--- /dev/null
+From bdcc02cf1bb508fc700df7662f55058f651f2621 Mon Sep 17 00:00:00 2001
+From: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>
+Date: Fri, 11 May 2018 12:51:42 -0700
+Subject: drm/psr: Fix missed entry in PSR setup time table.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>
+
+commit bdcc02cf1bb508fc700df7662f55058f651f2621 upstream.
+
+Entry corresponding to 220 us setup time was missing. I am not aware of
+any specific bug this fixes, but this could potentially result in enabling
+PSR on a panel with a higher setup time requirement than supported by the
+hardware.
+
+I verified the value is present in eDP spec versions 1.3, 1.4 and 1.4a.
+
+Fixes: 6608804b3d7f ("drm/dp: Add drm_dp_psr_setup_time()")
+Cc: stable@vger.kernel.org
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Jose Roberto de Souza <jose.souza@intel.com>
+Cc: dri-devel@lists.freedesktop.org
+Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
+Reviewed-by: Tarun Vyas <tarun.vyas@intel.com>
+Signed-off-by: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180511195145.3829-3-dhinakaran.pandiyan@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_dp_helper.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/drm_dp_helper.c
++++ b/drivers/gpu/drm/drm_dp_helper.c
+@@ -1141,6 +1141,7 @@ int drm_dp_psr_setup_time(const u8 psr_c
+ static const u16 psr_setup_time_us[] = {
+ PSR_SETUP_TIME(330),
+ PSR_SETUP_TIME(275),
++ PSR_SETUP_TIME(220),
+ PSR_SETUP_TIME(165),
+ PSR_SETUP_TIME(110),
+ PSR_SETUP_TIME(55),
--- /dev/null
+From 806e30873f0e74d9d41b0ef761bd4d3e55c7d510 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Sat, 26 May 2018 08:49:24 +0200
+Subject: hwtracing: stm: fix build error on some arches
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 806e30873f0e74d9d41b0ef761bd4d3e55c7d510 upstream.
+
+Commit b5e2ced9bf81 ("stm class: Use vmalloc for the master map") caused
+a build error on some arches as vmalloc.h was not explicitly included.
+
+Fix that by adding it to the list of includes.
+
+Fixes: b5e2ced9bf81 ("stm class: Use vmalloc for the master map")
+Reported-by: kbuild test robot <lkp@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/stm/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hwtracing/stm/core.c
++++ b/drivers/hwtracing/stm/core.c
+@@ -27,6 +27,7 @@
+ #include <linux/stm.h>
+ #include <linux/fs.h>
+ #include <linux/mm.h>
++#include <linux/vmalloc.h>
+ #include "stm.h"
+
+ #include <uapi/linux/stm.h>
--- /dev/null
+From a840c93ca7582bb6c88df2345a33f979b7a67874 Mon Sep 17 00:00:00 2001
+From: Parav Pandit <parav@mellanox.com>
+Date: Sun, 27 May 2018 14:49:16 +0300
+Subject: IB/core: Fix error code for invalid GID entry
+
+From: Parav Pandit <parav@mellanox.com>
+
+commit a840c93ca7582bb6c88df2345a33f979b7a67874 upstream.
+
+When a GID entry is invalid EAGAIN is returned. This is an incorrect error
+code, there is nothing that will make this GID entry valid again in
+bounded time.
+
+Some user space tools fail incorrectly if EAGAIN is returned here, and
+this represents a small ABI change from earlier kernels.
+
+The first patch in the Fixes list makes entries that were valid before
+to become invalid, allowing this code to trigger, while the second patch
+in the Fixes list introduced the wrong EAGAIN.
+
+Therefore revert the return result to EINVAL which matches the historical
+expectations of the ibv_query_gid_type() API of the libibverbs user space
+library.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 598ff6bae689 ("IB/core: Refactor GID modify code for RoCE")
+Fixes: 03db3a2d81e6 ("IB/core: Add RoCE GID table management")
+Reviewed-by: Daniel Jurgens <danielj@mellanox.com>
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/cache.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/core/cache.c
++++ b/drivers/infiniband/core/cache.c
+@@ -434,7 +434,7 @@ static int __ib_cache_gid_get(struct ib_
+ return -EINVAL;
+
+ if (table->data_vec[index].props & GID_TABLE_ENTRY_INVALID)
+- return -EAGAIN;
++ return -EINVAL;
+
+ memcpy(gid, &table->data_vec[index].gid, sizeof(*gid));
+ if (attr) {
--- /dev/null
+From 490fba90a90eb7b741f57fefd2bcf2c1e11eb471 Mon Sep 17 00:00:00 2001
+From: Michael Nosthoff <committed@heine.so>
+Date: Fri, 9 Mar 2018 16:13:52 +0100
+Subject: iio: ad7793: implement IIO_CHAN_INFO_SAMP_FREQ
+
+From: Michael Nosthoff <committed@heine.so>
+
+commit 490fba90a90eb7b741f57fefd2bcf2c1e11eb471 upstream.
+
+This commit is a follow-up to changes made to ad_sigma_delta.h
+in staging: iio: ad7192: implement IIO_CHAN_INFO_SAMP_FREQ
+which broke ad7793 as it was not altered to match those changes.
+
+This driver predates the availability of IIO_CHAN_INFO_SAMP_FREQ
+attribute wherein usage has some advantages like it can be accessed by
+in-kernel consumers as well as reduces the code size.
+
+Therefore, use IIO_CHAN_INFO_SAMP_FREQ to implement the
+sampling_frequency attribute instead of using IIO_DEV_ATTR_SAMP_FREQ()
+macro.
+
+Move code from the functions associated with IIO_DEV_ATTR_SAMP_FREQ()
+into respective read and write hooks with the mask set to
+IIO_CHAN_INFO_SAMP_FREQ.
