commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be Author: Linus Torvalds Date: Sun Dec 23 15:55:59 2018 -0800 Linux 4.20 commit 3c730b1041aefa2a92b96fcba9db237d28585922 Merge: 9105b8aa50c1 ea5751ccd665 Author: Linus Torvalds Date: Sun Dec 23 10:40:41 2018 -0800 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs fixes from Al Viro: "A couple of fixes - no common topic ;-)" [ The aio spectre patch also came in from Jens, so now we have that doubly fixed .. ] * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: proc/sysctl: don't return ENOMEM on lookup when a table is unregistering aio: fix spectre gadget in lookup_ioctx commit 9105b8aa50c182371533fc97db64fc8f26f051b3 Merge: 1104bd96eb2a 61cce6f6eece Author: Linus Torvalds Date: Sat Dec 22 15:03:00 2018 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "This is two simple target fixes and one discard related I/O starvation problem in sd. The discard problem occurs because the discard page doesn't have a mempool backing so if the allocation fails due to memory pressure, we then lose the forward progress we require if the writeout is on the same device. The fix is to back it with a mempool" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: sd: use mempool for discard special page scsi: target: iscsi: cxgbit: add missing spin_lock_init() scsi: target: iscsi: cxgbit: fix csk leak commit 1104bd96eb2af9707dce69a22c63bd432a41380a Merge: 38c0ecf6087a 71391bdd2e9a Author: Linus Torvalds Date: Sat Dec 22 14:29:21 2018 -0800 Merge tag 'compiler-attributes-for-linus-v4.20' of https://github.com/ojeda/linux Pull compiler_types.h fix from Miguel Ojeda: "A cleanup for userspace in compiler_types.h: don't pollute userspace with macro definitions (Xiaozhou Liu) This is harmless for the kernel, but v4.19 was released with a few macros exposed to userspace as the patch explains; which this removes, so it *could* happen that we break something for someone (although leaving inline redefined is probably worse)" * tag 'compiler-attributes-for-linus-v4.20' of https://github.com/ojeda/linux: include/linux/compiler_types.h: don't pollute userspace with macro definitions commit 38c0ecf6087a8cb2af24ddd2124e9ca3c666dcdf Merge: 94f82008ce30 9bc30ab82108 Author: Linus Torvalds Date: Sat Dec 22 14:25:23 2018 -0800 Merge tag 'auxdisplay-for-linus-v4.20' of https://github.com/ojeda/linux Pull auxdisplay fix from Miguel Ojeda: "charlcd: fix x/y command parsing (Mans Rullgard)" * tag 'auxdisplay-for-linus-v4.20' of https://github.com/ojeda/linux: auxdisplay: charlcd: fix x/y command parsing commit 94f82008ce30e2624537d240d64ce718255e0b80 Author: Christian Brauner Date: Thu Jul 5 17:51:20 2018 +0200 Revert "vfs: Allow userns root to call mknod on owned filesystems." This reverts commit 55956b59df336f6738da916dbb520b6e37df9fbd. commit 55956b59df33 ("vfs: Allow userns root to call mknod on owned filesystems.") enabled mknod() in user namespaces for userns root if CAP_MKNOD is available. However, these device nodes are useless since any filesystem mounted from a non-initial user namespace will set the SB_I_NODEV flag on the filesystem. Now, when a device node s created in a non-initial user namespace a call to open() on said device node will fail due to: bool may_open_dev(const struct path *path) { return !(path->mnt->mnt_flags & MNT_NODEV) && !(path->mnt->mnt_sb->s_iflags & SB_I_NODEV); } The problem with this is that as of the aforementioned commit mknod() creates partially functional device nodes in non-initial user namespaces. In particular, it has the consequence that as of the aforementioned commit open() will be more privileged with respect to device nodes than mknod(). Before it was the other way around. Specifically, if mknod() succeeded then it was transparent for any userspace application that a fatal error must have occured when open() failed. All of this breaks multiple userspace workloads and a widespread assumption about how to handle mknod(). Basically, all container runtimes and systemd live by the slogan "ask for forgiveness not permission" when running user namespace workloads. For mknod() the assumption is that if the syscall succeeds the device nodes are useable irrespective of whether it succeeds in a non-initial user namespace or not. This logic was chosen explicitly to allow for the glorious day when mknod() will actually be able to create fully functional device nodes in user namespaces. A specific problem people are already running into when running 4.18 rc kernels are failing systemd services. For any distro that is run in a container systemd services started with the PrivateDevices= property set will fail to start since the device nodes in question cannot be opened (cf. the arguments in [1]). Full disclosure, Seth made the very sound argument that it is already possible to end up with partially functional device nodes. Any filesystem mounted with MS_NODEV set will allow mknod() to succeed but will not allow open() to succeed. The difference to the case here is that the MS_NODEV case is transparent to userspace since it is an explicitly set mount option while the SB_I_NODEV case is an implicit property enforced by the kernel and hence opaque to userspace. [1]: https://github.com/systemd/systemd/pull/9483 Signed-off-by: Christian Brauner Cc: "Eric W. Biederman" Cc: Seth Forshee Cc: Serge Hallyn Signed-off-by: Linus Torvalds commit 0cd60eb1a7b5421e92a3489e1829bfb2243e21e1 Author: Christoph Hellwig Date: Sat Dec 22 09:21:08 2018 +0100 dma-mapping: fix flags in dma_alloc_wc We really need the writecombine flag in dma_alloc_wc, fix a stupid oversight. Fixes: 7ed1d91a9e ("dma-mapping: translate __GFP_NOFAIL to DMA_ATTR_NO_WARN") Signed-off-by: Christoph Hellwig Signed-off-by: Linus Torvalds commit 23203e3f34c97f4ddd6e353adba45161880a52a4 Merge: 6cafab50eea3 17e2e7d7e1b8 Author: Linus Torvalds Date: Fri Dec 21 14:59:00 2018 -0800 Merge branch 'akpm' (patches from Andrew) Merge misc fixes from Andrew Morton: "4 fixes" * emailed patches from Andrew Morton : mm, page_alloc: fix has_unmovable_pages for HugePages fork,memcg: fix crash in free_thread_stack on memcg charge fail mm: thp: fix flags for pmd migration when split mm, memory_hotplug: initialize struct pages for the full memory section commit 17e2e7d7e1b83fa324b3f099bfe426659aa3c2a4 Author: Oscar Salvador Date: Fri Dec 21 14:31:00 2018 -0800 mm, page_alloc: fix has_unmovable_pages for HugePages While playing with gigantic hugepages and memory_hotplug, I triggered the following #PF when "cat memoryX/removable": BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 #PF error: [normal kernel read fault] PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 1 PID: 1481 Comm: cat Tainted: G E 4.20.0-rc6-mm1-1-default+ #18 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.0.0-prebuilt.qemu-project.org 04/01/2014 RIP: 0010:has_unmovable_pages+0x154/0x210 Call Trace: is_mem_section_removable+0x7d/0x100 removable_show+0x90/0xb0 dev_attr_show+0x1c/0x50 sysfs_kf_seq_show+0xca/0x1b0 seq_read+0x133/0x380 __vfs_read+0x26/0x180 vfs_read+0x89/0x140 ksys_read+0x42/0x90 do_syscall_64+0x5b/0x180 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The reason is we do not pass the Head to page_hstate(), and so, the call to compound_order() in page_hstate() returns 0, so we end up checking all hstates's size to match PAGE_SIZE. Obviously, we do not find any hstate matching that size, and we return NULL. Then, we dereference that NULL pointer in hugepage_migration_supported() and we got the #PF from above. Fix that by getting the head page before calling page_hstate(). Also, since gigantic pages span several pageblocks, re-adjust the logic for skipping pages. While are it, we can also get rid of the round_up(). [osalvador@suse.de: remove round_up(), adjust skip pages logic per Michal] Link: http://lkml.kernel.org/r/20181221062809.31771-1-osalvador@suse.de Link: http://lkml.kernel.org/r/20181217225113.17864-1-osalvador@suse.de Signed-off-by: Oscar Salvador Acked-by: Michal Hocko Reviewed-by: David Hildenbrand Cc: Vlastimil Babka Cc: Pavel Tatashin Cc: Mike Rapoport Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5eed6f1dff87bfb5e545935def3843edf42800f2 Author: Rik van Riel Date: Fri Dec 21 14:30:54 2018 -0800 fork,memcg: fix crash in free_thread_stack on memcg charge fail Commit 9b6f7e163cd0 ("mm: rework memcg kernel stack accounting") will result in fork failing if allocating a kernel stack for a task in dup_task_struct exceeds the kernel memory allowance for that cgroup. Unfortunately, it also results in a crash. This is due to the code jumping to free_stack and calling free_thread_stack when the memcg kernel stack charge fails, but without tsk->stack pointing at the freshly allocated stack. This in turn results in the vfree_atomic in free_thread_stack oopsing with a backtrace like this: #5 [ffffc900244efc88] die at ffffffff8101f0ab #6 [ffffc900244efcb8] do_general_protection at ffffffff8101cb86 #7 [ffffc900244efce0] general_protection at ffffffff818ff082 [exception RIP: llist_add_batch+7] RIP: ffffffff8150d487 RSP: ffffc900244efd98 RFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88085ef55980 RCX: 0000000000000000 RDX: ffff88085ef55980 RSI: 343834343531203a RDI: 343834343531203a RBP: ffffc900244efd98 R8: 0000000000000001 R9: ffff8808578c3600 R10: 0000000000000000 R11: 0000000000000001 R12: ffff88029f6c21c0 R13: 0000000000000286 R14: ffff880147759b00 R15: 0000000000000000 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #8 [ffffc900244efda0] vfree_atomic at ffffffff811df2c7 #9 [ffffc900244efdb8] copy_process at ffffffff81086e37 #10 [ffffc900244efe98] _do_fork at ffffffff810884e0 #11 [ffffc900244eff10] sys_vfork at ffffffff810887ff #12 [ffffc900244eff20] do_syscall_64 at ffffffff81002a43 RIP: 000000000049b948 RSP: 00007ffcdb307830 RFLAGS: 00000246 RAX: ffffffffffffffda RBX: 0000000000896030 RCX: 000000000049b948 RDX: 0000000000000000 RSI: 00007ffcdb307790 RDI: 00000000005d7421 RBP: 000000000067370f R8: 00007ffcdb3077b0 R9: 000000000001ed00 R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000040 R13: 000000000000000f R14: 0000000000000000 R15: 000000000088d018 ORIG_RAX: 000000000000003a CS: 0033 SS: 002b The simplest fix is to assign tsk->stack right where it is allocated. Link: http://lkml.kernel.org/r/20181214231726.7ee4843c@imladris.surriel.com Fixes: 9b6f7e163cd0 ("mm: rework memcg kernel stack accounting") Signed-off-by: Rik van Riel Acked-by: Roman Gushchin Acked-by: Michal Hocko Cc: Shakeel Butt Cc: Johannes Weiner Cc: Tejun Heo Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2e83ee1d8694a61d0d95a5b694f2e61e8dde8627 Author: Peter Xu Date: Fri Dec 21 14:30:50 2018 -0800 mm: thp: fix flags for pmd migration when split When splitting a huge migrating PMD, we'll transfer all the existing PMD bits and apply them again onto the small PTEs. However we are fetching the bits unconditionally via pmd_soft_dirty(), pmd_write() or pmd_yound() while actually they don't make sense at all when it's a migration entry. Fix them up. Since at it, drop the ifdef together as not needed. Note that if my understanding is correct about the problem then if without the patch there is chance to lose some of the dirty bits in the migrating pmd pages (on x86_64 we're fetching bit 11 which is part of swap offset instead of bit 2) and it could potentially corrupt the memory of an userspace program which depends on the dirty bit. Link: http://lkml.kernel.org/r/20181213051510.20306-1-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: Konstantin Khlebnikov Reviewed-by: William Kucharski Acked-by: Kirill A. Shutemov Cc: Andrea Arcangeli Cc: Matthew Wilcox Cc: Michal Hocko Cc: Dave Jiang Cc: "Aneesh Kumar K.V" Cc: Souptick Joarder Cc: Konstantin Khlebnikov Cc: Zi Yan Cc: [4.14+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2830bf6f05fb3e05bc4743274b806c821807a684 Author: Mikhail Zaslonko Date: Fri Dec 21 14:30:46 2018 -0800 mm, memory_hotplug: initialize struct pages for the full memory section If memory end is not aligned with the sparse memory section boundary, the mapping of such a section is only partly initialized. This may lead to VM_BUG_ON due to uninitialized struct page access from is_mem_section_removable() or test_pages_in_a_zone() function triggered by memory_hotplug sysfs handlers: Here are the the panic examples: CONFIG_DEBUG_VM=y CONFIG_DEBUG_VM_PGFLAGS=y kernel parameter mem=2050M -------------------------- page:000003d082008000 is uninitialized and poisoned page dumped because: VM_BUG_ON_PAGE(PagePoisoned(p)) Call Trace: ( test_pages_in_a_zone+0xde/0x160) show_valid_zones+0x5c/0x190 dev_attr_show+0x34/0x70 sysfs_kf_seq_show+0xc8/0x148 seq_read+0x204/0x480 __vfs_read+0x32/0x178 vfs_read+0x82/0x138 ksys_read+0x5a/0xb0 system_call+0xdc/0x2d8 Last Breaking-Event-Address: test_pages_in_a_zone+0xde/0x160 Kernel panic - not syncing: Fatal exception: panic_on_oops kernel parameter mem=3075M -------------------------- page:000003d08300c000 is uninitialized and poisoned page dumped because: VM_BUG_ON_PAGE(PagePoisoned(p)) Call Trace: ( is_mem_section_removable+0xb4/0x190) show_mem_removable+0x9a/0xd8 dev_attr_show+0x34/0x70 sysfs_kf_seq_show+0xc8/0x148 seq_read+0x204/0x480 __vfs_read+0x32/0x178 vfs_read+0x82/0x138 ksys_read+0x5a/0xb0 system_call+0xdc/0x2d8 Last Breaking-Event-Address: is_mem_section_removable+0xb4/0x190 Kernel panic - not syncing: Fatal exception: panic_on_oops Fix the problem by initializing the last memory section of each zone in memmap_init_zone() till the very end, even if it goes beyond the zone end. Michal said: : This has alwways been problem AFAIU. It just went unnoticed because we : have zeroed memmaps during allocation before f7f99100d8d9 ("mm: stop : zeroing memory during allocation in vmemmap") and so the above test : would simply skip these ranges as belonging to zone 0 or provided a : garbage. : : So I guess we do care for post f7f99100d8d9 kernels mostly and : therefore Fixes: f7f99100d8d9 ("mm: stop zeroing memory during : allocation in vmemmap") Link: http://lkml.kernel.org/r/20181212172712.34019-2-zaslonko@linux.ibm.com Fixes: f7f99100d8d9 ("mm: stop zeroing memory during allocation in vmemmap") Signed-off-by: Mikhail Zaslonko Reviewed-by: Gerald Schaefer Suggested-by: Michal Hocko Acked-by: Michal Hocko Reported-by: Mikhail Gavrilov Tested-by: Mikhail Gavrilov Cc: Dave Hansen Cc: Alexander Duyck Cc: Pasha Tatashin Cc: Martin Schwidefsky Cc: Heiko Carstens Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6cafab50eea327e0d198cc9579a60440fc959756 Merge: 87935eee5770 d430aff8cd0c Author: Linus Torvalds Date: Fri Dec 21 14:23:57 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc Pull sparc fixes from David Miller: "Just some small fixes here and there, and a refcount leak in a serial driver, nothing serious" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: serial/sunsu: fix refcount leak sparc: Set "ARCH: sunxx" information on the same line sparc: vdso: Drop implicit common-page-size linker flag commit 87935eee57705e9b6df506c5df8b92d6a0b77a51 Merge: 5092adb2272e d667044f4951 Author: Linus Torvalds Date: Fri Dec 21 14:21:17 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull more networking fixes from David Miller: "Some more bug fixes have trickled in, we have: 1) Local MAC entries properly in mscc driver, from Allan W. Nielsen. 2) Eric Dumazet found some more of the typical "pskb_may_pull() --> oops forgot to reload the header pointer" bugs in ipv6 tunnel handling. 3) Bad SKB socket pointer in ipv6 fragmentation handling, from Herbert Xu. 4) Overflow fix in sk_msg_clone(), from Vakul Garg. 5) Validate address lengths in AF_PACKET, from Willem de Bruijn" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: qmi_wwan: Fix qmap header retrieval in qmimux_rx_fixup qmi_wwan: Add support for Fibocom NL678 series tls: Do not call sk_memcopy_from_iter with zero length ipv6: tunnels: fix two use-after-free Prevent overflow of sk_msg in sk_msg_clone() packet: validate address length net: netxen: fix a missing check and an uninitialized use tcp: fix a race in inet_diag_dump_icsk() MAINTAINERS: update cxgb4 and cxgb3 maintainer ipv6: frags: Fix bogus skb->sk in reassembled packets mscc: Configured MAC entries should be locked. commit 9bc30ab82108e6a34dc63bf956b49edf71b1681a Author: Mans Rullgard Date: Wed Dec 5 13:52:47 2018 +0000 auxdisplay: charlcd: fix x/y command parsing The x/y command parsing has been broken since commit 129957069e6a ("staging: panel: Fixed checkpatch warning about simple_strtoul()"). Commit b34050fadb86 ("auxdisplay: charlcd: Fix and clean up handling of x/y commands") fixed some problems by rewriting the parsing code, but also broke things further by removing the check for a complete command before attempting to parse it. As a result, parsing is terminated at the first x or y character. This reinstates the check for a final semicolon. Whereas the original code use strchr(), this is wasteful seeing as the semicolon is always at the end of the buffer. Thus check this character directly instead. Signed-off-by: Mans Rullgard Signed-off-by: Miguel Ojeda commit d430aff8cd0c57502d873909c184e3b5753f8b88 Author: Yangtao Li Date: Wed Dec 12 11:01:45 2018 -0500 serial/sunsu: fix refcount leak The function of_find_node_by_path() acquires a reference to the node returned by it and that reference needs to be dropped by its caller. su_get_type() doesn't do that. The match node are used as an identifier to compare against the current node, so we can directly drop the refcount after getting the node from the path as it is not used as pointer. Fix this by use a single variable and drop the refcount right after of_find_node_by_path(). Signed-off-by: Yangtao Li Signed-off-by: David S. Miller commit afaffac36806db34edcbd20f04258b1fcda192c1 Author: Corentin Labbe Date: Tue Dec 11 12:11:09 2018 +0000 sparc: Set "ARCH: sunxx" information on the same line While checking boot log from SPARC qemu, I saw that the "ARCH: sunxx" information was split on two different line. This patchs merge both line together. In the meantime, thoses information need to be printed via pr_info since printk print them by default via the warning loglevel. Signed-off-by: Corentin Labbe Signed-off-by: David S. Miller commit 0ff70f62c6a7eb5521ab340624de4c19f0c0881c Author: ndesaulniers@google.com Date: Mon Dec 10 14:35:13 2018 -0800 sparc: vdso: Drop implicit common-page-size linker flag GNU linker's -z common-page-size's default value is based on the target architecture. arch/sparc/vdso/Makefile sets it to the architecture default, which is implicit and redundant. Drop it. Link: https://lkml.kernel.org/r/20181206191231.192355-1-ndesaulniers@google.com Signed-off-by: Nick Desaulniers Signed-off-by: David S. Miller commit 5092adb2272e1760030a889aa4a3e9cf1d5f74b5 Merge: e572fa0e8401 3cf85f9f6bd7 Author: Linus Torvalds Date: Fri Dec 21 11:15:36 2018 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fix from Paolo Bonzini: "A simple patch for a pretty bad bug: Unbreak AMD nested virtualization." * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86: nSVM: fix switch to guest mmu commit d667044f49513d55fcfefe4fa8f8d96091782901 Author: Daniele Palmas Date: Fri Dec 21 13:07:23 2018 +0100 qmi_wwan: Fix qmap header retrieval in qmimux_rx_fixup This patch fixes qmap header retrieval when modem is configured for dl data aggregation. Signed-off-by: Daniele Palmas Signed-off-by: David S. Miller commit e572fa0e840154d33a69622af030dda551eee606 Merge: d5fa080d4cea 0e334db6bb4b Author: Linus Torvalds Date: Fri Dec 21 10:51:54 2018 -0800 Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Ingo Molnar: "Fix a division by zero crash in the posix-timers code" * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: posix-timers: Fix division by zero bug commit 7c3db4105ce8d69bcb5c04bfa9acd1e9119af8d5 Author: Jörgen Storvist Date: Fri Dec 21 15:38:52 2018 +0100 qmi_wwan: Add support for Fibocom NL678 series Added support for Fibocom NL678 series cellular module QMI interface. Using QMI_QUIRK_SET_DTR required for Qualcomm MDM9x40 series chipsets. Signed-off-by: Jörgen Storvist Signed-off-by: David S. Miller commit 65a10e28aee72903a41670170cd5330ad73c490e Author: Vakul Garg Date: Fri Dec 21 15:16:52 2018 +0000 tls: Do not call sk_memcopy_from_iter with zero length In some conditions e.g. when tls_clone_plaintext_msg() returns -ENOSPC, the number of bytes to be copied using subsequent function sk_msg_memcopy_from_iter() becomes zero. This causes function sk_msg_memcopy_from_iter() to fail which in turn causes tls_sw_sendmsg() to return failure. To prevent it, do not call sk_msg_memcopy_from_iter() when number of bytes to copy (indicated by 'try_to_copy') is zero. Fixes: d829e9c4112b ("tls: convert to generic sk_msg interface") Signed-off-by: Vakul Garg Signed-off-by: David S. Miller commit d5fa080d4ceaa8fec0fb28e27c7447caf4b4d22b Merge: 70ad6368e878 da791a667536 Author: Linus Torvalds Date: Fri Dec 21 10:11:51 2018 -0800 Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull futex fix from Ingo Molnar: "A single fix for a robust futexes race between sys_exit() and sys_futex_lock_pi()" * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Cure exit race commit 70ad6368e878857db315788dab36817aa992c86a Merge: 96d6ee7d2f81 6ac389346e69 Author: Linus Torvalds Date: Fri Dec 21 09:22:24 2018 -0800 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "The biggest part is a series of reverts for the macro based GCC inlining workarounds. It caused regressions in distro build and other kernel tooling environments, and the GCC project was very receptive to fixing the underlying inliner weaknesses - so as time ran out we decided to do a reasonably straightforward revert of the patches. The plan is to rely on the 'asm inline' GCC 9 feature, which might be backported to GCC 8 and could thus become reasonably widely available on modern distros. Other than those reverts, there's misc fixes from all around the place. I wish our final x86 pull request for v4.20 was smaller..." * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: Revert "kbuild/Makefile: Prepare for using macros in inline assembly code to work around asm() related GCC inlining bugs" Revert "x86/objtool: Use asm macros to work around GCC inlining bugs" Revert "x86/refcount: Work around GCC inlining bug" Revert "x86/alternatives: Macrofy lock prefixes to work around GCC inlining bugs" Revert "x86/bug: Macrofy the BUG table section handling, to work around GCC inlining bugs" Revert "x86/paravirt: Work around GCC inlining bugs when compiling paravirt ops" Revert "x86/extable: Macrofy inline assembly code to work around GCC inlining bugs" Revert "x86/cpufeature: Macrofy inline assembly code to work around GCC inlining bugs" Revert "x86/jump-labels: Macrofy inline assembly code to work around GCC inlining bugs" x86/mtrr: Don't copy uninitialized gentry fields back to userspace x86/fsgsbase/64: Fix the base write helper functions x86/mm/cpa: Fix cpa_flush_array() TLB invalidation x86/vdso: Pass --eh-frame-hdr to the linker x86/mm: Fix decoy address handling vs 32-bit builds x86/intel_rdt: Ensure a CPU remains online for the region's pseudo-locking sequence x86/dump_pagetables: Fix LDT remap address marker x86/mm: Fix guard hole handling commit cbb49697d5512ce9e61b45ce75d3ee43d7ea5524 Author: Eric Dumazet Date: Fri Dec 21 07:47:51 2018 -0800 ipv6: tunnels: fix two use-after-free xfrm6_policy_check() might have re-allocated skb->head, we need to reload ipv6 header pointer. sysbot reported : BUG: KASAN: use-after-free in __ipv6_addr_type+0x302/0x32f net/ipv6/addrconf_core.c:40 Read of size 4 at addr ffff888191b8cb70 by task syz-executor2/1304 CPU: 0 PID: 1304 Comm: syz-executor2 Not tainted 4.20.0-rc7+ #356 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x244/0x39d lib/dump_stack.c:113 print_address_description.cold.7+0x9/0x1ff mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.8+0x242/0x309 mm/kasan/report.c:412 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432 __ipv6_addr_type+0x302/0x32f net/ipv6/addrconf_core.c:40 ipv6_addr_type include/net/ipv6.h:403 [inline] ip6_tnl_get_cap+0x27/0x190 net/ipv6/ip6_tunnel.c:727 ip6_tnl_rcv_ctl+0xdb/0x2a0 net/ipv6/ip6_tunnel.c:757 vti6_rcv+0x336/0x8f3 net/ipv6/ip6_vti.c:321 xfrm6_ipcomp_rcv+0x1a5/0x3a0 net/ipv6/xfrm6_protocol.c:132 ip6_protocol_deliver_rcu+0x372/0x1940 net/ipv6/ip6_input.c:394 ip6_input_finish+0x84/0x170 net/ipv6/ip6_input.c:434 NF_HOOK include/linux/netfilter.h:289 [inline] ip6_input+0xe9/0x600 net/ipv6/ip6_input.c:443 IPVS: ftp: loaded support on port[0] = 21 ip6_mc_input+0x514/0x11c0 net/ipv6/ip6_input.c:537 dst_input include/net/dst.h:450 [inline] ip6_rcv_finish+0x17a/0x330 net/ipv6/ip6_input.c:76 NF_HOOK include/linux/netfilter.h:289 [inline] ipv6_rcv+0x115/0x640 net/ipv6/ip6_input.c:272 __netif_receive_skb_one_core+0x14d/0x200 net/core/dev.c:4973 __netif_receive_skb+0x2c/0x1e0 net/core/dev.c:5083 process_backlog+0x24e/0x7a0 net/core/dev.c:5923 napi_poll net/core/dev.c:6346 [inline] net_rx_action+0x7fa/0x19b0 net/core/dev.c:6412 __do_softirq+0x308/0xb7e kernel/softirq.c:292 do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1027 do_softirq.part.14+0x126/0x160 kernel/softirq.c:337 do_softirq+0x19/0x20 kernel/softirq.c:340 netif_rx_ni+0x521/0x860 net/core/dev.c:4569 dev_loopback_xmit+0x287/0x8c0 net/core/dev.c:3576 NF_HOOK include/linux/netfilter.h:289 [inline] ip6_finish_output2+0x193a/0x2930 net/ipv6/ip6_output.c:84 ip6_fragment+0x2b06/0x3850 net/ipv6/ip6_output.c:727 ip6_finish_output+0x6b7/0xc50 net/ipv6/ip6_output.c:152 NF_HOOK_COND include/linux/netfilter.h:278 [inline] ip6_output+0x232/0x9d0 net/ipv6/ip6_output.c:171 dst_output include/net/dst.h:444 [inline] ip6_local_out+0xc5/0x1b0 net/ipv6/output_core.c:176 ip6_send_skb+0xbc/0x340 net/ipv6/ip6_output.c:1727 ip6_push_pending_frames+0xc5/0xf0 net/ipv6/ip6_output.c:1747 rawv6_push_pending_frames net/ipv6/raw.c:615 [inline] rawv6_sendmsg+0x3a3e/0x4b40 net/ipv6/raw.c:945 kobject: 'queues' (0000000089e6eea2): kobject_add_internal: parent: 'tunl0', set: '' kobject: 'queues' (0000000089e6eea2): kobject_uevent_env inet_sendmsg+0x1a1/0x690 net/ipv4/af_inet.c:798 kobject: 'queues' (0000000089e6eea2): kobject_uevent_env: filter function caused the event to drop! sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg+0xd5/0x120 net/socket.c:631 sock_write_iter+0x35e/0x5c0 net/socket.c:900 call_write_iter include/linux/fs.h:1857 [inline] new_sync_write fs/read_write.c:474 [inline] __vfs_write+0x6b8/0x9f0 fs/read_write.c:487 kobject: 'rx-0' (00000000e2d902d9): kobject_add_internal: parent: 'queues', set: 'queues' kobject: 'rx-0' (00000000e2d902d9): kobject_uevent_env vfs_write+0x1fc/0x560 fs/read_write.c:549 ksys_write+0x101/0x260 fs/read_write.c:598 kobject: 'rx-0' (00000000e2d902d9): fill_kobj_path: path = '/devices/virtual/net/tunl0/queues/rx-0' __do_sys_write fs/read_write.c:610 [inline] __se_sys_write fs/read_write.c:607 [inline] __x64_sys_write+0x73/0xb0 fs/read_write.c:607 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 kobject: 'tx-0' (00000000443b70ac): kobject_add_internal: parent: 'queues', set: 'queues' entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457669 Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f9bd200bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457669 RDX: 000000000000058f RSI: 00000000200033c0 RDI: 0000000000000003 kobject: 'tx-0' (00000000443b70ac): kobject_uevent_env RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9bd200c6d4 R13: 00000000004c2dcc R14: 00000000004da398 R15: 00000000ffffffff Allocated by task 1304: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553 __do_kmalloc_node mm/slab.c:3684 [inline] __kmalloc_node_track_caller+0x50/0x70 mm/slab.c:3698 __kmalloc_reserve.isra.41+0x41/0xe0 net/core/skbuff.c:140 __alloc_skb+0x155/0x760 net/core/skbuff.c:208 kobject: 'tx-0' (00000000443b70ac): fill_kobj_path: path = '/devices/virtual/net/tunl0/queues/tx-0' alloc_skb include/linux/skbuff.h:1011 [inline] __ip6_append_data.isra.49+0x2f1a/0x3f50 net/ipv6/ip6_output.c:1450 ip6_append_data+0x1bc/0x2d0 net/ipv6/ip6_output.c:1619 rawv6_sendmsg+0x15ab/0x4b40 net/ipv6/raw.c:938 inet_sendmsg+0x1a1/0x690 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg+0xd5/0x120 net/socket.c:631 ___sys_sendmsg+0x7fd/0x930 net/socket.c:2116 __sys_sendmsg+0x11d/0x280 net/socket.c:2154 __do_sys_sendmsg net/socket.c:2163 [inline] __se_sys_sendmsg net/socket.c:2161 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2161 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe kobject: 'gre0' (00000000cb1b2d7b): kobject_add_internal: parent: 'net', set: 'devices' Freed by task 1304: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 __cache_free mm/slab.c:3498 [inline] kfree+0xcf/0x230 mm/slab.c:3817 skb_free_head+0x93/0xb0 net/core/skbuff.c:553 pskb_expand_head+0x3b2/0x10d0 net/core/skbuff.c:1498 __pskb_pull_tail+0x156/0x18a0 net/core/skbuff.c:1896 pskb_may_pull include/linux/skbuff.h:2188 [inline] _decode_session6+0xd11/0x14d0 net/ipv6/xfrm6_policy.c:150 __xfrm_decode_session+0x71/0x140 net/xfrm/xfrm_policy.c:3272 kobject: 'gre0' (00000000cb1b2d7b): kobject_uevent_env __xfrm_policy_check+0x380/0x2c40 net/xfrm/xfrm_policy.c:3322 __xfrm_policy_check2 include/net/xfrm.h:1170 [inline] xfrm_policy_check include/net/xfrm.h:1175 [inline] xfrm6_policy_check include/net/xfrm.h:1185 [inline] vti6_rcv+0x4bd/0x8f3 net/ipv6/ip6_vti.c:316 xfrm6_ipcomp_rcv+0x1a5/0x3a0 net/ipv6/xfrm6_protocol.c:132 ip6_protocol_deliver_rcu+0x372/0x1940 net/ipv6/ip6_input.c:394 ip6_input_finish+0x84/0x170 net/ipv6/ip6_input.c:434 NF_HOOK include/linux/netfilter.h:289 [inline] ip6_input+0xe9/0x600 net/ipv6/ip6_input.c:443 ip6_mc_input+0x514/0x11c0 net/ipv6/ip6_input.c:537 dst_input include/net/dst.h:450 [inline] ip6_rcv_finish+0x17a/0x330 net/ipv6/ip6_input.c:76 NF_HOOK include/linux/netfilter.h:289 [inline] ipv6_rcv+0x115/0x640 net/ipv6/ip6_input.c:272 __netif_receive_skb_one_core+0x14d/0x200 net/core/dev.c:4973 __netif_receive_skb+0x2c/0x1e0 net/core/dev.c:5083 process_backlog+0x24e/0x7a0 net/core/dev.c:5923 kobject: 'gre0' (00000000cb1b2d7b): fill_kobj_path: path = '/devices/virtual/net/gre0' napi_poll net/core/dev.c:6346 [inline] net_rx_action+0x7fa/0x19b0 net/core/dev.c:6412 __do_softirq+0x308/0xb7e kernel/softirq.c:292 The buggy address belongs to the object at ffff888191b8cac0 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 176 bytes inside of 512-byte region [ffff888191b8cac0, ffff888191b8ccc0) The buggy address belongs to the page: page:ffffea000646e300 count:1 mapcount:0 mapping:ffff8881da800940 index:0x0 flags: 0x2fffc0000000200(slab) raw: 02fffc0000000200 ffffea0006eaaa48 ffffea00065356c8 ffff8881da800940 raw: 0000000000000000 ffff888191b8c0c0 0000000100000006 0000000000000000 page dumped because: kasan: bad access detected kobject: 'queues' (000000005fd6226e): kobject_add_internal: parent: 'gre0', set: '' Memory state around the buggy address: ffff888191b8ca00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888191b8ca80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb >ffff888191b8cb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888191b8cb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888191b8cc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Fixes: 0d3c703a9d17 ("ipv6: Cleanup IPv6 tunnel receive path") Fixes: ed1efb2aefbb ("ipv6: Add support for IPsec virtual tunnel interfaces") Signed-off-by: Eric Dumazet Cc: Steffen Klassert Signed-off-by: David S. Miller commit 96d6ee7d2f8110f6f3460eab5d3826a6f1ca058d Merge: 0b517333721c b6aac625e579 Author: Linus Torvalds Date: Fri Dec 21 09:17:52 2018 -0800 Merge tag 'drm-fixes-2018-12-21' of git://anongit.freedesktop.org/drm/drm Pull final drm fix from Daniel Vetter: "Very calm week, so either everything perfect or everyone on holidays already. Just one array_index_nospec patch, also for stable" * tag 'drm-fixes-2018-12-21' of git://anongit.freedesktop.org/drm/drm: drm/ioctl: Fix Spectre v1 vulnerabilities commit 5c1e7e94a7faca70760f5a2939c6a6bb0e18a5d4 Author: Vakul Garg Date: Fri Dec 21 15:55:46 2018 +0000 Prevent overflow of sk_msg in sk_msg_clone() Fixed function sk_msg_clone() to prevent overflow of 'dst' while adding pages in scatterlist entries. The overflow of 'dst' causes crash in kernel tls module while doing record encryption. Crash fixed by this patch. [ 78.796119] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 [ 78.804900] Mem abort info: [ 78.807683] ESR = 0x96000004 [ 78.810744] Exception class = DABT (current EL), IL = 32 bits [ 78.816677] SET = 0, FnV = 0 [ 78.819727] EA = 0, S1PTW = 0 [ 78.822873] Data abort info: [ 78.825759] ISV = 0, ISS = 0x00000004 [ 78.829600] CM = 0, WnR = 0 [ 78.832576] user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000bf8ee311 [ 78.839195] [0000000000000008] pgd=0000000000000000 [ 78.844081] Internal error: Oops: 96000004 [#1] PREEMPT SMP [ 78.849642] Modules linked in: tls xt_conntrack ipt_REJECT nf_reject_ipv4 ip6table_filter ip6_tables xt_CHECKSUM cpve cpufreq_conservative lm90 ina2xx crct10dif_ce [ 78.865377] CPU: 0 PID: 6007 Comm: openssl Not tainted 4.20.0-rc6-01647-g754d5da63145-dirty #107 [ 78.874149] Hardware name: LS1043A RDB Board (DT) [ 78.878844] pstate: 60000005 (nZCv daif -PAN -UAO) [ 78.883632] pc : scatterwalk_copychunks+0x164/0x1c8 [ 78.888500] lr : scatterwalk_copychunks+0x160/0x1c8 [ 78.893366] sp : ffff00001d04b600 [ 78.896668] x29: ffff00001d04b600 x28: ffff80006814c680 [ 78.901970] x27: 0000000000000000 x26: ffff80006c8de786 [ 78.907272] x25: ffff00001d04b760 x24: 000000000000001a [ 78.912573] x23: 0000000000000006 x22: ffff80006814e440 [ 78.917874] x21: 0000000000000100 x20: 0000000000000000 [ 78.923175] x19: 000081ffffffffff x18: 0000000000000400 [ 78.928476] x17: 0000000000000008 x16: 0000000000000000 [ 78.933778] x15: 0000000000000100 x14: 0000000000000001 [ 78.939079] x13: 0000000000001080 x12: 0000000000000020 [ 78.944381] x11: 0000000000001080 x10: 00000000ffff0002 [ 78.949683] x9 : ffff80006814c248 x8 : 00000000ffff0000 [ 78.954985] x7 : ffff80006814c318 x6 : ffff80006c8de786 [ 78.960286] x5 : 0000000000000f80 x4 : ffff80006c8de000 [ 78.965588] x3 : 0000000000000000 x2 : 0000000000001086 [ 78.970889] x1 : ffff7e0001b74e02 x0 : 0000000000000000 [ 78.976192] Process openssl (pid: 6007, stack limit = 0x00000000291367f9) [ 78.982968] Call trace: [ 78.985406] scatterwalk_copychunks+0x164/0x1c8 [ 78.989927] skcipher_walk_next+0x28c/0x448 [ 78.994099] skcipher_walk_done+0xfc/0x258 [ 78.998187] gcm_encrypt+0x434/0x4c0 [ 79.001758] tls_push_record+0x354/0xa58 [tls] [ 79.006194] bpf_exec_tx_verdict+0x1e4/0x3e8 [tls] [ 79.010978] tls_sw_sendmsg+0x650/0x780 [tls] [ 79.015326] inet_sendmsg+0x2c/0xf8 [ 79.018806] sock_sendmsg+0x18/0x30 [ 79.022284] __sys_sendto+0x104/0x138 [ 79.025935] __arm64_sys_sendto+0x24/0x30 [ 79.029936] el0_svc_common+0x60/0xe8 [ 79.033588] el0_svc_handler+0x2c/0x80 [ 79.037327] el0_svc+0x8/0xc [ 79.040200] Code: 6b01005f 54fff788 940169b1 f9000320 (b9400801) [ 79.046283] ---[ end trace 74db007d069c1cf7 ]--- Fixes: d829e9c4112b ("tls: convert to generic sk_msg interface") Signed-off-by: Vakul Garg Acked-by: John Fastabend Signed-off-by: David S. Miller commit 99137b7888f4058087895d035d81c6b2d31015c5 Author: Willem de Bruijn Date: Fri Dec 21 12:06:59 2018 -0500 packet: validate address length Packet sockets with SOCK_DGRAM may pass an address for use in dev_hard_header. Ensure that it is of sufficient length. Reported-by: syzbot Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller commit 0b517333721c1b7a740e54b1cbe78a14884d51e7 Merge: bc380733a5e7 7a71712293ba Author: Linus Torvalds Date: Fri Dec 21 09:09:30 2018 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: "Switching a few devices with Synaptics over to SMbus and disabling SMbus on a couple devices with Elan touchpads as they need more plumbing on PS/2 side" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: synaptics - enable SMBus for HP EliteBook 840 G4 Input: elantech - disable elan-i2c for P52 and P72 Input: synaptics - enable RMI on ThinkPad T560 Input: omap-keypad - fix idle configuration to not block SoC idle states commit bc380733a5e77ccc3b4d4622595e42f1b0902d66 Merge: 783619556a56 c8da642d41a6 Author: Linus Torvalds Date: Fri Dec 21 09:05:28 2018 -0800 Merge tag 'gpio-v4.20-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fixes from Linus Walleij: "Hopefully last round of GPIO fixes. The ACPI patch is pretty important for some laptop users, the rest is driver-specific for embedded (mostly ARM) systems. I took out one ACPI patch that wasn't critical enough because I couldn't justify sending it at this point, and that is why the commit date is today, but the patches have been in linux-next. Sorry for not sending some of them earlier :( Notice that we have a co-maintainer for GPIO now, Bartosz Golaszewski, and he might jump in and make some pull requests at times when I am off. Summary: - ACPI IRQ request deferral - OMAP: revert deferred wakeup quirk - MAX7301: fix DMA safe memory handling - MVEBU: selective probe failure on missing clk" * tag 'gpio-v4.20-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpio: mvebu: only fail on missing clk if pwm is actually to be used gpio: max7301: fix driver for use with CONFIG_VMAP_STACK gpio: gpio-omap: Revert deferred wakeup quirk handling for regressions gpiolib-acpi: Only defer request_irq for GpioInt ACPI event handlers commit d134e486e831defd26130770181f01dfc6195f7d Author: Kangjie Lu Date: Fri Dec 21 00:22:32 2018 -0600 net: netxen: fix a missing check and an uninitialized use When netxen_rom_fast_read() fails, "bios" is left uninitialized and may contain random value, thus should not be used. The fix ensures that if netxen_rom_fast_read() fails, we return "-EIO". Signed-off-by: Kangjie Lu Signed-off-by: David S. Miller commit 783619556a560919ed2113261042ce53a186d8cc Merge: 9097a058d49e 271b9c0c8007 Author: Linus Torvalds Date: Fri Dec 21 08:56:31 2018 -0800 Merge tag '4.20-rc7-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb3 fix from Steve French: "An important smb3 fix for an regression to some servers introduced by compounding optimization to rmdir. This fix has been tested by multiple developers (including me) with the usual private xfstesting, but also by the new cifs/smb3 "buildbot" xfstest VMs (thank you Ronnie and Aurelien for good work on this automation). The automated testing has been updated so that it will catch problems like this in the future. Note that Pavel discovered (very recently) some unrelated but extremely important bugs in credit handling (smb3 flow control problem that can lead to disconnects/reconnects) when compounding, that I would have liked to send in ASAP but the complete testing of those two fixes may not be done in time and have to wait for 4.21" * tag '4.20-rc7-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb3: Fix rmdir compounding regression to strict servers commit 7a71712293ba303aad928f580b89addb0be2892e Author: Mantas Mikulėnas Date: Fri Dec 21 01:04:26 2018 -0800 Input: synaptics - enable SMBus for HP EliteBook 840 G4 dmesg reports that "Your touchpad (PNP: SYN3052 SYN0100 SYN0002 PNP0f13) says it can support a different bus." I've tested the offered psmouse.synaptics_intertouch=1 with 4.18.x and 4.19.x and it seems to work well. No problems seen with suspend/resume. Also, it appears that RMI/SMBus mode is actually required for 3-4 finger multitouch gestures to work -- otherwise they are not reported at all. Information from dmesg in both modes: psmouse serio3: synaptics: Touchpad model: 1, fw: 8.2, id: 0x1e2b1, caps: 0xf00123/0x840300/0x2e800/0x0, board id: 3139, fw id: 2000742 psmouse serio3: synaptics: Trying to set up SMBus access rmi4_smbus 6-002c: registering SMbus-connected sensor rmi4_f01 rmi4-00.fn01: found RMI device, manufacturer: Synaptics, product: TM3139-001, fw id: 2000742 Signed-off-by: Mantas Mikulėnas Reviewed-by: Benjamin Tissoires Signed-off-by: Dmitry Torokhov commit d21ff5d7f8c397261e095393a1a8e199934720bc Author: Benjamin Tissoires Date: Fri Dec 21 00:42:38 2018 -0800 Input: elantech - disable elan-i2c for P52 and P72 The current implementation of elan_i2c is known to not support those 2 laptops. A proper fix is to tweak both elantech and elan_i2c to transmit the correct information from PS/2, which would make a bad candidate for stable. So to give us some time for fixing the root of the problem, disable elan_i2c for the devices we know are not behaving properly. Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1803600 Link: https://bugs.archlinux.org/task/59714 Fixes: df077237cf55 Input: elantech - detect new ICs and setup Host Notify for them Cc: stable@vger.kernel.org # v4.18+ Signed-off-by: Benjamin Tissoires Acked-by: Peter Hutterer Signed-off-by: Dmitry Torokhov commit c8da642d41a6811c21177c9994aa7dc35be67d46 Author: Uwe Kleine-König Date: Mon Dec 17 09:43:13 2018 +0100 gpio: mvebu: only fail on missing clk if pwm is actually to be used The gpio IP on Armada 370 at offset 0x18180 has neither a clk nor pwm registers. So there is no need for a clk as the pwm isn't used anyhow. So only check for the clk in the presence of the pwm registers. This fixes a failure to probe the gpio driver for the above mentioned gpio device. Fixes: 757642f9a584 ("gpio: mvebu: Add limited PWM support") Signed-off-by: Uwe Kleine-König Reviewed-by: Gregory CLEMENT Signed-off-by: Linus Walleij commit abf221d2f51b8ce7b9959a8953f880a8b0a1400d Author: Christophe Leroy Date: Fri Dec 7 13:07:55 2018 +0000 gpio: max7301: fix driver for use with CONFIG_VMAP_STACK spi_read() and spi_write() require DMA-safe memory. When CONFIG_VMAP_STACK is selected, those functions cannot be used with buffers on stack. This patch replaces calls to spi_read() and spi_write() by spi_write_then_read() which doesn't require DMA-safe buffers. Fixes: 0c36ec314735 ("gpio: gpio driver for max7301 SPI GPIO expander") Cc: Signed-off-by: Christophe Leroy Signed-off-by: Linus Walleij commit 00ded24c33c586eaaf32764898c56f4a7d8c6d5c Author: Tony Lindgren Date: Fri Dec 7 11:08:29 2018 -0800 gpio: gpio-omap: Revert deferred wakeup quirk handling for regressions Commit ec0daae685b2 ("gpio: omap: Add level wakeup handling for omap4 based SoCs") attempted to fix omap4 GPIO wakeup handling as it was blocking deeper SoC idle states. However this caused a regression for GPIOs during runtime having over second long latencies for Ethernet GPIO interrupt as reportedy by Russell King . Let's fix this issue by doing a partial revert of the breaking commit. We still want to keep the quirk handling around as it is also used for OMAP_GPIO_QUIRK_IDLE_REMOVE_TRIGGER. The real fix for omap4 GPIO wakeup handling involves fixes for omap_set_gpio_trigger() and omap_gpio_unmask_irq() and will be posted separately. And we must keep the wakeup bit enabled during runtime because of module doing clock autogating with autoidle configured. Reported-by: Russell King Fixes: ec0daae685b2 ("gpio: omap: Add level wakeup handling for omap4 based SoCs") Cc: Aaro Koskinen Cc: Grygorii Strashko Cc: Keerthy Cc: Ladislav Michl Cc: Russell King Cc: Tero Kristo Signed-off-by: Tony Lindgren Signed-off-by: Linus Walleij commit f0c928d878e7d01b613c9ae5c971a6b1e473a938 Author: Eric Dumazet Date: Thu Dec 20 15:28:56 2018 -0800 tcp: fix a race in inet_diag_dump_icsk() Alexei reported use after frees in inet_diag_dump_icsk() [1] Because we use refcount_set() when various sockets are setup and inserted into ehash, we also need to make sure inet_diag_dump_icsk() wont race with the refcount_set() operations. Jonathan Lemon sent a patch changing net_twsk_hashdance() but other spots would need risky changes. Instead, fix inet_diag_dump_icsk() as this bug came with linux-4.10 only. [1] Quoting Alexei : First something iterating over sockets finds already freed tw socket: refcount_t: increment on 0; use-after-free. WARNING: CPU: 2 PID: 2738 at lib/refcount.c:153 refcount_inc+0x26/0x30 RIP: 0010:refcount_inc+0x26/0x30 RSP: 0018:ffffc90004c8fbc0 EFLAGS: 00010282 RAX: 000000000000002b RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88085ee9d680 RSI: ffff88085ee954c8 RDI: ffff88085ee954c8 RBP: ffff88010ecbd2c0 R08: 0000000000000000 R09: 000000000000174c R10: ffffffff81e7c5a0 R11: 0000000000000000 R12: 0000000000000000 R13: ffff8806ba9bf210 R14: ffffffff82304600 R15: ffff88010ecbd328 FS: 00007f81f5a7d700(0000) GS:ffff88085ee80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f81e2a95000 CR3: 000000069b2eb006 CR4: 00000000003606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: inet_diag_dump_icsk+0x2b3/0x4e0 [inet_diag] // sock_hold(sk); in net/ipv4/inet_diag.c:1002 ? kmalloc_large_node+0x37/0x70 ? __kmalloc_node_track_caller+0x1cb/0x260 ? __alloc_skb+0x72/0x1b0 ? __kmalloc_reserve.isra.40+0x2e/0x80 __inet_diag_dump+0x3b/0x80 [inet_diag] netlink_dump+0x116/0x2a0 netlink_recvmsg+0x205/0x3c0 sock_read_iter+0x89/0xd0 __vfs_read+0xf7/0x140 vfs_read+0x8a/0x140 SyS_read+0x3f/0xa0 do_syscall_64+0x5a/0x100 then a minute later twsk timer fires and hits two bad refcnts for this freed socket: refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 31 PID: 0 at lib/refcount.c:228 refcount_dec+0x2e/0x40 Modules linked in: RIP: 0010:refcount_dec+0x2e/0x40 RSP: 0018:ffff88085f5c3ea8 EFLAGS: 00010296 RAX: 000000000000002c RBX: ffff88010ecbd2c0 RCX: 000000000000083f RDX: 0000000000000000 RSI: 00000000000000f6 RDI: 000000000000003f RBP: ffffc90003c77280 R08: 0000000000000000 R09: 00000000000017d3 R10: ffffffff81e7c5a0 R11: 0000000000000000 R12: ffffffff82ad2d80 R13: ffffffff8182de00 R14: ffff88085f5c3ef8 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88085f5c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fbe42685250 CR3: 0000000002209001 CR4: 00000000003606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: inet_twsk_kill+0x9d/0xc0 // inet_twsk_bind_unhash(tw, hashinfo); call_timer_fn+0x29/0x110 run_timer_softirq+0x36b/0x3a0 refcount_t: underflow; use-after-free. WARNING: CPU: 31 PID: 0 at lib/refcount.c:187 refcount_sub_and_test+0x46/0x50 RIP: 0010:refcount_sub_and_test+0x46/0x50 RSP: 0018:ffff88085f5c3eb8 EFLAGS: 00010296 RAX: 0000000000000026 RBX: ffff88010ecbd2c0 RCX: 000000000000083f RDX: 0000000000000000 RSI: 00000000000000f6 RDI: 000000000000003f RBP: ffff88010ecbd358 R08: 0000000000000000 R09: 000000000000185b R10: ffffffff81e7c5a0 R11: 0000000000000000 R12: ffff88010ecbd358 R13: ffffffff8182de00 R14: ffff88085f5c3ef8 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88085f5c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fbe42685250 CR3: 0000000002209001 CR4: 00000000003606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: inet_twsk_put+0x12/0x20 // inet_twsk_put(tw); call_timer_fn+0x29/0x110 run_timer_softirq+0x36b/0x3a0 Fixes: 67db3e4bfbc9 ("tcp: no longer hold ehash lock while calling tcp_get_info()") Signed-off-by: Eric Dumazet Reported-by: Alexei Starovoitov Cc: Jonathan Lemon Acked-by: Jonathan Lemon Signed-off-by: David S. Miller commit de985ec5c5bb80c7d2554fb7ebd97953630b7589 Author: Ganesh Goudar Date: Thu Dec 20 18:56:09 2018 +0530 MAINTAINERS: update cxgb4 and cxgb3 maintainer Arjun Vynipadath will be taking over as maintainer from now. Signed-off-by: Ganesh Goudar Signed-off-by: David S. Miller commit d15f5ac8deea936d3adf629421a66a88b42b8a2f Author: Herbert Xu Date: Thu Dec 20 21:20:10 2018 +0800 ipv6: frags: Fix bogus skb->sk in reassembled packets It was reported that IPsec would crash when it encounters an IPv6 reassembled packet because skb->sk is non-zero and not a valid pointer. This is because skb->sk is now a union with ip_defrag_offset. This patch fixes this by resetting skb->sk when exiting from the reassembly code. Reported-by: Xiumei Mu Fixes: 219badfaade9 ("ipv6: frags: get rid of ip6frag_skb_cb/...") Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit 8fd1a4affbdafda592f80cd01bf7a382a5ff2fe8 Author: Allan W. Nielsen Date: Thu Dec 20 09:37:17 2018 +0100 mscc: Configured MAC entries should be locked. The MAC table in Ocelot supports auto aging (normal) and static entries. MAC entries that is manually configured should be static and not subject to aging. Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support") Signed-off-by: Allan Nielsen Reviewed-by: Steen Hegelund Signed-off-by: Steen Hegelund Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 9097a058d49e049925d8da72db07fffcee24efa0 Merge: f57b620a89ad 32774a8153b4 Author: Linus Torvalds Date: Thu Dec 20 14:49:56 2018 -0800 Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "I2C has a MAINTAINERS update for you, so people will be immediately pointed to the right person for this previously orphaned driver. And one of Arnd's build warning fixes for a new driver added this cycle" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: nvidia-gpu: mark resume function as __maybe_unused MAINTAINERS: add entry for i2c-axxia driver commit f57b620a89ad2eee2e25218b5cb2bee0ad1e2e7d Merge: 1d51b4b1d3f2 e58725d51fa8 Author: Linus Torvalds Date: Thu Dec 20 14:17:24 2018 -0800 Merge tag 'upstream-4.20-rc7' of git://git.infradead.org/linux-ubifs Pull UBI/UBIFS fixes from Richard Weinberger: - Kconfig dependency fixes for our new auth feature - Fix for selecting the right compressor when creating a fs - Bugfix for a bug in UBIFS's O_TMPFILE implementation - Refcounting fixes for UBI * tag 'upstream-4.20-rc7' of git://git.infradead.org/linux-ubifs: ubifs: Handle re-linking of inodes correctly while recovery ubi: Do not drop UBI device reference before using ubi: Put MTD device after it is not used ubifs: Fix default compression selection in ubifs ubifs: Fix memory leak on error condition ubifs: auth: Add CONFIG_KEYS dependency ubifs: CONFIG_UBIFS_FS_AUTHENTICATION should depend on UBIFS_FS ubifs: replay: Fix high stack usage commit b6aac625e579ca684448f8ace632f8dceb972afb Merge: 7566ec393f41 505b5240329b Author: Daniel Vetter Date: Thu Dec 20 18:13:53 2018 +0100 Merge tag 'drm-misc-fixes-2018-12-20' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Fix spectre v1 vuln in drm_ioctl Signed-off-by: Daniel Vetter From: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20181220165740.GA42344@art_vandelay commit 1d51b4b1d3f2db0d6d144175e31a84e472fbd99a Merge: c0f3ece4657f bed1369f5190 Author: Linus Torvalds Date: Thu Dec 20 07:35:16 2018 -0800 Merge tag 'm68k-for-v4.20-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k fix from Geert Uytterhoeven: "Fix memblock-related crashes" * tag 'm68k-for-v4.20-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: Fix memblock-related crashes commit c0f3ece4657fe2205c1e59c5c27547d6e8cba34a Merge: 122b7e33804d ef7cfd00b2ca Author: Linus Torvalds Date: Thu Dec 20 07:33:09 2018 -0800 Merge tag 'kbuild-fixes-v4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fix from Masahiro Yamada: "Fix false positive warning/error about missing library for objtool" * tag 'kbuild-fixes-v4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: fix false positive warning/error about missing libelf commit 122b7e33804d928f8f53cf9d25762c40b8148a02 Merge: bfd7bd5b49c8 55449af1a17a Author: Linus Torvalds Date: Thu Dec 20 07:30:37 2018 -0800 Merge tag 'char-misc-4.20-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are three tiny last-minute driver fixes for 4.20-rc8 that resolve some reported issues, and one MAINTAINERS file update. All of them are related to the hyper-v subsystem, it seems people are actually testing and using it now, which is nice to see :) The fixes are: - uio_hv_generic: fix for opening multiple times - Remove PCI dependancy on hyperv drivers - return proper error code for an unopened channel. And Sasha has signed up to help out with the hyperv maintainership. All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-4.20-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels x86, hyperv: remove PCI dependency MAINTAINERS: Patch monkey for the Hyper-V code uio_hv_generic: set callbacks on open commit bfd7bd5b49c84aac9068bff7635e94ce038475ec Merge: 177c459b08a3 3c9dc275dba1 Author: Linus Torvalds Date: Thu Dec 20 07:29:11 2018 -0800 Merge tag 'tty-4.20-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial fix from Greg KH: "Here is a single fix, a revert, for the 8250 serial driver to resolve a reported problem. There was some attempted patches to fix the issue, but people are arguing about them, so reverting the patch to revert back to the 4.19 and older behavior is the best thing to do at this late in the release cycle. The revert has been in linux-next with no reported issues" * tag 'tty-4.20-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: Revert "serial: 8250: Fix clearing FIFOs in RS485 mode again" commit 177c459b08a34dcf004aa9a4c1f1d8be682ff3af Merge: d31aeb78c682 2419f30a4a4f Author: Linus Torvalds Date: Thu Dec 20 07:27:39 2018 -0800 Merge tag 'usb-4.20-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes and ids from Greg KH: "Here are some late xhci fixes for 4.20-rc8 as well as a few new device ids for the option usb-serial driver. The xhci fixes resolve some many-reported issues and all of these have been in linux-next for a while with no reported problems" * tag 'usb-4.20-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: xhci: fix 'broken_suspend' placement in struct xchi_hcd xhci: Don't prevent USB2 bus suspend in state check intended for USB3 only USB: serial: option: add Telit LN940 series USB: serial: option: add Fibocom NL668 series USB: serial: option: add Simcom SIM7500/SIM7600 (MBIM mode) USB: serial: option: add GosunCn ZTE WeLink ME3630 USB: serial: option: add HP lt4132 commit d31aeb78c6827db17f447f0504fc35afcbb188c2 Merge: a837eca24120 e3ae3401aa19 Author: Linus Torvalds Date: Thu Dec 20 07:25:31 2018 -0800 Merge tag 'mmc-v4.20-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "MMC core: - Restore code to allow BKOPS and CACHE ctrl even if no HPI support - Reset HPI enabled state during re-init - Use a default minimum timeout when enabling CACHE ctrl MMC host: - omap_hsmmc: Fix DMA API warning - sdhci-tegra: Fix dt parsing of SDMMC pads autocal values - Correct register accesses when enabling v4 mode" * tag 'mmc-v4.20-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: core: Use a minimum 1600ms timeout when enabling CACHE ctrl mmc: core: Allow BKOPS and CACHE ctrl even if no HPI support mmc: core: Reset HPI enabled state during re-init and in case of errors mmc: omap_hsmmc: fix DMA API warning mmc: tegra: Fix for SDMMC pads autocal parsing from dt mmc: sdhci: Fix sdhci_do_enable_v4_mode commit a837eca2412051628c0529768c9bc4f3580b040e Author: Dave Chinner Date: Thu Dec 20 23:23:24 2018 +1100 iomap: Revert "fs/iomap.c: get/put the page in iomap_page_create/release()" This reverts commit 61c6de667263184125d5ca75e894fcad632b0dd3. The reverted commit added page reference counting to iomap page structures that are used to track block size < page size state. This was supposed to align the code with page migration page accounting assumptions, but what it has done instead is break XFS filesystems. Every fstests run I've done on sub-page block size XFS filesystems has since picking up this commit 2 days ago has failed with bad page state errors such as: # ./run_check.sh "-m rmapbt=1,reflink=1 -i sparse=1 -b size=1k" "generic/038" .... SECTION -- xfs FSTYP -- xfs (debug) PLATFORM -- Linux/x86_64 test1 4.20.0-rc6-dgc+ MKFS_OPTIONS -- -f -m rmapbt=1,reflink=1 -i sparse=1 -b size=1k /dev/sdc MOUNT_OPTIONS -- /dev/sdc /mnt/scratch generic/038 454s ... run fstests generic/038 at 2018-12-20 18:43:05 XFS (sdc): Unmounting Filesystem XFS (sdc): Mounting V5 Filesystem XFS (sdc): Ending clean mount BUG: Bad page state in process kswapd0 pfn:3a7fa page:ffffea0000ccbeb0 count:0 mapcount:0 mapping:ffff88800d9b6360 index:0x1 flags: 0xfffffc0000000() raw: 000fffffc0000000 dead000000000100 dead000000000200 ffff88800d9b6360 raw: 0000000000000001 0000000000000000 00000000ffffffff page dumped because: non-NULL mapping CPU: 0 PID: 676 Comm: kswapd0 Not tainted 4.20.0-rc6-dgc+ #915 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.1-1 04/01/2014 Call Trace: dump_stack+0x67/0x90 bad_page.cold.116+0x8a/0xbd free_pcppages_bulk+0x4bf/0x6a0 free_unref_page_list+0x10f/0x1f0 shrink_page_list+0x49d/0xf50 shrink_inactive_list+0x19d/0x3b0 shrink_node_memcg.constprop.77+0x398/0x690 ? shrink_slab.constprop.81+0x278/0x3f0 shrink_node+0x7a/0x2f0 kswapd+0x34b/0x6d0 ? node_reclaim+0x240/0x240 kthread+0x11f/0x140 ? __kthread_bind_mask+0x60/0x60 ret_from_fork+0x24/0x30 Disabling lock debugging due to kernel taint .... The failures are from anyway that frees pages and empties the per-cpu page magazines, so it's not a predictable failure or an easy to debug failure. generic/038 is a reliable reproducer of this problem - it has a 9 in 10 failure rate on one of my test machines. Failure on other machines have been at random points in fstests runs but every run has ended up tripping this problem. Hence generic/038 was used to bisect the failure because it was the most reliable failure. It is too close to the 4.20 release (not to mention holidays) to try to diagnose, fix and test the underlying cause of the problem, so reverting the commit is the only option we have right now. The revert has been tested against a current tot 4.20-rc7+ kernel across multiple machines running sub-page block size XFs filesystems and none of the bad page state failures have been seen. Signed-off-by: Dave Chinner Cc: Piotr Jaroszynski Cc: Christoph Hellwig Cc: William Kucharski Cc: Darrick J. Wong Cc: Brian Foster Signed-off-by: Linus Torvalds commit 519be6995c31005ae3bad5421e09ef99d4eb0b82 Merge: ab63e725b49c d84e7bc0595a Author: Linus Torvalds Date: Wed Dec 19 23:34:33 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Off by one in netlink parsing of mac802154_hwsim, from Alexander Aring. 2) nf_tables RCU usage fix from Taehee Yoo. 3) Flow dissector needs nhoff and thoff clamping, from Stanislav Fomichev. 4) Missing sin6_flowinfo initialization in SCTP, from Xin Long. 5) Spectrev1 in ipmr and ip6mr, from Gustavo A. R. Silva. 6) Fix r8169 crash when DEBUG_SHIRQ is enabled, from Heiner Kallweit. 7) Fix SKB leak in rtlwifi, from Larry Finger. 8) Fix state pruning in bpf verifier, from Jakub Kicinski. 9) Don't handle completely duplicate fragments as overlapping, from Michal Kubecek. 10) Fix memory corruption with macb and 64-bit DMA, from Anssi Hannula. 11) Fix TCP fallback socket release in smc, from Myungho Jung. 12) gro_cells_destroy needs to napi_disable, from Lorenzo Bianconi. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (130 commits) rds: Fix warning. neighbor: NTF_PROXY is a valid ndm_flag for a dump request net: mvpp2: fix the phylink mode validation net/sched: cls_flower: Remove old entries from rhashtable net/tls: allocate tls context using GFP_ATOMIC iptunnel: make TUNNEL_FLAGS available in uapi gro_cell: add napi_disable in gro_cells_destroy lan743x: Remove MAC Reset from initialization net/mlx5e: Remove the false indication of software timestamping support net/mlx5: Typo fix in del_sw_hw_rule net/mlx5e: RX, Fix wrong early return in receive queue poll ipv6: explicitly initialize udp6_addr in udp_sock_create6() bnxt_en: Fix ethtool self-test loopback. net/rds: remove user triggered WARN_ON in rds_sendmsg net/rds: fix warn in rds_message_alloc_sgs ath10k: skip sending quiet mode cmd for WCN3990 mac80211: free skb fraglist before freeing the skb nl80211: fix memory leak if validate_pae_over_nl80211() fails net/smc: fix TCP fallback socket release vxge: ensure data0 is initialized in when fetching firmware version information ... commit 505b5240329b922f21f91d5b5d1e535c805eca6d Author: Gustavo A. R. Silva Date: Wed Dec 19 18:00:15 2018 -0600 drm/ioctl: Fix Spectre v1 vulnerabilities nr is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: drivers/gpu/drm/drm_ioctl.c:805 drm_ioctl() warn: potential spectre issue 'dev->driver->ioctls' [r] drivers/gpu/drm/drm_ioctl.c:810 drm_ioctl() warn: potential spectre issue 'drm_ioctls' [r] (local cap) drivers/gpu/drm/drm_ioctl.c:892 drm_ioctl_flags() warn: potential spectre issue 'drm_ioctls' [r] (local cap) Fix this by sanitizing nr before using it to index dev->driver->ioctls and drm_ioctls. Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20181220000015.GA18973@embeddedor commit d84e7bc0595a7e146ad0ddb80b240cea77825245 Author: David S. Miller Date: Wed Dec 19 20:53:18 2018 -0800 rds: Fix warning. >> net/rds/send.c:1109:42: warning: Using plain integer as NULL pointer Fixes: ea010070d0a7 ("net/rds: fix warn in rds_message_alloc_sgs") Reported-by: kbuild test robot Signed-off-by: David S. Miller commit ab63e725b49c80f941446327d79ba5b68593bf5a Merge: 8c9dff1ebd72 c5c08bed843c Author: Linus Torvalds Date: Wed Dec 19 18:40:48 2018 -0800 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fix from Michael Tsirkin: "A last-minute fix for a test build" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: virtio: fix test build after uio.h change commit 8c9dff1ebd721a3b19a002d1a901d4dc31b18ebb Merge: fe112793600b abc13275771f Author: Linus Torvalds Date: Wed Dec 19 18:38:54 2018 -0800 Merge tag 'nfs-for-4.20-6' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client bugfixes from Trond Myklebust: - Fix TCP socket disconnection races by ensuring we always call xprt_disconnect_done() after releasing the socket. - Fix a race when clearing both XPRT_CONNECTING and XPRT_LOCKED - Remove xprt_connect_status() so it does not mask errors that should be handled by call_connect_status() * tag 'nfs-for-4.20-6' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: SUNRPC: Remove xprt_connect_status() SUNRPC: Fix a race with XPRT_CONNECTING SUNRPC: Fix disconnection races commit fe112793600bb14cfd519ed148ca2f252d7b14bc Merge: 2dd516ff7d85 0e1b869fff60 Author: Linus Torvalds Date: Wed Dec 19 18:27:58 2018 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: - One nasty use-after-free bugfix, from this merge window however - A less nasty use-after-free that can only zero some words at the beginning of the page, and hence is not really exploitable - A NULL pointer dereference - A dummy implementation of an AMD chicken bit MSR that Windows uses for some unknown reason * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: kvm: x86: Add AMD's EX_CFG to the list of ignored MSRs KVM: X86: Fix NULL deref in vcpu_scan_ioapic KVM: Fix UAF in nested posted interrupt processing KVM: fix unregistering coalesced mmio zone from wrong bus commit 2dd516ff7d852c2cda8c5b883d6625d1c812714e Merge: 62393dbcbe0f c92a54cfa025 Author: Linus Torvalds Date: Wed Dec 19 18:16:17 2018 -0800 Merge tag 'dma-mapping-4.20-4' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping fix from Christoph Hellwig: "Fix a regression in dma-direct that didn't take account the magic AMD memory encryption mask in the DMA address" * tag 'dma-mapping-4.20-4' of git://git.infradead.org/users/hch/dma-mapping: dma-direct: do not include SME mask in the DMA supported check commit c0fde870d96e42bbdcc0d9af7ae5e190c767aab8 Author: David Ahern Date: Wed Dec 19 16:54:38 2018 -0800 neighbor: NTF_PROXY is a valid ndm_flag for a dump request When dumping proxy entries the dump request has NTF_PROXY set in ndm_flags. strict mode checking needs to be updated to allow this flag. Fixes: 51183d233b5a ("net/neighbor: Update neigh_dump_info for strict data checking") Signed-off-by: David Ahern Signed-off-by: David S. Miller commit 1b451fb2051b464b9758c09a3492104403252e2b Author: Antoine Tenart Date: Wed Dec 19 18:00:12 2018 +0100 net: mvpp2: fix the phylink mode validation The mvpp2_phylink_validate() sets all modes that are supported by a given PPv2 port. An mistake made the 10000baseT_Full mode being advertised in some cases when a port wasn't configured to perform at 10G. This patch fixes this. Fixes: d97c9f4ab000 ("net: mvpp2: 1000baseX support") Reported-by: Russell King Signed-off-by: Antoine Tenart Signed-off-by: David S. Miller commit 599d2570b2da7c2f5419332b42b7999d79c85959 Author: Roi Dayan Date: Wed Dec 19 18:07:56 2018 +0200 net/sched: cls_flower: Remove old entries from rhashtable When replacing a rule we add the new rule to the rhashtable but only remove the old if not in skip_sw. This commit fix this and remove the old rule anyway. Fixes: 35cc3cefc4de ("net/sched: cls_flower: Reject duplicated rules also under skip_sw") Signed-off-by: Roi Dayan Reviewed-by: Vlad Buslov Acked-by: Or Gerlitz Signed-off-by: David S. Miller commit c6ec179a0082e2e76e3a72050c2b99d3d0f3da3f Author: Ganesh Goudar Date: Wed Dec 19 17:18:22 2018 +0530 net/tls: allocate tls context using GFP_ATOMIC create_ctx can be called from atomic context, hence use GFP_ATOMIC instead of GFP_KERNEL. [ 395.962599] BUG: sleeping function called from invalid context at mm/slab.h:421 [ 395.979896] in_atomic(): 1, irqs_disabled(): 0, pid: 16254, name: openssl [ 395.996564] 2 locks held by openssl/16254: [ 396.010492] #0: 00000000347acb52 (sk_lock-AF_INET){+.+.}, at: do_tcp_setsockopt.isra.44+0x13b/0x9a0 [ 396.029838] #1: 000000006c9552b5 (device_spinlock){+...}, at: tls_init+0x1d/0x280 [ 396.047675] CPU: 5 PID: 16254 Comm: openssl Tainted: G O 4.20.0-rc6+ #25 [ 396.066019] Hardware name: Supermicro X10SRA-F/X10SRA-F, BIOS 2.0c 09/25/2017 [ 396.083537] Call Trace: [ 396.096265] dump_stack+0x5e/0x8b [ 396.109876] ___might_sleep+0x216/0x250 [ 396.123940] kmem_cache_alloc_trace+0x1b0/0x240 [ 396.138800] create_ctx+0x1f/0x60 [ 396.152504] tls_init+0xbd/0x280 [ 396.166135] tcp_set_ulp+0x191/0x2d0 [ 396.180035] ? tcp_set_ulp+0x2c/0x2d0 [ 396.193960] do_tcp_setsockopt.isra.44+0x148/0x9a0 [ 396.209013] __sys_setsockopt+0x7c/0xe0 [ 396.223054] __x64_sys_setsockopt+0x20/0x30 [ 396.237378] do_syscall_64+0x4a/0x180 [ 396.251200] entry_SYSCALL_64_after_hwframe+0x49/0xbe Fixes: df9d4a178022 ("net/tls: sleeping function from invalid context") Signed-off-by: Ganesh Goudar Signed-off-by: David S. Miller commit 1875a9ab01dfa96b06cb6649cb1ce56efa86c7cb Author: wenxu Date: Wed Dec 19 14:11:15 2018 +0800 iptunnel: make TUNNEL_FLAGS available in uapi ip l add dev tun type gretap external ip r a 10.0.0.1 encap ip dst 192.168.152.171 id 1000 dev gretap For gretap Key example when the command set the id but don't set the TUNNEL_KEY flags. There is no key field in the send packet In the lwtunnel situation, some TUNNEL_FLAGS should can be set by userspace Signed-off-by: wenxu Signed-off-by: David S. Miller commit 8e1da73acded4751a93d4166458a7e640f37d26c Author: Lorenzo Bianconi Date: Wed Dec 19 23:23:00 2018 +0100 gro_cell: add napi_disable in gro_cells_destroy Add napi_disable routine in gro_cells_destroy since starting from commit c42858eaf492 ("gro_cells: remove spinlock protecting receive queues") gro_cell_poll and gro_cells_destroy can run concurrently on napi_skbs list producing a kernel Oops if the tunnel interface is removed while gro_cell_poll is running. The following Oops has been triggered removing a vxlan device while the interface is receiving traffic [ 5628.948853] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 [ 5628.949981] PGD 0 P4D 0 [ 5628.950308] Oops: 0002 [#1] SMP PTI [ 5628.950748] CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 4.20.0-rc6+ #41 [ 5628.952940] RIP: 0010:gro_cell_poll+0x49/0x80 [ 5628.955615] RSP: 0018:ffffc9000004fdd8 EFLAGS: 00010202 [ 5628.956250] RAX: 0000000000000000 RBX: ffffe8ffffc08150 RCX: 0000000000000000 [ 5628.957102] RDX: 0000000000000000 RSI: ffff88802356bf00 RDI: ffffe8ffffc08150 [ 5628.957940] RBP: 0000000000000026 R08: 0000000000000000 R09: 0000000000000000 [ 5628.958803] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000040 [ 5628.959661] R13: ffffe8ffffc08100 R14: 0000000000000000 R15: 0000000000000040 [ 5628.960682] FS: 0000000000000000(0000) GS:ffff88803ea00000(0000) knlGS:0000000000000000 [ 5628.961616] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5628.962359] CR2: 0000000000000008 CR3: 000000000221c000 CR4: 00000000000006b0 [ 5628.963188] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 5628.964034] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 5628.964871] Call Trace: [ 5628.965179] net_rx_action+0xf0/0x380 [ 5628.965637] __do_softirq+0xc7/0x431 [ 5628.966510] run_ksoftirqd+0x24/0x30 [ 5628.966957] smpboot_thread_fn+0xc5/0x160 [ 5628.967436] kthread+0x113/0x130 [ 5628.968283] ret_from_fork+0x3a/0x50 [ 5628.968721] Modules linked in: [ 5628.969099] CR2: 0000000000000008 [ 5628.969510] ---[ end trace 9d9dedc7181661fe ]--- [ 5628.970073] RIP: 0010:gro_cell_poll+0x49/0x80 [ 5628.972965] RSP: 0018:ffffc9000004fdd8 EFLAGS: 00010202 [ 5628.973611] RAX: 0000000000000000 RBX: ffffe8ffffc08150 RCX: 0000000000000000 [ 5628.974504] RDX: 0000000000000000 RSI: ffff88802356bf00 RDI: ffffe8ffffc08150 [ 5628.975462] RBP: 0000000000000026 R08: 0000000000000000 R09: 0000000000000000 [ 5628.976413] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000040 [ 5628.977375] R13: ffffe8ffffc08100 R14: 0000000000000000 R15: 0000000000000040 [ 5628.978296] FS: 0000000000000000(0000) GS:ffff88803ea00000(0000) knlGS:0000000000000000 [ 5628.979327] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5628.980044] CR2: 0000000000000008 CR3: 000000000221c000 CR4: 00000000000006b0 [ 5628.980929] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 5628.981736] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 5628.982409] Kernel panic - not syncing: Fatal exception in interrupt [ 5628.983307] Kernel Offset: disabled Fixes: c42858eaf492 ("gro_cells: remove spinlock protecting receive queues") Signed-off-by: Lorenzo Bianconi Acked-by: Eric Dumazet Signed-off-by: David S. Miller commit e0e587878f538c9e3400219b6c516b8199dc2042 Author: Bryan Whitehead Date: Wed Dec 19 16:55:15 2018 -0500 lan743x: Remove MAC Reset from initialization The MAC Reset was noticed to erase important EEPROM settings. It is also unnecessary since a chip wide reset was done earlier in initialization, and that reset preserves EEPROM settings. There for this patch removes the unnecessary MAC specific reset. Signed-off-by: Bryan Whitehead Signed-off-by: David S. Miller commit c5c08bed843c2b2c048c16d1296d7631d7c1620e Author: Michael S. Tsirkin Date: Wed Dec 19 18:21:51 2018 -0500 virtio: fix test build after uio.h change Fixes: d38499530e5 ("fs: decouple READ and WRITE from the block layer ops") Signed-off-by: Michael S. Tsirkin commit d9842f388b23d9bd4e7ac2cd273bdc3965db15ec Merge: fb2427454631 4765420439e7 Author: David S. Miller Date: Wed Dec 19 13:44:12 2018 -0800 Merge tag 'mlx5-fixes-2018-12-19' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5-fixes-2018-12-19 Some fixes for the mlx5 driver ==================== Signed-off-by: David S. Miller commit 4765420439e758bfa4808392d18b0a4cb6f06065 Author: Alaa Hleihel Date: Sun Nov 25 11:46:09 2018 +0200 net/mlx5e: Remove the false indication of software timestamping support mlx5 driver falsely advertises support of software timestamping. Fix it by removing the false indication. Fixes: ef9814deafd0 ("net/mlx5e: Add HW timestamping (TS) support") Signed-off-by: Alaa Hleihel Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit f0337889147c956721696553ffcc97212b0948fe Author: Yuval Avnery Date: Thu Dec 13 02:26:46 2018 +0200 net/mlx5: Typo fix in del_sw_hw_rule Expression terminated with "," instead of ";", resulted in set_fte getting bad value for modify_enable_mask field. Fixes: bd5251dbf156 ("net/mlx5_core: Introduce flow steering destination of type counter") Signed-off-by: Yuval Avnery Reviewed-by: Daniel Jurgens Signed-off-by: Saeed Mahameed commit bfc698254ba97b3e3e4ebbfae0ffa1f7e2fa0717 Author: Tariq Toukan Date: Sun Dec 2 15:45:53 2018 +0200 net/mlx5e: RX, Fix wrong early return in receive queue poll When the completion queue of the RQ is empty, do not immediately return. If left-over decompressed CQEs (from the previous cycle) were processed, need to go to the finalization part of the poll function. Bug exists only when CQE compression is turned ON. This solves the following issue: mlx5_core 0000:82:00.1: mlx5_eq_int:544:(pid 0): CQ error on CQN 0xc08, syndrome 0x1 mlx5_core 0000:82:00.1 p4p2: mlx5e_cq_error_event: cqn=0x000c08 event=0x04 Fixes: 4b7dfc992514 ("net/mlx5e: Early-return on empty completion queues") Signed-off-by: Tariq Toukan Reviewed-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed commit 3cf85f9f6bd7b172122865432b4c6f0ec844e22a Author: Vitaly Kuznetsov Date: Wed Dec 19 17:25:14 2018 +0100 KVM: x86: nSVM: fix switch to guest mmu Recent optimizations in MMU code broke nested SVM with NPT in L1 completely: when we do nested_svm_{,un}init_mmu_context() we want to switch from TDP MMU to shadow MMU, both init_kvm_tdp_mmu() and kvm_init_shadow_mmu() check if re-configuration is needed by looking at cache source data. The data, however, doesn't change - it's only the type of the MMU which changes. We end up not re-initializing guest MMU as shadow and everything goes off the rails. The issue could have been fixed by putting MMU type into extended MMU role but this is not really needed. We can just split root and guest MMUs the exact same way we did for nVMX, their types never change in the lifetime of a vCPU. There is still room for improvement: currently, we reset all MMU roots when switching from L1 to L2 and back and this is not needed. Fixes: 7dcd57552008 ("x86/kvm/mmu: check if tdp/shadow MMU reconfiguration is needed") Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit fb24274546310872eeeaf3d1d53799d8414aa0f2 Author: Cong Wang Date: Tue Dec 18 21:17:44 2018 -0800 ipv6: explicitly initialize udp6_addr in udp_sock_create6() syzbot reported the use of uninitialized udp6_addr::sin6_scope_id. We can just set ::sin6_scope_id to zero, as tunnels are unlikely to use an IPv6 address that needs a scope id and there is no interface to bind in this context. For net-next, it looks different as we have cfg->bind_ifindex there so we can probably call ipv6_iface_scope_id(). Same for ::sin6_flowinfo, tunnels don't use it. Fixes: 8024e02879dd ("udp: Add udp_sock_create for UDP tunnels to open listener socket") Reported-by: syzbot+c56449ed3652e6720f30@syzkaller.appspotmail.com Cc: Jon Maloy Signed-off-by: Cong Wang Signed-off-by: David S. Miller commit 84404d5fd5858588bbf694b0300dbc6310d02737 Author: Michael Chan Date: Wed Dec 19 13:46:50 2018 -0500 bnxt_en: Fix ethtool self-test loopback. The current code has 2 problems. It assumes that the RX ring for the loopback packet is combined with the TX ring. This is not true if the ethtool channels are set to non-combined mode. The second problem is that it won't work on 57500 chips without adjusting the logic to get the proper completion ring (cpr) pointer. Fix both issues by locating the proper cpr pointer through the RX ring. Fixes: e44758b78ae8 ("bnxt_en: Use bnxt_cp_ring_info struct pointer as parameter for RX path.") Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 912cb1d55c96cd6a4e2c9c06803aa3a7810f72ba Merge: c6f4075e2f14 c75ab8a55ac1 Author: David S. Miller Date: Wed Dec 19 10:27:58 2018 -0800 Merge branch 'rds-fixes' Shamir Rabinovitch says: ==================== WARNING in rds_message_alloc_sgs This patch set fix google syzbot rds bug found in linux-next. The first patch solve the syzbot issue. The second patch fix issue mentioned by Leon Romanovsky that drivers should not call WARN_ON as result from user input. syzbot bug report can be foud here: https://lkml.org/lkml/2018/10/31/28 v1->v2: - patch 1: make rds_iov_vector fields name more descriptive (Hakon) - patch 1: fix potential mem leak in rds_rm_size if krealloc fail (Hakon) v2->v3: - patch 2: harden rds_sendmsg for invalid number of sgs (Gerd) v3->v4 - Santosh a.b. on both patches + repost to net-dev ==================== Signed-off-by: David S. Miller commit c75ab8a55ac1083c232e4407f52b0cadae6c1e0e Author: shamir rabinovitch Date: Sun Dec 16 09:01:09 2018 +0200 net/rds: remove user triggered WARN_ON in rds_sendmsg per comment from Leon in rdma mailing list https://lkml.org/lkml/2018/10/31/312 : Please don't forget to remove user triggered WARN_ON. https://lwn.net/Articles/769365/ "Greg Kroah-Hartman raised the problem of core kernel API code that will use WARN_ON_ONCE() to complain about bad usage; that will not generate the desired result if WARN_ON_ONCE() is configured to crash the machine. He was told that the code should just call pr_warn() instead, and that the called function should return an error in such situations. It was generally agreed that any WARN_ON() or WARN_ON_ONCE() calls that can be triggered from user space need to be fixed." in addition harden rds_sendmsg to detect and overcome issues with invalid sg count and fail the sendmsg. Suggested-by: Leon Romanovsky Acked-by: Santosh Shilimkar Signed-off-by: shamir rabinovitch Signed-off-by: David S. Miller commit ea010070d0a7497253d5a6f919f6dd107450b31a Author: shamir rabinovitch Date: Sun Dec 16 09:01:08 2018 +0200 net/rds: fix warn in rds_message_alloc_sgs redundant copy_from_user in rds_sendmsg system call expose rds to issue where rds_rdma_extra_size walk the rds iovec and and calculate the number pf pages (sgs) it need to add to the tail of rds message and later rds_cmsg_rdma_args copy the rds iovec again and re calculate the same number and get different result causing WARN_ON in rds_message_alloc_sgs. fix this by doing the copy_from_user only once per rds_sendmsg system call. When issue occur the below dump is seen: WARNING: CPU: 0 PID: 19789 at net/rds/message.c:316 rds_message_alloc_sgs+0x10c/0x160 net/rds/message.c:316 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 19789 Comm: syz-executor827 Not tainted 4.19.0-next-20181030+ #101 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x244/0x39d lib/dump_stack.c:113 panic+0x2ad/0x55c kernel/panic.c:188 __warn.cold.8+0x20/0x45 kernel/panic.c:540 report_bug+0x254/0x2d0 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:178 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:271 do_invalid_op+0x36/0x40 arch/x86/kernel/traps.c:290 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:969 RIP: 0010:rds_message_alloc_sgs+0x10c/0x160 net/rds/message.c:316 Code: c0 74 04 3c 03 7e 6c 44 01 ab 78 01 00 00 e8 2b 9e 35 fa 4c 89 e0 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 14 9e 35 fa <0f> 0b 31 ff 44 89 ee e8 18 9f 35 fa 45 85 ed 75 1b e8 fe 9d 35 fa RSP: 0018:ffff8801c51b7460 EFLAGS: 00010293 RAX: ffff8801bc412080 RBX: ffff8801d7bf4040 RCX: ffffffff8749c9e6 RDX: 0000000000000000 RSI: ffffffff8749ca5c RDI: 0000000000000004 RBP: ffff8801c51b7490 R08: ffff8801bc412080 R09: ffffed003b5c5b67 R10: ffffed003b5c5b67 R11: ffff8801dae2db3b R12: 0000000000000000 R13: 000000000007165c R14: 000000000007165c R15: 0000000000000005 rds_cmsg_rdma_args+0x82d/0x1510 net/rds/rdma.c:623 rds_cmsg_send net/rds/send.c:971 [inline] rds_sendmsg+0x19a2/0x3180 net/rds/send.c:1273 sock_sendmsg_nosec net/socket.c:622 [inline] sock_sendmsg+0xd5/0x120 net/socket.c:632 ___sys_sendmsg+0x7fd/0x930 net/socket.c:2117 __sys_sendmsg+0x11d/0x280 net/socket.c:2155 __do_sys_sendmsg net/socket.c:2164 [inline] __se_sys_sendmsg net/socket.c:2162 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2162 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x44a859 Code: e8 dc e6 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 6b cb fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f1d4710ada8 EFLAGS: 00000297 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000006dcc28 RCX: 000000000044a859 RDX: 0000000000000000 RSI: 0000000020001600 RDI: 0000000000000003 RBP: 00000000006dcc20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000297 R12: 00000000006dcc2c R13: 646e732f7665642f R14: 00007f1d4710b9c0 R15: 00000000006dcd2c Kernel Offset: disabled Rebooting in 86400 seconds.. Reported-by: syzbot+26de17458aeda9d305d8@syzkaller.appspotmail.com Acked-by: Santosh Shilimkar Signed-off-by: shamir rabinovitch Signed-off-by: David S. Miller commit c6f4075e2f14a91f2180c98bc7715946f791cbe6 Merge: 49ce708be602 53884577fbce Author: David S. Miller Date: Wed Dec 19 08:39:18 2018 -0800 Merge tag 'wireless-drivers-for-davem-2018-12-19' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for 4.20 Last set of fixes for 4.20. All (except the mt76 fix) of these are important fixes to user reported problems and pretty small in size. rtlwifi * fix skb leak mwifiex * revert a commit from v4.19 due to problems with locking mt76 * fix a potential NULL derenfence * add entry to MAINTAINERS iwlwifi * fix a firmware crash which was a regression introduced in