+
+From: Steven Rostedt (VMware) <rostedt@goodmis.org>
+
+commit 45d8b80c2ac5d21cd1e2954431fb676bc2b1e099 upstream.
+
+Two info bits were added to the "commit" part of the ring buffer data page
+when returned to be consumed. This was to inform the user space readers that
+events have been missed, and that the count may be stored at the end of the
+page.
+
+What wasn't handled, was the splice code that actually called a function to
+return the length of the data in order to zero out the rest of the page
+before sending it up to user space. These data bits were returned with the
+length making the value negative, and that negative value was not checked.
+It was compared to PAGE_SIZE, and only used if the size was less than
+PAGE_SIZE. Luckily PAGE_SIZE is unsigned long which made the compare an
+unsigned compare, meaning the negative size value did not end up causing a
+large portion of memory to be randomly zeroed out.
+
+Fixes: 66a8cb95ed040 ("ring-buffer: Add place holder recording of dropped events")
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/ring_buffer.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -281,6 +281,8 @@ EXPORT_SYMBOL_GPL(ring_buffer_event_data
+ /* Missed count stored at end */
+ #define RB_MISSED_STORED (1 << 30)
+
++#define RB_MISSED_FLAGS (RB_MISSED_EVENTS|RB_MISSED_STORED)
++
+ struct buffer_data_page {
+ u64 time_stamp; /* page time stamp */
+ local_t commit; /* write committed index */
+@@ -332,7 +334,9 @@ static void rb_init_page(struct buffer_d
+ */
+ size_t ring_buffer_page_len(void *page)
+ {
+- return local_read(&((struct buffer_data_page *)page)->commit)
++ struct buffer_data_page *bpage = page;
++
++ return (local_read(&bpage->commit) & ~RB_MISSED_FLAGS)
+ + BUF_PAGE_HDR_SIZE;
+ }
+
x86-mm-dump_pagetables-check-user-space-page-table-for-wx-pages.patch
x86-mm-dump_pagetables-allow-dumping-current-pagetables.patch
x86-ldt-make-the-ldt-mapping-ro.patch
+ring-buffer-mask-out-the-info-bits-when-returning-buffer-page-length.patch
+ring-buffer-do-no-reuse-reader-page-if-still-in-use.patch
+iw_cxgb4-only-validate-the-msn-for-successful-completions.patch
+asoc-codecs-msm8916-wcd-fix-supported-formats.patch
+asoc-wm_adsp-fix-validation-of-firmware-and-coeff-lengths.patch
+asoc-da7218-fix-fix-child-node-lookup.patch
+asoc-fsl_ssi-ac-97-ops-need-regmap-clock-and-cleaning-up-on-failure.patch
+asoc-twl4030-fix-child-node-lookup.patch
+asoc-tlv320aic31xx-fix-gpio1-register-definition.patch
+gpio-fix-gpio-line-names-property-retrieval.patch
+ib-hfi-only-read-capability-registers-if-the-capability-exists.patch
+ib-mlx5-serialize-access-to-the-vma-list.patch
+ib-uverbs-fix-command-checking-as-part-of-ib_uverbs_ex_modify_qp.patch
+ib-core-verify-that-qp-is-security-enabled-in-create-and-destroy.patch
+alsa-hda-drop-useless-warn_on.patch
+alsa-hda-add-mic_no_presence-fixup-for-2-hp-machines.patch
+alsa-hda-change-the-location-for-one-mic-on-a-lenovo-machine.patch
+alsa-hda-fix-headset-mic-detection-issue-on-a-dell-machine.patch
+alsa-hda-fix-missing-coef-init-for-alc225-295-299.patch
+cpufreq-schedutil-use-idle_calls-counter-of-the-remote-cpu.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