+
+Fixes: a13e831fcaa7 ("staging: iio: ad7192: implement IIO_CHAN_INFO_SAMP_FREQ")
+
+Signed-off-by: Michael Nosthoff <committed@heine.so>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/ad7793.c | 75 +++++++++++++++--------------------------------
+ 1 file changed, 24 insertions(+), 51 deletions(-)
+
+--- a/drivers/iio/adc/ad7793.c
++++ b/drivers/iio/adc/ad7793.c
+@@ -348,55 +348,6 @@ static const u16 ad7793_sample_freq_avai
+ static const u16 ad7797_sample_freq_avail[16] = {0, 0, 0, 123, 62, 50, 0,
+ 33, 0, 17, 16, 12, 10, 8, 6, 4};
+
+-static ssize_t ad7793_read_frequency(struct device *dev,
+- struct device_attribute *attr,
+- char *buf)
+-{
+- struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+- struct ad7793_state *st = iio_priv(indio_dev);
+-
+- return sprintf(buf, "%d\n",
+- st->chip_info->sample_freq_avail[AD7793_MODE_RATE(st->mode)]);
+-}
+-
+-static ssize_t ad7793_write_frequency(struct device *dev,
+- struct device_attribute *attr,
+- const char *buf,
+- size_t len)
+-{
+- struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+- struct ad7793_state *st = iio_priv(indio_dev);
+- long lval;
+- int i, ret;
+-
+- ret = kstrtol(buf, 10, &lval);
+- if (ret)
+- return ret;
+-
+- if (lval == 0)
+- return -EINVAL;
+-
+- for (i = 0; i < 16; i++)
+- if (lval == st->chip_info->sample_freq_avail[i])
+- break;
+- if (i == 16)
+- return -EINVAL;
+-
+- ret = iio_device_claim_direct_mode(indio_dev);
+- if (ret)
+- return ret;
+- st->mode &= ~AD7793_MODE_RATE(-1);
+- st->mode |= AD7793_MODE_RATE(i);
+- ad_sd_write_reg(&st->sd, AD7793_REG_MODE, sizeof(st->mode), st->mode);
+- iio_device_release_direct_mode(indio_dev);
+-
+- return len;
+-}
+-
+-static IIO_DEV_ATTR_SAMP_FREQ(S_IWUSR | S_IRUGO,
+- ad7793_read_frequency,
+- ad7793_write_frequency);
+-
+ static IIO_CONST_ATTR_SAMP_FREQ_AVAIL(
+ "470 242 123 62 50 39 33 19 17 16 12 10 8 6 4");
+
+@@ -424,7 +375,6 @@ static IIO_DEVICE_ATTR_NAMED(in_m_in_sca
+ ad7793_show_scale_available, NULL, 0);
+
+ static struct attribute *ad7793_attributes[] = {
+- &iio_dev_attr_sampling_frequency.dev_attr.attr,
+ &iio_const_attr_sampling_frequency_available.dev_attr.attr,
+ &iio_dev_attr_in_m_in_scale_available.dev_attr.attr,
+ NULL
+@@ -435,7 +385,6 @@ static const struct attribute_group ad77
+ };
+
+ static struct attribute *ad7797_attributes[] = {
+- &iio_dev_attr_sampling_frequency.dev_attr.attr,
+ &iio_const_attr_sampling_frequency_available_ad7797.dev_attr.attr,
+ NULL
+ };
+@@ -505,6 +454,10 @@ static int ad7793_read_raw(struct iio_de
+ *val -= offset;
+ }
+ return IIO_VAL_INT;
++ case IIO_CHAN_INFO_SAMP_FREQ:
++ *val = st->chip_info
++ ->sample_freq_avail[AD7793_MODE_RATE(st->mode)];
++ return IIO_VAL_INT;
+ }
+ return -EINVAL;
+ }
+@@ -542,6 +495,26 @@ static int ad7793_write_raw(struct iio_d
+ break;
+ }
+ break;
++ case IIO_CHAN_INFO_SAMP_FREQ:
++ if (!val) {
++ ret = -EINVAL;
++ break;
++ }
++
++ for (i = 0; i < 16; i++)
++ if (val == st->chip_info->sample_freq_avail[i])
++ break;
++
++ if (i == 16) {
++ ret = -EINVAL;
++ break;
++ }
++
++ st->mode &= ~AD7793_MODE_RATE(-1);
++ st->mode |= AD7793_MODE_RATE(i);
++ ad_sd_write_reg(&st->sd, AD7793_REG_MODE, sizeof(st->mode),
++ st->mode);
++ break;
+ default:
+ ret = -EINVAL;
+ }
--- /dev/null
+From f0c8d1f6dc8eac5a1fbf441c8e080721a7b6c0ff Mon Sep 17 00:00:00 2001
+From: Eugen Hristev <eugen.hristev@microchip.com>
+Date: Tue, 10 Apr 2018 11:57:47 +0300
+Subject: iio: adc: at91-sama5d2_adc: fix channel configuration for differential channels
+
+From: Eugen Hristev <eugen.hristev@microchip.com>
+
+commit f0c8d1f6dc8eac5a1fbf441c8e080721a7b6c0ff upstream.
+
+When iterating through the channels, the index in the array is not the
+scan index. Added an xlate function to translate to the proper index.
+The result of the bug is that the channel array is indexed with a wrong index,
+thus instead of the proper channel, we access invalid memory, which may
+lead to invalid results and/or corruption.
+This will be used also for devicetree channel xlate.
+
+Fixes: 5e1a1da0f ("iio: adc: at91-sama5d2_adc: add hw trigger and buffer support")
+Fixes: 073c66201 ("iio: adc: at91-sama5d2_adc: add support for DMA")
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/at91-sama5d2_adc.c | 41 +++++++++++++++++++++++++++++++++----
+ 1 file changed, 37 insertions(+), 4 deletions(-)
+
+--- a/drivers/iio/adc/at91-sama5d2_adc.c
++++ b/drivers/iio/adc/at91-sama5d2_adc.c
+@@ -333,6 +333,27 @@ static const struct iio_chan_spec at91_a
+ + AT91_SAMA5D2_DIFF_CHAN_CNT + 1),
+ };
+
++static int at91_adc_chan_xlate(struct iio_dev *indio_dev, int chan)
++{
++ int i;
++
++ for (i = 0; i < indio_dev->num_channels; i++) {
++ if (indio_dev->channels[i].scan_index == chan)
++ return i;
++ }
++ return -EINVAL;
++}
++
++static inline struct iio_chan_spec const *
++at91_adc_chan_get(struct iio_dev *indio_dev, int chan)
++{
++ int index = at91_adc_chan_xlate(indio_dev, chan);
++
++ if (index < 0)
++ return NULL;
++ return indio_dev->channels + index;
++}
++
+ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
+ {
+ struct iio_dev *indio = iio_trigger_get_drvdata(trig);
+@@ -350,8 +371,10 @@ static int at91_adc_configure_trigger(st
+ at91_adc_writel(st, AT91_SAMA5D2_TRGR, status);
+
+ for_each_set_bit(bit, indio->active_scan_mask, indio->num_channels) {
+- struct iio_chan_spec const *chan = indio->channels + bit;
++ struct iio_chan_spec const *chan = at91_adc_chan_get(indio, bit);
+
++ if (!chan)
++ continue;
+ if (state) {
+ at91_adc_writel(st, AT91_SAMA5D2_CHER,
+ BIT(chan->channel));
+@@ -448,7 +471,11 @@ static int at91_adc_dma_start(struct iio
+
+ for_each_set_bit(bit, indio_dev->active_scan_mask,
+ indio_dev->num_channels) {
+- struct iio_chan_spec const *chan = indio_dev->channels + bit;
++ struct iio_chan_spec const *chan =
++ at91_adc_chan_get(indio_dev, bit);
++
++ if (!chan)
++ continue;
+
+ st->dma_st.rx_buf_sz += chan->scan_type.storagebits / 8;
+ }
+@@ -526,8 +553,11 @@ static int at91_adc_buffer_predisable(st
+ */
+ for_each_set_bit(bit, indio_dev->active_scan_mask,
+ indio_dev->num_channels) {
+- struct iio_chan_spec const *chan = indio_dev->channels + bit;
++ struct iio_chan_spec const *chan =
++ at91_adc_chan_get(indio_dev, bit);
+
++ if (!chan)
++ continue;
+ if (st->dma_st.dma_chan)
+ at91_adc_readl(st, chan->address);
+ }
+@@ -587,8 +617,11 @@ static void at91_adc_trigger_handler_nod
+
+ for_each_set_bit(bit, indio_dev->active_scan_mask,
+ indio_dev->num_channels) {
+- struct iio_chan_spec const *chan = indio_dev->channels + bit;
++ struct iio_chan_spec const *chan =
++ at91_adc_chan_get(indio_dev, bit);
+
++ if (!chan)
++ continue;
+ st->buffer[i] = at91_adc_readl(st, chan->address);
+ i++;
+ }
--- /dev/null
+From 76974ef9d1bf397b7bb97892a3b3bc516a1fc2c2 Mon Sep 17 00:00:00 2001
+From: Eugen Hristev <eugen.hristev@microchip.com>
+Date: Mon, 16 Apr 2018 09:54:03 +0300
+Subject: iio: adc: select buffer for at91-sama5d2_adc
+
+From: Eugen Hristev <eugen.hristev@microchip.com>
+
+commit 76974ef9d1bf397b7bb97892a3b3bc516a1fc2c2 upstream.
