From 5ea3d7c4bdb35d868c8f6863e60be6d8cc26bacc Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 3 Jun 2018 10:53:54 +0200 Subject: [PATCH] 4.14-stable patches added patches: drm-i915-disable-lvds-on-radiant-p845.patch drm-i915-lvds-move-acpi-lid-notification-registration-to-registration-phase.patch drm-psr-fix-missed-entry-in-psr-setup-time-table.patch hwtracing-stm-fix-build-error-on-some-arches.patch ib-core-fix-error-code-for-invalid-gid-entry.patch iio-ad7793-implement-iio_chan_info_samp_freq.patch iio-adc-select-buffer-for-at91-sama5d2_adc.patch iio-buffer-make-length-types-match-kfifo-types.patch iio-kfifo_buf-check-for-uint-overflow.patch intel_th-use-correct-device-when-freeing-buffers.patch mips-lantiq-gphy-drop-reboot-remove-reset-asserts.patch mips-prctl-disallow-fre-without-fr-with-pr_set_fp_mode-requests.patch mips-ptrace-fix-ptrace_peekusr-requests-for-64-bit-fgrs.patch mm-huge_memory.c-__split_huge_page-use-atomic-clearpagedirty.patch revert-rt2800-use-txop_backoff-for-probe-frames.patch scsi-scsi_transport_srp-fix-shost-to-rport-translation.patch stm-class-use-vmalloc-for-the-master-map.patch --- ...rm-i915-disable-lvds-on-radiant-p845.patch | 44 +++++ ...n-registration-to-registration-phase.patch | 152 ++++++++++++++++++ ...missed-entry-in-psr-setup-time-table.patch | 45 ++++++ ...g-stm-fix-build-error-on-some-arches.patch | 33 ++++ ...fix-error-code-for-invalid-gid-entry.patch | 48 ++++++ ...93-implement-iio_chan_info_samp_freq.patch | 148 +++++++++++++++++ ...c-select-buffer-for-at91-sama5d2_adc.patch | 36 +++++ ...-make-length-types-match-kfifo-types.patch | 86 ++++++++++ ...io-kfifo_buf-check-for-uint-overflow.patch | 60 +++++++ ...-correct-device-when-freeing-buffers.patch | 58 +++++++ ...phy-drop-reboot-remove-reset-asserts.patch | 105 ++++++++++++ ...hout-fr-with-pr_set_fp_mode-requests.patch | 59 +++++++ ...ace_peekusr-requests-for-64-bit-fgrs.patch | 53 ++++++ ..._huge_page-use-atomic-clearpagedirty.patch | 52 ++++++ ...00-use-txop_backoff-for-probe-frames.patch | 46 ++++++ ...t_srp-fix-shost-to-rport-translation.patch | 97 +++++++++++ queue-4.14/series | 17 ++ ...class-use-vmalloc-for-the-master-map.patch | 62 +++++++ 18 files changed, 1201 insertions(+) create mode 100644 queue-4.14/drm-i915-disable-lvds-on-radiant-p845.patch create mode 100644 queue-4.14/drm-i915-lvds-move-acpi-lid-notification-registration-to-registration-phase.patch create mode 100644 queue-4.14/drm-psr-fix-missed-entry-in-psr-setup-time-table.patch create mode 100644 queue-4.14/hwtracing-stm-fix-build-error-on-some-arches.patch create mode 100644 queue-4.14/ib-core-fix-error-code-for-invalid-gid-entry.patch create mode 100644 queue-4.14/iio-ad7793-implement-iio_chan_info_samp_freq.patch create mode 100644 queue-4.14/iio-adc-select-buffer-for-at91-sama5d2_adc.patch create mode 100644 queue-4.14/iio-buffer-make-length-types-match-kfifo-types.patch create mode 100644 queue-4.14/iio-kfifo_buf-check-for-uint-overflow.patch create mode 100644 queue-4.14/intel_th-use-correct-device-when-freeing-buffers.patch create mode 100644 queue-4.14/mips-lantiq-gphy-drop-reboot-remove-reset-asserts.patch create mode 100644 queue-4.14/mips-prctl-disallow-fre-without-fr-with-pr_set_fp_mode-requests.patch create mode 100644 queue-4.14/mips-ptrace-fix-ptrace_peekusr-requests-for-64-bit-fgrs.patch create mode 100644 queue-4.14/mm-huge_memory.c-__split_huge_page-use-atomic-clearpagedirty.patch create mode 100644 queue-4.14/revert-rt2800-use-txop_backoff-for-probe-frames.patch create mode 100644 queue-4.14/scsi-scsi_transport_srp-fix-shost-to-rport-translation.patch create mode 100644 queue-4.14/stm-class-use-vmalloc-for-the-master-map.patch diff --git a/queue-4.14/drm-i915-disable-lvds-on-radiant-p845.patch b/queue-4.14/drm-i915-disable-lvds-on-radiant-p845.patch new file mode 100644 index 00000000000..d0fb7d50529 --- /dev/null +++ b/queue-4.14/drm-i915-disable-lvds-on-radiant-p845.patch @@ -0,0 +1,44 @@ +From b3fb22733ae61050f8d10a1d6a8af176c5c5db1a Mon Sep 17 00:00:00 2001 +From: Ondrej Zary +Date: Fri, 9 Mar 2018 23:22:04 +0100 +Subject: drm/i915: Disable LVDS on Radiant P845 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ondrej Zary + +commit b3fb22733ae61050f8d10a1d6a8af176c5c5db1a upstream. + +Radiant P845 does not have LVDS, only VGA. + +Cc: stable@vger.kernel.org +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105468 +Signed-off-by: Ondrej Zary +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20180309222204.4771-1-linux@rainbow-software.org +(cherry picked from commit 7f7105f99b75aca4f8c2a748ed6b82c7f8be3293) +Signed-off-by: Joonas Lahtinen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_lvds.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/gpu/drm/i915/intel_lvds.c ++++ b/drivers/gpu/drm/i915/intel_lvds.c +@@ -845,6 +845,14 @@ static const struct dmi_system_id intel_ + DMI_EXACT_MATCH(DMI_BOARD_NAME, "D525MW"), + }, + }, ++ { ++ .callback = intel_no_lvds_dmi_callback, ++ .ident = "Radiant P845", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Radiant Systems Inc"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "P845"), ++ }, ++ }, + + { } /* terminating entry */ + }; diff --git a/queue-4.14/drm-i915-lvds-move-acpi-lid-notification-registration-to-registration-phase.patch b/queue-4.14/drm-i915-lvds-move-acpi-lid-notification-registration-to-registration-phase.patch new file mode 100644 index 00000000000..3d31e317cd0 --- /dev/null +++ b/queue-4.14/drm-i915-lvds-move-acpi-lid-notification-registration-to-registration-phase.patch @@ -0,0 +1,152 @@ +From b9eb9c92899a509fe258d38dd6c214b1de69eee0 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Fri, 18 May 2018 08:48:40 +0100 +Subject: drm/i915/lvds: Move acpi lid notification registration to registration phase +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chris Wilson + +commit b9eb9c92899a509fe258d38dd6c214b1de69eee0 upstream. + +Delay registering ourselves with the acpi lid notification mechanism +until we are registering the connectors after initialisation is +complete. This prevents a possibility of trying to handle the lid +notification before we are ready with the danger of chasing +uninitialised