From: Greg Kroah-Hartman Date: Sun, 3 Jun 2018 08:37:42 +0000 (+0200) Subject: 4.16-stable patches X-Git-Tag: v4.9.106~22 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c083f374fd74ca94ce23b029e0a2bedd0f30d91f;p=thirdparty%2Fkernel%2Fstable-queue.git 4.16-stable patches added patches: drm-psr-fix-missed-entry-in-psr-setup-time-table.patch hwtracing-stm-fix-build-error-on-some-arches.patch ib-core-fix-error-code-for-invalid-gid-entry.patch iio-ad7793-implement-iio_chan_info_samp_freq.patch iio-adc-at91-sama5d2_adc-fix-channel-configuration-for-differential-channels.patch iio-adc-select-buffer-for-at91-sama5d2_adc.patch iio-adc-stm32-dfsdm-fix-sample-rate-for-div2-spi-clock.patch iio-adc-stm32-dfsdm-fix-successive-oversampling-settings.patch iio-buffer-make-length-types-match-kfifo-types.patch iio-hid-sensor-trigger-fix-sometimes-not-powering-up-the-sensor-after-resume.patch iio-kfifo_buf-check-for-uint-overflow.patch intel_th-use-correct-device-when-freeing-buffers.patch mips-lantiq-gphy-drop-reboot-remove-reset-asserts.patch mips-prctl-disallow-fre-without-fr-with-pr_set_fp_mode-requests.patch mips-ptrace-fix-ptrace_peekusr-requests-for-64-bit-fgrs.patch mm-huge_memory.c-__split_huge_page-use-atomic-clearpagedirty.patch revert-rt2800-use-txop_backoff-for-probe-frames.patch scsi-scsi_transport_srp-fix-shost-to-rport-translation.patch stm-class-use-vmalloc-for-the-master-map.patch --- diff --git a/queue-4.16/drm-psr-fix-missed-entry-in-psr-setup-time-table.patch b/queue-4.16/drm-psr-fix-missed-entry-in-psr-setup-time-table.patch new file mode 100644 index 00000000000..71bc74af26d --- /dev/null +++ b/queue-4.16/drm-psr-fix-missed-entry-in-psr-setup-time-table.patch @@ -0,0 +1,45 @@ +From bdcc02cf1bb508fc700df7662f55058f651f2621 Mon Sep 17 00:00:00 2001 +From: Dhinakaran Pandiyan +Date: Fri, 11 May 2018 12:51:42 -0700 +Subject: drm/psr: Fix missed entry in PSR setup time table. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dhinakaran Pandiyan + +commit bdcc02cf1bb508fc700df7662f55058f651f2621 upstream. + +Entry corresponding to 220 us setup time was missing. I am not aware of +any specific bug this fixes, but this could potentially result in enabling +PSR on a panel with a higher setup time requirement than supported by the +hardware. + +I verified the value is present in eDP spec versions 1.3, 1.4 and 1.4a. + +Fixes: 6608804b3d7f ("drm/dp: Add drm_dp_psr_setup_time()") +Cc: stable@vger.kernel.org +Cc: Ville Syrjälä +Cc: Jose Roberto de Souza +Cc: dri-devel@lists.freedesktop.org +Reviewed-by: José Roberto de Souza +Reviewed-by: Tarun Vyas +Signed-off-by: Dhinakaran Pandiyan +Signed-off-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20180511195145.3829-3-dhinakaran.pandiyan@intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_dp_helper.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/drm_dp_helper.c ++++ b/drivers/gpu/drm/drm_dp_helper.c +@@ -1141,6 +1141,7 @@ int drm_dp_psr_setup_time(const u8 psr_c + static const u16 psr_setup_time_us[] = { + PSR_SETUP_TIME(330), + PSR_SETUP_TIME(275), ++ PSR_SETUP_TIME(220), + PSR_SETUP_TIME(165), + PSR_SETUP_TIME(110), + PSR_SETUP_TIME(55), diff --git a/queue-4.16/hwtracing-stm-fix-build-error-on-some-arches.patch b/queue-4.16/hwtracing-stm-fix-build-error-on-some-arches.patch new file mode 100644 index 00000000000..0c7285617a0 --- /dev/null +++ b/queue-4.16/hwtracing-stm-fix-build-error-on-some-arches.patch @@ -0,0 +1,33 @@ +From 806e30873f0e74d9d41b0ef761bd4d3e55c7d510 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Sat, 26 May 2018 08:49:24 +0200 +Subject: hwtracing: stm: fix build error on some arches + +From: Greg Kroah-Hartman + +commit 806e30873f0e74d9d41b0ef761bd4d3e55c7d510 upstream. + +Commit b5e2ced9bf81 ("stm class: Use vmalloc for the master map") caused +a build error on some arches as vmalloc.h was not explicitly included. + +Fix that by adding it to the list of includes. + +Fixes: b5e2ced9bf81 ("stm class: Use vmalloc for the master map") +Reported-by: kbuild test robot +Cc: Alexander Shishkin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/stm/core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/hwtracing/stm/core.c ++++ b/drivers/hwtracing/stm/core.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + #include "stm.h" + + #include diff --git a/queue-4.16/ib-core-fix-error-code-for-invalid-gid-entry.patch b/queue-4.16/ib-core-fix-error-code-for-invalid-gid-entry.patch new file mode 100644 index 00000000000..7ba4094d7a2 --- /dev/null +++ b/queue-4.16/ib-core-fix-error-code-for-invalid-gid-entry.patch @@ -0,0 +1,48 @@ +From a840c93ca7582bb6c88df2345a33f979b7a67874 Mon Sep 17 00:00:00 2001 +From: Parav Pandit +Date: Sun, 27 May 2018 14:49:16 +0300 +Subject: IB/core: Fix error code for invalid GID entry + +From: Parav Pandit + +commit a840c93ca7582bb6c88df2345a33f979b7a67874 upstream. + +When a GID entry is invalid EAGAIN is returned. This is an incorrect error +code, there is nothing that will make this GID entry valid again in +bounded time. + +Some user space tools fail incorrectly if EAGAIN is returned here, and +this represents a small ABI change from earlier kernels. + +The first patch in the Fixes list makes entries that were valid before +to become invalid, allowing this code to trigger, while the second patch +in the Fixes list introduced the wrong EAGAIN. + +Therefore revert the return result to EINVAL which matches the historical +expectations of the ibv_query_gid_type() API of the libibverbs user space +library. + +Cc: +Fixes: 598ff6bae689 ("IB/core: Refactor GID modify code for RoCE") +Fixes: 03db3a2d81e6 ("IB/core: Add RoCE GID table management") +Reviewed-by: Daniel Jurgens +Signed-off-by: Parav Pandit +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/core/cache.