+
+We need to select the buffer code, otherwise we get build errors
+with undefined functions on the trigger and buffer,
+if we select just IIO and then AT91_SAMA5D2_ADC from menuconfig
+
+This adds a Kconfig 'select' statement like other ADC
+drivers have it already.
+
+Fixes: 5e1a1da0f8c9 ("iio: adc: at91-sama5d2_adc: add hw trigger and buffer support")
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/iio/adc/Kconfig
++++ b/drivers/iio/adc/Kconfig
+@@ -159,6 +159,7 @@ config AT91_SAMA5D2_ADC
+ depends on ARCH_AT91 || COMPILE_TEST
+ depends on HAS_IOMEM
+ depends on HAS_DMA
++ select IIO_BUFFER
+ select IIO_TRIGGERED_BUFFER
+ help
+ Say yes here to build support for Atmel SAMA5D2 ADC which is
--- /dev/null
+From d58109dcf37fc9baec354385ec9fdcd8878d174d Mon Sep 17 00:00:00 2001
+From: Fabrice Gasnier <fabrice.gasnier@st.com>
+Date: Tue, 13 Mar 2018 15:23:06 +0100
+Subject: iio: adc: stm32-dfsdm: fix sample rate for div2 spi clock
+
+From: Fabrice Gasnier <fabrice.gasnier@st.com>
+
+commit d58109dcf37fc9baec354385ec9fdcd8878d174d upstream.
+
+When channel clk source is set to "CLKOUT_F" or "CLKOUT_R" (e.g. div2),
+sample rate is currently set to half the requested value.
+
+Fixes: eca949800d2d ("IIO: ADC: add stm32 DFSDM support for PDM
+microphone")
+
+Signed-off-by: Fabrice Gasnier <fabrice.gasnier@st.com>
+Acked-by: Arnaud Pouliquen <arnaud.pouliquen@st.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/stm32-dfsdm-adc.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/adc/stm32-dfsdm-adc.c
++++ b/drivers/iio/adc/stm32-dfsdm-adc.c
+@@ -771,7 +771,7 @@ static int stm32_dfsdm_write_raw(struct
+ struct stm32_dfsdm_adc *adc = iio_priv(indio_dev);
+ struct stm32_dfsdm_filter *fl = &adc->dfsdm->fl_list[adc->fl_id];
+ struct stm32_dfsdm_channel *ch = &adc->dfsdm->ch_list[chan->channel];
+- unsigned int spi_freq = adc->spi_freq;
++ unsigned int spi_freq;
+ int ret = -EINVAL;
+
+ switch (mask) {
+@@ -785,8 +785,18 @@ static int stm32_dfsdm_write_raw(struct
+ case IIO_CHAN_INFO_SAMP_FREQ:
+ if (!val)
+ return -EINVAL;
+- if (ch->src != DFSDM_CHANNEL_SPI_CLOCK_EXTERNAL)
++
++ switch (ch->src) {
++ case DFSDM_CHANNEL_SPI_CLOCK_INTERNAL:
+ spi_freq = adc->dfsdm->spi_master_freq;
++ break;
++ case DFSDM_CHANNEL_SPI_CLOCK_INTERNAL_DIV2_FALLING:
++ case DFSDM_CHANNEL_SPI_CLOCK_INTERNAL_DIV2_RISING:
++ spi_freq = adc->dfsdm->spi_master_freq / 2;
++ break;
++ default:
++ spi_freq = adc->spi_freq;
++ }
+
+ if (spi_freq % val)
+ dev_warn(&indio_dev->dev,
--- /dev/null
+From 7531cf59bfa082769887ec70c2029838ea139f11 Mon Sep 17 00:00:00 2001
+From: Fabrice Gasnier <fabrice.gasnier@st.com>
+Date: Tue, 13 Mar 2018 15:23:05 +0100
+Subject: iio: adc: stm32-dfsdm: fix successive oversampling settings
+
+From: Fabrice Gasnier <fabrice.gasnier@st.com>
+
+commit 7531cf59bfa082769887ec70c2029838ea139f11 upstream.
+
+When doing successive oversampling settings, it may fail to update filter
+parameters silently:
+- First time oversampling is being set, it will be successful, as fl->res
+is 0 initially.
+- Next attempts with various oversamp value may return 0 (success), but
+keep previous filter parameters, due to 'res' never reaches above or
+equal current 'fl->res'.
+
+This is particularly true when setting sampling frequency (that relies on
+oversamp). Typical failure without error:
+- run 1st test @16kHz samp freq will succeed
+- run new test @8kHz will succeed as well
+- run new test @16kHz (again): sample rate will remain 8kHz without error
+
+Fixes: e2e6771c6462 ("IIO: ADC: add STM32 DFSDM sigma delta ADC support")
+
+Signed-off-by: Fabrice Gasnier <fabrice.gasnier@st.com>
+Acked-by: Arnaud Pouliquen <arnaud.pouliquen@st.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/stm32-dfsdm-adc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/adc/stm32-dfsdm-adc.c
++++ b/drivers/iio/adc/stm32-dfsdm-adc.c
+@@ -144,6 +144,7 @@ static int stm32_dfsdm_set_osrs(struct s
+ * Leave as soon as if exact resolution if reached.