function pointers. + + BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 + IP: (null) + PGD 0 P4D 0 + Oops: 0010 [#1] PREEMPT SMP PTI + Modules linked in: arc4(+) iwldvm(+) i915(+) mac80211 i2c_algo_bit coretemp mei_wdt iwlwifi drm_kms_helper kvm_intel wmi_bmof iTCO_wdt iTCO_vendor_support kvm snd_hda_codec_conexant snd_hda_codec_generic drm psmouse cfg80211 irqbypass input_leds pcspkr i2c_i801 snd_hda_intel snd_hda_codec thinkpad_acpi snd_hda_core mei_me lpc_ich snd_hwdep e1000e wmi nvram snd_pcm mei snd_timer shpchp ptp pps_core rfkill syscopyarea snd intel_agp sysfillrect intel_gtt soundcore sysimgblt battery led_class fb_sys_fops ac rtc_cmos agpgart evdev mac_hid acpi_cpufreq ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 fscrypto crypto_simd glue_helper cryptd aes_x86_64 xts algif_skcipher af_alg dm_crypt dm_mod sd_mod uas usb_storage serio_raw atkbd libps2 ahci libahci uhci_hcd libata scsi_mod ehci_pci + ehci_hcd usbcore usb_common i8042 serio + CPU: 1 PID: 378 Comm: systemd-logind Not tainted 4.16.8-1-ARCH #1 + Hardware name: LENOVO 7454CTO/7454CTO, BIOS 6DET72WW (3.22 ) 10/25/2012 + RIP: 0010: (null) + RSP: 0018:ffffaf4580c33a18 EFLAGS: 00010287 + RAX: 0000000000000000 RBX: ffff947533558000 RCX: 000000000000003e + RDX: ffffffffc0aa80c0 RSI: ffffaf4580c33a3c RDI: ffff947534e4c000 + RBP: ffff947533558338 R08: ffff947534598930 R09: ffffffffc0a928b1 + R10: ffffd8f181d5fd40 R11: 0000000000000000 R12: ffffffffc0a928b1 + R13: ffff947533558368 R14: ffffffffc0a928a9 R15: ffff947534e4c000 + FS: 00007f3dc4ddb940(0000) GS:ffff947539280000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000000 CR3: 000000006e214000 CR4: 00000000000406e0 + Call Trace: + ? intel_modeset_setup_hw_state+0x385/0xf60 [i915] + ? __intel_display_resume+0x1e/0xc0 [i915] + ? intel_display_resume+0xcc/0x120 [i915] + ? intel_lid_notify+0xbc/0xc0 [i915] + ? notifier_call_chain+0x47/0x70 + ? blocking_notifier_call_chain+0x3e/0x60 + ? acpi_lid_notify_state+0x8f/0x1d0 + ? acpi_lid_update_state+0x49/0x70 + ? acpi_lid_input_open+0x60/0x90 + ? input_open_device+0x5d/0xa0 + ? evdev_open+0x1ba/0x1e0 [evdev] + ? chrdev_open+0xa3/0x1b0 + ? cdev_put.part.0+0x20/0x20 + ? do_dentry_open+0x14c/0x300 + ? path_openat+0x30c/0x1240 + ? current_time+0x16/0x60 + ? do_filp_open+0x93/0x100 + ? __check_object_size+0xfb/0x180 + ? do_sys_open+0x186/0x210 + ? do_syscall_64+0x74/0x190 + ? entry_SYSCALL_64_after_hwframe+0x3d/0xa2 + Code: Bad RIP value. + RIP: (null) RSP: ffffaf4580c33a18 + CR2: 0000000000000000 + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=106559 +Fixes: c1c7af608920 ("drm/i915: force mode set at lid open time") +Signed-off-by: Chris Wilson +Cc: Maarten Lankhorst +Cc: Ville Syrjälä +Cc: Daniel Vetter +Reviewed-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20180518074840.16194-1-chris@chris-wilson.co.uk +Cc: stable@vger.kernel.org +(cherry picked from commit e578a570dc7c20475774d1ff993825e3bd7a7011) +Signed-off-by: Joonas Lahtinen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_lvds.c | 43 ++++++++++++++++++++++++++++---------- + 1 file changed, 32 insertions(+), 11 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_lvds.c ++++ b/drivers/gpu/drm/i915/intel_lvds.c +@@ -565,6 +565,36 @@ exit: + return NOTIFY_OK; + } + ++static int ++intel_lvds_connector_register(struct drm_connector *connector) ++{ ++ struct intel_lvds_connector *lvds = to_lvds_connector(connector); ++ int ret; ++ ++ ret = intel_connector_register(connector); ++ if (ret) ++ return ret; ++ ++ lvds->lid_notifier.notifier_call = intel_lid_notify; ++ if (acpi_lid_notifier_register(&lvds->lid_notifier)) { ++ DRM_DEBUG_KMS("lid notifier registration failed\n"); ++ lvds->lid_notifier.notifier_call = NULL; ++ } ++ ++ return 0; ++} ++ ++static void ++intel_lvds_connector_unregister(struct drm_connector *connector) ++{ ++ struct intel_lvds_connector *lvds = to_lvds_connector(connector); ++ ++ if (lvds->lid_notifier.notifier_call) ++ acpi_lid_notifier_unregister(&lvds->lid_notifier); ++ ++ intel_connector_unregister(connector); ++} ++ + /** + * intel_lvds_destroy - unregister and free LVDS structures + * @connector: connector to free +@@ -577,9 +607,6 @@ static void intel_lvds_destroy(struct dr + struct intel_lvds_connector *lvds_connector = + to_lvds_connector(connector); + +- if (lvds_connector->lid_notifier.notifier_call) +- acpi_lid_notifier_unregister(&lvds_connector->lid_notifier); +- + if (!IS_ERR_OR_NULL(lvds_connector->base.edid)) + kfree(lvds_connector->base.edid); + +@@ -600,8 +627,8 @@ static const struct drm_connector_funcs + .fill_modes = drm_helper_probe_single_connector_modes, + .atomic_get_property = intel_digital_connector_atomic_get_property, + .atomic_set_property = intel_digital_connector_atomic_set_property, +- .late_register = intel_connector_register, +- .early_unregister = intel_connector_unregister, ++ .late_register = intel_lvds_connector_register, ++ .early_unregister = intel_lvds_connector_unregister, + .destroy = intel_lvds_destroy, + .atomic_destroy_state = drm_atomic_helper_connector_destroy_state, + .atomic_duplicate_state = intel_digital_connector_duplicate_state, +@@ -1149,12 +1176,6 @@ out: + + lvds_encoder->a3_power = lvds & LVDS_A3_POWER_MASK; + +- lvds_connector->lid_notifier.notifier_call = intel_lid_notify; +- if (acpi_lid_notifier_register(&lvds_connector->lid_notifier)) { +- DRM_DEBUG_KMS("lid notifier registration failed\n"); +- lvds_connector->lid_notifier.notifier_call = NULL; +- } +- + return; + + failed: diff --git a/queue-4.14/drm-psr-fix-missed-entry-in-psr-setup-time-table.patch b/queue-4.14/drm-psr-fix-missed-entry-in-psr-setup-time-table.patch new file mode 100644 index 00000000000..e29d967cd09 --- /dev/null +++ b/queue-4.14/drm-psr-fix-missed-entry-in-psr-setup-time-table.patch @@ -0,0 +1,45 @@ +From bdcc02cf1bb508fc700df7662f55058f651f2621 Mon Sep 17 00:00:00 2001 +From: Dhinakaran Pandiyan +Date: Fri, 11 May 2018 12:51:42 -0700 +Subject: drm/psr: Fix missed entry in PSR setup time table. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dhinakaran Pandiyan + +commit bdcc02cf1bb508fc700df7662f55058f651f2621 upstream. + +Entry corresponding to 220 us setup time was missing. I am not aware of +any specific bug this fixes, but this could potentially result in enabling +PSR on a panel with a higher setup time requirement than supported by the +hardware. + +I verified the value is present in eDP spec versions 1.3, 1.4 and 1.4a. + +Fixes: 6608804b3d7f ("drm/dp: Add drm_dp_psr_setup_time()") +Cc: stable@vger.kernel.org +Cc: Ville Syrjälä +Cc: Jose Roberto de Souza +Cc: dri-devel@lists.freedesktop.org +Reviewed-by: José Roberto de Souza +Reviewed-by: Tarun Vyas +Signed-off-by: Dhinakaran Pandiyan +Signed-off-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20180511195145.3829-3-dhinakaran.pandiyan@intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_dp_helper.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/drm_dp_helper.c ++++ b/drivers/gpu/drm/drm_dp_helper.c +@@ -1139,6 +1139,7 @@ int drm_dp_psr_setup_time(const u8 psr_c + static const u16 psr_setup_time_us[] = { + PSR_SETUP_TIME(330), + PSR_SETUP_TIME(275), ++ PSR_SETUP_TIME(220), + PSR_SETUP_TIME(165), + PSR_SETUP_TIME(110), + PSR_SETUP_TIME(55), diff --git a/queue-4.14/hwtracing-stm-fix-build-error-on-some-arches.patch b/queue-4.14/hwtracing-stm-fix-build-error-on-some-arches.patch new file mode 100644 index 00000000000..0c7285617a0 --- /dev/null +++ b/queue-4.14/hwtracing-stm-fix-build-error-on-some-arches.patch @@ -0,0 +1,33 @@ +From 806e30873f0e74d9d41b0ef761bd4d3e55c7d510 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Sat, 26 May 2018 08:49:24 +0200 +Subject: hwtracing: stm: fix build error on some arches + +From: Greg Kroah-Hartman + +commit 806e30873f0e74d9d41b0ef761bd4d3e55c7d510 upstream. + +Commit b5e2ced9bf81 ("stm class: Use vmalloc for the master map") caused +a build error on some arches as vmalloc.h was not explicitly included. + +Fix that by adding it to the list of includes. + +Fixes: b5e2ced9bf81 ("stm class: Use vmalloc for the master map") +Reported-by: kbuild test robot +Cc: Alexander Shishkin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/stm/core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/hwtracing/stm/core.c ++++ b/drivers/hwtracing/stm/core.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + #include "stm.h" + + #include diff --git a/queue-4.14/ib-core-fix-error-code-for-invalid-gid-entry.patch b/queue-4.14/ib-core-fix-error-code-for-invalid-gid-entry.patch new file mode 100644 index 00000000000..7ba4094d7a2 --- /dev/null +++ b/queue-4.14/ib-core-fix-error-code-for-invalid-gid-entry.patch @@ -0,0 +1,48 @@ +From a840c93ca7582bb6c88df2345a33f979b7a67874 Mon Sep 17 00:00:00 2001 +From: Parav Pandit +Date: Sun, 27 May 2018 14:49:16 +0300 +Subject: IB/core: Fix error code for invalid GID entry + +From: Parav Pandit + +commit a840c93ca7582bb6c88df2345a33f979b7a67874 upstream. + +When a GID entry is invalid EAGAIN is returned. This is an incorrect error +code, there is nothing that will make this GID entry valid again in +bounded time. + +Some user space tools fail incorrectly if EAGAIN is returned here, and +this represents a small ABI change from earlier kernels. + +The first patch in the Fixes list makes entries that were valid before +to become invalid, allowing this code to trigger, while the second patch +in the Fixes list introduced the wrong EAGAIN. + +Therefore revert the return result to EINVAL which matches the historical +expectations of the ibv_query_gid_type() API of the libibverbs user space +library. + +Cc: +Fixes: 598ff6bae689 ("IB/core: Refactor GID modify code for RoCE") +Fixes: 03db3a2d81e6 ("IB/core: Add RoCE GID table management") +Reviewed-by: Daniel Jurgens +Signed-off-by: Parav Pandit +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/core/cache.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/core/cache.c ++++ b/drivers/infiniband/core/cache.c +@@ -434,7 +434,7 @@ static int __ib_cache_gid_get(struct ib_ + return -EINVAL; + + if (table->data_vec[index].props & GID_TABLE_ENTRY_INVALID) +- return -EAGAIN; ++ return -EINVAL; + + memcpy(gid, &table->data_vec[index].gid, sizeof(*gid)); + if (attr) { diff --git a/queue-4.14/iio-ad7793-implement-iio_chan_info_samp_freq.patch b/queue-4.14/iio-ad7793-implement-iio_chan_info_samp_freq.patch new file mode 100644 index 00000000000..35fab07a629 --- /dev/null +++ b/queue-4.14/iio-ad7793-implement-iio_chan_info_samp_freq.patch @@ -0,0 +1,148 @@ +From 490fba90a90eb7b741f57fefd2bcf2c1e11eb471 Mon Sep 17 00:00:00 2001 +From: Michael Nosthoff +Date: Fri, 9 Mar 2018 16:13:52 +0100 +Subject: iio: ad7793: implement IIO_CHAN_INFO_SAMP_FREQ + +From: Michael Nosthoff + +commit 490fba90a90eb7b741f57fefd2bcf2c1e11eb471 upstream. + +This commit is a follow-up to changes made to ad_sigma_delta.h +in staging: iio: ad7192: implement IIO_CHAN_INFO_SAMP_FREQ +which broke ad7793 as it was not altered to match those changes. + +This driver predates the availability of IIO_CHAN_INFO_SAMP_FREQ +attribute wherein usage has some advantages like it can be accessed by +in-kernel consumers as well as reduces the code size. + +Therefore, use IIO_CHAN_INFO_SAMP_FREQ to implement the +sampling_frequency attribute instead of using IIO_DEV_ATTR_SAMP_FREQ() +macro. + +Move code from the functions associated with IIO_DEV_ATTR_SAMP_FREQ() +into respective read and write hooks with the mask set to +IIO_CHAN_INFO_SAMP_FREQ. + +Fixes: a13e831fcaa7 ("staging: iio: ad7192: implement IIO_CHAN_INFO_SAMP_FREQ") + +Signed-off-by: Michael Nosthoff +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/ad7793.c | 75 +++++++++++++++-------------------------------- + 1 file changed, 24 insertions(+), 51 deletions(-) + +--- a/drivers/iio/adc/ad7793.c ++++ b/drivers/iio/adc/ad7793.c +@@ -348,55 +348,6 @@ static const u16 ad7793_sample_freq_avai + static const u16 ad7797_sample_freq_avail[16] = {0, 0, 0, 123, 62, 50, 0, + 33, 0, 17, 16, 12, 10, 8, 6, 4}; + +-static ssize_t ad7793_read_frequency(struct device *dev, +- struct device_attribute *attr, +- char *buf) +-{ +- struct iio_dev *indio_dev = dev_to_iio_dev(dev); +- struct ad7793_state *st = iio_priv(indio_dev); +- +- return sprintf(buf, "%d\n", +- st->chip_info->sample_freq_avail[AD7793_MODE_RATE(st->mode)]); +-} +- +-static ssize_t ad7793_write_frequency(struct device *dev, +- struct device_attribute *attr, +- const char *buf, +- size_t len) +-{ +- struct iio_dev *indio_dev = dev_to_iio_dev(dev); +- struct ad7793_state *st = iio_priv(indio_dev); +- long lval; +- int i, ret; +- +- ret = kstrtol(buf, 10, &lval); +- if (ret) +- return ret; +- +- if (lval == 0) +- return -EINVAL; +- +- for (i = 0; i < 16; i++) +- if (lval == st->chip_info->sample_freq_avail[i]) +- break; +- if (i == 16) +- return -EINVAL; +- +- ret = iio_device_claim_direct_mode(indio_dev); +- if (ret) +- return ret; +- st->mode &= ~AD7793_MODE_RATE(-1); +- st->mode |= AD7793_MODE_RATE(i); +- ad_sd_write_reg(&st->sd, AD7793_REG_MODE, sizeof(st->mode), st->mode); +- iio_device_release_direct_mode(indio_dev); +- +- return len; +-} +- +-static IIO_DEV_ATTR_SAMP_FREQ(S_IWUSR | S_IRUGO, +- ad7793_read_frequency, +- ad7793_write_frequency); +- + static IIO_CONST_ATTR_SAMP_FREQ_AVAIL( + "470 242 123 62 50 39 33 19 17 16 12 10 8 6 4"); + +@@ -424,7 +375,6 @@ static IIO_DEVICE_ATTR_NAMED(in_m_in_sca + ad7793_show_scale_available, NULL, 0); + + static struct attribute *ad7793_attributes[] = { +- &iio_dev_attr_sampling_frequency.dev_attr.attr, + &iio_const_attr_sampling_frequency_available.dev_attr.attr, + &iio_dev_attr_in_m_in_scale_available.dev_attr.attr, + NULL +@@ -435,7 +385,6 @@ static const struct attribute_group ad77 + }; + + static struct attribute *ad7797_attributes[] = { +- &iio_dev_attr_sampling_frequency.dev_attr.attr, + &iio_const_attr_sampling_frequency_available_ad7797.dev_attr.attr, + NULL + }; +@@ -505,6 +454,10 @@ static int ad7793_read_raw(struct iio_de + *val -= offset; + } + return IIO_VAL_INT; ++ case IIO_CHAN_INFO_SAMP_FREQ: ++ *val = st->chip_info ++ ->sample_freq_avail[AD7793_MODE_RATE(st->mode)]; ++ return IIO_VAL_INT; + } + return -EINVAL; + } +@@ -542,6 +495,26 @@ static int ad7793_write_raw(struct iio_d + break; + } + break; ++ case IIO_CHAN_INFO_SAMP_FREQ: ++ if (!val) { ++ ret = -EINVAL; ++ break; ++ } ++ ++ for (i = 0; i < 16; i++) ++ if (val == st->chip_info->sample_freq_avail[i]) ++ break; ++ ++ if (i == 16) { ++ ret = -EINVAL; ++ break; ++ } ++ ++ st->mode &= ~AD7793_MODE_RATE(-1); ++ st->mode |= AD7793_MODE_RATE(i); ++ ad_sd_write_reg(&st->sd, AD7793_REG_MODE, sizeof(st->mode), ++ st->mode); ++ break; + default: + ret = -EINVAL; + } diff --git a/queue-4.14/iio-adc-select-buffer-for-at91-sama5d2_adc.patch b/queue-4.14/iio-adc-select-buffer-for-at91-sama5d2_adc.patch new file mode 100644 index 00000000000..121c8f25093 --- /dev/null +++ b/queue-4.14/iio-adc-select-buffer-for-at91-sama5d2_adc.patch @@ -0,0 +1,36 @@ +From 76974ef9d1bf397b7bb97892a3b3bc516a1fc2c2 Mon Sep 17 00:00:00 2001 +From: Eugen Hristev +Date: Mon, 16 Apr 2018 09:54:03 +0300 +Subject: iio: adc: select buffer for at91-sama5d2_adc + +From: Eugen Hristev + +commit 76974ef9d1bf397b7bb97892a3b3bc516a1fc2c2 upstream. + +We need to select the buffer code, otherwise we get build errors +with undefined functions on the trigger and buffer, +if we select just IIO and then AT91_SAMA5D2_ADC from menuconfig + +This adds a Kconfig 'select' statement like other ADC +drivers have it already. + +Fixes: 5e1a1da0f8c9 ("iio: adc: at91-sama5d2_adc: add hw trigger and buffer support") +Signed-off-by: Eugen Hristev +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/adc/Kconfig ++++ b/drivers/iio/adc/Kconfig +@@ -158,6 +158,7 @@ config AT91_SAMA5D2_ADC + tristate "Atmel AT91 SAMA5D2 ADC" + depends on ARCH_AT91 || COMPILE_TEST + depends on HAS_IOMEM ++ select IIO_BUFFER + select IIO_TRIGGERED_BUFFER + help + Say yes here to build support for Atmel SAMA5D2 ADC which is diff --git a/queue-4.14/iio-buffer-make-length-types-match-kfifo-types.patch b/queue-4.14/iio-buffer-make-length-types-match-kfifo-types.patch new file mode 100644 index 00000000000..f4ed721e280 --- /dev/null +++ b/queue-4.14/iio-buffer-make-length-types-match-kfifo-types.patch @@ -0,0 +1,86 @@ +From c043ec1ca5baae63726aae32abbe003192bc6eec Mon Sep 17 00:00:00 2001 +From: Martin Kelly +Date: Mon, 26 Mar 2018 14:27:51 -0700 +Subject: iio:buffer: make length types match kfifo types + +From: Martin Kelly + +commit c043ec1ca5baae63726aae32abbe003192bc6eec upstream. + +Currently, we use int for buffer length and bytes_per_datum. However, +kfifo uses unsigned int for length and size_t for element size. We need +to make sure these matches or we will have bugs related to overflow (in +the range between INT_MAX and UINT_MAX for length, for example). + +In addition, set_bytes_per_datum uses size_t while bytes_per_datum is an +int, which would cause bugs for large values of bytes_per_datum. + +Change buffer length to use unsigned int and bytes_per_datum to use +size_t. + +Signed-off-by: Martin Kelly +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/buffer/industrialio-buffer-dma.c | 2 +- + drivers/iio/buffer/kfifo_buf.c | 4 ++-- + include/linux/iio/buffer_impl.h | 6 +++--- + 3 files changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/iio/buffer/industrialio-buffer-dma.c ++++ b/drivers/iio/buffer/industrialio-buffer-dma.c +@@ -587,7 +587,7 @@ EXPORT_SYMBOL_GPL(iio_dma_buffer_set_byt + * Should be used as the set_length callback for iio_buffer_access_ops + * struct for DMA buffers. + */ +-int iio_dma_buffer_set_length(struct iio_buffer *buffer, int length) ++int iio_dma_buffer_set_length(struct iio_buffer *buffer, unsigned int length) + { + /* Avoid an invalid state */ + if (length < 2) +--- a/drivers/iio/buffer/kfifo_buf.c ++++ b/drivers/iio/buffer/kfifo_buf.c +@@ -22,7 +22,7 @@ struct iio_kfifo { + #define iio_to_kfifo(r) container_of(r, struct iio_kfifo, buffer) + + static inline int __iio_allocate_kfifo(struct iio_kfifo *buf, +- int bytes_per_datum, int length) ++ size_t bytes_per_datum, unsigned int length) + { + if ((length == 0) || (bytes_per_datum == 0)) + return -EINVAL; +@@ -67,7 +67,7 @@ static int iio_set_bytes_per_datum_kfifo + return 0; + } + +-static int iio_set_length_kfifo(struct iio_buffer *r, int length) ++static int iio_set_length_kfifo(struct iio_buffer *r, unsigned int length) + { + /* Avoid an invalid state */ + if (length < 2) +--- a/include/linux/iio/buffer_impl.h ++++ b/include/linux/iio/buffer_impl.h +@@ -53,7 +53,7 @@ struct