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/core/cache.c ++++ b/drivers/infiniband/core/cache.c +@@ -434,7 +434,7 @@ static int __ib_cache_gid_get(struct ib_ + return -EINVAL; + + if (table->data_vec[index].props & GID_TABLE_ENTRY_INVALID) +- return -EAGAIN; ++ return -EINVAL; + + memcpy(gid, &table->data_vec[index].gid, sizeof(*gid)); + if (attr) { diff --git a/queue-4.16/iio-ad7793-implement-iio_chan_info_samp_freq.patch b/queue-4.16/iio-ad7793-implement-iio_chan_info_samp_freq.patch new file mode 100644 index 00000000000..35fab07a629 --- /dev/null +++ b/queue-4.16/iio-ad7793-implement-iio_chan_info_samp_freq.patch @@ -0,0 +1,148 @@ +From 490fba90a90eb7b741f57fefd2bcf2c1e11eb471 Mon Sep 17 00:00:00 2001 +From: Michael Nosthoff +Date: Fri, 9 Mar 2018 16:13:52 +0100 +Subject: iio: ad7793: implement IIO_CHAN_INFO_SAMP_FREQ + +From: Michael Nosthoff + +commit 490fba90a90eb7b741f57fefd2bcf2c1e11eb471 upstream. + +This commit is a follow-up to changes made to ad_sigma_delta.h +in staging: iio: ad7192: implement IIO_CHAN_INFO_SAMP_FREQ +which broke ad7793 as it was not altered to match those changes. + +This driver predates the availability of IIO_CHAN_INFO_SAMP_FREQ +attribute wherein usage has some advantages like it can be accessed by +in-kernel consumers as well as reduces the code size. + +Therefore, use IIO_CHAN_INFO_SAMP_FREQ to implement the +sampling_frequency attribute instead of using IIO_DEV_ATTR_SAMP_FREQ() +macro. + +Move code from the functions associated with IIO_DEV_ATTR_SAMP_FREQ() +into respective read and write hooks with the mask set to +IIO_CHAN_INFO_SAMP_FREQ. + +Fixes: a13e831fcaa7 ("staging: iio: ad7192: implement IIO_CHAN_INFO_SAMP_FREQ") + +Signed-off-by: Michael Nosthoff +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/ad7793.c | 75 +++++++++++++++-------------------------------- + 1 file changed, 24 insertions(+), 51 deletions(-) + +--- a/drivers/iio/adc/ad7793.c ++++ b/drivers/iio/adc/ad7793.c +@@ -348,55 +348,6 @@ static const u16 ad7793_sample_freq_avai + static const u16 ad7797_sample_freq_avail[16] = {0, 0, 0, 123, 62, 50, 0, + 33, 0, 17, 16, 12, 10, 8, 6, 4}; + +-static ssize_t ad7793_read_frequency(struct device *dev, +- struct device_attribute *attr, +- char *buf) +-{ +- struct iio_dev *indio_dev = dev_to_iio_dev(dev); +- struct ad7793_state *st = iio_priv(indio_dev); +- +- return sprintf(buf, "%d\n", +- st->chip_info->sample_freq_avail[AD7793_MODE_RATE(st->mode)]); +-} +- +-static ssize_t ad7793_write_frequency(struct device *dev, +- struct device_attribute *attr, +- const char *buf, +- size_t len) +-{ +- struct iio_dev *indio_dev = dev_to_iio_dev(dev); +- struct ad7793_state *st = iio_priv(indio_dev); +- long lval; +- int i, ret; +- +- ret = kstrtol(buf, 10, &lval); +- if (ret) +- return ret; +- +- if (lval == 0) +- return -EINVAL; +- +- for (i = 0; i < 16; i++) +- if (lval == st->chip_info->sample_freq_avail[i]) +- break; +- if (i == 16) +- return -EINVAL; +- +- ret = iio_device_claim_direct_mode(indio_dev); +- if (ret) +- return ret; +- st->mode &= ~AD7793_MODE_RATE(-1); +- st->mode |= AD7793_MODE_RATE(i); +- ad_sd_write_reg(&st->sd, AD7793_REG_MODE, sizeof(st->mode), st->mode); +- iio_device_release_direct_mode(indio_dev); +- +- return len; +-} +- +-static IIO_DEV_ATTR_SAMP_FREQ(S_IWUSR | S_IRUGO, +- ad7793_read_frequency, +- ad7793_write_frequency); +- + static IIO_CONST_ATTR_SAMP_FREQ_AVAIL( + "470 242 123 62 50 39 33 19 17 16 12 10 8 6 4"); + +@@ -424,7 +375,6 @@ static IIO_DEVICE_ATTR_NAMED(in_m_in_sca + ad7793_show_scale_available, NULL, 0); + + static struct attribute *ad7793_attributes[] = { +- &iio_dev_attr_sampling_frequency.dev_attr.attr, + &iio_const_attr_sampling_frequency_available.dev_attr.attr, + &iio_dev_attr_in_m_in_scale_available.dev_attr.attr, + NULL +@@ -435,7 +385,6 @@ static const struct attribute_group ad77 + }; + + static struct attribute *ad7797_attributes[] = { +- &iio_dev_attr_sampling_frequency.dev_attr.attr, + &iio_const_attr_sampling_frequency_available_ad7797.dev_attr.attr, + NULL + }; +@@ -505,6 +454,10 @@ static int ad7793_read_raw(struct iio_de + *val -= offset; + } + return IIO_VAL_INT; ++ case IIO_CHAN_INFO_SAMP_FREQ: ++ *val = st->chip_info ++ ->sample_freq_avail[AD7793_MODE_RATE(st->mode)]; ++ return IIO_VAL_INT; + } + return -EINVAL; + } +@@ -542,6 +495,26 @@ static int ad7793_write_raw(struct iio_d + break; + } + break; ++ case IIO_CHAN_INFO_SAMP_FREQ: ++ if (!val) { ++ ret = -EINVAL; ++ break; ++ } ++ ++ for (i = 0; i < 16; i++) ++ if (val == st->chip_info->sample_freq_avail[i]) ++ break; ++ ++ if (i == 16) { ++ ret = -EINVAL; ++ break; ++ } ++ ++ st->mode &= ~AD7793_MODE_RATE(-1); ++ st->mode |= AD7793_MODE_RATE(i); ++ ad_sd_write_reg(&st->sd, AD7793_REG_MODE, sizeof(st->mode), ++ st->mode); ++ break; + default: + ret = -EINVAL; + } diff --git a/queue-4.16/iio-adc-at91-sama5d2_adc-fix-channel-configuration-for-differential-channels.patch b/queue-4.16/iio-adc-at91-sama5d2_adc-fix-channel-configuration-for-differential-channels.patch new file mode 100644 index 00000000000..1c8f1ca1990 --- /dev/null +++ b/queue-4.16/iio-adc-at91-sama5d2_adc-fix-channel-configuration-for-differential-channels.patch @@ -0,0 +1,108 @@ +From f0c8d1f6dc8eac5a1fbf441c8e080721a7b6c0ff Mon Sep 17 00:00:00 2001 +From: Eugen Hristev +Date: Tue, 10 Apr 2018 11:57:47 +0300 +Subject: iio: adc: at91-sama5d2_adc: fix channel configuration for differential channels + +From: Eugen Hristev + +commit f0c8d1f6dc8eac5a1fbf441c8e080721a7b6c0ff upstream. + +When iterating through the channels, the index in the array is not the +scan index. Added an xlate function to translate to the proper index. +The result of the bug is that the channel array is indexed with a wrong index, +thus instead of the proper channel, we access invalid memory, which may +lead to invalid results and/or corruption. +This will be used also for devicetree channel xlate. + +Fixes: 5e1a1da0f ("iio: adc: at91-sama5d2_adc: add hw trigger and buffer support") +Fixes: 073c66201 ("iio: adc: at91-sama5d2_adc: add support for DMA") +Signed-off-by: Eugen Hristev +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/at91-sama5d2_adc.c | 41 +++++++++++++++++++++++++++++++++---- + 1 file changed, 37 insertions(+), 4 deletions(-) + +--- a/drivers/iio/adc/at91-sama5d2_adc.c ++++ b/drivers/iio/adc/at91-sama5d2_adc.c +@@ -333,6 +333,27 @@ static const struct iio_chan_spec at91_a + + AT91_SAMA5D2_DIFF_CHAN_CNT + 1), + }; + ++static int at91_adc_chan_xlate(struct iio_dev *indio_dev, int chan) ++{ ++ int i; ++ ++ for (i = 0; i < indio_dev->num_channels; i++) { ++ if (indio_dev->channels[i].scan_index == chan) ++ return i; ++ } ++ return -EINVAL; ++} ++ ++static inline struct iio_chan_spec const * ++at91_adc_chan_get(struct iio_dev *indio_dev, int chan) ++{ ++ int index = at91_adc_chan_xlate(indio_dev, chan); ++ ++ if (index < 0) ++ return NULL; ++ return indio_dev->channels + index; ++} ++ + static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state) + { + struct iio_dev *indio = iio_trigger_get_drvdata(trig); +@@ -350,8 +371,10 @@ static int at91_adc_configure_trigger(st + at91_adc_writel(st, AT91_SAMA5D2_TRGR, status); + + for_each_set_bit(bit, indio->active_scan_mask, indio->num_channels) { +- struct iio_chan_spec const *chan = indio->channels + bit; ++ struct iio_chan_spec const *chan = at91_adc_chan_get(indio, bit); + ++ if (!chan) ++ continue; + if (state) { + at91_adc_writel(st, AT91_SAMA5D2_CHER, + BIT(chan->channel)); +@@ -448,7 +471,11 @@ static int at91_adc_dma_start(struct iio + + for_each_set_bit(bit, indio_dev->active_scan_mask, + indio_dev->num_channels) { +- struct iio_chan_spec const *chan = indio_dev->channels + bit; ++ struct iio_chan_spec const *chan = ++ at91_adc_chan_get(indio_dev, bit); ++ ++ if (!chan) ++ continue; + + st->dma_st.rx_buf_sz += chan->scan_type.storagebits / 8; + } +@@ -526,8 +553,11 @@ static int at91_adc_buffer_predisable(st + */ + for_each_set_bit(bit, indio_dev->active_scan_mask, + indio_dev->num_channels) { +- struct iio_chan_spec const *chan = indio_dev->channels + bit; ++ struct iio_chan_spec const *chan = ++ at91_adc_chan_get(indio_dev, bit); + ++ if (!chan) ++ continue; + if (st->dma_st.dma_chan) + at91_adc_readl(st, chan->address); + } +@@ -587,8 +617,11 @@ static void at91_adc_trigger_handler_nod + + for_each_set_bit(bit, indio_dev->active_scan_mask, + indio_dev->num_channels) { +- struct iio_chan_spec const *chan = indio_dev->channels + bit; ++ struct iio_chan_spec const *chan = ++ at91_adc_chan_get(indio_dev, bit); + ++ if (!chan) ++ continue; + st->buffer[i] = at91_adc_readl(st, chan->address); + i++; + } diff --git a/queue-4.16/iio-adc-select-buffer-for-at91-sama5d2_adc.patch b/queue-4.16/iio-adc-select-buffer-for-at91-sama5d2_adc.patch new file mode 100644 index 00000000000..ed2bb7f04c8 --- /dev/null +++ b/queue-4.16/iio-adc-select-buffer-for-at91-sama5d2_adc.patch @@ -0,0 +1,36 @@ +From 76974ef9d1bf397b7bb97892a3b3bc516a1fc2c2 Mon Sep 17 00:00:00 2001 +From: Eugen Hristev +Date: Mon, 16 Apr 2018 09:54:03 +0300 +Subject: iio: adc: select buffer for at91-sama5d2_adc + +From: Eugen Hristev + +commit 76974ef9d1bf397b7bb97892a3b3bc516a1fc2c2 upstream. + +We need to select the buffer code, otherwise we get build errors +with undefined functions on the trigger and buffer, +if we select just IIO and then AT91_SAMA5D2_ADC from menuconfig + +This adds a Kconfig 'select' statement like other ADC +drivers have it already. + +Fixes: 5e1a1da0f8c9 ("iio: adc: at91-sama5d2_adc: add hw trigger and buffer support") +Signed-off-by: Eugen Hristev +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/adc/Kconfig ++++ b/drivers/iio/adc/Kconfig +@@ -159,6 +159,7 @@ config AT91_SAMA5D2_ADC + depends on ARCH_AT91 || COMPILE_TEST + depends on HAS_IOMEM + depends on HAS_DMA ++ select IIO_BUFFER + select IIO_TRIGGERED_BUFFER + help + Say yes here to build support for Atmel SAMA5D2 ADC which is diff --git a/queue-4.16/iio-adc-stm32-dfsdm-fix-sample-rate-for-div2-spi-clock.patch b/queue-4.16/iio-adc-stm32-dfsdm-fix-sample-rate-for-div2-spi-clock.patch new file mode 100644 index 00000000000..19ec71ffb09 --- /dev/null +++ b/queue-4.16/iio-adc-stm32-dfsdm-fix-sample-rate-for-div2-spi-clock.patch @@ -0,0 +1,56 @@ +From d58109dcf37fc9baec354385ec9fdcd8878d174d Mon Sep 17 00:00:00 2001 +From: Fabrice Gasnier +Date: Tue, 13 Mar 2018 15:23:06 +0100 +Subject: iio: adc: stm32-dfsdm: fix sample rate for div2 spi clock + +From: Fabrice Gasnier + +commit d58109dcf37fc9baec354385ec9fdcd8878d174d upstream. + +When channel clk source is set to "CLKOUT_F" or "CLKOUT_R" (e.g. div2), +sample rate is currently set to half the requested value. + +Fixes: eca949800d2d ("IIO: ADC: add stm32 DFSDM support for PDM +microphone") + +Signed-off-by: Fabrice Gasnier +Acked-by: Arnaud Pouliquen +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/stm32-dfsdm-adc.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/iio/adc/stm32-dfsdm-adc.c ++++ b/drivers/iio/adc/stm32-dfsdm-adc.c +@@ -771,7 +771,7 @@ static int stm32_dfsdm_write_raw(struct + struct stm32_dfsdm_adc *adc = iio_priv(indio_dev); + struct stm32_dfsdm_filter *fl = &adc->dfsdm->fl_list[adc->fl_id]; + struct stm32_dfsdm_channel *ch = &adc->dfsdm->ch_list[chan->channel]; +- unsigned int spi_freq = adc->spi_freq; ++ unsigned int spi_freq; + int ret = -EINVAL; + + switch (mask) { +@@ -785,8 +785,18 @@ static int stm32_dfsdm_write_raw(struct + case IIO_CHAN_INFO_SAMP_FREQ: + if (!val) + return -EINVAL; +- if (ch->src != DFSDM_CHANNEL_SPI_CLOCK_EXTERNAL) ++ ++ switch (ch->src) { ++ case DFSDM_CHANNEL_SPI_CLOCK_INTERNAL: + spi_freq = adc->dfsdm->spi_master_freq; ++ break; ++ case DFSDM_CHANNEL_SPI_CLOCK_INTERNAL_DIV2_FALLING: ++ case DFSDM_CHANNEL_SPI_CLOCK_INTERNAL_DIV2_RISING: ++ spi_freq = adc->dfsdm->spi_master_freq / 2; ++ break; ++ default: ++ spi_freq = adc->spi_freq; ++ } + + if (spi_freq % val) + dev_warn(&indio_dev->dev, diff --git a/queue-4.16/iio-adc-stm32-dfsdm-fix-successive-oversampling-settings.patch b/queue-4.16/iio-adc-stm32-dfsdm-fix-successive-oversampling-settings.patch new file mode 100644 index 00000000000..eaacac37684 --- /dev/null +++ b/queue-4.16/iio-adc-stm32-dfsdm-fix-successive-oversampling-settings.patch @@ -0,0 +1,54 @@ +From 7531cf59bfa082769887ec70c2029838ea139f11 Mon Sep 17 00:00:00 2001 +From: Fabrice Gasnier +Date: Tue, 13 Mar 2018 15:23:05 +0100 +Subject: iio: adc: stm32-dfsdm: fix successive oversampling settings + +From: Fabrice Gasnier + +commit 7531cf59bfa082769887ec70c2029838ea139f11 upstream. + +When doing successive oversampling settings, it may fail to update filter +parameters silently: +- First time oversampling is being set, it will be successful, as fl->res +is 0 initially. +- Next attempts with various oversamp value may return 0 (success), but +keep previous filter parameters, due to 'res' never reaches above or +equal current 'fl->res'. + +This is