+ * Otherwise the higher resolution below 32 bits is kept.
+ */
++ fl->res = 0;
+ for (fosr = 1; fosr <= DFSDM_MAX_FL_OVERSAMPLING; fosr++) {
+ for (iosr = 1; iosr <= DFSDM_MAX_INT_OVERSAMPLING; iosr++) {
+ if (fast)
+@@ -193,7 +194,7 @@ static int stm32_dfsdm_set_osrs(struct s
+ }
+ }
+
+- if (!fl->fosr)
++ if (!fl->res)
+ return -EINVAL;
+
+ return 0;
--- /dev/null
+From c043ec1ca5baae63726aae32abbe003192bc6eec Mon Sep 17 00:00:00 2001
+From: Martin Kelly <mkelly@xevo.com>
+Date: Mon, 26 Mar 2018 14:27:51 -0700
+Subject: iio:buffer: make length types match kfifo types
+
+From: Martin Kelly <mkelly@xevo.com>
+
+commit c043ec1ca5baae63726aae32abbe003192bc6eec upstream.
+
+Currently, we use int for buffer length and bytes_per_datum. However,
+kfifo uses unsigned int for length and size_t for element size. We need
+to make sure these matches or we will have bugs related to overflow (in
+the range between INT_MAX and UINT_MAX for length, for example).
+
+In addition, set_bytes_per_datum uses size_t while bytes_per_datum is an
+int, which would cause bugs for large values of bytes_per_datum.
+
+Change buffer length to use unsigned int and bytes_per_datum to use
+size_t.
+
+Signed-off-by: Martin Kelly <mkelly@xevo.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/buffer/industrialio-buffer-dma.c | 2 +-
+ drivers/iio/buffer/kfifo_buf.c | 4 ++--
+ include/linux/iio/buffer_impl.h | 6 +++---
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/iio/buffer/industrialio-buffer-dma.c
++++ b/drivers/iio/buffer/industrialio-buffer-dma.c
+@@ -587,7 +587,7 @@ EXPORT_SYMBOL_GPL(iio_dma_buffer_set_byt
+ * Should be used as the set_length callback for iio_buffer_access_ops
+ * struct for DMA buffers.
+ */
+-int iio_dma_buffer_set_length(struct iio_buffer *buffer, int length)
++int iio_dma_buffer_set_length(struct iio_buffer *buffer, unsigned int length)
+ {
+ /* Avoid an invalid state */
+ if (length < 2)
+--- a/drivers/iio/buffer/kfifo_buf.c
++++ b/drivers/iio/buffer/kfifo_buf.c
+@@ -22,7 +22,7 @@ struct iio_kfifo {
+ #define iio_to_kfifo(r) container_of(r, struct iio_kfifo, buffer)
+
+ static inline int __iio_allocate_kfifo(struct iio_kfifo *buf,
+- int bytes_per_datum, int length)
++ size_t bytes_per_datum, unsigned int length)
+ {
+ if ((length == 0) || (bytes_per_datum == 0))
+ return -EINVAL;
+@@ -67,7 +67,7 @@ static int iio_set_bytes_per_datum_kfifo
+ return 0;
+ }
+
+-static int iio_set_length_kfifo(struct iio_buffer *r, int length)
++static int iio_set_length_kfifo(struct iio_buffer *r, unsigned int length)
+ {
+ /* Avoid an invalid state */
+ if (length < 2)
+--- a/include/linux/iio/buffer_impl.h
++++ b/include/linux/iio/buffer_impl.h
+@@ -53,7 +53,7 @@ struct iio_buffer_access_funcs {
+ int (*request_update)(struct iio_buffer *buffer);
+
+ int (*set_bytes_per_datum)(struct iio_buffer *buffer, size_t bpd);
+- int (*set_length)(struct iio_buffer *buffer, int length);
++ int (*set_length)(struct iio_buffer *buffer, unsigned int length);
+
+ int (*enable)(struct iio_buffer *buffer, struct iio_dev *indio_dev);
+ int (*disable)(struct iio_buffer *buffer, struct iio_dev *indio_dev);
+@@ -72,10 +72,10 @@ struct iio_buffer_access_funcs {
+ */
+ struct iio_buffer {
+ /** @length: Number of datums in buffer. */
+- int length;
++ unsigned int length;
+
+ /** @bytes_per_datum: Size of individual datum including timestamp. */
+- int bytes_per_datum;
++ size_t bytes_per_datum;
+
+ /**
+ * @access: Buffer access functions associated with the
--- /dev/null
+From 6f92253024d9d947a4f454654840ce479e251376 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sat, 14 Apr 2018 17:09:09 +0200
+Subject: iio: hid-sensor-trigger: Fix sometimes not powering up the sensor after resume
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 6f92253024d9d947a4f454654840ce479e251376 upstream.
+
+hid_sensor_set_power_work() powers the sensors back up after a resume
+based on the user_requested_state atomic_t.
+
+But hid_sensor_power_state() treats this as a boolean flag, leading to
+the following problematic scenario:
+
+1) Some app starts using the iio-sensor in buffered / triggered mode,
+ hid_sensor_data_rdy_trigger_set_state(true) gets called, setting
+ user_requested_state to 1.
+2) Something directly accesses a _raw value through sysfs, leading
+ to a call to hid_sensor_power_state(true) followed by
+ hid_sensor_power_state(false) call, this sets user_requested_state
+ to 1 followed by setting it to 0.
+3) Suspend/resume the machine, hid_sensor_set_power_work() now does
+ NOT power the sensor back up because user_requested_state (wrongly)
+ is 0. Which stops the app using the sensor in buffered mode from
+ receiving any new values.
+
+This commit changes user_requested_state to a counter tracking how many
+times hid_sensor_power_state(true) was called instead, fixing this.