v4.20-rc4 ath10k * fix a firmware crash with wcn3990 firmware ==================== Signed-off-by: David S. Miller commit 49ce708be602787518af6d846cf5f0a966018acb Merge: 3061169a47ee 34b1e0e9efe1 Author: David S. Miller Date: Wed Dec 19 08:34:46 2018 -0800 Merge tag 'mac80211-for-davem-2018-12-19' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== Just three fixes: * fix a memory leak in an error path * fix TXQs in interface teardown * free fraglist if we used it internally before returning SKB ==================== Signed-off-by: David S. Miller commit bed1369f51901b17108a4bb4f7210aab183bea42 Author: Geert Uytterhoeven Date: Mon Dec 3 12:53:51 2018 +0100 m68k: Fix memblock-related crashes When running the kernel in Fast RAM on Atari: Ignoring memory chunk at 0x0:0xe00000 before the first chunk ... Unable to handle kernel NULL pointer dereference at virtual address (ptrval) Oops: 00000000 Modules linked in: PC: [<0069dbac>] free_all_bootmem+0x12c/0x186 SR: 2714 SP: (ptrval) a2: 005e3314 d0: 00000000 d1: 0000000a d2: 00000e00 d3: 00000000 d4: 005e1fc0 d5: 0000001a a0: 01000000 a1: 00000000 Process swapper (pid: 0, task=(ptrval)) Frame format=7 eff addr=00000736 ssw=0505 faddr=00000736 wb 1 stat/addr/data: 0000 00000000 00000000 wb 2 stat/addr/data: 0000 00000000 00000000 wb 3 stat/addr/data: 0000 00000736 00000000 push data: 00000000 00000000 00000000 00000000 Stack from 005e1f84: 00000000 0000000a 027d3260 006b5006 00000000 00000000 00000000 00000000 0004f062 0003a220 0069e272 005e1ff8 0000054c 00000000 00e00000 00000000 00000001 00693cd8 027d3260 0004f062 0003a220 00691be6 00000000 00000000 00000000 00000000 00000000 00000000 006b5006 00000000 00690872 Call Trace: [<0004f062>] printk+0x0/0x18 [<0003a220>] parse_args+0x0/0x2d4 [<0069e272>] memblock_virt_alloc_try_nid+0x0/0xa4 [<00693cd8>] mem_init+0xa/0x5c [<0004f062>] printk+0x0/0x18 [<0003a220>] parse_args+0x0/0x2d4 [<00691be6>] start_kernel+0x1ca/0x462 [<00690872>] _sinittext+0x872/0x11f8 Code: 7a1a eaae 2270 6db0 0061 ef14 2f01 2f03 <96a9> 0736 2203 e589 d681 e78b d6a9 0732 2f03 2f40 0034 4eb9 0069 b8d0 260e 4fef Disabling lock debugging due to kernel taint Kernel panic - not syncing: Attempted to kill the idle task! As the kernel must run in the memory chunk with the lowest address, ST-RAM is ignored, and removed from the m68k_memory[] array. However, it is not removed from memblock, causing a crash later. More investigation shows that there are 3 places where memory chunks are ignored, all after the calls to memblock_add() in m68k_parse_bootinfo(), and thus causing crashes: 1. On classic m68k CPUs with a MMU, paging_init() ignores all memory chunks below the first chunk, cfr. above, 2. On Amigas equipped with a Zorro III bus, config_amiga() ignores all Zorro II memory, 3. If CONFIG_SINGLE_MEMORY_CHUNK=y, m68k_parse_bootinfo() ignores all but the first memory chunk. Fix this by moving the calls to memblock_add() from m68k_parse_bootinfo() to paging_init(), after all ignored memory chunks have been removed from m68k_memory[]. Reported-by: Andreas Schwab Fixes: 1008a11590b966b4 ("m68k: switch to MEMBLOCK + NO_BOOTMEM") Signed-off-by: Geert Uytterhoeven commit ef7cfd00b2caf6edeb7f169682b64be2d0a798cf Author: Masahiro Yamada Date: Tue Dec 18 14:25:41 2018 +0900 kbuild: fix false positive warning/error about missing libelf For the same reason as commit 25896d073d8a ("x86/build: Fix compiler support check for CONFIG_RETPOLINE"), you cannot put this $(error ...) into the parse stage of the top Makefile. Perhaps I'd propose a more sophisticated solution later, but this is the best I can do for now. Link: https://lkml.org/lkml/2017/12/25/211 Reported-by: Paul Gortmaker Reported-by: Bernd Edlinger Reported-by: Qian Cai Cc: Josh Poimboeuf Signed-off-by: Masahiro Yamada Tested-by: Qian Cai commit 271b9c0c80076bb1dd868dc384ef3aac87ec7dec Author: Ronnie Sahlberg Date: Tue Dec 18 17:49:05 2018 -0600 smb3: Fix rmdir compounding regression to strict servers Some servers require that the setinfo matches the exact size, and in this case compounding changes introduced by commit c2e0fe3f5aae ("cifs: make rmdir() use compounding") caused us to send 8 bytes (padded length) instead of 1 byte (the size of the structure). See MS-FSCC section 2.4.11. Fixing this when we send a SET_INFO command for delete file disposition, then ends up as an iov of a single byte but this causes problems with SMB3 and encryption. To avoid this, instead of creating a one byte iov for the disposition value and then appending an additional iov with a 7 byte padding we now handle this as a single 8 byte iov containing both the disposition byte as well as the padding in one single buffer. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French Acked-by: Paulo Alcantara commit 53884577fbcef33a7d15ad664e664a3dabe35171 Author: Rakesh Pillai Date: Fri Dec 14 12:17:46 2018 +0200 ath10k: skip sending quiet mode cmd for WCN3990 HL2.0 firmware does not support setting quiet mode. If the host driver sends the quiet mode setting command to the HL2.0 firmware, it crashes with the below signature. fatal error received: err_qdi.c:456:EX:wlan_process:1:WLAN RT:207a:PC=b001b4f0 The quiet mode command support is exposed by the firmware via thermal throttle wmi service. Enable ath10k thermal support if thermal throttle wmi service bit is set. 10.x firmware versions support this feature by default, but unfortunately do not advertise the support via service flags, hence have to manually set the service flag in ath10k_core_compat_services(). Tested on QCA988X with 10.2.4.70.9-2. Also tested on WCN3990. Co-developed-by: Govind Singh Co-developed-by: Kalle Valo Signed-off-by: Rakesh Pillai Signed-off-by: Govind Singh Signed-off-by: Kalle Valo commit 6ac389346e6964e1f6a1c675cebf8bd0912526a5 Author: Ingo Molnar Date: Wed Dec 19 11:27:05 2018 +0100 Revert "kbuild/Makefile: Prepare for using macros in inline assembly code to work around asm() related GCC inlining bugs" This reverts commit 77b0bf55bc675233d22cd5df97605d516d64525e. See this commit for details about the revert: e769742d3584 ("Revert "x86/jump-labels: Macrofy inline assembly code to work around GCC inlining bugs"") Conflicts: arch/x86/Makefile Reported-by: Masahiro Yamada Reviewed-by: Borislav Petkov Reviewed-by: Thomas Gleixner Cc: Juergen Gross Cc: Richard Biener Cc: Kees Cook Cc: Segher Boessenkool Cc: Ard Biesheuvel Cc: Peter Zijlstra Cc: Josh Poimboeuf Cc: Nadav Amit Cc: Linus Torvalds Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar commit 96af6cd02a10b96108fc415a213441e7fb9f4f9b Author: Ingo Molnar Date: Wed Dec 19 11:23:27 2018 +0100 Revert "x86/objtool: Use asm macros to work around GCC inlining bugs" This reverts commit c06c4d8090513f2974dfdbed2ac98634357ac475. See this commit for details about the revert: e769742d3584 ("Revert "x86/jump-labels: Macrofy inline assembly code to work around GCC inlining bugs"") Reported-by: Masahiro Yamada Reviewed-by: Borislav Petkov Reviewed-by: Thomas Gleixner Cc: Juergen Gross Cc: Richard Biener Cc: Kees Cook Cc: Segher Boessenkool Cc: Ard Biesheuvel Cc: Peter Zijlstra Cc: Josh Poimboeuf Cc: Nadav Amit Cc: Linus Torvalds Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar commit ac180540b04d7ffaf8ba6f13bf628c4f50dc9820 Author: Ingo Molnar Date: Wed Dec 19 11:23:14 2018 +0100 Revert "x86/refcount: Work around GCC inlining bug" This reverts commit 9e1725b410594911cc5981b6c7b4cea4ec054ca8. See this commit for details about the revert: e769742d3584 ("Revert "x86/jump-labels: Macrofy inline assembly code to work around GCC inlining bugs"") The conflict resolution for interaction with: 288e4521f0f6: ("x86/asm: 'Simplify' GEN_*_RMWcc() macros") was provided by Masahiro Yamada. Conflicts: arch/x86/include/asm/refcount.h Reported-by: Masahiro Yamada Reviewed-by: Borislav Petkov Reviewed-by: Thomas Gleixner Cc: Juergen Gross Cc: Richard Biener Cc: Kees Cook Cc: Segher Boessenkool Cc: Ard Biesheuvel Cc: Peter Zijlstra Cc: Josh Poimboeuf Cc: Nadav Amit Cc: Linus Torvalds Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar commit 851a4cd7cc11fcebfa833824415fc57cf180cadf Author: Ingo Molnar Date: Wed Dec 19 11:20:57 2018 +0100 Revert "x86/alternatives: Macrofy lock prefixes to work around GCC inlining bugs" This reverts commit 77f48ec28e4ccff94d2e5f4260a83ac27a7f3099. See this commit for details about the revert: e769742d3584 ("Revert "x86/jump-labels: Macrofy inline assembly code to work around GCC inlining bugs"") Reported-by: Masahiro Yamada Reviewed-by: Borislav Petkov Reviewed-by: Thomas Gleixner Cc: Juergen Gross Cc: Richard Biener Cc: Kees Cook Cc: Segher Boessenkool Cc: Ard Biesheuvel Cc: Peter Zijlstra Cc: Josh Poimboeuf Cc: Nadav Amit Cc: Linus Torvalds Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar commit ffb61c6346d0f02b2a03377a3edac838c1f09b45 Author: Ingo Molnar Date: Wed Dec 19 11:20:50 2018 +0100 Revert "x86/bug: Macrofy the BUG table section handling, to work around GCC inlining bugs" This reverts commit f81f8ad56fd1c7b99b2ed1c314527f7d9ac447c6. See this commit for details about the revert: e769742d3584 ("Revert "x86/jump-labels: Macrofy inline assembly code to work around GCC inlining bugs"") Reported-by: Masahiro Yamada Reviewed-by: Borislav Petkov Reviewed-by: Thomas Gleixner Cc: Juergen Gross Cc: Richard Biener Cc: Kees Cook Cc: Segher Boessenkool Cc: Ard Biesheuvel Cc: Peter Zijlstra Cc: Josh Poimboeuf Cc: Nadav Amit Cc: Linus Torvalds Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar commit a4da3d86a285f0035a21bae776846c5077a535df Author: Ingo Molnar Date: Wed Dec 19 11:20:44 2018 +0100 Revert "x86/paravirt: Work around GCC inlining bugs when compiling paravirt ops" This reverts commit 494b5168f2de009eb80f198f668da374295098dd. See this commit for details about the revert: e769742d3584 ("Revert "x86/jump-labels: Macrofy inline assembly code to work around GCC inlining bugs"") Reported-by: Masahiro Yamada Reviewed-by: Borislav Petkov Reviewed-by: Thomas Gleixner Cc: Juergen Gross Cc: Richard Biener Cc: Kees Cook Cc: Segher Boessenkool Cc: Ard Biesheuvel Cc: Peter Zijlstra Cc: Josh Poimboeuf Cc: Nadav Amit Cc: Linus Torvalds Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar commit 81a68455e795c9094a49c017d974c89223e6cd42 Author: Ingo Molnar Date: Wed Dec 19 11:20:37 2018 +0100 Revert "x86/extable: Macrofy inline assembly code to work around GCC inlining bugs" This reverts commit 0474d5d9d2f7f3b11262f7bf87d0e7314ead9200. See this commit for details about the revert: e769742d3584 ("Revert "x86/jump-labels: Macrofy inline assembly code to work around GCC inlining bugs"") Reported-by: Masahiro Yamada Reviewed-by: Borislav Petkov Reviewed-by: Thomas Gleixner Cc: Juergen Gross Cc: Richard Biener Cc: Kees Cook Cc: Segher Boessenkool Cc: Ard Biesheuvel Cc: Peter Zijlstra Cc: Josh Poimboeuf Cc: Nadav Amit Cc: Linus Torvalds Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar commit c3462ba986837238f4409f2a9dfcf2b4c3195067 Author: Ingo Molnar Date: Wed Dec 19 11:20:30 2018 +0100 Revert "x86/cpufeature: Macrofy inline assembly code to work around GCC inlining bugs" This reverts commit d5a581d84ae6b8a4a740464b80d8d9cf1e7947b2. See this commit for details about the revert: e769742d3584 ("Revert "x86/jump-labels: Macrofy inline assembly code to work around GCC inlining bugs"") Reported-by: Masahiro Yamada Reviewed-by: Borislav Petkov Reviewed-by: Thomas Gleixner Cc: Juergen Gross Cc: Richard Biener Cc: Kees Cook Cc: Segher Boessenkool Cc: Ard Biesheuvel Cc: Peter Zijlstra Cc: Josh Poimboeuf Cc: Nadav Amit Cc: Linus Torvalds Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar commit e769742d35841a8198dd6af94e2931083abdee08 Author: Ingo Molnar Date: Wed Dec 19 11:20:23 2018 +0100 Revert "x86/jump-labels: Macrofy inline assembly code to work around GCC inlining bugs" This reverts commit 5bdcd510c2ac9efaf55c4cbd8d46421d8e2320cd. The macro based workarounds for GCC's inlining bugs caused regressions: distcc and other distro build setups broke, and the fixes are not easy nor will they solve regressions on already existing installations. So we are reverting this patch and the 8 followup patches. What makes this revert easier is that GCC9 will likely include the new 'asm inline' syntax that makes inlining of assembly blocks a lot more robust. This is a superior method to any macro based hackeries - and might even be backported to GCC8, which would make all modern distros get the inlining fixes as well. Many thanks to Masahiro Yamada and others for helping sort out these problems. Reported-by: Masahiro Yamada Reviewed-by: Borislav Petkov Reviewed-by: Thomas Gleixner Cc: Juergen Gross Cc: Richard Biener Cc: Kees Cook Cc: Segher Boessenkool Cc: Ard Biesheuvel Cc: Peter Zijlstra Cc: Josh Poimboeuf Cc: Nadav Amit Cc: Linus Torvalds Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar commit 34b1e0e9efe101822e83cc62d22443ed3867ae7a Author: Sara Sharon Date: Sat Dec 15 11:03:06 2018 +0200 mac80211: free skb fraglist before freeing the skb mac80211 uses the frag list to build AMSDU. When freeing the skb, it may not be really freed, since someone is still holding a reference to it. In that case, when TCP skb is being retransmitted, the pointer to the frag list is being reused, while the data in there is no longer valid. Since we will never get frag list from the network stack, as mac80211 doesn't advertise the capability, we can safely free and nullify it before releasing the SKB. Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg commit d350a0f431189517b1af0dbbb605c273231a8966 Author: Johannes Berg Date: Sat Dec 15 11:03:22 2018 +0200 nl80211: fix memory leak if validate_pae_over_nl80211() fails If validate_pae_over_nl80211() were to fail in nl80211_crypto_settings(), we might leak the 'connkeys' allocation. Fix this. Fixes: 64bf3d4bc2b0 ("nl80211: Add CONTROL_PORT_OVER_NL80211 attribute") Signed-off-by: Johannes Berg commit 3061169a47ee3572af6de78887222b6d03771621 Merge: 78abe3d0dfad bcb671c2fa0e Author: David S. Miller Date: Tue Dec 18 22:30:33 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Alexei Starovoitov says: ==================== pull-request: bpf 2018-12-18 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) promote bpf_perf_event.h to mandatory UAPI header, from Masahiro. ==================== Signed-off-by: David S. Miller commit 78abe3d0dfad196959b1246003366e2610775ea6 Author: Myungho Jung Date: Tue Dec 18 09:02:25 2018 -0800 net/smc: fix TCP fallback socket release clcsock can be released while kernel_accept() references it in TCP listen worker. Also, clcsock needs to wake up before released if TCP fallback is used and the clcsock is blocked by accept. Add a lock to safely release clcsock and call kernel_sock_shutdown() to wake up clcsock from accept in smc_release(). Reported-by: syzbot+0bf2e01269f1274b4b03@syzkaller.appspotmail.com Reported-by: syzbot+e3132895630f957306bc@syzkaller.appspotmail.com Signed-off-by: Myungho Jung Signed-off-by: David S. Miller commit f7db2beb4c2c6cc8111f5ab90fc7363ca91107b6 Author: Colin Ian King Date: Tue Dec 18 15:19:47 2018 +0000 vxge: ensure data0 is initialized in when fetching firmware version information Currently variable data0 is not being initialized so a garbage value is being passed to vxge_hw_vpath_fw_api and this value is being written to the rts_access_steer_data0 register. There are other occurrances where data0 is being initialized to zero (e.g. in function vxge_hw_upgrade_read_version) so I think it makes sense to ensure data0 is initialized likewise to 0. Detected by CoverityScan, CID#140696 ("Uninitialized scalar variable") Fixes: 8424e00dfd52 ("vxge: serialize access to steering control register") Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit d81c5054a5d1d4999c7cdead7636b6cd4af83d36 Author: Juergen Gross Date: Tue Dec 18 16:06:19 2018 +0100 xen/netfront: tolerate frags with no data At least old Xen net backends seem to send frags with no real data sometimes. In case such a fragment happens to occur with the frag limit already reached the frontend will BUG currently even if this situation is easily recoverable. Modify the BUG_ON() condition accordingly. Tested-by: Dietmar Hahn Signed-off-by: Juergen Gross Signed-off-by: David S. Miller commit 8742beb50f2db903d3b6d69ddd81d67ce9914453 Author: Kunihiko Hayashi Date: Tue Dec 18 16:57:04 2018 +0900 net: phy: Fix the issue that netif always links up after resuming Even though the link is down before entering hibernation, there is an issue that the network interface always links up after resuming from hibernation. If the link is still down before enabling the network interface, and after resuming from hibernation, the phydev->state is forcibly set to PHY_UP in mdio_bus_phy_restore(), and the link becomes up. In suspend sequence, only if the PHY is attached, mdio_bus_phy_suspend() calls phy_stop_machine(), and mdio_bus_phy_resume() calls phy_start_machine(). In resume sequence, it's enough to do the same as mdio_bus_phy_resume() because the state has been preserved. This patch fixes the issue by calling phy_start_machine() in mdio_bus_phy_restore() in the same way as mdio_bus_phy_resume(). Fixes: bc87922ff59d ("phy: Move PHY PM operations into phy_device") Suggested-by: Heiner Kallweit Signed-off-by: Kunihiko Hayashi Signed-off-by: David S. Miller commit 15515aaaa69659c502003926a2067ee76176148a Author: Jason Martinsen Date: Tue Dec 18 05:38:22 2018 +0000 lan78xx: Resolve issue with changing MAC address Current state for the lan78xx driver does not allow for changing the MAC address of the interface, without either removing the module (if you compiled it that way) or rebooting the machine. If you attempt to change the MAC address, ifconfig will show the new address, however, the system/interface will not respond to any traffic using that configuration. A few short-term options to work around this are to unload the module and reload it with the new MAC address, change the interface to "promisc", or reboot with the correct configuration to change the MAC. This patch enables the ability to change the MAC address via fairly normal means... ifdown modify entry in /etc/network/interfaces OR a similar method ifup Then test via any network communication, such as ICMP requests to gateway. My only test platform for this patch has been a raspberry pi model 3b+. Signed-off-by: Jason Martinsen ----- Signed-off-by: David S. Miller commit 0db7d253e9f0ff1a41c602429bea93df221be6ed Author: Bryan Whitehead Date: Mon Dec 17 16:44:50 2018 -0500 lan743x: Expand phy search for LAN7431 The LAN7431 uses an external phy, and it can be found anywhere in the phy address space. This patch uses phy address 1 for LAN7430 only. And searches all addresses otherwise. Signed-off-by: Bryan Whitehead Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 59fc137ebdd1a93bfec991a1c8dd96002433b2e9 Merge: a9d6d897f399 55cbe0794294 Author: David S. Miller Date: Tue Dec 18 21:18:26 2018 -0800 Merge branch 'vxlan-Various-fixes' Petr Machata says: ==================== vxlan: Various fixes This patch set contains three fixes for the vxlan driver. Patch #1 fixes handling of offload mark on replaced VXLAN FDB entries. A way to trigger this is to replace the FDB entry with one that can not be offloaded. A future patch set should make it possible to veto such FDB changes. However the FDB might still fail to be offloaded due to another issue, and the offload mark should reflect that. Patch #2 fixes problems in __vxlan_dev_create() when a call to rtnl_configure_link() fails. These failures would be tricky to hit on a real system, the most likely vector is through an error in vxlan_open(). However, with the abovementioned vetoing patchset, vetoing the created entry would trigger the same problems (and be easier to reproduce). Patch #3 fixes a problem in vxlan_changelink(). In situations where the default remote configured in the FDB table (if any) does not exactly match the remote address configured at the VXLAN device, changing the remote address breaks the default FDB entry. Patch #4 is then a self test for this issue. v3: - Patch #2: - Reuse the same errout block for both cleanup paths. Use a bool to decide