iio_buffer_access_funcs { + int (*request_update)(struct iio_buffer *buffer); + + int (*set_bytes_per_datum)(struct iio_buffer *buffer, size_t bpd); +- int (*set_length)(struct iio_buffer *buffer, int length); ++ int (*set_length)(struct iio_buffer *buffer, unsigned int length); + + int (*enable)(struct iio_buffer *buffer, struct iio_dev *indio_dev); + int (*disable)(struct iio_buffer *buffer, struct iio_dev *indio_dev); +@@ -72,10 +72,10 @@ struct iio_buffer_access_funcs { + */ + struct iio_buffer { + /** @length: Number of datums in buffer. */ +- int length; ++ unsigned int length; + + /** @bytes_per_datum: Size of individual datum including timestamp. */ +- int bytes_per_datum; ++ size_t bytes_per_datum; + + /** + * @access: Buffer access functions associated with the diff --git a/queue-4.14/iio-kfifo_buf-check-for-uint-overflow.patch b/queue-4.14/iio-kfifo_buf-check-for-uint-overflow.patch new file mode 100644 index 00000000000..e083e10afca --- /dev/null +++ b/queue-4.14/iio-kfifo_buf-check-for-uint-overflow.patch @@ -0,0 +1,60 @@ +From 3d13de4b027d5f6276c0f9d3a264f518747d83f2 Mon Sep 17 00:00:00 2001 +From: Martin Kelly +Date: Mon, 26 Mar 2018 14:27:52 -0700 +Subject: iio:kfifo_buf: check for uint overflow + +From: Martin Kelly + +commit 3d13de4b027d5f6276c0f9d3a264f518747d83f2 upstream. + +Currently, the following causes a kernel OOPS in memcpy: + +echo 1073741825 > buffer/length +echo 1 > buffer/enable + +Note that using 1073741824 instead of 1073741825 causes "write error: +Cannot allocate memory" but no OOPS. + +This is because 1073741824 == 2^30 and 1073741825 == 2^30+1. Since kfifo +rounds up to the nearest power of 2, it will actually call kmalloc with +roundup_pow_of_two(length) * bytes_per_datum. + +Using length == 1073741825 and bytes_per_datum == 2, we get: + +kmalloc(roundup_pow_of_two(1073741825) * 2 +or kmalloc(2147483648 * 2) +or kmalloc(4294967296) +or kmalloc(UINT_MAX + 1) + +so this overflows to 0, causing kmalloc to return ZERO_SIZE_PTR and +subsequent memcpy to fail once the device is enabled. + +Fix this by checking for overflow prior to allocating a kfifo. With this +check added, the above code returns -EINVAL when enabling the buffer, +rather than causing an OOPS. + +Signed-off-by: Martin Kelly +cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/buffer/kfifo_buf.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/iio/buffer/kfifo_buf.c ++++ b/drivers/iio/buffer/kfifo_buf.c +@@ -27,6 +27,13 @@ static inline int __iio_allocate_kfifo(s + if ((length == 0) || (bytes_per_datum == 0)) + return -EINVAL; + ++ /* ++ * Make sure we don't overflow an unsigned int after kfifo rounds up to ++ * the next power of 2. ++ */ ++ if (roundup_pow_of_two(length) > UINT_MAX / bytes_per_datum) ++ return -EINVAL; ++ + return __kfifo_alloc((struct __kfifo *)&buf->kf, length, + bytes_per_datum, GFP_KERNEL); + } diff --git a/queue-4.14/intel_th-use-correct-device-when-freeing-buffers.patch b/queue-4.14/intel_th-use-correct-device-when-freeing-buffers.patch new file mode 100644 index 00000000000..a65521d1557 --- /dev/null +++ b/queue-4.14/intel_th-use-correct-device-when-freeing-buffers.patch @@ -0,0 +1,58 @@ +From 0ed2424b911f3a058dfea01b78817abed767433d Mon Sep 17 00:00:00 2001 +From: Alexander Shishkin +Date: Thu, 24 May 2018 11:27:27 +0300 +Subject: intel_th: Use correct device when freeing buffers + +From: Alexander Shishkin + +commit 0ed2424b911f3a058dfea01b78817abed767433d upstream. + +Commit d5c435df4a890 ("intel_th: msu: Use the real device in case of IOMMU +domain allocation") changes dma buffer allocation to use the actual +underlying device, but forgets to change the deallocation path, which leads +to (if you've got CAP_SYS_RAWIO): + +> # echo 0,0 > /sys/bus/intel_th/devices/0-msc0/nr_pages +> ------------[ cut here ]------------ +> kernel BUG at ../linux/drivers/iommu/intel-iommu.c:3670! +> CPU: 3 PID: 231 Comm: sh Not tainted 4.17.0-rc1+ #2729 +> RIP: 0010:intel_unmap+0x11e/0x130 +... +> Call Trace: +> intel_free_coherent+0x3e/0x60 +> msc_buffer_win_free+0x100/0x160 [intel_th_msu] + +This patch fixes the buffer deallocation code to use the correct device. + +Signed-off-by: Alexander Shishkin +Fixes: d5c435df4a890 ("intel_th: msu: Use the real device in case of IOMMU domain allocation") +Reported-by: Baofeng Tian +CC: stable@vger.kernel.org # v4.14+ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/intel_th/msu.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/hwtracing/intel_th/msu.c ++++ b/drivers/hwtracing/intel_th/msu.c +@@ -741,8 +741,8 @@ err_nomem: + /* Reset the page to write-back before releasing */ + set_memory_wb((unsigned long)win->block[i].bdesc, 1); + #endif +- dma_free_coherent(msc_dev(msc), size, win->block[i].bdesc, +- win->block[i].addr); ++ dma_free_coherent(msc_dev(msc)->parent->parent, size, ++ win->block[i].bdesc, win->block[i].addr); + } + kfree(win); + +@@ -777,7 +777,7 @@ static void msc_buffer_win_free(struct m + /* Reset the page to write-back before releasing */ + set_memory_wb((unsigned long)win->block[i].bdesc, 1); + #endif +- dma_free_coherent(msc_dev(win->msc), PAGE_SIZE, ++ dma_free_coherent(msc_dev(win->msc)->parent->parent, PAGE_SIZE, + win->block[i].bdesc, win->block[i].addr); + } + diff --git a/queue-4.14/mips-lantiq-gphy-drop-reboot-remove-reset-asserts.patch b/queue-4.14/mips-lantiq-gphy-drop-reboot-remove-reset-asserts.patch new file mode 100644 index 00000000000..933104dc026 --- /dev/null +++ b/queue-4.14/mips-lantiq-gphy-drop-reboot-remove-reset-asserts.patch @@ -0,0 +1,105 @@ +From 32795631e67e16141aa5e065c28ba03bf17abb90 Mon Sep 17 00:00:00 2001 +From: Mathias Kresin +Date: Sun, 8 Apr 2018 10:30:03 +0200 +Subject: MIPS: lantiq: gphy: Drop reboot/remove reset asserts + +From: Mathias Kresin + +commit 32795631e67e16141aa5e065c28ba03bf17abb90 upstream. + +While doing a global software reset, these bits are not cleared and let +some bootloader fail to initialise the GPHYs. The bootloader don't +expect the GPHYs in reset, as they aren't during power on. + +The asserts were a workaround for a wrong syscon-reboot mask. With a +mask set which includes the GPHY resets, these resets aren't required +any more. + +Fixes: 