+
+Cc: Bastien Nocera <hadess@hadess.net>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/common/hid-sensors/hid-sensor-trigger.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
++++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+@@ -178,14 +178,14 @@ int hid_sensor_power_state(struct hid_se
+ #ifdef CONFIG_PM
+ int ret;
+
+- atomic_set(&st->user_requested_state, state);
+-
+ if (atomic_add_unless(&st->runtime_pm_enable, 1, 1))
+ pm_runtime_enable(&st->pdev->dev);
+
+- if (state)
++ if (state) {
++ atomic_inc(&st->user_requested_state);
+ ret = pm_runtime_get_sync(&st->pdev->dev);
+- else {
++ } else {
++ atomic_dec(&st->user_requested_state);
+ pm_runtime_mark_last_busy(&st->pdev->dev);
+ pm_runtime_use_autosuspend(&st->pdev->dev);
+ ret = pm_runtime_put_autosuspend(&st->pdev->dev);
--- /dev/null
+From 3d13de4b027d5f6276c0f9d3a264f518747d83f2 Mon Sep 17 00:00:00 2001
+From: Martin Kelly <mkelly@xevo.com>
+Date: Mon, 26 Mar 2018 14:27:52 -0700
+Subject: iio:kfifo_buf: check for uint overflow
+
+From: Martin Kelly <mkelly@xevo.com>
+
+commit 3d13de4b027d5f6276c0f9d3a264f518747d83f2 upstream.
+
+Currently, the following causes a kernel OOPS in memcpy:
+
+echo 1073741825 > buffer/length
+echo 1 > buffer/enable
+
+Note that using 1073741824 instead of 1073741825 causes "write error:
+Cannot allocate memory" but no OOPS.
+
+This is because 1073741824 == 2^30 and 1073741825 == 2^30+1. Since kfifo
+rounds up to the nearest power of 2, it will actually call kmalloc with
+roundup_pow_of_two(length) * bytes_per_datum.
+
+Using length == 1073741825 and bytes_per_datum == 2, we get:
+
+kmalloc(roundup_pow_of_two(1073741825) * 2
+or kmalloc(2147483648 * 2)
+or kmalloc(4294967296)
+or kmalloc(UINT_MAX + 1)
+
+so this overflows to 0, causing kmalloc to return ZERO_SIZE_PTR and
+subsequent memcpy to fail once the device is enabled.
+
+Fix this by checking for overflow prior to allocating a kfifo. With this
+check added, the above code returns -EINVAL when enabling the buffer,
+rather than causing an OOPS.
+
+Signed-off-by: Martin Kelly <mkelly@xevo.com>
+cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/buffer/kfifo_buf.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/iio/buffer/kfifo_buf.c
++++ b/drivers/iio/buffer/kfifo_buf.c
+@@ -27,6 +27,13 @@ static inline int __iio_allocate_kfifo(s
+ if ((length == 0) || (bytes_per_datum == 0))
+ return -EINVAL;
+
++ /*
++ * Make sure we don't overflow an unsigned int after kfifo rounds up to
++ * the next power of 2.
++ */
++ if (roundup_pow_of_two(length) > UINT_MAX / bytes_per_datum)
++ return -EINVAL;
++
+ return __kfifo_alloc((struct __kfifo *)&buf->kf, length,
+ bytes_per_datum, GFP_KERNEL);
+ }
--- /dev/null
+From 0ed2424b911f3a058dfea01b78817abed767433d Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Thu, 24 May 2018 11:27:27 +0300
+Subject: intel_th: Use correct device when freeing buffers
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+commit 0ed2424b911f3a058dfea01b78817abed767433d upstream.
+
+Commit d5c435df4a890 ("intel_th: msu: Use the real device in case of IOMMU
+domain allocation") changes dma buffer allocation to use the actual
+underlying device, but forgets to change the deallocation path, which leads
+to (if you've got CAP_SYS_RAWIO):
+
+> # echo 0,0 > /sys/bus/intel_th/devices/0-msc0/nr_pages
+> ------------[ cut here ]------------
+> kernel BUG at ../linux/drivers/iommu/intel-iommu.c:3670!
+> CPU: 3 PID: 231 Comm: sh Not tainted 4.17.0-rc1+ #2729
+> RIP: 0010:intel_unmap+0x11e/0x130
+...
+> Call Trace:
+> intel_free_coherent+0x3e/0x60
+> msc_buffer_win_free+0x100/0x160 [intel_th_msu]
+
+This patch fixes the buffer deallocation code to use the correct device.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Fixes: d5c435df4a890 ("intel_th: msu: Use the real device in case of IOMMU domain allocation")
+Reported-by: Baofeng Tian <baofeng.tian@intel.com>
+CC: stable@vger.kernel.org # v4.14+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/intel_th/msu.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/hwtracing/intel_th/msu.c
++++ b/drivers/hwtracing/intel_th/msu.c
+@@ -741,8 +741,8 @@ err_nomem:
+ /* Reset the page to write-back before releasing */
+ set_memory_wb((unsigned long)win->block[i].bdesc, 1);
+ #endif
+- dma_free_coherent(msc_dev(msc), size, win->block[i].bdesc,
+- win->block[i].addr);
++ dma_free_coherent(msc_dev(msc)->parent->parent, size,
++ win->block[i].bdesc, win->block[i].addr);
+ }
+ kfree(win);
+
+@@ -777,7 +777,7 @@ static void msc_buffer_win_free(struct m
+ /* Reset the page to write-back before releasing */
+ set_memory_wb((unsigned long)win->block[i].bdesc, 1);
+ #endif
+- dma_free_coherent(msc_dev(win->msc), PAGE_SIZE,
++ dma_free_coherent(msc_dev(win->msc)->parent->parent, PAGE_SIZE,
+ win->block[i].bdesc, win->block[i].addr);
+ }
+
--- /dev/null
+From 32795631e67e16141aa5e065c28ba03bf17abb90 Mon Sep 17 00:00:00 2001
+From: Mathias Kresin <dev@kresin.me>
+Date: Sun, 8 Apr 2018 10:30:03 +0200
+Subject: MIPS: lantiq: gphy: Drop reboot/remove reset asserts
+
+From: Mathias Kresin <dev@kresin.me>
+
+commit 32795631e67e16141aa5e065c28ba03bf17abb90 upstream.
+
+While doing a global software reset, these bits are not cleared and let
+some bootloader fail to initialise the GPHYs. The bootloader don't
+expect the GPHYs in reset, as they aren't during power on.
+
+The asserts were a workaround for a wrong syscon-reboot mask. With a
+mask set which includes the GPHY resets, these resets aren't required
+any more.