particularly true when setting sampling frequency (that relies on +oversamp). Typical failure without error: +- run 1st test @16kHz samp freq will succeed +- run new test @8kHz will succeed as well +- run new test @16kHz (again): sample rate will remain 8kHz without error + +Fixes: e2e6771c6462 ("IIO: ADC: add STM32 DFSDM sigma delta ADC support") + +Signed-off-by: Fabrice Gasnier +Acked-by: Arnaud Pouliquen +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/stm32-dfsdm-adc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/iio/adc/stm32-dfsdm-adc.c ++++ b/drivers/iio/adc/stm32-dfsdm-adc.c +@@ -144,6 +144,7 @@ static int stm32_dfsdm_set_osrs(struct s + * Leave as soon as if exact resolution if reached. + * Otherwise the higher resolution below 32 bits is kept. + */ ++ fl->res = 0; + for (fosr = 1; fosr <= DFSDM_MAX_FL_OVERSAMPLING; fosr++) { + for (iosr = 1; iosr <= DFSDM_MAX_INT_OVERSAMPLING; iosr++) { + if (fast) +@@ -193,7 +194,7 @@ static int stm32_dfsdm_set_osrs(struct s + } + } + +- if (!fl->fosr) ++ if (!fl->res) + return -EINVAL; + + return 0; diff --git a/queue-4.16/iio-buffer-make-length-types-match-kfifo-types.patch b/queue-4.16/iio-buffer-make-length-types-match-kfifo-types.patch new file mode 100644 index 00000000000..f4ed721e280 --- /dev/null +++ b/queue-4.16/iio-buffer-make-length-types-match-kfifo-types.patch @@ -0,0 +1,86 @@ +From c043ec1ca5baae63726aae32abbe003192bc6eec Mon Sep 17 00:00:00 2001 +From: Martin Kelly +Date: Mon, 26 Mar 2018 14:27:51 -0700 +Subject: iio:buffer: make length types match kfifo types + +From: Martin Kelly + +commit c043ec1ca5baae63726aae32abbe003192bc6eec upstream. + +Currently, we use int for buffer length and bytes_per_datum. However, +kfifo uses unsigned int for length and size_t for element size. We need +to make sure these matches or we will have bugs related to overflow (in +the range between INT_MAX and UINT_MAX for length, for example). + +In addition, set_bytes_per_datum uses size_t while bytes_per_datum is an +int, which would cause bugs for large values of bytes_per_datum. + +Change buffer length to use unsigned int and bytes_per_datum to use +size_t. + +Signed-off-by: Martin Kelly +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/buffer/industrialio-buffer-dma.c | 2 +- + drivers/iio/buffer/kfifo_buf.c | 4 ++-- + include/linux/iio/buffer_impl.h | 6 +++--- + 3 files changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/iio/buffer/industrialio-buffer-dma.c ++++ b/drivers/iio/buffer/industrialio-buffer-dma.c +@@ -587,7 +587,7 @@ EXPORT_SYMBOL_GPL(iio_dma_buffer_set_byt + * Should be used as the set_length callback for iio_buffer_access_ops + * struct for DMA buffers. + */ +-int iio_dma_buffer_set_length(struct iio_buffer *buffer, int length) ++int iio_dma_buffer_set_length(struct iio_buffer *buffer, unsigned int length) + { + /* Avoid an invalid state */ + if (length < 2) +--- a/drivers/iio/buffer/kfifo_buf.c ++++ b/drivers/iio/buffer/kfifo_buf.c +@@ -22,7 +22,7 @@ struct iio_kfifo { + #define iio_to_kfifo(r) container_of(r, struct iio_kfifo, buffer) + + static inline int __iio_allocate_kfifo(struct iio_kfifo *buf, +- int bytes_per_datum, int length) ++ size_t bytes_per_datum, unsigned int length) + { + if ((length == 0) || (bytes_per_datum == 0)) + return -EINVAL; +@@ -67,7 +67,7 @@ static int iio_set_bytes_per_datum_kfifo + return 0; + } + +-static int iio_set_length_kfifo(struct iio_buffer *r, int length) ++static int iio_set_length_kfifo(struct iio_buffer *r, unsigned int length) + { + /* Avoid an invalid state */ + if (length < 2) +--- a/include/linux/iio/buffer_impl.h ++++ b/include/linux/iio/buffer_impl.h +@@ -53,7 +53,7 @@ struct iio_buffer_access_funcs { + int (*request_update)(struct iio_buffer *buffer); + + int (*set_bytes_per_datum)(struct iio_buffer *buffer, size_t bpd); +- int (*set_length)(struct iio_buffer *buffer, int length); ++ int (*set_length)(struct iio_buffer *buffer, unsigned int length); + + int (*enable)(struct iio_buffer *buffer, struct iio_dev *indio_dev); + int (*disable)(struct iio_buffer *buffer, struct iio_dev *indio_dev); +@@ -72,10 +72,10 @@ struct iio_buffer_access_funcs { + */ + struct iio_buffer { + /** @length: Number of datums in buffer. */ +- int length; ++ unsigned int length; + + /** @bytes_per_datum: Size of individual datum including timestamp. */ +- int bytes_per_datum; ++ size_t bytes_per_datum; + + /** + * @access: Buffer access functions associated with the diff --git a/queue-4.16/iio-hid-sensor-trigger-fix-sometimes-not-powering-up-the-sensor-after-resume.patch b/queue-4.16/iio-hid-sensor-trigger-fix-sometimes-not-powering-up-the-sensor-after-resume.patch new file mode 100644 index 00000000000..7be9451ae45 --- /dev/null +++ b/queue-4.16/iio-hid-sensor-trigger-fix-sometimes-not-powering-up-the-sensor-after-resume.patch @@ -0,0 +1,63 @@ +From 6f92253024d9d947a4f454654840ce479e251376 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sat, 14 Apr 2018 17:09:09 +0200 +Subject: iio: hid-sensor-trigger: Fix sometimes not powering up the sensor after resume + +From: Hans de Goede + +commit 6f92253024d9d947a4f454654840ce479e251376 upstream. + +hid_sensor_set_power_work() powers the sensors back up after a resume +based on the user_requested_state atomic_t. + +But hid_sensor_power_state() treats this as a boolean flag, leading to +the following problematic scenario: + +1) Some app starts using the iio-sensor in buffered / triggered mode, + hid_sensor_data_rdy_trigger_set_state(true) gets called, setting + user_requested_state to 1. +2) Something directly accesses a _raw value through sysfs, leading + to a call to hid_sensor_power_state(true) followed by + hid_sensor_power_state(false) call, this sets user_requested_state + to 1 followed by setting it to 0. +3) Suspend/resume the machine, hid_sensor_set_power_work() now does + NOT power the sensor back up because user_requested_state (wrongly) + is 0. Which stops the app using the sensor in buffered mode from + receiving any new values. + +This commit changes user_requested_state to a counter tracking how many +times hid_sensor_power_state(true) was called instead, fixing this. + +Cc: Bastien Nocera +Cc: Srinivas Pandruvada +Signed-off-by: Hans de Goede +Acked-by: Srinivas Pandruvada +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/common/hid-sensors/hid-sensor-trigger.