126534141b45 ("MIPS: lantiq: Add a GPHY driver which uses the RCU syscon-mfd") +Signed-off-by: Mathias Kresin +Acked-by: Martin Blumenstingl +Acked-by: Hauke Mehrtens +Cc: John Crispin +Cc: linux-mips@linux-mips.org +Cc: # 4.14+ +Patchwork: https://patchwork.linux-mips.org/patch/19003/ +[jhogan@kernel.org: Fix build warnings] +Signed-off-by: James Hogan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/soc/lantiq/gphy.c | 36 ------------------------------------ + 1 file changed, 36 deletions(-) + +--- a/drivers/soc/lantiq/gphy.c ++++ b/drivers/soc/lantiq/gphy.c +@@ -30,7 +30,6 @@ struct xway_gphy_priv { + struct clk *gphy_clk_gate; + struct reset_control *gphy_reset; + struct reset_control *gphy_reset2; +- struct notifier_block gphy_reboot_nb; + void __iomem *membase; + char *fw_name; + }; +@@ -64,24 +63,6 @@ static const struct of_device_id xway_gp + }; + MODULE_DEVICE_TABLE(of, xway_gphy_match); + +-static struct xway_gphy_priv *to_xway_gphy_priv(struct notifier_block *nb) +-{ +- return container_of(nb, struct xway_gphy_priv, gphy_reboot_nb); +-} +- +-static int xway_gphy_reboot_notify(struct notifier_block *reboot_nb, +- unsigned long code, void *unused) +-{ +- struct xway_gphy_priv *priv = to_xway_gphy_priv(reboot_nb); +- +- if (priv) { +- reset_control_assert(priv->gphy_reset); +- reset_control_assert(priv->gphy_reset2); +- } +- +- return NOTIFY_DONE; +-} +- + static int xway_gphy_load(struct device *dev, struct xway_gphy_priv *priv, + dma_addr_t *dev_addr) + { +@@ -205,14 +186,6 @@ static int xway_gphy_probe(struct platfo + reset_control_deassert(priv->gphy_reset); + reset_control_deassert(priv->gphy_reset2); + +- /* assert the gphy reset because it can hang after a reboot: */ +- priv->gphy_reboot_nb.notifier_call = xway_gphy_reboot_notify; +- priv->gphy_reboot_nb.priority = -1; +- +- ret = register_reboot_notifier(&priv->gphy_reboot_nb); +- if (ret) +- dev_warn(dev, "Failed to register reboot notifier\n"); +- + platform_set_drvdata(pdev, priv); + + return ret; +@@ -220,21 +193,12 @@ static int xway_gphy_probe(struct platfo + + static int xway_gphy_remove(struct platform_device *pdev) + { +- struct device *dev = &pdev->dev; + struct xway_gphy_priv *priv = platform_get_drvdata(pdev); +- int ret; +- +- reset_control_assert(priv->gphy_reset); +- reset_control_assert(priv->gphy_reset2); + + iowrite32be(0, priv->membase); + + clk_disable_unprepare(priv->gphy_clk_gate); + +- ret = unregister_reboot_notifier(&priv->gphy_reboot_nb); +- if (ret) +- dev_warn(dev, "Failed to unregister reboot notifier\n"); +- + return 0; + } + diff --git a/queue-4.14/mips-prctl-disallow-fre-without-fr-with-pr_set_fp_mode-requests.patch b/queue-4.14/mips-prctl-disallow-fre-without-fr-with-pr_set_fp_mode-requests.patch new file mode 100644 index 00000000000..fb09088101e --- /dev/null +++ b/queue-4.14/mips-prctl-disallow-fre-without-fr-with-pr_set_fp_mode-requests.patch @@ -0,0 +1,59 @@ +From 28e4213dd331e944e7fca1954a946829162ed9d4 Mon Sep 17 00:00:00 2001 +From: "Maciej W. Rozycki" +Date: Tue, 15 May 2018 23:04:44 +0100 +Subject: MIPS: prctl: Disallow FRE without FR with PR_SET_FP_MODE requests + +From: Maciej W. Rozycki + +commit 28e4213dd331e944e7fca1954a946829162ed9d4 upstream. + +Having PR_FP_MODE_FRE (i.e. Config5.FRE) set without PR_FP_MODE_FR (i.e. +Status.FR) is not supported as the lone purpose of Config5.FRE is to +emulate Status.FR=0 handling on FPU hardware that has Status.FR=1 +hardwired[1][2]. Also we do not handle this case elsewhere, and assume +throughout our code that TIF_HYBRID_FPREGS and TIF_32BIT_FPREGS cannot +be set both at once for a task, leading to inconsistent behaviour if +this does happen. + +Return unsuccessfully then from prctl(2) PR_SET_FP_MODE calls requesting +PR_FP_MODE_FRE to be set with PR_FP_MODE_FR clear. This corresponds to +modes allowed by `mips_set_personality_fp'. + +References: + +[1] "MIPS Architecture For Programmers, Vol. III: MIPS32 / microMIPS32 + Privileged Resource Architecture", Imagination Technologies, + Document Number: MD00090, Revision 6.02, July 10, 2015, Table 9.69 + "Config5 Register Field Descriptions", p. 262 + +[2] "MIPS Architecture For Programmers, Volume III: MIPS64 / microMIPS64 + Privileged Resource Architecture", Imagination Technologies, + Document Number: MD00091, Revision 6.03, December 22, 2015, Table + 9.72 "Config5 Register Field Descriptions", p. 288 + +Fixes: 9791554b45a2 ("MIPS,prctl: add PR_[GS]ET_FP_MODE prctl options for MIPS") +Signed-off-by: Maciej W. Rozycki +Cc: Ralf Baechle +Cc: linux-mips@linux-mips.org +Cc: # 4.0+ +Patchwork: https://patchwork.linux-mips.org/patch/19327/ +Signed-off-by: James Hogan +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kernel/process.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/mips/kernel/process.c ++++ b/arch/mips/kernel/process.c +@@ -721,6 +721,10 @@ int mips_set_process_fp_mode(struct task + if (value & ~known_bits) + return -EOPNOTSUPP; + ++ /* Setting FRE without FR is not supported. */ ++ if ((value & (PR_FP_MODE_FR | PR_FP_MODE_FRE)) == PR_FP_MODE_FRE) ++ return -EOPNOTSUPP; ++ + /* Avoid inadvertently triggering emulation */ + if ((value & PR_FP_MODE_FR) && raw_cpu_has_fpu && + !(raw_current_cpu_data.fpu_id & MIPS_FPIR_F64)) diff --git a/queue-4.14/mips-ptrace-fix-ptrace_peekusr-requests-for-64-bit-fgrs.patch b/queue-4.14/mips-ptrace-fix-ptrace_peekusr-requests-for-64-bit-fgrs.patch new file mode 100644 index 00000000000..6f517d2a6f4 --- /dev/null +++ b/queue-4.14/mips-ptrace-fix-ptrace_peekusr-requests-for-64-bit-fgrs.patch @@ -0,0 +1,53 @@ +From c7e814628df65f424fe197dde73bfc67e4a244d7 Mon Sep 17 00:00:00 2001 +From: "Maciej W. Rozycki" +Date: Wed, 16 May 2018 16:39:58 +0100 +Subject: MIPS: ptrace: Fix PTRACE_PEEKUSR requests for 64-bit FGRs + +From: Maciej W. Rozycki + +commit c7e814628df65f424fe197dde73bfc67e4a244d7 upstream. + +Use 64-bit accesses for 64-bit floating-point general registers with +PTRACE_PEEKUSR, removing the truncation of their upper halves in the +FR=1 mode, caused by commit bbd426f542cb ("MIPS: Simplify FP context +access"), which inadvertently switched them to using 32-bit accesses. + +The PTRACE_POKEUSR side is fine as it's never been broken and continues +using 64-bit accesses. + +Fixes: bbd426f542cb ("MIPS: Simplify FP context access") +Signed-off-by: Maciej W. Rozycki +Cc: Ralf Baechle +Cc: linux-mips@linux-mips.org +Cc: # 3.15+ +Patchwork: https://patchwork.linux-mips.org/patch/19334/ +Signed-off-by: James Hogan +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kernel/ptrace.c | 2 +- + arch/mips/kernel/ptrace32.