+
+Fixes: 126534141b45 ("MIPS: lantiq: Add a GPHY driver which uses the RCU syscon-mfd")
+Signed-off-by: Mathias Kresin <dev@kresin.me>
+Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: John Crispin <john@phrozen.org>
+Cc: linux-mips@linux-mips.org
+Cc: <stable@vger.kernel.org> # 4.14+
+Patchwork: https://patchwork.linux-mips.org/patch/19003/
+[jhogan@kernel.org: Fix build warnings]
+Signed-off-by: James Hogan <jhogan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/soc/lantiq/gphy.c | 36 ------------------------------------
+ 1 file changed, 36 deletions(-)
+
+--- a/drivers/soc/lantiq/gphy.c
++++ b/drivers/soc/lantiq/gphy.c
+@@ -30,7 +30,6 @@ struct xway_gphy_priv {
+ struct clk *gphy_clk_gate;
+ struct reset_control *gphy_reset;
+ struct reset_control *gphy_reset2;
+- struct notifier_block gphy_reboot_nb;
+ void __iomem *membase;
+ char *fw_name;
+ };
+@@ -64,24 +63,6 @@ static const struct of_device_id xway_gp
+ };
+ MODULE_DEVICE_TABLE(of, xway_gphy_match);
+
+-static struct xway_gphy_priv *to_xway_gphy_priv(struct notifier_block *nb)
+-{
+- return container_of(nb, struct xway_gphy_priv, gphy_reboot_nb);
+-}
+-
+-static int xway_gphy_reboot_notify(struct notifier_block *reboot_nb,
+- unsigned long code, void *unused)
+-{
+- struct xway_gphy_priv *priv = to_xway_gphy_priv(reboot_nb);
+-
+- if (priv) {
+- reset_control_assert(priv->gphy_reset);
+- reset_control_assert(priv->gphy_reset2);
+- }
+-
+- return NOTIFY_DONE;
+-}
+-
+ static int xway_gphy_load(struct device *dev, struct xway_gphy_priv *priv,
+ dma_addr_t *dev_addr)
+ {
+@@ -205,14 +186,6 @@ static int xway_gphy_probe(struct platfo
+ reset_control_deassert(priv->gphy_reset);
+ reset_control_deassert(priv->gphy_reset2);
+
+- /* assert the gphy reset because it can hang after a reboot: */
+- priv->gphy_reboot_nb.notifier_call = xway_gphy_reboot_notify;
+- priv->gphy_reboot_nb.priority = -1;
+-
+- ret = register_reboot_notifier(&priv->gphy_reboot_nb);
+- if (ret)
+- dev_warn(dev, "Failed to register reboot notifier\n");
+-
+ platform_set_drvdata(pdev, priv);
+
+ return ret;
+@@ -220,21 +193,12 @@ static int xway_gphy_probe(struct platfo
+
+ static int xway_gphy_remove(struct platform_device *pdev)
+ {
+- struct device *dev = &pdev->dev;
+ struct xway_gphy_priv *priv = platform_get_drvdata(pdev);
+- int ret;
+-
+- reset_control_assert(priv->gphy_reset);
+- reset_control_assert(priv->gphy_reset2);
+
+ iowrite32be(0, priv->membase);
+
+ clk_disable_unprepare(priv->gphy_clk_gate);
+
+- ret = unregister_reboot_notifier(&priv->gphy_reboot_nb);
+- if (ret)
+- dev_warn(dev, "Failed to unregister reboot notifier\n");
+-
+ return 0;
+ }
+
--- /dev/null
+From 28e4213dd331e944e7fca1954a946829162ed9d4 Mon Sep 17 00:00:00 2001
+From: "Maciej W. Rozycki" <macro@mips.com>
+Date: Tue, 15 May 2018 23:04:44 +0100
+Subject: MIPS: prctl: Disallow FRE without FR with PR_SET_FP_MODE requests
+
+From: Maciej W. Rozycki <macro@mips.com>
+
+commit 28e4213dd331e944e7fca1954a946829162ed9d4 upstream.
+
+Having PR_FP_MODE_FRE (i.e. Config5.FRE) set without PR_FP_MODE_FR (i.e.
+Status.FR) is not supported as the lone purpose of Config5.FRE is to
+emulate Status.FR=0 handling on FPU hardware that has Status.FR=1
+hardwired[1][2]. Also we do not handle this case elsewhere, and assume
+throughout our code that TIF_HYBRID_FPREGS and TIF_32BIT_FPREGS cannot
+be set both at once for a task, leading to inconsistent behaviour if
+this does happen.
+
+Return unsuccessfully then from prctl(2) PR_SET_FP_MODE calls requesting
+PR_FP_MODE_FRE to be set with PR_FP_MODE_FR clear. This corresponds to
+modes allowed by `mips_set_personality_fp'.
+
+References:
+
+[1] "MIPS Architecture For Programmers, Vol. III: MIPS32 / microMIPS32
+ Privileged Resource Architecture", Imagination Technologies,
+ Document Number: MD00090, Revision 6.02, July 10, 2015, Table 9.69
+ "Config5 Register Field Descriptions", p. 262
+
+[2] "MIPS Architecture For Programmers, Volume III: MIPS64 / microMIPS64
+ Privileged Resource Architecture", Imagination Technologies,
+ Document Number: MD00091, Revision 6.03, December 22, 2015, Table
+ 9.72 "Config5 Register Field Descriptions", p. 288
+
+Fixes: 9791554b45a2 ("MIPS,prctl: add PR_[GS]ET_FP_MODE prctl options for MIPS")
+Signed-off-by: Maciej W. Rozycki <macro@mips.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: linux-mips@linux-mips.org
+Cc: <stable@vger.kernel.org> # 4.0+
+Patchwork: https://patchwork.linux-mips.org/patch/19327/
+Signed-off-by: James Hogan <jhogan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kernel/process.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/mips/kernel/process.c
++++ b/arch/mips/kernel/process.c
+@@ -721,6 +721,10 @@ int mips_set_process_fp_mode(struct task
+ if (value & ~known_bits)
+ return -EOPNOTSUPP;
+
++ /* Setting FRE without FR is not supported. */
++ if ((value & (PR_FP_MODE_FR | PR_FP_MODE_FRE)) == PR_FP_MODE_FRE)
++ return -EOPNOTSUPP;
++
+ /* Avoid inadvertently triggering emulation */
+ if ((value & PR_FP_MODE_FR) && raw_cpu_has_fpu &&
+ !(raw_current_cpu_data.fpu_id & MIPS_FPIR_F64))
--- /dev/null
+From c7e814628df65f424fe197dde73bfc67e4a244d7 Mon Sep 17 00:00:00 2001
+From: "Maciej W. Rozycki" <macro@mips.com>
+Date: Wed, 16 May 2018 16:39:58 +0100
+Subject: MIPS: ptrace: Fix PTRACE_PEEKUSR requests for 64-bit FGRs
+
+From: Maciej W. Rozycki <macro@mips.com>
+
+commit c7e814628df65f424fe197dde73bfc67e4a244d7 upstream.
+
+Use 64-bit accesses for 64-bit floating-point general registers with
+PTRACE_PEEKUSR, removing the truncation of their upper halves in the
+FR=1 mode, caused by commit bbd426f542cb ("MIPS: Simplify FP context
+access"), which inadvertently switched them to using 32-bit accesses.
+
+The PTRACE_POKEUSR side is fine as it's never been broken and continues
+using 64-bit accesses.