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c ++++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c +@@ -178,14 +178,14 @@ int hid_sensor_power_state(struct hid_se + #ifdef CONFIG_PM + int ret; + +- atomic_set(&st->user_requested_state, state); +- + if (atomic_add_unless(&st->runtime_pm_enable, 1, 1)) + pm_runtime_enable(&st->pdev->dev); + +- if (state) ++ if (state) { ++ atomic_inc(&st->user_requested_state); + ret = pm_runtime_get_sync(&st->pdev->dev); +- else { ++ } else { ++ atomic_dec(&st->user_requested_state); + pm_runtime_mark_last_busy(&st->pdev->dev); + pm_runtime_use_autosuspend(&st->pdev->dev); + ret = pm_runtime_put_autosuspend(&st->pdev->dev); diff --git a/queue-4.16/iio-kfifo_buf-check-for-uint-overflow.patch b/queue-4.16/iio-kfifo_buf-check-for-uint-overflow.patch new file mode 100644 index 00000000000..e083e10afca --- /dev/null +++ b/queue-4.16/iio-kfifo_buf-check-for-uint-overflow.patch @@ -0,0 +1,60 @@ +From 3d13de4b027d5f6276c0f9d3a264f518747d83f2 Mon Sep 17 00:00:00 2001 +From: Martin Kelly +Date: Mon, 26 Mar 2018 14:27:52 -0700 +Subject: iio:kfifo_buf: check for uint overflow + +From: Martin Kelly + +commit 3d13de4b027d5f6276c0f9d3a264f518747d83f2 upstream. + +Currently, the following causes a kernel OOPS in memcpy: + +echo 1073741825 > buffer/length +echo 1 > buffer/enable + +Note that using 1073741824 instead of 1073741825 causes "write error: +Cannot allocate memory" but no OOPS. + +This is because 1073741824 == 2^30 and 1073741825 == 2^30+1. Since kfifo +rounds up to the nearest power of 2, it will actually call kmalloc with +roundup_pow_of_two(length) * bytes_per_datum. + +Using length == 1073741825 and bytes_per_datum == 2, we get: + +kmalloc(roundup_pow_of_two(1073741825) * 2 +or kmalloc(2147483648 * 2) +or kmalloc(4294967296) +or kmalloc(UINT_MAX + 1) + +so this overflows to 0, causing kmalloc to return ZERO_SIZE_PTR and +subsequent memcpy to fail once the device is enabled. + +Fix this by checking for overflow prior to allocating a kfifo. With this +check added, the above code returns -EINVAL when enabling the buffer, +rather than causing an OOPS. + +Signed-off-by: Martin Kelly +cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/buffer/kfifo_buf.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/iio/buffer/kfifo_buf.c ++++ b/drivers/iio/buffer/kfifo_buf.c +@@ -27,6 +27,13 @@ static inline int __iio_allocate_kfifo(s + if ((length == 0) || (bytes_per_datum == 0)) + return -EINVAL; + ++ /* ++ * Make sure we don't overflow an unsigned int after kfifo rounds up to ++ * the next power of 2. ++ */ ++ if (roundup_pow_of_two(length) > UINT_MAX / bytes_per_datum) ++ return -EINVAL; ++ + return __kfifo_alloc((struct __kfifo *)&buf->kf, length, + bytes_per_datum, GFP_KERNEL); + } diff --git a/queue-4.16/intel_th-use-correct-device-when-freeing-buffers.patch b/queue-4.16/intel_th-use-correct-device-when-freeing-buffers.patch new file mode 100644 index 00000000000..a65521d1557 --- /dev/null +++ b/queue-4.16/intel_th-use-correct-device-when-freeing-buffers.patch @@ -0,0 +1,58 @@ +From 0ed2424b911f3a058dfea01b78817abed767433d Mon Sep 17 00:00:00 2001 +From: Alexander Shishkin +Date: Thu, 24 May 2018 11:27:27 +0300 +Subject: intel_th: Use correct device when freeing buffers + +From: Alexander Shishkin + +commit 0ed2424b911f3a058dfea01b78817abed767433d upstream. + +Commit d5c435df4a890 ("intel_th: msu: Use the real device in case of IOMMU +domain allocation") changes dma buffer allocation to use the actual +underlying device, but forgets to change the deallocation path, which leads +to (if you've got CAP_SYS_RAWIO): + +> # echo 0,0 > /sys/bus/intel_th/devices/0-msc0/nr_pages +> ------------[ cut here ]------------ +> kernel BUG at ../linux/drivers/iommu/intel-iommu.c:3670! +> CPU: 3 PID: 231 Comm: sh Not tainted 4.17.0-rc1+ #2729 +> RIP: 0010:intel_unmap+0x11e/0x130 +... +> Call Trace: +> intel_free_coherent+0x3e/0x60 +> msc_buffer_win_free+0x100/0x160 [intel_th_msu] + +This patch fixes the buffer deallocation code to use the correct device. + +Signed-off-by: Alexander Shishkin +Fixes: d5c435df4a890 ("intel_th: msu: Use the real device in case of IOMMU domain allocation") +Reported-by: Baofeng Tian +CC: stable@vger.kernel.org # v4.14+ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/intel_th/msu.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/hwtracing/intel_th/msu.c ++++ b/drivers/hwtracing/intel_th/msu.c +@@ -741,8 +741,8 @@ err_nomem: + /* Reset the page to write-back before releasing */ + set_memory_wb((unsigned long)win->block[i].bdesc, 1); + #endif +- dma_free_coherent(msc_dev(msc), size, win->block[i].bdesc, +- win->block[i].addr); ++ dma_free_coherent(msc_dev(msc)->parent->parent, size, ++ win->block[i].bdesc, win->block[i].addr); + } + kfree(win); + +@@ -777,7 +777,7 @@ static void msc_buffer_win_free(struct m + /* Reset the page to write-back before releasing */ + set_memory_wb((unsigned long)win->block[i].bdesc, 1); + #endif +- dma_free_coherent(msc_dev(win->msc), PAGE_SIZE, ++ dma_free_coherent(msc_dev(win->msc)->parent->parent, PAGE_SIZE, + win->block[i].bdesc, win->block[i].addr); + } + diff --git a/queue-4.16/mips-lantiq-gphy-drop-reboot-remove-reset-asserts.patch b/queue-4.16/mips-lantiq-gphy-drop-reboot-remove-reset-asserts.patch new file mode 100644 index 00000000000..933104dc026 --- /dev/null +++ b/queue-4.16/mips-lantiq-gphy-drop-reboot-remove-reset-asserts.patch @@ -0,0 +1,105 @@ +From 32795631e67e16141aa5e065c28ba03bf17abb90 Mon Sep 17 00:00:00 2001 +From: Mathias Kresin +Date: Sun, 8 Apr 2018 10:30:03 +0200 +Subject: MIPS: lantiq: gphy: Drop reboot/remove reset asserts + +From: Mathias Kresin + +commit 32795631e67e16141aa5e065c28ba03bf17abb90 upstream. + +While doing a global software reset, these bits are not cleared and let +some bootloader fail to initialise the GPHYs. The bootloader don't +expect the GPHYs in reset, as they aren't during power on. + +The asserts were a workaround for a wrong syscon-reboot mask. With a +mask set which includes the GPHY resets, these resets aren't required +any more. + +Fixes: 126534141b45 ("MIPS: lantiq: Add a GPHY driver which uses the RCU syscon-mfd") +Signed-off-by: Mathias Kresin +Acked-by: Martin Blumenstingl +Acked-by: Hauke Mehrtens +Cc: John Crispin +Cc: linux-mips@linux-mips.org +Cc: # 4.14+ +Patchwork: https://patchwork.linux-mips.org/patch/19003/ +[jhogan@kernel.org: Fix build warnings] +Signed-off-by: James Hogan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/soc/lantiq/gphy.c | 36 ------------------------------------ + 1 file changed, 36 deletions(-) + +--- a/drivers/soc/lantiq/gphy.c ++++ b/drivers/soc/lantiq/gphy.c +@@ -30,7 +30,6 @@ struct xway_gphy_priv { + struct clk *gphy_clk_gate; + struct reset_control *gphy_reset; + struct reset_control *gphy_reset2; +- struct notifier_block gphy_reboot_nb; + void __iomem *membase; + char *fw_name; + }; +@@ -64,24 +63,6 @@ static const struct of_device_id xway_gp + }; + MODULE_DEVICE_TABLE(of, xway_gphy_match); + +-static struct xway_gphy_priv *to_xway_gphy_priv(struct notifier_block *nb) +-{ +- return container_of(nb, struct xway_gphy_priv, gphy_reboot_nb); +-} +- +-static int xway_gphy_reboot_notify(struct notifier_block *reboot_nb, +- unsigned long code, void *unused) +-{ +- struct xway_gphy_priv *priv = to_xway_gphy_priv(reboot_nb); +- +- if (priv) { +- reset_control_assert(priv->gphy_reset); +- reset_control_assert(priv->gphy_reset2); +- } +- +- return NOTIFY_DONE; +-} +- + static int xway_gphy_load(struct device *dev, struct xway_gphy_priv *priv, + dma_addr_t *dev_addr) + { +@@ -205,14 +186,6 @@ static int xway_gphy_probe(struct platfo + reset_control_deassert(priv->gphy_reset); + reset_control_deassert(priv->gphy_reset2); + +- /* assert the gphy reset because it can hang after a reboot: */ +- priv->gphy_reboot_nb.notifier_call = xway_gphy_reboot_notify; +- priv->gphy_reboot_nb.priority = -1; +- +- ret = register_reboot_notifier(&priv->gphy_reboot_nb); +- if (ret) +- dev_warn(dev, "Failed to register reboot notifier\n"); +- + platform_set_drvdata(pdev, priv); + + return ret; +@@ -220,21 +193,12 @@ static int xway_gphy_probe(struct platfo + + static int xway_gphy_remove(struct platform_device *pdev) + { +- struct device *dev = &pdev->dev; + struct xway_gphy_priv *priv = platform_get_drvdata(pdev); +- int ret; +- +- reset_control_assert(priv->gphy_reset); +- reset_control_assert(priv->gphy_reset2); + + iowrite32be(0, priv->membase); + + clk_disable_unprepare(priv->gphy_clk_gate); + +- ret = unregister_reboot_notifier(&priv->gphy_reboot_nb); +- if (ret) +- dev_warn(dev, "Failed to unregister reboot notifier\n"); +- + return 0; + } + diff --git a/queue-4.16/mips-prctl-disallow-fre-without-fr-with-pr_set_fp_mode-requests.patch b/queue-4.16/mips-prctl-disallow-fre-without-fr-with-pr_set_fp_mode-requests.patch new file mode 100644 index 00000000000..fb09088101e --- /dev/null +++ b/queue-4.16/mips-prctl-disallow-fre-without-fr-with-pr_set_fp_mode-requests.patch @@ -0,0 +1,59 @@ +From 28e4213dd331e944e7fca1954a946829162ed9d4 Mon Sep 17 00:00:00 2001 +From: "Maciej W. Rozycki" +Date: Tue, 15 May 2018 23:04:44 +0100 +Subject: MIPS: prctl: Disallow FRE without FR with PR_SET_FP_MODE requests + +From: Maciej W. Rozycki + +commit 28e4213dd331e944e7fca1954a946829162ed9d4 upstream. + +Having PR_FP_MODE_FRE (i.e. Config5.FRE) set without PR_FP_MODE_FR (i.e. +Status.FR) is not supported as the lone purpose of Config5.FRE is to +emulate Status.FR=0 handling on FPU hardware that has Status.FR=1 +hardwired[1][2]. Also we do not handle this case elsewhere, and assume +throughout our code that TIF_HYBRID_FPREGS and TIF_32BIT_FPREGS cannot +be set both at once for a task, leading to inconsistent behaviour if +this does happen. + +Return unsuccessfully then from prctl(2) PR_SET_FP_MODE calls requesting +PR_FP_MODE_FRE to be set with PR_FP_MODE_FR clear. This corresponds to +modes allowed by `mips_set_personality_fp'. + +References: + +[1] "MIPS Architecture For Programmers, Vol. III: MIPS32 / microMIPS32 + Privileged Resource Architecture", Imagination Technologies, + Document Number: MD00090, Revision 6.02, July 10, 2015, Table 9.69 + "Config5 Register Field Descriptions", p. 262 + +[2] "MIPS Architecture For Programmers, Volume III: MIPS64 / microMIPS64 + Privileged Resource Architecture", Imagination Technologies, + Document Number: MD00091, Revision 6.03, December 22, 2015, Table + 9.72 "Config5 Register Field Descriptions", p. 288 + +Fixes: 9791554b45a2 ("MIPS,prctl: add PR_[GS]ET_FP_MODE prctl options for MIPS") +Signed-off-by: Maciej W. Rozycki +Cc: Ralf Baechle +Cc: linux-mips@linux-mips.org +Cc: # 4.0+ +Patchwork: https://patchwork.linux-mips.org/patch/19327/ +Signed-off-by: James Hogan +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kernel/process.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/mips/kernel/process.c ++++ b/arch/mips/kernel/process.c +@@ -721,6 +721,10 @@ int mips_set_process_fp_mode(struct task + if (value & ~known_bits) + return -EOPNOTSUPP; + ++ /* Setting FRE without FR is not supported. */ ++ if ((value & (PR_FP_MODE_FR | PR_FP_MODE_FRE)) == PR_FP_MODE_FRE) ++ return -EOPNOTSUPP; ++ + /* Avoid inadvertently triggering emulation */ + if ((value & PR_FP_MODE_FR) && raw_cpu_has_fpu && + !(raw_current_cpu_data.fpu_id & MIPS_FPIR_F64)) diff --git a/queue-4.16/mips-ptrace-fix-ptrace_peekusr-requests-for-64-bit-fgrs.patch b/queue-4.16/mips-ptrace-fix-ptrace_peekusr-requests-for-64-bit-fgrs.patch new file mode 100644 index 00000000000..8627a2e4365 --- /dev/null +++ b/queue-4.16/mips-ptrace-fix-ptrace_peekusr-requests-for-64-bit-fgrs.patch @@ -0,0 +1,53 @@ +From c7e814628df65f424fe197dde73bfc67e4a244d7 Mon Sep 17 00:00:00 2001 +From: "Maciej W. Rozycki" +Date: Wed, 16 May 2018 16:39:58 +0100 +Subject: MIPS: ptrace: Fix PTRACE_PEEKUSR requests for 64-bit FGRs + +From: Maciej W. Rozycki + +commit c7e814628df65f424fe197dde73bfc67e4a244d7 upstream. + +Use 64-bit accesses for 64-bit floating-point general registers with +PTRACE_PEEKUSR, removing the truncation of their upper halves in the +FR=1 mode, caused by commit bbd426f542cb ("MIPS: Simplify FP context +access"), which inadvertently switched them to using 32-bit accesses. + +The PTRACE_POKEUSR side is fine as it's never been broken and continues +using 64-bit accesses. + +Fixes: bbd426f542cb ("MIPS: Simplify FP context access") +Signed-off-by: Maciej W. Rozycki +Cc: Ralf Baechle +Cc: linux-mips@linux-mips.org +Cc: # 3.15+ +Patchwork: https://patchwork.linux-mips.org/patch/19334/ +Signed-off-by: James Hogan +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kernel/ptrace.c | 2 +- + arch/mips/kernel/ptrace32.