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/mips/kernel/ptrace.c ++++ b/arch/mips/kernel/ptrace.c +@@ -809,7 +809,7 @@ long arch_ptrace(struct task_struct *chi + break; + } + #endif +- tmp = get_fpr32(&fregs[addr - FPR_BASE], 0); ++ tmp = get_fpr64(&fregs[addr - FPR_BASE], 0); + break; + case PC: + tmp = regs->cp0_epc; +--- a/arch/mips/kernel/ptrace32.c ++++ b/arch/mips/kernel/ptrace32.c +@@ -108,7 +108,7 @@ long compat_arch_ptrace(struct task_stru + addr & 1); + break; + } +- tmp = get_fpr32(&fregs[addr - FPR_BASE], 0); ++ tmp = get_fpr64(&fregs[addr - FPR_BASE], 0); + break; + case PC: + tmp = regs->cp0_epc; diff --git a/queue-4.14/mm-huge_memory.c-__split_huge_page-use-atomic-clearpagedirty.patch b/queue-4.14/mm-huge_memory.c-__split_huge_page-use-atomic-clearpagedirty.patch new file mode 100644 index 00000000000..c1b89c394c0 --- /dev/null +++ b/queue-4.14/mm-huge_memory.c-__split_huge_page-use-atomic-clearpagedirty.patch @@ -0,0 +1,52 @@ +From 2d077d4b59924acd1f5180c6fb73b57f4771fde6 Mon Sep 17 00:00:00 2001 +From: Hugh Dickins +Date: Fri, 1 Jun 2018 16:50:45 -0700 +Subject: mm/huge_memory.c: __split_huge_page() use atomic ClearPageDirty() + +From: Hugh Dickins + +commit 2d077d4b59924acd1f5180c6fb73b57f4771fde6 upstream. + +Swapping load on huge=always tmpfs (with khugepaged tuned up to be very +eager, but I'm not sure that is relevant) soon hung uninterruptibly, +waiting for page lock in shmem_getpage_gfp()'s find_lock_entry(), most +often when "cp -a" was trying to write to a smallish file. Debug showed +that the page in question was not locked, and page->mapping NULL by now, +but page->index consistent with having been in a huge page before. + +Reproduced in minutes on a 4.15 kernel, even with 4.17's 605ca5ede764 +("mm/huge_memory.c: reorder operations in __split_huge_page_tail()") added +in; but took hours to reproduce on a 4.17 kernel (no idea why). + +The culprit proved to be the __ClearPageDirty() on tails beyond i_size in +__split_huge_page(): the non-atomic __bitoperation may have been safe when +4.8's baa355fd3314 ("thp: file pages support for split_huge_page()") +introduced it, but liable to erase PageWaiters after 4.10's 62906027091f +("mm: add PageWaiters indicating tasks are waiting for a page bit"). + +Link: http://lkml.kernel.org/r/alpine.LSU.2.11.1805291841070.3197@eggly.anvils +Fixes: 62906027091f ("mm: add PageWaiters indicating tasks are waiting for a page bit") +Signed-off-by: Hugh Dickins +Acked-by: Kirill A. Shutemov +Cc: Konstantin Khlebnikov +Cc: Nicholas Piggin +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/huge_memory.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -2388,7 +2388,7 @@ static void __split_huge_page(struct pag + __split_huge_page_tail(head, i, lruvec, list); + /* Some pages can be beyond i_size: drop them from page cache */ + if (head[i].index >= end) { +- __ClearPageDirty(head + i); ++ ClearPageDirty(head + i); + __delete_from_page_cache(head + i, NULL); + if (IS_ENABLED(CONFIG_SHMEM) && PageSwapBacked(head)) + shmem_uncharge(head->mapping->host, 1); diff --git a/queue-4.14/revert-rt2800-use-txop_backoff-for-probe-frames.patch b/queue-4.14/revert-rt2800-use-txop_backoff-for-probe-frames.patch new file mode 100644 index 00000000000..9d1e96c9cd2 --- /dev/null +++ b/queue-4.14/revert-rt2800-use-txop_backoff-for-probe-frames.patch @@ -0,0 +1,46 @@ +From 52a192362932f333a7ebafd581c4d9b81da2fec8 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Mon, 28 May 2018 13:25:06 +0200 +Subject: Revert "rt2800: use TXOP_BACKOFF for probe frames" + +From: Stanislaw Gruszka + +commit 52a192362932f333a7ebafd581c4d9b81da2fec8 upstream. + +This reverts commit fb47ada8dc3c30c8e7b415da155742b49536c61e. + +In some situations when we set TXOP_BACKOFF, the probe frame is +not sent at all. What it worse then sending probe frame as part +of AMPDU and can degrade 11n performance to 11g rates. + +Cc: stable@vger.kernel.org +Signed-off-by: Stanislaw Gruszka +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ralink/rt2x00/rt2x00queue.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c ++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c +@@ -372,16 +372,15 @@ static void rt2x00queue_create_tx_descri + + /* + * Determine IFS values +- * - Use TXOP_BACKOFF for probe and management frames except beacons ++ * - Use TXOP_BACKOFF for management frames except beacons + * - Use TXOP_SIFS for fragment bursts + * - Use TXOP_HTTXOP for everything else + * + * Note: rt2800 devices won't use CTS protection (if used) + * for frames not transmitted with TXOP_HTTXOP + */ +- if ((ieee80211_is_mgmt(hdr->frame_control) && +- !ieee80211_is_beacon(hdr->frame_control)) || +- (tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)) ++ if (ieee80211_is_mgmt(hdr->frame_control) && ++ !ieee80211_is_beacon(hdr->frame_control)) + txdesc->u.ht.txop = TXOP_BACKOFF; + else if (!(tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)) + txdesc->u.ht.txop = TXOP_SIFS; diff --git a/queue-4.14/scsi-scsi_transport_srp-fix-shost-to-rport-translation.patch b/queue-4.14/scsi-scsi_transport_srp-fix-shost-to-rport-translation.patch new file mode 100644 index 00000000000..d4159d1a9d3 --- /dev/null +++ b/queue-4.14/scsi-scsi_transport_srp-fix-shost-to-rport-translation.patch @@ -0,0 +1,97 @@ +From c9ddf73476ff4fffb7a87bd5107a0705bf2cf64b Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Mon, 21 May 2018 11:17:29 -0700 +Subject: scsi: scsi_transport_srp: Fix shost to rport translation + +From: Bart Van Assche + +commit c9ddf73476ff4fffb7a87bd5107a0705bf2cf64b upstream. + +Since an SRP remote port is attached as a child to shost->shost_gendev +and as the only child, the translation from the shost pointer into an +rport pointer must happen by looking up the shost child that is an +rport. This patch fixes the following KASAN complaint: + +BUG: KASAN: slab-out-of-bounds in srp_timed_out+0x57/0x110 [scsi_transport_srp] +Read of size 4 at addr ffff880035d3fcc0 by task kworker/1:0H/19 + +CPU: 1 PID: 19 Comm: kworker/1:0H Not tainted 4.16.0-rc3-dbg+ #1 +Workqueue: kblockd blk_mq_timeout_work +Call Trace: +dump_stack+0x85/0xc7 +print_address_description+0x65/0x270 +kasan_report+0x231/0x350 +srp_timed_out+0x57/0x110 [scsi_transport_srp] +scsi_times_out+0xc7/0x3f0 [scsi_mod] +blk_mq_terminate_expired+0xc2/0x140 +bt_iter+0xbc/0xd0 +blk_mq_queue_tag_busy_iter+0x1c7/0x350 +blk_mq_timeout_work+0x325/0x3f0 +process_one_work+0x441/0xa50 +worker_thread+0x76/0x6c0 +kthread+0x1b2/0x1d0 +ret_from_fork+0x24/0x30 + +Fixes: e68ca75200fe ("scsi_transport_srp: Reduce failover time") +Signed-off-by: Bart Van Assche +Cc: Hannes Reinecke +Cc: Johannes Thumshirn +Cc: Jason Gunthorpe +Cc: Doug Ledford +Cc: Laurence Oberman +Cc: stable@vger.kernel.org +Reviewed-by: Johannes Thumshirn +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/scsi_transport_srp.c | 22 ++++++++++++++++++++-- + 1 file changed, 20 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/scsi_transport_srp.c ++++ b/drivers/scsi/scsi_transport_srp.c +@@ -51,6 +51,8 @@ struct srp_internal { + struct transport_container rport_attr_cont; + }; + ++static int scsi_is_srp_rport(const struct device *dev); ++ + #define to_srp_internal(tmpl) container_of(tmpl, struct srp_internal, t) + + #define dev_to_rport(d) container_of(d, struct srp_rport, dev) +@@ -60,9 +62,24 @@ static inline struct Scsi_Host *rport_to + return dev_to_shost(r->dev.parent); + } + ++static int find_child_rport(struct device *dev, void *data) ++{ ++ struct device **child = data; ++ ++ if (scsi_is_srp_rport(dev)) { ++ WARN_ON_ONCE(*child); ++ *child = dev; ++ } ++ return 0; ++} ++ + static inline struct srp_rport *shost_to_rport(struct Scsi_Host *shost) + { +- return transport_class_to_srp_rport(&shost->shost_gendev); ++ struct device *child = NULL; ++ ++ WARN_ON_ONCE(device_for_each_child(&shost->shost_gendev, &child, ++ find_child_rport) < 0); ++ return child ? dev_to_rport(child) : NULL; + } + + /** +@@ -600,7 +617,8 @@ enum blk_eh_timer_return srp_timed_out(s + struct srp_rport *rport = shost_to_rport(shost); + + pr_debug("timeout for sdev %s\n", dev_name(&sdev->sdev_gendev)); +- return rport->fast_io_fail_tmo < 0 && rport->dev_loss_tmo < 0 && ++ return rport && rport->fast_io_fail_tmo < 0 && ++ rport->dev_loss_tmo < 0 && + i->f->reset_timer_if_blocked && scsi_device_blocked(sdev) ? + BLK_EH_RESET_TIMER : BLK_EH_NOT_HANDLED; + } diff --git a/queue-4.14/series b/queue-4.14/series index 30fbf98a601..fa6ebb2c63e 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -27,3 +27,20 @@ asoc-intel-sst-remove-redundant-variable-dma_dev_name.patch platform-chrome-cros_ec_lpc-remove-redundant-pointer-request.patch kbuild-clang-disable-unused-variable-warnings-only-when-constant.patch tcp-avoid-integer-overflows-in-tcp_rcv_space_adjust.patch +iio-ad7793-implement-iio_chan_info_samp_freq.patch +iio-buffer-make-length-types-match-kfifo-types.patch +iio-kfifo_buf-check-for-uint-overflow.patch +iio-adc-select-buffer-for-at91-sama5d2_adc.patch +mips-lantiq-gphy-drop-reboot-remove-reset-asserts.patch +mips-ptrace-fix-ptrace_peekusr-requests-for-64-bit-fgrs.patch +mips-prctl-disallow-fre-without-fr-with-pr_set_fp_mode-requests.patch +scsi-scsi_transport_srp-fix-shost-to-rport-translation.patch +stm-class-use-vmalloc-for-the-master-map.patch +hwtracing-stm-fix-build-error-on-some-arches.patch +ib-core-fix-error-code-for-invalid-gid-entry.patch +mm-huge_memory.c-__split_huge_page-use-atomic-clearpagedirty.patch +revert-rt2800-use-txop_backoff-for-probe-frames.patch +intel_th-use-correct-device-when-freeing-buffers.patch +drm-psr-fix-missed-entry-in-psr-setup-time-table.patch +drm-i915-lvds-move-acpi-lid-notification-registration-to-registration-phase.patch +drm-i915-disable-lvds-on-radiant-p845.patch diff --git a/queue-4.14/stm-class-use-vmalloc-for-the-master-map.patch b/queue-4.14/stm-class-use-vmalloc-for-the-master-map.patch new file mode 100644 index 00000000000..f5a506e868c --- /dev/null +++ b/queue-4.14/stm-class-use-vmalloc-for-the-master-map.patch @@ -0,0 +1,62 @@ +From b5e2ced9bf81393034072dd4d372f6b430bc1f0a Mon Sep 17 00:00:00 2001 +From: Alexander Shishkin +Date: Thu, 24 May 2018 11:27:26 +0300 +Subject: stm class: Use vmalloc for the master map + +From: Alexander Shishkin + +commit b5e2ced9bf81393034072dd4d372f6b430bc1f0a upstream. + +Fengguang is running into a warning from the buddy allocator: + +> swapper/0: page allocation failure: order:9, mode:0x14040c0(GFP_KERNEL|__GFP_COMP), nodemask=(null) +> CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.17.0-rc1 #262 +> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 +> Call Trace: +... +> __kmalloc+0x14b/0x180: ____cache_alloc at mm/slab.c:3127 +> stm_register_device+0xf3/0x5c0: stm_register_device at drivers/hwtracing/stm/core.c:695 +... + +Which is basically a result of the stm class trying to allocate ~512kB +for the dummy_stm with its default parameters. There's no reason, however, +for it not to be vmalloc()ed instead, which is what this patch does. + +Reported-by: Fengguang Wu +Signed-off-by: Alexander Shishkin +CC: stable@vger.kernel.org # v4.4+ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/stm/core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/hwtracing/stm/core.c ++++ b/drivers/hwtracing/stm/core.c +@@ -682,7 +682,7 @@ static void stm_device_release(struct de + { + struct stm_device *stm = to_stm_device(dev); + +- kfree(stm); ++ vfree(stm); + } + + int stm_register_device(struct device *parent, struct stm_data *stm_data, +@@ -699,7 +699,7 @@ int stm_register_device(struct device *p + return -EINVAL; + + nmasters = stm_data->sw_end - stm_data->sw_start + 1; +- stm = kzalloc(sizeof(*stm) + nmasters * sizeof(void *), GFP_KERNEL); ++ stm = vzalloc(sizeof(*stm) + nmasters * sizeof(void *)); + if (!stm) + return -ENOMEM; + +@@ -752,7 +752,7 @@ err_device: + /* matches device_initialize() above */ + put_device(&stm->dev); + err_free: +- kfree(stm); ++ vfree(stm); + + return err; + } -- 2.47.3