+
+Fixes: bbd426f542cb ("MIPS: Simplify FP context access")
+Signed-off-by: Maciej W. Rozycki <macro@mips.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: linux-mips@linux-mips.org
+Cc: <stable@vger.kernel.org> # 3.15+
+Patchwork: https://patchwork.linux-mips.org/patch/19334/
+Signed-off-by: James Hogan <jhogan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kernel/ptrace.c | 2 +-
+ arch/mips/kernel/ptrace32.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/mips/kernel/ptrace.c
++++ b/arch/mips/kernel/ptrace.c
+@@ -818,7 +818,7 @@ long arch_ptrace(struct task_struct *chi
+ break;
+ }
+ #endif
+- tmp = get_fpr32(&fregs[addr - FPR_BASE], 0);
++ tmp = get_fpr64(&fregs[addr - FPR_BASE], 0);
+ break;
+ case PC:
+ tmp = regs->cp0_epc;
+--- a/arch/mips/kernel/ptrace32.c
++++ b/arch/mips/kernel/ptrace32.c
+@@ -109,7 +109,7 @@ long compat_arch_ptrace(struct task_stru
+ addr & 1);
+ break;
+ }
+- tmp = get_fpr32(&fregs[addr - FPR_BASE], 0);
++ tmp = get_fpr64(&fregs[addr - FPR_BASE], 0);
+ break;
+ case PC:
+ tmp = regs->cp0_epc;
--- /dev/null
+From 2d077d4b59924acd1f5180c6fb73b57f4771fde6 Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd@google.com>
+Date: Fri, 1 Jun 2018 16:50:45 -0700
+Subject: mm/huge_memory.c: __split_huge_page() use atomic ClearPageDirty()
+
+From: Hugh Dickins <hughd@google.com>
+
+commit 2d077d4b59924acd1f5180c6fb73b57f4771fde6 upstream.
+
+Swapping load on huge=always tmpfs (with khugepaged tuned up to be very
+eager, but I'm not sure that is relevant) soon hung uninterruptibly,
+waiting for page lock in shmem_getpage_gfp()'s find_lock_entry(), most
+often when "cp -a" was trying to write to a smallish file. Debug showed
+that the page in question was not locked, and page->mapping NULL by now,
+but page->index consistent with having been in a huge page before.
+
+Reproduced in minutes on a 4.15 kernel, even with 4.17's 605ca5ede764
+("mm/huge_memory.c: reorder operations in __split_huge_page_tail()") added
+in; but took hours to reproduce on a 4.17 kernel (no idea why).
+
+The culprit proved to be the __ClearPageDirty() on tails beyond i_size in
+__split_huge_page(): the non-atomic __bitoperation may have been safe when
+4.8's baa355fd3314 ("thp: file pages support for split_huge_page()")
+introduced it, but liable to erase PageWaiters after 4.10's 62906027091f
+("mm: add PageWaiters indicating tasks are waiting for a page bit").
+
+Link: http://lkml.kernel.org/r/alpine.LSU.2.11.1805291841070.3197@eggly.anvils
+Fixes: 62906027091f ("mm: add PageWaiters indicating tasks are waiting for a page bit")
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Cc: Nicholas Piggin <npiggin@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/huge_memory.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2432,7 +2432,7 @@ static void __split_huge_page(struct pag
+ __split_huge_page_tail(head, i, lruvec, list);
+ /* Some pages can be beyond i_size: drop them from page cache */
+ if (head[i].index >= end) {
+- __ClearPageDirty(head + i);
++ ClearPageDirty(head + i);
+ __delete_from_page_cache(head + i, NULL);
+ if (IS_ENABLED(CONFIG_SHMEM) && PageSwapBacked(head))
+ shmem_uncharge(head->mapping->host, 1);
--- /dev/null
+From 52a192362932f333a7ebafd581c4d9b81da2fec8 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Mon, 28 May 2018 13:25:06 +0200
+Subject: Revert "rt2800: use TXOP_BACKOFF for probe frames"
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit 52a192362932f333a7ebafd581c4d9b81da2fec8 upstream.
+
+This reverts commit fb47ada8dc3c30c8e7b415da155742b49536c61e.
+
+In some situations when we set TXOP_BACKOFF, the probe frame is
+not sent at all. What it worse then sending probe frame as part
+of AMPDU and can degrade 11n performance to 11g rates.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ralink/rt2x00/rt2x00queue.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
+@@ -372,16 +372,15 @@ static void rt2x00queue_create_tx_descri
+
+ /*
+ * Determine IFS values
+- * - Use TXOP_BACKOFF for probe and management frames except beacons
++ * - Use TXOP_BACKOFF for management frames except beacons
+ * - Use TXOP_SIFS for fragment bursts
+ * - Use TXOP_HTTXOP for everything else
+ *
+ * Note: rt2800 devices won't use CTS protection (if used)
+ * for frames not transmitted with TXOP_HTTXOP
+ */
+- if ((ieee80211_is_mgmt(hdr->frame_control) &&
+- !ieee80211_is_beacon(hdr->frame_control)) ||
+- (tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE))
++ if (ieee80211_is_mgmt(hdr->frame_control) &&
++ !ieee80211_is_beacon(hdr->frame_control))
+ txdesc->u.ht.txop = TXOP_BACKOFF;
+ else if (!(tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT))
+ txdesc->u.ht.txop = TXOP_SIFS;
--- /dev/null
+From c9ddf73476ff4fffb7a87bd5107a0705bf2cf64b Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bart.vanassche@wdc.com>
+Date: Mon, 21 May 2018 11:17:29 -0700
+Subject: scsi: scsi_transport_srp: Fix shost to rport translation
+
+From: Bart Van Assche <bart.vanassche@wdc.com>
+
+commit c9ddf73476ff4fffb7a87bd5107a0705bf2cf64b upstream.