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/mips/kernel/ptrace.c ++++ b/arch/mips/kernel/ptrace.c +@@ -818,7 +818,7 @@ long arch_ptrace(struct task_struct *chi + break; + } + #endif +- tmp = get_fpr32(&fregs[addr - FPR_BASE], 0); ++ tmp = get_fpr64(&fregs[addr - FPR_BASE], 0); + break; + case PC: + tmp = regs->cp0_epc; +--- a/arch/mips/kernel/ptrace32.c ++++ b/arch/mips/kernel/ptrace32.c +@@ -109,7 +109,7 @@ long compat_arch_ptrace(struct task_stru + addr & 1); + break; + } +- tmp = get_fpr32(&fregs[addr - FPR_BASE], 0); ++ tmp = get_fpr64(&fregs[addr - FPR_BASE], 0); + break; + case PC: + tmp = regs->cp0_epc; diff --git a/queue-4.16/mm-huge_memory.c-__split_huge_page-use-atomic-clearpagedirty.patch b/queue-4.16/mm-huge_memory.c-__split_huge_page-use-atomic-clearpagedirty.patch new file mode 100644 index 00000000000..860ea67b235 --- /dev/null +++ b/queue-4.16/mm-huge_memory.c-__split_huge_page-use-atomic-clearpagedirty.patch @@ -0,0 +1,52 @@ +From 2d077d4b59924acd1f5180c6fb73b57f4771fde6 Mon Sep 17 00:00:00 2001 +From: Hugh Dickins +Date: Fri, 1 Jun 2018 16:50:45 -0700 +Subject: mm/huge_memory.c: __split_huge_page() use atomic ClearPageDirty() + +From: Hugh Dickins + +commit 2d077d4b59924acd1f5180c6fb73b57f4771fde6 upstream. + +Swapping load on huge=always tmpfs (with khugepaged tuned up to be very +eager, but I'm not sure that is relevant) soon hung uninterruptibly, +waiting for page lock in shmem_getpage_gfp()'s find_lock_entry(), most +often when "cp -a" was trying to write to a smallish file. Debug showed +that the page in question was not locked, and page->mapping NULL by now, +but page->index consistent with having been in a huge page before. + +Reproduced in minutes on a 4.15 kernel, even with 4.17's 605ca5ede764 +("mm/huge_memory.c: reorder operations in __split_huge_page_tail()") added +in; but took hours to reproduce on a 4.17 kernel (no idea why). + +The culprit proved to be the __ClearPageDirty() on tails beyond i_size in +__split_huge_page(): the non-atomic __bitoperation may have been safe when +4.8's baa355fd3314 ("thp: file pages support for split_huge_page()") +introduced it, but liable to erase PageWaiters after 4.10's 62906027091f +("mm: add PageWaiters indicating tasks are waiting for a page bit"). + +Link: http://lkml.kernel.org/r/alpine.LSU.2.11.1805291841070.3197@eggly.anvils +Fixes: 62906027091f ("mm: add PageWaiters indicating tasks are waiting for a page bit") +Signed-off-by: Hugh Dickins +Acked-by: Kirill A. Shutemov +Cc: Konstantin Khlebnikov +Cc: Nicholas Piggin +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/huge_memory.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -2432,7 +2432,7 @@ static void __split_huge_page(struct pag + __split_huge_page_tail(head, i, lruvec, list); + /* Some pages can be beyond i_size: drop them from page cache */ + if (head[i].index >= end) { +- __ClearPageDirty(head + i); ++ ClearPageDirty(head + i); + __delete_from_page_cache(head + i, NULL); + if (IS_ENABLED(CONFIG_SHMEM) && PageSwapBacked(head)) + shmem_uncharge(head->mapping->host, 1); diff --git a/queue-4.16/revert-rt2800-use-txop_backoff-for-probe-frames.patch b/queue-4.16/revert-rt2800-use-txop_backoff-for-probe-frames.patch new file mode 100644 index 00000000000..9d1e96c9cd2 --- /dev/null +++ b/queue-4.16/revert-rt2800-use-txop_backoff-for-probe-frames.patch @@ -0,0 +1,46 @@ +From 52a192362932f333a7ebafd581c4d9b81da2fec8 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Mon, 28 May 2018 13:25:06 +0200 +Subject: Revert "rt2800: use TXOP_BACKOFF for probe frames" + +From: Stanislaw Gruszka + +commit 52a192362932f333a7ebafd581c4d9b81da2fec8 upstream. + +This reverts commit fb47ada8dc3c30c8e7b415da155742b49536c61e. + +In some situations when we set TXOP_BACKOFF, the probe frame is +not sent at all. What it worse then sending probe frame as part +of AMPDU and can degrade 11n performance to 11g rates. + +Cc: stable@vger.kernel.org +Signed-off-by: Stanislaw Gruszka +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ralink/rt2x00/rt2x00queue.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c ++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c +@@ -372,16 +372,15 @@ static void rt2x00queue_create_tx_descri + + /* + * Determine IFS values +- * - Use TXOP_BACKOFF for probe and management frames except beacons ++ * - Use TXOP_BACKOFF for management frames except beacons + * - Use TXOP_SIFS for fragment bursts + * - Use TXOP_HTTXOP for everything else + * + * Note: rt2800 devices won't use CTS protection (if used) + * for frames not transmitted with TXOP_HTTXOP + */ +- if ((ieee80211_is_mgmt(hdr->frame_control) && +- !ieee80211_is_beacon(hdr->frame_control)) || +- (tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)) ++ if (ieee80211_is_mgmt(hdr->frame_control) && ++ !ieee80211_is_beacon(hdr->frame_control)) + txdesc->u.ht.txop = TXOP_BACKOFF; + else if (!(tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)) + txdesc->u.ht.txop = TXOP_SIFS; diff --git a/queue-4.16/scsi-scsi_transport_srp-fix-shost-to-rport-translation.patch b/queue-4.16/scsi-scsi_transport_srp-fix-shost-to-rport-translation.patch new file mode 100644 index 00000000000..d4159d1a9d3 --- /dev/null +++ b/queue-4.16/scsi-scsi_transport_srp-fix-shost-to-rport-translation.patch @@ -0,0 +1,97 @@ +From c9ddf73476ff4fffb7a87bd5107a0705bf2cf64b Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Mon, 21 May 2018 11:17:29 -0700 +Subject: scsi: scsi_transport_srp: Fix shost to rport translation + +From: Bart Van Assche + +commit c9ddf73476ff4fffb7a87bd5107a0705bf2cf64b upstream. + +Since an SRP remote port is attached as a child to shost->shost_gendev +and as the only child, the translation from the shost pointer into an +rport pointer must happen by looking up the shost child that is an +rport. This patch fixes the following KASAN complaint: + +BUG: KASAN: slab-out-of-bounds in srp_timed_out+0x57/0x110 [scsi_transport_srp] +Read of size 4 at addr ffff880035d3fcc0 by task kworker/1:0H/19 + +CPU: 1 PID: 19 Comm: kworker/1:0H Not tainted 4.16.0-rc3-dbg+ #1 +Workqueue: kblockd blk_mq_timeout_work +Call Trace: +dump_stack+0x85/0xc7 +print_address_description+0x65/0x270 +kasan_report+0x231/0x350 +srp_timed_out+0x57/0x110 [scsi_transport_srp] +scsi_times_out+0xc7/0x3f0 [scsi_mod] +blk_mq_terminate_expired+0xc2/0x140 +bt_iter+0xbc/0xd0 +blk_mq_queue_tag_busy_iter+0x1c7/0x350 +blk_mq_timeout_work+0x325/0x3f0 +process_one_work+0x441/0xa50 +worker_thread+0x76/0x6c0 +kthread+0x1b2/0x1d0 +ret_from_fork+0x24/0x30 + +Fixes: e68ca75200fe ("scsi_transport_srp: Reduce failover time") +Signed-off-by: Bart Van Assche +Cc: Hannes Reinecke +Cc: Johannes Thumshirn +Cc: Jason Gunthorpe +Cc: Doug Ledford +Cc: Laurence Oberman +Cc: stable@vger.kernel.org +Reviewed-by: Johannes Thumshirn +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/scsi_transport_srp.c | 22 ++++++++++++++++++++-- + 1 file changed, 20 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/scsi_transport_srp.c ++++ b/drivers/scsi/scsi_transport_srp.c +@@ -51,6 +51,8 @@ struct srp_internal { + struct transport_container rport_attr_cont; + }; + ++static int scsi_is_srp_rport(const struct device *dev); ++ + #define to_srp_internal(tmpl) container_of(tmpl, struct srp_internal, t) + + #define dev_to_rport(d) container_of(d, struct srp_rport, dev) +@@ -60,9 +62,24 @@ static inline struct Scsi_Host *rport_to + return dev_to_shost(r->dev.parent); + } + ++static int find_child_rport(struct device *dev, void *data) ++{ ++ struct device **child = data; ++ ++ if (scsi_is_srp_rport(dev)) { ++ WARN_ON_ONCE(*child); ++ *child = dev; ++ } ++ return 0; ++} ++ + static inline struct srp_rport *shost_to_rport(struct Scsi_Host *shost) + { +- return transport_class_to_srp_rport(&shost->shost_gendev); ++ struct device *child = NULL; ++ ++ WARN_ON_ONCE(device_for_each_child(&shost->shost_gendev, &child, ++ find_child_rport) < 0); ++ return child ? dev_to_rport(child) : NULL; + } + + /** +@@ -600,7 +617,8 @@ enum blk_eh_timer_return srp_timed_out(s + struct srp_rport *rport = shost_to_rport(shost); + + pr_debug("timeout for sdev %s\n", dev_name(&sdev->sdev_gendev)); +- return rport->fast_io_fail_tmo < 0 && rport->dev_loss_tmo < 0 && ++ return rport && rport->fast_io_fail_tmo < 0 && ++ rport->dev_loss_tmo < 0 && + i->f->reset_timer_if_blocked && scsi_device_blocked(sdev) ? + BLK_EH_RESET_TIMER : BLK_EH_NOT_HANDLED; + } diff --git a/queue-4.16/series b/queue-4.16/series index 8b585cc9133..585b511b94d 100644 --- a/queue-4.16/series +++ b/queue-4.16/series @@ -22,3 +22,22 @@ selinux-kasan-slab-out-of-bounds-in-xattr_getsecurity.patch cfg80211-further-limit-wiphy-names-to-64-bytes.patch drm-amd-powerplay-fix-enum-mismatch.patch rtlwifi-rtl8192cu-remove-variable-self-assignment-in-rf.c.patch +iio-ad7793-implement-iio_chan_info_samp_freq.patch +iio-hid-sensor-trigger-fix-sometimes-not-powering-up-the-sensor-after-resume.patch +iio-buffer-make-length-types-match-kfifo-types.patch +iio-kfifo_buf-check-for-uint-overflow.patch +iio-adc-stm32-dfsdm-fix-successive-oversampling-settings.patch +iio-adc-stm32-dfsdm-fix-sample-rate-for-div2-spi-clock.patch +iio-adc-at91-sama5d2_adc-fix-channel-configuration-for-differential-channels.patch +iio-adc-select-buffer-for-at91-sama5d2_adc.patch +mips-lantiq-gphy-drop-reboot-remove-reset-asserts.patch +mips-ptrace-fix-ptrace_peekusr-requests-for-64-bit-fgrs.patch +mips-prctl-disallow-fre-without-fr-with-pr_set_fp_mode-requests.patch +scsi-scsi_transport_srp-fix-shost-to-rport-translation.patch +stm-class-use-vmalloc-for-the-master-map.patch +hwtracing-stm-fix-build-error-on-some-arches.patch +ib-core-fix-error-code-for-invalid-gid-entry.patch +mm-huge_memory.c-__split_huge_page-use-atomic-clearpagedirty.patch +revert-rt2800-use-txop_backoff-for-probe-frames.patch +intel_th-use-correct-device-when-freeing-buffers.patch +drm-psr-fix-missed-entry-in-psr-setup-time-table.patch diff --git a/queue-4.16/stm-class-use-vmalloc-for-the-master-map.patch b/queue-4.16/stm-class-use-vmalloc-for-the-master-map.patch new file mode 100644 index 00000000000..f5a506e868c --- /dev/null +++ b/queue-4.16/stm-class-use-vmalloc-for-the-master-map.patch @@ -0,0 +1,62 @@ +From b5e2ced9bf81393034072dd4d372f6b430bc1f0a Mon Sep 17 00:00:00 2001 +From: Alexander Shishkin +Date: Thu, 24 May 2018 11:27:26 +0300 +Subject: stm class: Use vmalloc for the master map + +From: Alexander Shishkin + +commit b5e2ced9bf81393034072dd4d372f6b430bc1f0a upstream. + +Fengguang is running into a warning from the buddy allocator: + +> swapper/0: page allocation failure: order:9, mode:0x14040c0(GFP_KERNEL|__GFP_COMP), nodemask=(null) +> CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.17.0-rc1 #262 +> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 +> Call Trace: +... +> __kmalloc+0x14b/0x180: ____cache_alloc at mm/slab.c:3127 +> stm_register_device+0xf3/0x5c0: stm_register_device at drivers/hwtracing/stm/core.c:695 +... + +Which is basically a result of the stm class trying to allocate ~512kB +for the dummy_stm with its default parameters. There's no reason, however, +for it not to be vmalloc()ed instead, which is what this patch does. + +Reported-by: Fengguang Wu +Signed-off-by: Alexander Shishkin +CC: stable@vger.kernel.org # v4.4+ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/stm/core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/hwtracing/stm/core.c ++++ b/drivers/hwtracing/stm/core.c +@@ -682,7 +682,7 @@ static void stm_device_release(struct de + { + struct stm_device *stm = to_stm_device(dev); + +- kfree(stm); ++ vfree(stm); + } + + int stm_register_device(struct device *parent, struct stm_data *stm_data, +@@ -699,7 +699,7 @@ int stm_register_device(struct device *p + return -EINVAL; + + nmasters = stm_data->sw_end - stm_data->sw_start + 1; +- stm = kzalloc(sizeof(*stm) + nmasters * sizeof(void *), GFP_KERNEL); ++ stm = vzalloc(sizeof(*stm) + nmasters * sizeof(void *)); + if (!stm) + return -ENOMEM; + +@@ -752,7 +752,7 @@ err_device: + /* matches device_initialize() above */ + put_device(&stm->dev); + err_free: +- kfree(stm); ++ vfree(stm); + + return err; + }