+
+Since an SRP remote port is attached as a child to shost->shost_gendev
+and as the only child, the translation from the shost pointer into an
+rport pointer must happen by looking up the shost child that is an
+rport. This patch fixes the following KASAN complaint:
+
+BUG: KASAN: slab-out-of-bounds in srp_timed_out+0x57/0x110 [scsi_transport_srp]
+Read of size 4 at addr ffff880035d3fcc0 by task kworker/1:0H/19
+
+CPU: 1 PID: 19 Comm: kworker/1:0H Not tainted 4.16.0-rc3-dbg+ #1
+Workqueue: kblockd blk_mq_timeout_work
+Call Trace:
+dump_stack+0x85/0xc7
+print_address_description+0x65/0x270
+kasan_report+0x231/0x350
+srp_timed_out+0x57/0x110 [scsi_transport_srp]
+scsi_times_out+0xc7/0x3f0 [scsi_mod]
+blk_mq_terminate_expired+0xc2/0x140
+bt_iter+0xbc/0xd0
+blk_mq_queue_tag_busy_iter+0x1c7/0x350
+blk_mq_timeout_work+0x325/0x3f0
+process_one_work+0x441/0xa50
+worker_thread+0x76/0x6c0
+kthread+0x1b2/0x1d0
+ret_from_fork+0x24/0x30
+
+Fixes: e68ca75200fe ("scsi_transport_srp: Reduce failover time")
+Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
+Cc: Hannes Reinecke <hare@suse.com>
+Cc: Johannes Thumshirn <jthumshirn@suse.de>
+Cc: Jason Gunthorpe <jgg@mellanox.com>
+Cc: Doug Ledford <dledford@redhat.com>
+Cc: Laurence Oberman <loberman@redhat.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/scsi_transport_srp.c | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/scsi_transport_srp.c
++++ b/drivers/scsi/scsi_transport_srp.c
+@@ -51,6 +51,8 @@ struct srp_internal {
+ struct transport_container rport_attr_cont;
+ };
+
++static int scsi_is_srp_rport(const struct device *dev);
++
+ #define to_srp_internal(tmpl) container_of(tmpl, struct srp_internal, t)
+
+ #define dev_to_rport(d) container_of(d, struct srp_rport, dev)
+@@ -60,9 +62,24 @@ static inline struct Scsi_Host *rport_to
+ return dev_to_shost(r->dev.parent);
+ }
+
++static int find_child_rport(struct device *dev, void *data)
++{
++ struct device **child = data;
++
++ if (scsi_is_srp_rport(dev)) {
++ WARN_ON_ONCE(*child);
++ *child = dev;
++ }
++ return 0;
++}
++
+ static inline struct srp_rport *shost_to_rport(struct Scsi_Host *shost)
+ {
+- return transport_class_to_srp_rport(&shost->shost_gendev);
++ struct device *child = NULL;
++
++ WARN_ON_ONCE(device_for_each_child(&shost->shost_gendev, &child,
++ find_child_rport) < 0);
++ return child ? dev_to_rport(child) : NULL;
+ }
+
+ /**
+@@ -600,7 +617,8 @@ enum blk_eh_timer_return srp_timed_out(s
+ struct srp_rport *rport = shost_to_rport(shost);
+
+ pr_debug("timeout for sdev %s\n", dev_name(&sdev->sdev_gendev));
+- return rport->fast_io_fail_tmo < 0 && rport->dev_loss_tmo < 0 &&
++ return rport && rport->fast_io_fail_tmo < 0 &&
++ rport->dev_loss_tmo < 0 &&
+ i->f->reset_timer_if_blocked && scsi_device_blocked(sdev) ?
+ BLK_EH_RESET_TIMER : BLK_EH_NOT_HANDLED;
+ }
cfg80211-further-limit-wiphy-names-to-64-bytes.patch
drm-amd-powerplay-fix-enum-mismatch.patch
rtlwifi-rtl8192cu-remove-variable-self-assignment-in-rf.c.patch
+iio-ad7793-implement-iio_chan_info_samp_freq.patch
+iio-hid-sensor-trigger-fix-sometimes-not-powering-up-the-sensor-after-resume.patch
+iio-buffer-make-length-types-match-kfifo-types.patch
+iio-kfifo_buf-check-for-uint-overflow.patch
+iio-adc-stm32-dfsdm-fix-successive-oversampling-settings.patch
+iio-adc-stm32-dfsdm-fix-sample-rate-for-div2-spi-clock.patch
+iio-adc-at91-sama5d2_adc-fix-channel-configuration-for-differential-channels.patch
+iio-adc-select-buffer-for-at91-sama5d2_adc.patch
+mips-lantiq-gphy-drop-reboot-remove-reset-asserts.patch
+mips-ptrace-fix-ptrace_peekusr-requests-for-64-bit-fgrs.patch
+mips-prctl-disallow-fre-without-fr-with-pr_set_fp_mode-requests.patch
+scsi-scsi_transport_srp-fix-shost-to-rport-translation.patch
+stm-class-use-vmalloc-for-the-master-map.patch
+hwtracing-stm-fix-build-error-on-some-arches.patch
+ib-core-fix-error-code-for-invalid-gid-entry.patch
+mm-huge_memory.c-__split_huge_page-use-atomic-clearpagedirty.patch
+revert-rt2800-use-txop_backoff-for-probe-frames.patch
+intel_th-use-correct-device-when-freeing-buffers.patch
+drm-psr-fix-missed-entry-in-psr-setup-time-table.patch
--- /dev/null
+From b5e2ced9bf81393034072dd4d372f6b430bc1f0a Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Thu, 24 May 2018 11:27:26 +0300
+Subject: stm class: Use vmalloc for the master map
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+commit b5e2ced9bf81393034072dd4d372f6b430bc1f0a upstream.
+
+Fengguang is running into a warning from the buddy allocator:
+
+> swapper/0: page allocation failure: order:9, mode:0x14040c0(GFP_KERNEL|__GFP_COMP), nodemask=(null)
+> CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.17.0-rc1 #262
+> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
+> Call Trace:
+...
+> __kmalloc+0x14b/0x180: ____cache_alloc at mm/slab.c:3127
+> stm_register_device+0xf3/0x5c0: stm_register_device at drivers/hwtracing/stm/core.c:695
+...
+
+Which is basically a result of the stm class trying to allocate ~512kB
+for the dummy_stm with its default parameters. There's no reason, however,
+for it not to be vmalloc()ed instead, which is what this patch does.
+
+Reported-by: Fengguang Wu <fengguang.wu@intel.com>
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+CC: stable@vger.kernel.org # v4.4+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/stm/core.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/hwtracing/stm/core.c
++++ b/drivers/hwtracing/stm/core.c
+@@ -682,7 +682,7 @@ static void stm_device_release(struct de
+ {
+ struct stm_device *stm = to_stm_device(dev);
+
+- kfree(stm);
++ vfree(stm);
+ }
+
+ int stm_register_device(struct device *parent, struct stm_data *stm_data,
+@@ -699,7 +699,7 @@ int stm_register_device(struct device *p
+ return -EINVAL;
+
+ nmasters = stm_data->sw_end - stm_data->sw_start + 1;
+- stm = kzalloc(sizeof(*stm) + nmasters * sizeof(void *), GFP_KERNEL);
++ stm = vzalloc(sizeof(*stm) + nmasters * sizeof(void *));
+ if (!stm)
+ return -ENOMEM;
+
+@@ -752,7 +752,7 @@ err_device:
+ /* matches device_initialize() above */
+ put_device(&stm->dev);
+ err_free:
+- kfree(stm);
++ vfree(stm);
+
+ return err;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