whether the unregister_netdevice() call should be made. v2: - Drop former patch #3 - Patch #2: - Delete the default entry before calling unregister_netdevice(). That takes care of former patch #3, hence tweak the commit message to mention that problem as well. ==================== Signed-off-by: David S. Miller commit 55cbe0794294031d9b36984d4529f416e7e0a40a Author: Petr Machata Date: Tue Dec 18 13:16:03 2018 +0000 selftests: net: Add test_vxlan_fdb_changelink.sh Add a test to exercise the fix from the previous patch. Signed-off-by: Petr Machata Signed-off-by: David S. Miller commit ce5e098f7a10b4bf8e948c12fa350320c5c3afad Author: Petr Machata Date: Tue Dec 18 13:16:02 2018 +0000 vxlan: changelink: Fix handling of default remotes Default remotes are stored as FDB entries with an Ethernet address of 00:00:00:00:00:00. When a request is made to change a remote address of a VXLAN device, vxlan_changelink() first deletes the existing default remote, and then creates a new FDB entry. This works well as long as the list of default remotes matches exactly the configuration of a VXLAN remote address. Thus when the VXLAN device has a remote of X, there should be exactly one default remote FDB entry X. If the VXLAN device has no remote address, there should be no such entry. Besides using "ip link set", it is possible to manipulate the list of default remotes by using the "bridge fdb". It is therefore easy to break the above condition. Under such circumstances, the __vxlan_fdb_delete() call doesn't delete the FDB entry itself, but just one remote. The following vxlan_fdb_create() then creates a new FDB entry, leading to a situation where two entries exist for the address 00:00:00:00:00:00, each with a different subset of default remotes. An even more obvious breakage rooted in the same cause can be observed when a remote address is configured for a VXLAN device that did not have one before. In that case vxlan_changelink() doesn't remove any remote, and just creates a new FDB entry for the new address: $ ip link add name vx up type vxlan id 2000 dstport 4789 $ bridge fdb ap dev vx 00:00:00:00:00:00 dst 192.0.2.20 self permanent $ bridge fdb ap dev vx 00:00:00:00:00:00 dst 192.0.2.30 self permanent $ ip link set dev vx type vxlan remote 192.0.2.30 $ bridge fdb sh dev vx | grep 00:00:00:00:00:00 00:00:00:00:00:00 dst 192.0.2.30 self permanent <- new entry, 1 rdst 00:00:00:00:00:00 dst 192.0.2.20 self permanent <- orig. entry, 2 rdsts 00:00:00:00:00:00 dst 192.0.2.30 self permanent To fix this, instead of calling vxlan_fdb_create() directly, defer to vxlan_fdb_update(). That has logic to handle the duplicates properly. Additionally, it also handles notifications, so drop that call from changelink as well. Fixes: 0241b836732f ("vxlan: fix default fdb entry netlink notify ordering during netdev create") Signed-off-by: Petr Machata Acked-by: Roopa Prabhu Signed-off-by: David S. Miller commit 6db9246871394b3a136cd52001a0763676563840 Author: Petr Machata Date: Tue Dec 18 13:16:00 2018 +0000 vxlan: Fix error path in __vxlan_dev_create() When a failure occurs in rtnl_configure_link(), the current code calls unregister_netdevice() to roll back the earlier call to register_netdevice(), and jumps to errout, which calls vxlan_fdb_destroy(). However unregister_netdevice() calls transitively ndo_uninit, which is vxlan_uninit(), and that already takes care of deleting the default FDB entry by calling vxlan_fdb_delete_default(). Since the entry added earlier in __vxlan_dev_create() is exactly the default entry, the cleanup code in the errout block always leads to double free and thus a panic. Besides, since vxlan_fdb_delete_default() always destroys the FDB entry with notification enabled, the deletion of the default entry is notified even before the addition was notified. Instead, move the unregister_netdevice() call after the manual destroy, which solves both problems. Fixes: 0241b836732f ("vxlan: fix default fdb entry netlink notify ordering during netdev create") Signed-off-by: Petr Machata Signed-off-by: David S. Miller commit 6ad0b5a4e03dc5cc0c1ed6be093bdcefdc794a6f Author: Petr Machata Date: Tue Dec 18 13:15:59 2018 +0000 vxlan: Unmark offloaded bit on replaced FDB entries When rdst of an offloaded FDB entry is replaced, it certainly isn't offloaded anymore. Drivers are notified about such replacements, and can re-mark the entry as offloaded again if they so wish. However until a driver does so explicitly, assume a replaced FDB entry is not offloaded. Note that replaces coming via vxlan_fdb_external_learn_add() are always immediately followed by an explicit offload marking. Fixes: 0efe11733356 ("vxlan: Support marking RDSTs as offloaded") Signed-off-by: Petr Machata Signed-off-by: David S. Miller commit a9d6d897f3999e613dfacd4efbf63057f30ad7b3 Merge: e2c4cf7f98a5 6e0af298066f Author: David S. Miller Date: Tue Dec 18 16:17:49 2018 -0800 Merge branch 'macb-DMA-race-fixes' Anssi Hannula says: ==================== net: macb: DMA race condition fixes Here are a couple of race condition fixes for the macb driver. The first two are for issues observed at runtime on real HW. v2: - added received Tested-bys and Acked-bys to the first two patches - in patch 3/3, moved the timestamp protection barrier closer to the timestamp reads - in patch 3/3, removed unnecessary move of the addr assignment in gem_rx() to keep the patch minimal for maximum clarity - in patch 3/3, clarified commit message and comments The 3/3 is the same one I improperly sent last week as a standalone patch. ==================== Signed-off-by: David S. Miller commit 6e0af298066f3b6d99f58989bb0dca6f764b4c6d Author: Anssi Hannula Date: Mon Dec 17 15:05:41 2018 +0200 net: macb: add missing barriers when reading descriptors When reading buffer descriptors on RX or on TX completion, an RX_USED/TX_USED bit is checked first to ensure that the descriptors have been populated, i.e. the ownership has been transferred. However, there are no memory barriers to ensure that the data protected by the RX_USED/TX_USED bit is up-to-date with respect to that bit. Specifically: - TX timestamp descriptors may be loaded before ctrl is loaded for the TX_USED check, which is racy as the descriptors may be updated between the loads, causing old timestamp descriptor data to be used. - RX ctrl may be loaded before addr is loaded for the RX_USED check, which is racy as a new frame may be written between the loads, causing old ctrl descriptor data to be used. This issue exists for both macb_rx() and gem_rx() variants. Fix the races by adding DMA read memory barriers on those paths and reordering the reads in macb_rx(). I have not observed any actual problems in practice caused by these being missing, though. Tested on a ZynqMP based system. Fixes: 89e5785fc8a6 ("[PATCH] Atmel MACB ethernet driver") Signed-off-by: Anssi Hannula Cc: Nicolas Ferre Signed-off-by: David S. Miller commit 8159ecab0db9095902d4c73605fb8787f5c7d653 Author: Anssi Hannula Date: Mon Dec 17 15:05:40 2018 +0200 net: macb: fix dropped RX frames due to a race Bit RX_USED set to 0 in the address field allows the controller to write data to the receive buffer descriptor. The driver does not ensure the ctrl field is ready (cleared) when the controller sees the RX_USED=0 written by the driver. The ctrl field might only be cleared after the controller has already updated it according to a newly received frame, causing the frame to be discarded in gem_rx() due to unexpected ctrl field contents. A message is logged when the above scenario occurs: macb ff0b0000.ethernet eth0: not whole frame pointed by descriptor Fix the issue by ensuring that when the controller sees RX_USED=0 the ctrl field is already cleared. This issue was observed on a ZynqMP based system. Fixes: 4df95131ea80 ("net/macb: change RX path for GEM") Signed-off-by: Anssi Hannula Tested-by: Claudiu Beznea Cc: Nicolas Ferre Signed-off-by: David S. Miller commit e100a897bf9b19089e57f236f2398c9e0538900e Author: Anssi Hannula Date: Mon Dec 17 15:05:39 2018 +0200 net: macb: fix random memory corruption on RX with 64-bit DMA 64-bit DMA addresses are split in upper and lower halves that are written in separate fields on GEM. For RX, bit 0 of the address is used as the ownership bit (RX_USED). When the RX_USED bit is unset the controller is allowed to write data to the buffer. The driver does not guarantee that the controller already sees the upper half when the RX_USED bit is cleared, possibly resulting in the controller writing an incoming frame to an address with an incorrect upper half and therefore possibly corrupting unrelated system memory. Fix that by adding the necessary DMA memory barrier between the writes. This corruption was observed on a ZynqMP based system. Fixes: fff8019a08b6 ("net: macb: Add 64 bit addressing support for GEM") Signed-off-by: Anssi Hannula Acked-by: Harini Katakam Tested-by: Claudiu Beznea Cc: Nicolas Ferre Cc: Michal Simek Signed-off-by: David S. Miller commit e2c4cf7f98a519eb4d95532bfa06bcaf3562fed5 Author: Davide Caratti Date: Mon Dec 17 11:26:38 2018 +0100 net: Use __kernel_clockid_t in uapi net_stamp.h Herton reports the following error when building a userspace program that includes net_stamp.h: In file included from foo.c:2: /usr/include/linux/net_tstamp.h:158:2: error: unknown type name ‘clockid_t’ clockid_t clockid; /* reference clockid */ ^~~~~~~~~ Fix it by using __kernel_clockid_t in place of clockid_t. Fixes: 80b14dee2bea ("net: Add a new socket option for a future transmit time.") Cc: Timothy Redaelli Reported-by: Herton R. Krzesinski Signed-off-by: Davide Caratti Tested-by: Paolo Abeni Signed-off-by: David S. Miller commit 4298388574dae6168fa8940b3edc7ba965e8a7ab Author: Claudiu Beznea Date: Mon Dec 17 10:02:42 2018 +0000 net: macb: restart tx after tx used bit read On some platforms (currently detected only on SAMA5D4) TX might stuck even the pachets are still present in DMA memories and TX start was issued for them. This happens due to race condition between MACB driver updating next TX buffer descriptor to be used and IP reading the same descriptor. In such a case, the "TX USED BIT READ" interrupt is asserted. GEM/MACB user guide specifies that if a "TX USED BIT READ" interrupt is asserted TX must be restarted. Restart TX if used bit is read and packets are present in software TX queue. Packets are removed from software TX queue if TX was successful for them (see macb_tx_interrupt()). Signed-off-by: Claudiu Beznea Acked-by: Nicolas Ferre Signed-off-by: David S. Miller commit 62393dbcbe0f3001691e4bd479a25beb5941f2ed Merge: e738441e803d 98256376f81a Author: Linus Torvalds Date: Tue Dec 18 15:47:40 2018 -0800 Merge tag 'for-linus-20181218' of git://git.kernel.dk/linux-block Pull block fix from Jens Axboe: "Correct an ioctl direction for the zoned ioctls" * tag 'for-linus-20181218' of git://git.kernel.dk/linux-block: uapi: linux/blkzoned.h: fix BLKGETZONESZ and BLKGETNRZONES definitions commit e738441e803db6b61d5119df8f758396914fafd8 Merge: ddfbab46539f 1063a5148ac9 Author: Linus Torvalds Date: Tue Dec 18 15:45:38 2018 -0800 Merge tag 'pci-v4.20-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fix from Bjorn Helgaas: "Fix the ACPI APEI error path, which previously queued several uninitialized events (Yanjiang Jin)" * tag 'pci-v4.20-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI/AER: Queue one GHES event, not several uninitialized ones commit b26322d2ac6c1c1087af73856531bb836f6963ca Author: Dan Carpenter Date: Mon Dec 17 11:06:06 2018 +0300 net: stmmac: Fix an error code in probe() The function should return an error if create_singlethread_workqueue() fails. Fixes: 34877a15f787 ("net: stmmac: Rework and fix TX Timeout code") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller commit 3c6306d44082ef007a258ae1b86ea58e6974ee3f Author: Cong Wang Date: Sun Dec 16 23:25:12 2018 -0800 tipc: check group dests after tipc_wait_for_cond() Similar to commit 143ece654f9f ("tipc: check tsk->group in tipc_wait_for_cond()") we have to reload grp->dests too after we re-take the sock lock. This means we need to move the dsts check after tipc_wait_for_cond() too. Fixes: 75da2163dbb6 ("tipc: introduce communication groups") Reported-and-tested-by: syzbot+99f20222fc5018d2b97a@syzkaller.appspotmail.com Cc: Ying Xue Cc: Jon Maloy Signed-off-by: Cong Wang Acked-by: Jon Maloy Signed-off-by: David S. Miller commit f07d4276892d97671e880190ff195a288b2d8d92 Author: Dan Carpenter Date: Mon Dec 17 10:05:13 2018 +0300 qed: Fix an error code qed_ll2_start_xmit() We accidentally deleted the code to set "rc = -ENOMEM;" and this patch adds it back. Fixes: d2201a21598a ("qed: No need for LL2 frags indication") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller commit 32043fa065b51e0b1433e48d118821c71b5cd65d Author: Colin Ian King Date: Tue Dec 18 17:29:56 2018 +0000 x86/mtrr: Don't copy uninitialized gentry fields back to userspace Currently the copy_to_user of data in the gentry struct is copying uninitiaized data in field _pad from the stack to userspace. Fix this by explicitly memset'ing gentry to zero, this also will zero any compiler added padding fields that may be in struct (currently there are none). Detected by CoverityScan, CID#200783 ("Uninitialized scalar variable") Fixes: b263b31e8ad6 ("x86, mtrr: Use explicit sizing and padding for the 64-bit ioctls") Signed-off-by: Colin Ian King Signed-off-by: Thomas Gleixner Reviewed-by: Tyler Hicks Cc: security@kernel.org Link: https://lkml.kernel.org/r/20181218172956.1440-1-colin.king@canonical.com commit 006791772084383de779ef29f2e06f3a6e111e7d Author: Antoine Tenart Date: Tue Dec 11 17:32:28 2018 +0100 net: mvpp2: 10G modes aren't supported on all ports The mvpp2_phylink_validate() function sets all modes that are supported by a given PPv2 port. A recent change made all ports to advertise they support 10G modes in certain cases. This is not true, as only the port #0 can do so. This patch fixes it. Fixes: 01b3fd5ac97c ("net: mvpp2: fix detection of 10G SFP modules") Cc: Baruch Siach Signed-off-by: Antoine Tenart Signed-off-by: David S. Miller commit da791a667536bf8322042e38ca85d55a78d3c273 Author: Thomas Gleixner Date: Mon Dec 10 14:35:14 2018 +0100 futex: Cure exit race Stefan reported, that the glibc tst-robustpi4 test case fails occasionally. That case creates the following race between sys_exit() and sys_futex_lock_pi(): CPU0 CPU1 sys_exit() sys_futex() do_exit() futex_lock_pi() exit_signals(tsk) No waiters: tsk->flags |= PF_EXITING; *uaddr == 0x00000PID mm_release(tsk) Set waiter bit exit_robust_list(tsk) { *uaddr = 0x80000PID; Set owner died attach_to_pi_owner() { *uaddr = 0xC0000000; tsk = get_task(PID); } if (!tsk->flags & PF_EXITING) { ... attach(); tsk->flags |= PF_EXITPIDONE; } else { if (!(tsk->flags & PF_EXITPIDONE)) return -EAGAIN; return -ESRCH; <--- FAIL } ESRCH is returned all the way to user space, which triggers the glibc test case assert. Returning ESRCH unconditionally is wrong here because the user space value has been changed by the exiting task to 0xC0000000, i.e. the FUTEX_OWNER_DIED bit is set and the futex PID value has been cleared. This is a valid state and the kernel has to handle it, i.e. taking the futex. Cure it by rereading the user space value when PF_EXITING and PF_EXITPIDONE is set in the task which 'owns' the futex. If the value has changed, let the kernel retry the operation, which includes all regular sanity checks and correctly handles the FUTEX_OWNER_DIED case. If it hasn't changed, then return ESRCH as there is no way to distinguish this case from malfunctioning user space. This happens when the exiting task did not have a robust list, the robust list was corrupted or the user space value in the futex was simply bogus. Reported-by: Stefan Liebler Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra Cc: Heiko Carstens Cc: Darren Hart Cc: Ingo Molnar Cc: Sasha Levin Cc: stable@vger.kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=200467 Link: https://lkml.kernel.org/r/20181210152311.986181245@linutronix.de commit 0e1b869fff60c81b510c2d00602d778f8f59dd9a Author: Eduardo Habkost Date: Mon Dec 17 22:34:18 2018 -0200 kvm: x86: Add AMD's EX_CFG to the list of ignored MSRs Some guests OSes (including Windows 10) write to MSR 0xc001102c on some cases (possibly while trying to apply a CPU errata). Make KVM ignore reads and writes to that MSR, so the guest won't crash. The MSR is documented as "Execution Unit Configuration (EX_CFG)", at AMD's "BIOS and Kernel Developer's Guide (BKDG) for AMD Family 15h Models 00h-0Fh Processors". Cc: stable@vger.kernel.org Signed-off-by: Eduardo Habkost Signed-off-by: Paolo Bonzini commit dcbd3e49c2f0b2c2d8a321507ff8f3de4af76d7c Author: Wanpeng Li Date: Mon Dec 17 10:43:23 2018 +0800 KVM: X86: Fix NULL deref in vcpu_scan_ioapic Reported by syzkaller: CPU: 1 PID: 5962 Comm: syz-executor118 Not tainted 4.20.0-rc6+ #374 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:kvm_apic_hw_enabled arch/x86/kvm/lapic.h:169 [inline] RIP: 0010:vcpu_scan_ioapic arch/x86/kvm/x86.c:7449 [inline] RIP: 0010:vcpu_enter_guest arch/x86/kvm/x86.c:7602 [inline] RIP: 0010:vcpu_run arch/x86/kvm/x86.c:7874 [inline] RIP: 0010:kvm_arch_vcpu_ioctl_run+0x5296/0x7320 arch/x86/kvm/x86.c:8074 Call Trace: kvm_vcpu_ioctl+0x5c8/0x1150 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2596 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:509 [inline] do_vfs_ioctl+0x1de/0x1790 fs/ioctl.c:696 ksys_ioctl+0xa9/0xd0 fs/ioctl.c:713 __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl fs/ioctl.c:718 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe The reason is that the testcase writes hyperv synic HV_X64_MSR_SINT14 msr and triggers scan ioapic logic to load synic vectors into EOI exit bitmap. However, irqchip is not initialized by this simple testcase, ioapic/apic objects should not be accessed. This patch fixes it by also considering whether or not apic is present. Reported-by: syzbot+39810e6c400efadfef71@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Cc: Paolo Bonzini Cc: Radim Krčmář Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini commit c2dd5146e9fe1f22c77c1b011adf84eea0245806 Author: Cfir Cohen Date: Tue Dec 18 08:18:41 2018 -0800 KVM: Fix UAF in nested posted interrupt processing nested_get_vmcs12_pages() processes the posted_intr address in vmcs12. It caches the kmap()ed page object and pointer, however, it doesn't handle errors correctly: it's possible to cache a valid pointer, then release the page and later dereference the dangling pointer. I was able to reproduce with the following steps: 1. Call vmlaunch with valid posted_intr_desc_addr but an invalid MSR_EFER. This causes nested_get_vmcs12_pages() to cache the kmap()ed pi_desc_page and pi_desc. Later the invalid EFER value fails check_vmentry_postreqs() which fails the first vmlaunch. 2. Call vmlanuch with a valid EFER but an invalid posted_intr_desc_addr (I set it to 2G - 0x80). The second time we call nested_get_vmcs12_pages pi_desc_page is unmapped and released and pi_desc_page is set to NULL (the "shouldn't happen" clause). Due to the invalid posted_intr_desc_addr, kvm_vcpu_gpa_to_page() fails and nested_get_vmcs12_pages() returns. It doesn't return an error value so vmlaunch proceeds. Note that at this time we have a dangling pointer in vmx->nested.pi_desc and POSTED_INTR_DESC_ADDR in L0's vmcs. 3. Issue an IPI in L2 guest code. This triggers a call to vmx_complete_nested_posted_interrupt() and pi_test_and_clear_on() which dereferences the dangling pointer. Vulnerable code requires nested and enable_apicv variables to be set to true. The host CPU must also support posted interrupts. Fixes: 5e2f30b756a37 "KVM: nVMX: get rid of nested_get_page()" Cc: stable@vger.kernel.org Reviewed-by: Andy Honig Signed-off-by: Cfir Cohen Reviewed-by: Liran Alon Signed-off-by: Paolo Bonzini commit 987d1149be7ddcc1380ff946cf236874421a7e1b Author: Eric Biggers Date: Mon Dec 17 09:36:19 2018 -0800 KVM: fix unregistering coalesced mmio zone from wrong bus If you register a kvm_coalesced_mmio_zone with '.pio = 0' but then unregister it with '.pio = 1', KVM_UNREGISTER_COALESCED_MMIO will try to unregister it from KVM_PIO_BUS rather than KVM_MMIO_BUS, which is a no-op. But it frees the kvm_coalesced_mmio_dev anyway, causing a use-after-free. Fix it by only unregistering and freeing the zone if the correct value of 'pio' is provided. Reported-by: syzbot+f87f60bb6f13f39b54e3@syzkaller.appspotmail.com Fixes: 0804c849f1df ("kvm/x86 : add coalesced pio support") Signed-off-by: Eric Biggers Signed-off-by: Paolo Bonzini commit a915b982d8f5e4295f64b8dd37ce753874867e88 Author: Jorgen Hansen Date: Tue Dec 18 00:34:06 2018 -0800 VSOCK: Send reset control packet when socket is partially bound If a server side socket is bound to an address, but not in the listening state yet, incoming connection requests should receive a reset control packet in response. However, the function used to send the reset silently drops the reset packet if the sending socket isn't bound to a remote address (as is the case for a bound socket not yet in the listening state). This change fixes this by using the src of the incoming packet as destination for the reset packet in this case. Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Reviewed-by: Adit Ranadive Reviewed-by: Vishnu Dasa Signed-off-by: Jorgen Hansen Signed-off-by: David S. Miller commit fde9cd69a59f7ee405c87fff84bc08fa2a550e47 Merge: 8d013b791059 4a135e538962 Author: David S. Miller Date: Tue Dec 18 11:43:26 2018 -0800 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2018-12-18 1) Fix error return code in xfrm_output_one() when no dst_entry is attached to the skb. From Wei Yongjun. 2) The xfrm state hash bucket count reported to userspace is off by one. Fix from Benjamin Poirier. 3) Fix NULL pointer dereference in xfrm_input when skb_dst_force clears the dst_entry. 4) Fix freeing of xfrm states on acquire. We use a dedicated slab cache for the xfrm states now, so free it properly with kmem_cache_free. From Mathias Krause. Please pull or let me know if there are problems. ==================== Signed-off-by: David S. Miller commit ddfbab46539f2d37a9e9d357b054486b51f7dc27 Merge: 1a9430db2835 60a89a3ce0cc Author: Linus Torvalds Date: Tue Dec 18 09:38:34 2018 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Three fixes: The t10-pi one is a regression from the 4.19 release, the qla2xxx one is a 4.20 merge window regression and the bnx2fc is a very old bug" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: t10-pi: Return correct ref tag when queue has no integrity profile scsi: bnx2fc: Fix NULL dereference in error handling Revert "scsi: qla2xxx: Fix NVMe Target discovery" commit 8d013b7910599a06405fb37d6def4dde7cab7984 Merge: a5f3932646a7 5edb7e8bd52c Author: David S. Miller Date: Tue Dec 18 09:17:39 2018 -0800 Merge branch 'mlxsw-VXLAN-and-firmware-flashing-fixes' Ido Schimmel says: ==================== mlxsw: VXLAN and firmware flashing fixes Patch #1 fixes firmware flashing failures by increasing the time period after which the driver fails the transaction with the firmware. The problem is explained in detail in the commit message. Patch #2 adds a missing trap for decapsulated ARP packets. It is necessary for VXLAN routing to work. Patch #3 fixes a memory leak during driver reload caused by NULLing a pointer before kfree(). Please consider patch #1 for 4.19.y ==================== Signed-off-by: David S. Miller commit 5edb7e8bd52cd79634d1d7fbc97c5960a21b2873 Author: Ido Schimmel Date: Tue Dec 18 15:59:23 2018 +0000 mlxsw: spectrum_nve: Fix memory leak upon driver reload The pointer was NULLed before freeing the memory, resulting in a memory leak. Trace from kmemleak: unreferenced object 0xffff88820ae36528 (size 512): comm "devlink", pid 5374, jiffies 4295354033 (age 10829.296s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000a43f5195>] kmem_cache_alloc_trace+0x1be/0x330 [<00000000312f8140>] mlxsw_sp_nve_init+0xcb/0x1ae0 [<0000000009201d22>] mlxsw_sp_init+0x1382/0x2690 [<000000007227d877>] mlxsw_sp1_init+0x1b5/0x260 [<000000004a16feec>] __mlxsw_core_bus_device_register+0x776/0x1360 [<0000000070ab954c>] mlxsw_devlink_core_bus_device_reload+0x129/0x220 [<00000000432313d5>] devlink_nl_cmd_reload+0x119/0x1e0 [<000000003821a06b>] genl_family_rcv_msg+0x813/0x1150 [<00000000d54d04c0>] genl_rcv_msg+0xd1/0x180 [<0000000040543d12>] netlink_rcv_skb+0x152/0x3c0 [<00000000efc4eae8>] genl_rcv+0x2d/0x40 [<00000000ea645603>] netlink_unicast+0x52f/0x740 [<00000000641fca1a>] netlink_sendmsg+0x9c7/0xf50 [<00000000fed4a4b8>] sock_sendmsg+0xbe/0x120 [<00000000d85795a9>] __sys_sendto+0x397/0x620 [<00000000c5f84622>] __x64_sys_sendto+0xe6/0x1a0 Fixes: 6e6030bd5412 ("mlxsw: spectrum_nve: Implement common NVE core") Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller commit 5d5043917a28438df163c4e6e56e77ef6d981089 Author: Ido Schimmel Date: Tue Dec 18 15:59:22 2018 +0000 mlxsw: spectrum: Add trap for decapsulated ARP packets After a packet was decapsulated it is classified to the relevant FID based on its VNI and undergoes L2 forwarding. Unlike regular (non-encapsulated) ARP packets, Spectrum does not trap decapsulated ARP packets during L2 forwarding and instead can only trap such packets in the underlay router during decapsulation. Add this missing packet trap, which is required for VXLAN routing when the MAC of the target host is not known. Fixes: b02597d513a9 ("mlxsw: spectrum: Add NVE packet traps") Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller commit cf0b70e71b32137ccf9c1f3dd9fb30cbf89b4322 Author: Shalom Toledo Date: Tue Dec 18 15:59:20 2018 +0000 mlxsw: core: Increase timeout during firmware flash process During the firmware flash process, some of the EMADs get timed out, which causes the driver to send them again with a limit of 5 retries. There are some situations in which 5 retries is not enough and the EMAD access fails. If the failed EMAD was related to the flashing process, the driver fails the flashing. The reason for these timeouts during firmware flashing is cache misses in the CPU running the firmware. In case the CPU needs to fetch instructions from the flash when a firmware is flashed, it needs to wait for the flashing to complete. Since flashing takes time, it is possible for pending EMADs to timeout. Fix by increasing EMADs' timeout while flashing firmware. Fixes: ce6ef68f433f ("mlxsw: spectrum: Implement the ethtool flash_device callback") Signed-off-by: Shalom Toledo Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit abc13275771fac77e2d7b129c289522dacb644b6 Author: Trond Myklebust Date: Mon Dec 17 17:33:33 2018 -0500 SUNRPC: Remove xprt_connect_status() Over the years, xprt_connect_status() has been superseded by call_connect_status(), which now handles all the errors that xprt_connect_status() does and more. Since the latter converts all errors that it doesn't recognise to EIO, then it is time for it to be retired. Reported-by: Chuck Lever Signed-off-by: Trond Myklebust Tested-by: Chuck Lever commit cf76785d30712d90185455e752337acdb53d2a5d Author: Trond Myklebust Date: Mon Dec 17 17:38:51 2018 -0500 SUNRPC: Fix a race with XPRT_CONNECTING Ensure that we clear XPRT_CONNECTING before releasing the XPRT_LOCK so that we don't have races between the (asynchronous) socket setup code and tasks in xprt_connect(). Signed-off-by: Trond Myklebust Tested-by: Chuck Lever commit 0445f92c5d537c173a54446b80d2052145de5148 Author: Trond Myklebust Date: Mon Dec 17 13:34:59 2018 -0500 SUNRPC: Fix disconnection races When the socket is closed, we need to call xprt_disconnect_done() in order to clean up the XPRT_WRITE_SPACE flag, and wake up the sleeping tasks. However, we also want to ensure that we don't wake them up before the socket is closed, since that would cause thundering herd issues with everyone piling up to retransmit before the TCP shutdown dance has completed. Only the task that holds XPRT_LOCKED needs to wake up early in order to allow the close to complete. Reported-by: Dave Wysochanski Reported-by: Scott Mayhew Cc: Chuck Lever Signed-off-by: Trond Myklebust Tested-by: Chuck Lever commit 87ab4689ca6526079ab6f5150219ee88b42000ae Author: Chang S. Bae Date: Mon Nov 26 11:55:24 2018 -0800 x86/fsgsbase/64: Fix the base write helper functions Andy spotted a regression in the fs/gs base helpers after the patch series was committed. The helper functions which write fs/gs base are not just writing the base, they are also changing the index. That's wrong and needs to be separated because writing the base has not to modify the index. While the regression is not causing any harm right now because the only caller depends on that behaviour, it's a guarantee for subtle breakage down the road. Make the index explicitly changed from the caller, instead of including the code in the helpers. Subsequently, the task write helpers do not handle for the current task anymore. The range check for a base value is also factored out, to minimize code redundancy from the caller. Fixes: b1378a561fd1 ("x86/fsgsbase/64: Introduce FS/GS base helper functions") Suggested-by: Andy Lutomirski Signed-off-by: Chang S. Bae Signed-off-by: Thomas Gleixner Reviewed-by: Andy Lutomirski Cc: "H . Peter Anvin" Cc: Andi Kleen Cc: Dave Hansen Cc: Ravi Shankar Cc: H. Peter Anvin Link: https://lkml.kernel.org/r/20181126195524.32179-1-chang.seok.bae@intel.com commit a50e5fb8db83c5b57392204c21ea6c5c4ccefde6 Author: Sara Sharon Date: Sat Dec 15 11:03:10 2018 +0200 mac80211: fix a kernel panic when TXing after TXQ teardown Recently TXQ teardown was moved earlier in ieee80211_unregister_hw(), to avoid a use-after-free of the netdev data. However, interfaces aren't fully removed at the point, and cfg80211_shutdown_all_interfaces can for example, TX a deauth frame. Move the TXQ teardown to the point between cfg80211_shutdown_all_interfaces and the free of netdev queues, so we can be sure they are torn down before netdev is freed, but after there is no ongoing TX. Fixes: 77cfaf52eca5 ("mac80211: Run TXQ teardown code before de-registering interfaces") Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg commit a5f3932646a74e690ed532a1f421f75c3b8cf1ec Author: Vivien Didelot Date: Mon Dec 17 16:05:21 2018 -0500 net: dsa: mv88e6xxx: set ethtool regs version Currently the ethtool_regs version is set to 0 for all DSA drivers. Use this field to store the chip ID to simplify the pretty dump of any interfaces registered by the "dsa" driver. Signed-off-by: Vivien Didelot Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit b33299017ca7a303fa650e007ebfbcf57527fc8c Merge: 255fe81a6ad4 8f932f762e79 Author: David S. Miller Date: Mon Dec 17 23:27:01 2018 -0800 Merge branch 'net-SO_TIMESTAMPING-fixes' Willem de Bruijn says: ==================== net: SO_TIMESTAMPING fixes Fix two omissions: - tx timestamping is missing for AF_INET6/SOCK_RAW/IPPROTO_RAW - SOF_TIMESTAMPING_OPT_ID is missing for IPPROTO_RAW, PF_PACKET, CAN Discovered while expanding the selftest in tools/testing/selftests/networking/timestamping/txtimestamp.c Will send the test patchset to net-next once the fixes make it to that branch. For now, it is available at https://github.com/wdebruij/linux/commits/txtimestamp-test-1 ==================== Signed-off-by: David S. Miller commit 8f932f762e7928d250e21006b00ff9b7718b0a64 Author: Willem de Bruijn Date: Mon Dec 17 12:24:00 2018 -0500 net: add missing SOF_TIMESTAMPING_OPT_ID support SOF_TIMESTAMPING_OPT_ID is supported on TCP, UDP and RAW sockets. But it was missing on RAW with IPPROTO_IP, PF_PACKET and CAN. Add skb_setup_tx_timestamp that configures both tx_flags and tskey for these paths that do not need corking or use bytestream keys. Fixes: 09c2d251b707 ("net-timestamp: add key to disambiguate concurrent datagrams") Signed-off-by: Willem de Bruijn Acked-by: Soheil Hassas Yeganeh Signed-off-by: David S. Miller commit fbfb2321e950918b430e7225546296b2dcadf725 Author: Willem de Bruijn Date: Mon Dec 17 12:23:59 2018 -0500 ipv6: add missing tx timestamping on IPPROTO_RAW Raw sockets support tx timestamping, but one case is missing. IPPROTO_RAW takes a separate packet construction path. raw_send_hdrinc has an explicit call to sock_tx_timestamp, but rawv6_send_hdrinc does not. Add it. Fixes: 11878b40ed5c ("net-timestamp: SOCK_RAW and PING timestamping") Signed-off-by: Willem de Bruijn Acked-by: Soheil Hassas Yeganeh Signed-off-by: David S. Miller commit 1a9430db2835c0c00acc87d915b573496998c1bf Author: Mimi Zohar Date: Mon Dec 17 19:14:49 2018 -0500 ima: cleanup the match_token policy code Start the policy_tokens and the associated enumeration from zero, simplifying the pt macro. Signed-off-by: Mimi Zohar Signed-off-by: Linus Torvalds commit 94c13f66e13ca0f3d5b7b9e7e385fe5db35abe3c Author: Linus Torvalds Date: Mon Dec 17 11:39:57 2018 -0800 security: don't use a negative Opt_err token index The code uses a bitmap to check for duplicate tokens during parsing, and that doesn't work at all for the negative Opt_err token case. There is absolutely no reason to make Opt_err be negative, and in fact it only confuses things, since some of the affected functions actually return a positive Opt_xyz enum _or_ a regular negative error code (eg -EINVAL), and using -1 for Opt_err makes no sense. There are similar problems in ima_policy.c and key encryption, but they don't have the immediate bug wrt bitmap handing, and ima_policy.c in particular needs a different patch to make the enum values match the token array index. Mimi is sending that separately. Reported-by: syzbot+a22e0dc07567662c50bc@syzkaller.appspotmail.com Reported-by: Eric Biggers Fixes: 5208cc83423d ("keys, trusted: fix: *do not* allow duplicate key options") Fixes: 00d60fd3b932 ("KEYS: Provide keyctls to drive the new key type ops for asymmetric keys [ver #2]") Cc: James Morris James Morris Cc: Mimi Zohar Cc: Jarkko Sakkinen Cc: Peter Huewe Signed-off-by: Linus Torvalds commit 255fe81a6ad420258b6dac8c509c99cd1c233390 Author: Vivien Didelot Date: Mon Dec 17 16:29:01 2018 -0500 MAINTAINERS: change my email address Make my Gmail address the primary one from now on. Signed-off-by: Vivien Didelot Signed-off-by: David S. Miller commit bcb671c2fa0e238eea087fdcb7eba72376ba3697 Author: Masahiro Yamada Date: Mon Dec 17 00:04:40 2018 +0900 bpf: promote bpf_perf_event.h to mandatory UAPI header Since commit c895f6f703ad ("bpf: correct broken uapi for BPF_PROG_TYPE_PERF_EVENT program type"), all architectures (except um) are required to have bpf_perf_event.h in uapi/asm. Add it to mandatory-y so "make headers_install" can check it. Signed-off-by: Masahiro Yamada Signed-off-by: Daniel Borkmann commit 721066dfd4d5c0fee5772c777d6930d0f423b4eb Author: Peter Zijlstra Date: Mon Dec 3 18:03:44 2018 +0100 x86/mm/cpa: Fix cpa_flush_array() TLB invalidation In commit: a7295fd53c39 ("x86/mm/cpa: Use flush_tlb_kernel_range()") I misread the CAP array code and incorrectly used tlb_flush_kernel_range(), resulting in missing TLB flushes and consequent failures. Instead do a full invalidate in this case -- for now. Reported-by: StDenis, Tom Signed-off-by: Peter Zijlstra (Intel) Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Dave Hansen Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Rik van Riel Cc: Thomas Gleixner Cc: dave.hansen@intel.com Fixes: a7295fd53c39 ("x86/mm/cpa: Use flush_tlb_kernel_range()") Link: http://lkml.kernel.org/r/20181203171043.089868285@infradead.org Signed-off-by: Ingo Molnar commit c92a54cfa0257e8ffd66b2a17d49e9c0bd4b769f Author: Lendacky, Thomas Date: Mon Dec 17 14:39:16 2018 +0000 dma-direct: do not include SME mask in the DMA supported check The dma_direct_supported() function intends to check the DMA mask against specific values. However, the phys_to_dma() function includes the SME encryption mask, which defeats the intended purpose of the check. This results in drivers that support less than 48-bit DMA (SME encryption mask is bit 47) from being able to set the DMA mask successfully when SME is active, which results in the driver failing to initialize. Change the function used to check the mask from phys_to_dma() to __phys_to_dma() so that the SME encryption mask is not part of the check. Fixes: c1d0af1a1d5d ("kernel/dma/direct: take DMA offset into account in dma_direct_supported") Signed-off-by: Tom Lendacky Signed-off-by: Christoph Hellwig commit 0e334db6bb4b1fd1e2d72c1f3d8f004313cd9f94 Author: Thomas Gleixner Date: Mon Dec 17 13:31:05 2018 +0100 posix-timers: Fix division by zero bug The signal delivery path of posix-timers can try to rearm the timer even if the interval is zero. That's handled for the common case (hrtimer) but not for alarm timers. In that case the forwarding function raises a division by zero exception. The handling for hrtimer based posix timers is wrong because it marks the timer as active despite the fact that it is stopped. Move the check from common_hrtimer_rearm() to posixtimer_rearm() to cure both issues. Reported-by: syzbot+9d38bedac9cc77b8ad5e@syzkaller.appspotmail.com Signed-off-by: Thomas Gleixner Cc: John Stultz Cc: Linus Torvalds Cc: Peter Zijlstra Cc: sboyd@kernel.org Cc: stable@vger.kernel.org Cc: syzkaller-bugs@googlegroups.com Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1812171328050.1880@nanos.tec.linutronix.de Signed-off-by: Ingo Molnar commit 3c9dc275dba1124c1e16e7037226038451286813 Author: Paul Burton Date: Sun Dec 16 20:10:01 2018 +0000 Revert "serial: 8250: Fix clearing FIFOs in RS485 mode again" Commit f6aa5beb45be ("serial: 8250: Fix clearing FIFOs in RS485 mode again") makes a change to FIFO clearing code which its commit message suggests was intended to be specific to use with RS485 mode, however: 1) The change made does not just affect __do_stop_tx_rs485(), it also affects other uses of serial8250_clear_fifos() including paths for starting up, shutting down or auto-configuring a port regardless of whether it's an RS485 port or not. 2) It makes the assumption that resetting the FIFOs is a no-op when FIFOs are disabled, and as such it checks for this case & explicitly avoids setting the FIFO reset bits when the FIFO enable bit is clear. A reading of the PC16550D manual would suggest that this is OK since the FIFO should automatically be reset if it is later enabled, but we support many 16550-compatible devices and have never required this auto-reset behaviour for at least the whole git era. Starting to rely on it now seems risky, offers no benefit, and indeed breaks at least the Ingenic JZ4780's UARTs which reads garbage when the RX FIFO is enabled if we don't explicitly reset it. 3) By only resetting the FIFOs if they're enabled, the behaviour of serial8250_do_startup() during boot now depends on what the value of FCR is before the 8250 driver is probed. This in itself seems questionable and leaves us with FCR=0 & no FIFO reset if the UART was used by 8250_early, otherwise it depends upon what the bootloader left behind. 4) Although the naming of serial8250_clear_fifos() may be unclear, it is clear that callers of it expect that it will disable FIFOs. Both serial8250_do_startup() & serial8250_do_shutdown() contain comments to that effect, and other callers explicitly re-enable the FIFOs after calling serial8250_clear_fifos(). The premise of that patch that disabling the FIFOs is incorrect therefore seems wrong. For these reasons, this reverts commit f6aa5beb45be ("serial: 8250: Fix clearing FIFOs in RS485 mode again"). Signed-off-by: Paul Burton Fixes: f6aa5beb45be ("serial: 8250: Fix clearing FIFOs in RS485 mode again"). Cc: Greg Kroah-Hartman Cc: Daniel Jedrychowski Cc: Marek Vasut Cc: linux-mips@vger.kernel.org Cc: linux-serial@vger.kernel.org Cc: stable # 4.10+ Signed-off-by: Greg Kroah-Hartman commit 2419f30a4a4fcaa5f35111563b4c61f1b2b26841 Author: Nicolas Saenz Julienne Date: Mon Dec 17 14:37:40 2018 +0100 USB: xhci: fix 'broken_suspend' placement in struct xchi_hcd As commented in the struct's definition there shouldn't be anything underneath its 'priv[0]' member as it would break some macros. The patch converts the broken_suspend into a bit-field and relocates it next to to the rest of bit-fields. Fixes: a7d57abcc8a5 ("xhci: workaround CSS timeout on AMD SNPS 3.0 xHC") Reported-by: Oliver Neukum Signed-off-by: Nicolas Saenz Julienne Acked-by: Mathias Nyman Cc: stable Signed-off-by: Greg Kroah-Hartman commit eca1e56ceedd9cc185eb18baf307d3ff2e4af376 Author: Emmanuel Grumbach Date: Fri Dec 14 18:30:22 2018 +0200 iwlwifi: mvm: don't send GEO_TX_POWER_LIMIT to old firmwares Old firmware versions don't support this command. Sending it to any firmware before -41.ucode will crash the firmware. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=201975 Fixes: 66e839030fd6 ("iwlwifi: fix wrong WGDS_WIFI_DATA_SIZE") CC: #4.19+ Signed-off-by: Emmanuel Grumbach Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo commit e3ae3401aa19432ee4943eb0bbc2ec704d07d793 Author: Ulf Hansson Date: Mon Dec 10 17:52:38 2018 +0100 mmc: core: Use a minimum 1600ms timeout when enabling CACHE ctrl Some eMMCs from Micron have been reported to need ~800 ms timeout, while enabling the CACHE ctrl after running sudden power failure tests. The needed timeout is greater than what the card specifies as its generic CMD6 timeout, through the EXT_CSD register, hence the problem. Normally we would introduce a card quirk to extend the timeout for these specific Micron cards. However, due to the rather complicated debug process needed to find out the error, let's simply use a minimum timeout of 1600ms, the double of what has been reported, for all cards when enabling CACHE ctrl. Reported-by: Sjoerd Simons Reported-by: Andreas Dannenberg Reported-by: Faiz Abbas Cc: Signed-off-by: Ulf Hansson commit ba9f39a785a9977e72233000711ef1eb48203551 Author: Ulf Hansson Date: Mon Dec 10 17:52:37 2018 +0100 mmc: core: Allow BKOPS and CACHE ctrl even if no HPI support In commit 5320226a0512 ("mmc: core: Disable HPI for certain Hynix eMMC cards"), then intent was to prevent HPI from being used for some eMMC cards, which didn't properly support it. However, that went too far, as even BKOPS and CACHE ctrl became prevented. Let's restore those parts and allow BKOPS and CACHE ctrl even if HPI isn't supported. Fixes: 5320226a0512 ("mmc: core: Disable HPI for certain Hynix eMMC cards") Cc: Pratibhasagar V Cc: Signed-off-by: Ulf Hansson commit a0741ba40a009f97c019ae7541dc61c1fdf41efb Author: Ulf Hansson Date: Mon Dec 10 17:52:36 2018 +0100 mmc: core: Reset HPI enabled state during re-init and in case of errors During a re-initialization of the eMMC card, we may fail to re-enable HPI. In these cases, that isn't properly reflected in the card->ext_csd.hpi_en bit, as it keeps being set. This may cause following attempts to use HPI, even if's not enabled. Let's fix this! Fixes: eb0d8f135b67 ("mmc: core: support HPI send command") Cc: Signed-off-by: Ulf Hansson commit 0b479790684192ab7024ce6a621f93f6d0a64d92 Author: Russell King Date: Tue Dec 11 14:41:31 2018 +0000 mmc: omap_hsmmc: fix DMA API warning While booting with rootfs on MMC, the following warning is encountered on OMAP4430: omap-dma-engine 4a056000.dma-controller: DMA-API: mapping sg segment longer than device claims to support [len=69632] [max=65536] This is because the DMA engine has a default maximum segment size of 64K but HSMMC sets: mmc->max_blk_size = 512; /* Block Length at max can be 1024 */ mmc->max_blk_count = 0xFFFF; /* No. of Blocks is 16 bits */ mmc->max_req_size = mmc->max_blk_size * mmc->max_blk_count; mmc->max_seg_size = mmc->max_req_size; which ends up telling the block layer that we support a maximum segment size of 65535*512, which exceeds the advertised DMA engine capabilities. Fix this by clamping the maximum segment size to the lower of the maximum request size and of the DMA engine device used for either DMA channel. Signed-off-by: Russell King Cc: Signed-off-by: Ulf Hansson commit 5ccf7f5505f4c250b97d8d7ecee7397a94b637fa Author: Sowjanya Komatineni Date: Thu Dec 13 12:25:43 2018 -0800 mmc: tegra: Fix for SDMMC pads autocal parsing from dt Some of the SDMMC pads auto calibration values parsed from devicetree are assigned incorrectly. This patch fixes it. Signed-off-by: Sowjanya Komatineni Acked-by: Adrian Hunter Acked-by: Thierry Reding Fixes: 51b77c8ea784 ("mmc: tegra: Program pad autocal offsets from dt") Signed-off-by: Ulf Hansson commit 97207c12780d749770825f62c292c3140e57d79c Author: Sowjanya Komatineni Date: Thu Dec 13 12:34:06 2018 -0800 mmc: sdhci: Fix sdhci_do_enable_v4_mode V4_MODE is Bit-15 of SDHCI_HOST_CONTROL2 register. Need to perform word access to this register. Signed-off-by: Sowjanya Komatineni Fixes: b3f80b434f72 ("mmc: sdhci: Add sd host v4 mode") Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit 98256376f81ab7afd8dd233b99c78356159c21d5 Author: Dmitry V. Levin Date: Sun Dec 16 04:49:52 2018 +0300 uapi: linux/blkzoned.h: fix BLKGETZONESZ and BLKGETNRZONES definitions According to the documentation in include/uapi/asm-generic/ioctl.h, _IOW means userspace is writing and kernel is reading, and _IOR means userspace is reading and kernel is writing. In case of these two ioctls, kernel is writing and userspace is reading, so they have to be _IOR instead of _IOW. Fixes: 72cd87576d1d8 ("block: Introduce BLKGETZONESZ ioctl") Fixes: 65e4e3eee83d7 ("block: Introduce BLKGETNRZONES ioctl") Reviewed-by: Damien Le Moal Signed-off-by: Dmitry V. Levin Signed-off-by: Jens Axboe commit 7566ec393f4161572ba6f11ad5171fd5d59b0fbd Author: Linus Torvalds Date: Sun Dec 16 15:46:55 2018 -0800 Linux 4.20-rc7 commit e735fd55b94bb48363737db3b1d57627c1a16b47 Author: Marcin Wojtas Date: Tue Dec 11 13:56:49 2018 +0100 net: mvneta: fix operation for 64K PAGE_SIZE Recent changes in the mvneta driver reworked allocation and handling of the ingress buffers to use entire pages. Apart from that in SW BM scenario the HW must be informed via PRXDQS about the biggest possible incoming buffer that can be propagated by RX descriptors. The BufferSize field was filled according to the MTU-dependent pkt_size value. Later change to PAGE_SIZE broke RX operation when usin 64K pages, as the field is simply too small. This patch conditionally limits the value passed to the BufferSize of the PRXDQS register, depending on the PAGE_SIZE used. On the occasion remove now unused frag_size field of the mvneta_port structure. Fixes: 562e2f467e71 ("net: mvneta: Improve the buffer allocation method for SWBM") Signed-off-by: Marcin Wojtas Signed-off-by: David S. Miller commit 369a094d500fb4962071f2a91793f66cdfef00aa Merge: 8203e2d844d3 6adafc356e20 Author: David S. Miller Date: Sun Dec 16 12:07:32 2018 -0800 Merge branch 'hns-fixes' Peng Li says: ==================== net: hns: Code improvements & fixes for HNS driver This patchset introduces some code improvements and fixes for the identified problems in the HNS driver. Every patch is independent. ==================== Signed-off-by: David S. Miller commit 6adafc356e20189193b38ee6b9af7743078bf6b4 Author: Yonglong Liu Date: Sat Dec 15 11:53:29 2018 +0800 net: hns: Fix ping failed when use net bridge and send multicast Create a net bridge, add eth and vnet to the bridge. The vnet is used by a virtual machine. When ping the virtual machine from the outside host and the virtual machine send multicast at the same time, the ping package will lost. The multicast package send to the eth, eth will send it to the bridge too, and the bridge learn the mac of eth. When outside host ping the virtual mechine, it will match the promisc entry of the eth which is not expected, and the bridge send it to eth not to vnet, cause ping lost. So this patch change promisc tcam entry position to the END of 512 tcam entries, which indicate lower priority. And separate one promisc entry to two: mc & uc, to avoid package match the wrong tcam entry. Signed-off-by: Yonglong Liu Signed-off-by: Peng Li Signed-off-by: David S. Miller commit 726ae5c9e5f0c18eca8ea5296b526242c3e89822 Author: Yonglong Liu Date: Sat Dec 15 11:53:28 2018 +0800 net: hns: Add mac pcs config when enable|disable mac In some case, when mac enable|disable and adjust link, may cause hard to link(or abnormal) between mac and phy. This patch adds the code for rx PCS to avoid this bug. Disable the rx PCS when driver disable the gmac, and enable the rx PCS when driver enable the mac. Signed-off-by: Yonglong Liu Signed-off-by: Peng Li Signed-off-by: David S. Miller commit 7e74a19ca522aec7c2be201a7ae1d1d57ded409b Author: Yonglong Liu Date: Sat Dec 15 11:53:27 2018 +0800 net: hns: Fix ntuple-filters status error. The ntuple-filters features is forced on by chip. But it shows "ntuple-filters: off [fixed]" when use ethtool. This patch make it correct with "ntuple-filters: on [fixed]". Signed-off-by: Yonglong Liu Signed-off-by: Peng Li Signed-off-by: David S. Miller commit a57275d35576fdd89d8c771eedf1e7cf97e0dfa6 Author: Yonglong Liu Date: Sat Dec 15 11:53:26 2018 +0800 net: hns: Avoid net reset caused by pause frames storm There will be a large number of MAC pause frames on the net, which caused tx timeout of net device. And then the net device was reset to try to recover it. So that is not useful, and will cause some other problems. So need doubled ndev->watchdog_timeo if device watchdog occurred until watchdog_timeo up to 40s and then try resetting to recover it. When collecting dfx information such as hardware registers when tx timeout. Some registers for count were cleared when read. So need move this task before update net state which also read the count registers. Signed-off-by: Yonglong Liu Signed-off-by: Peng Li Signed-off-by: David S. Miller commit c82bd077e1ba3dd586569c733dc6d3dd4b0e43cd Author: Yonglong Liu Date: Sat Dec 15 11:53:25 2018 +0800 net: hns: Free irq when exit from abnormal branch 1.In "hns_nic_init_irq", if request irq fail at index i, the function return directly without releasing irq resources that already requested. 2.In "hns_nic_net_up" after "hns_nic_init_irq", if exceptional branch occurs, irqs that already requested are not release. Signed-off-by: Yonglong Liu Signed-off-by: Peng Li Signed-off-by: David S. Miller commit 31f6b61d810654fb3ef43f4d8afda0f44b142fad Author: Yonglong Liu Date: Sat Dec 15 11:53:24 2018 +0800 net: hns: Clean rx fbd when ae stopped. If there are packets in hardware when changing the speed or duplex, it may cause hardware hang up. This patch adds the code to wait rx fbd clean up when ae stopped. Signed-off-by: Yonglong Liu Signed-off-by: Peng Li Signed-off-by: David S. Miller commit 5778b13b64eca5549d242686f2f91a2c80c8fa40 Author: Yonglong Liu Date: Sat Dec 15 11:53:23 2018 +0800 net: hns: Fixed bug that netdev was opened twice After resetting dsaf to try to repair chip error such as ecc error, the net device will be open if net interface is up. But at this time if there is the users set the net device up with the command ifconfig, the net device will be opened twice consecutively. Function napi_enable was called when open device. And Kernel panic will be occurred if it was called twice consecutively. Such as follow: static inline void napi_enable(struct napi_struct *n) { BUG_ON(!test_bit(NAPI_STATE_SCHED, &n->state)); smp_mb__before_clear_bit(); clear_bit(NAPI_STATE_SCHED, &n->state); } [37255.571996] Kernel panic - not syncing: BUG! [37255.595234] Call trace: [37255.597694] [] dump_backtrace+0x0/0x1a0 [37255.603114] [] show_stack+0x20/0x28 [37255.608187] [] dump_stack+0x98/0xb8 [37255.613258] [] panic+0x10c/0x26c [37255.618070] [] hns_nic_net_up+0x30c/0x4e0 [37255.623664] [] hns_nic_net_open+0x94/0x12c [37255.629346] [] __dev_open+0xf4/0x168 [37255.634504] [] __dev_change_flags+0x98/0x15c [37255.640359] [] dev_change_flags+0x2c/0x68 [37255.769580] [] devinet_ioctl+0x650/0x704 [37255.775086] [] inet_ioctl+0x98/0xb4 [37255.780159] [] sock_do_ioctl+0x44/0x84 [37255.785490] [] sock_ioctl+0x248/0x30c [37255.790737] [] do_vfs_ioctl+0x480/0x618 [37255.796156] [] SyS_ioctl+0x90/0xa4 [37255.801139] SMP: stopping secondary CPUs [37255.805079] kbox: catch panic event. [37255.809586] collected_len = 128928, LOG_BUF_LEN_LOCAL = 131072 [37255.816103] flush cache 0xffff80003f000000 size 0x800000 [37255.822192] flush cache 0xffff80003f000000 size 0x800000 [37255.828289] flush cache 0xffff80003f000000 size 0x800000 [37255.834378] kbox: no notify die func register. no need to notify [37255.840413] ---[ end Kernel panic - not syncing: BUG! This patchset fix this bug according to the flag NIC_STATE_DOWN. Signed-off-by: Yonglong Liu Signed-off-by: Peng Li Signed-off-by: David S. Miller commit 4ad26f117b6ea0f5d5f1592127bafb5ec65904d3 Author: Yonglong Liu Date: Sat Dec 15 11:53:22 2018 +0800 net: hns: Some registers use wrong address according to the datasheet. According to the hip06 datasheet: 1.Six registers use wrong address: RCB_COM_SF_CFG_INTMASK_RING RCB_COM_SF_CFG_RING_STS RCB_COM_SF_CFG_RING RCB_COM_SF_CFG_INTMASK_BD RCB_COM_SF_CFG_BD_RINT_STS DSAF_INODE_VC1_IN_PKT_NUM_0_REG 2.The offset of DSAF_INODE_VC1_IN_PKT_NUM_0_REG should be 0x103C + 0x80 * all_chn_num 3.The offset to show the value of DSAF_INODE_IN_DATA_STP_DISC_0_REG is wrong, so the value of DSAF_INODE_SW_VLAN_TAG_DISC_0_REG will be overwrite These registers are only used in "ethtool -d", so that did not cause ndev to misfunction. Signed-off-by: Yonglong Liu Signed-off-by: Peng Li Signed-off-by: David S. Miller commit 308c6cafde0147616da45e3a928adae55c428deb Author: Yonglong Liu Date: Sat Dec 15 11:53:21 2018 +0800 net: hns: All ports can not work when insmod hns ko after rmmod. There are two test cases: 1. Remove the 4 modules:hns_enet_drv/hns_dsaf/hnae/hns_mdio, and install them again, must use "ifconfig down/ifconfig up" command pair to bring port to work. This patch calls phy_stop function when init phy to fix this bug. 2. Remove the 2 modules:hns_enet_drv/hns_dsaf, and install them again, all ports can not use anymore, because of the phy devices register failed(phy devices already exists). Phy devices are registered when hns_dsaf installed, this patch removes them when hns_dsaf removed. The two cases are sometimes related, fixing the second case also requires fixing the first case, so fix them together. Signed-off-by: Yonglong Liu Signed-off-by: Peng Li Signed-off-by: David S. Miller commit 4e1d4be681b2c26fd874adbf584bf034573ac45d Author: Yonglong Liu Date: Sat Dec 15 11:53:20 2018 +0800 net: hns: Incorrect offset address used for some registers. According to the hip06 Datasheet: 1. The offset of INGRESS_SW_VLAN_TAG_DISC should be 0x1A00+4*all_chn_num 2. The offset of INGRESS_IN_DATA_STP_DISC should be 0x1A50+4*all_chn_num Signed-off-by: Yonglong Liu Signed-off-by: Peng Li Signed-off-by: David S. Miller commit 8203e2d844d34af247a151d8ebd68553a6e91785 Author: Eric Dumazet Date: Fri Dec 14 06:46:49 2018 -0800 net: clear skb->tstamp in forwarding paths Sergey reported that forwarding was no longer working if fq packet scheduler was used. This is caused by the recent switch to EDT model, since incoming packets might have been timestamped by __net_timestamp() __net_timestamp() uses ktime_get_real(), while fq expects packets using CLOCK_MONOTONIC base. The fix is to clear skb->tstamp in forwarding paths. Fixes: 80b14dee2bea ("net: Add a new socket option for a future transmit time.") Fixes: fb420d5d91c1 ("tcp/fq: move back to CLOCK_MONOTONIC") Signed-off-by: Eric Dumazet Reported-by: Sergey Matyukevich Tested-by: Sergey Matyukevich Signed-off-by: David S. Miller commit 15c6d8e565943a904172de69cc13c53f724fa16c Author: Robert P. J. Day Date: Thu Dec 13 15:00:11 2018 -0500 mod_devicetable.h: correct kerneldoc typo, "PHYSID2" -> "MII_PHYSID2" Signed-off-by: Robert P. J. Day Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit ade446403bfb79d3528d56071a84b15351a139ad Author: Michal Kubecek Date: Thu Dec 13 17:23:32 2018 +0100 net: ipv4: do not handle duplicate fragments as overlapping Since commit 7969e5c40dfd ("ip: discard IPv4 datagrams with overlapping segments.") IPv4 reassembly code drops the whole queue whenever an overlapping fragment is received. However, the test is written in a way which detects duplicate fragments as overlapping so that in environments with many duplicate packets, fragmented packets may be undeliverable. Add an extra test and for (potentially) duplicate fragment, only drop the new fragment rather than the whole queue. Only starting offset and length are checked, not the contents of the fragments as that would be too expensive. For similar reason, linear list ("run") of a rbtree node is not iterated, we only check if the new fragment is a subset of the interval covered by existing consecutive fragments. v2: instead of an exact check iterating through linear list of an rbtree node, only check if the new fragment is subset of the "run" (suggested by Eric Dumazet) Fixes: 7969e5c40dfd ("ip: discard IPv4 datagrams with overlapping segments.") Signed-off-by: Michal Kubecek Signed-off-by: David S. Miller commit 1986af16e8ed355822600c24b3d2f0be46b573df Author: Jörgen Storvist Date: Thu Dec 13 17:00:35 2018 +0100 qmi_wwan: Added support for Telit LN940 series Added support for the Telit LN940 series cellular modules QMI interface. QMI_QUIRK_SET_DTR quirk requied for Qualcomm MDM9x40 chipset. Signed-off-by: Jörgen Storvist Acked-by: Bjørn Mork Signed-off-by: David S. Miller commit 110a1cc28bc383adb4885eff27e18c61ddebffb4 Author: Jörgen Storvist Date: Wed Dec 12 22:45:34 2018 +0100 qmi_wwan: Added support for Fibocom NL668 series Added support for Fibocom NL668 series QMI interface. Using QMI_QUIRK_SET_DTR required for Qualcomm MDM9x07 chipsets. Signed-off-by: Jörgen Storvist Signed-off-by: David S. Miller commit 10589a568f2ec531975504c98c1bed88c233a63d Merge: 143ece654f9f 7640ead93924 Author: David S. Miller Date: Sat Dec 15 10:58:32 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Alexei Starovoitov says: ==================== pull-request: bpf 2018-12-15 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) fix liveness propagation of callee saved registers, from Jakub. 2) fix overflow in bpf_jit_limit knob, from Daniel. 3) bpf_flow_dissector api fix, from Stanislav. 4) bpf_perf_event api fix on powerpc, from Sandipan. ==================== Signed-off-by: David S. Miller commit cd01544a268ad8ee5b1dfe42c4393f1095f86879 Author: Alistair Strachan Date: Fri Dec 14 14:36:37 2018 -0800 x86/vdso: Pass --eh-frame-hdr to the linker Commit 379d98ddf413 ("x86: vdso: Use $LD instead of $CC to link") accidentally broke unwinding from userspace, because ld would strip the .eh_frame sections when linking. Originally, the compiler would implicitly add --eh-frame-hdr when invoking the linker, but when this Makefile was converted from invoking ld via the compiler, to invoking it directly (like vmlinux does), the flag was missed. (The EH_FRAME section is important for the VDSO shared libraries, but not for vmlinux.) Fix the problem by explicitly specifying --eh-frame-hdr, which restores parity with the old method. See relevant bug reports for additional info: https://bugzilla.kernel.org/show_bug.cgi?id=201741 https://bugzilla.redhat.com/show_bug.cgi?id=1659295 Fixes: 379d98ddf413 ("x86: vdso: Use $LD instead of $CC to link") Reported-by: Florian Weimer Reported-by: Carlos O'Donell Reported-by: "H. J. Lu" Signed-off-by: Alistair Strachan Signed-off-by: Borislav Petkov Tested-by: Laura Abbott Cc: Andy Lutomirski Cc: Carlos O'Donell Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Joel Fernandes Cc: kernel-team@android.com Cc: Laura Abbott Cc: stable Cc: Thomas Gleixner Cc: X86 ML Link: https://lkml.kernel.org/r/20181214223637.35954-1-astrachan@google.com commit 143ece654f9f5b37bedea252a990be37e48ae3a5 Author: Cong Wang Date: Tue Dec 11 21:43:51 2018 -0800 tipc: check tsk->group in tipc_wait_for_cond() tipc_wait_for_cond() drops socket lock before going to sleep, but tsk->group could be freed right after that release_sock(). So we have to re-check and reload tsk->group after it wakes up. After this patch, tipc_wait_for_cond() returns -ERESTARTSYS when tsk->group is NULL, instead of continuing with the assumption of a non-NULL tsk->group. (It looks like 'dsts' should be re-checked and reloaded too, but it is a different bug.) Similar for tipc_send_group_unicast() and tipc_send_group_anycast(). Reported-by: syzbot+10a9db47c3a0e13eb31c@syzkaller.appspotmail.com Fixes: b7d42635517f ("tipc: introduce flow control for group broadcast messages") Fixes: ee106d7f942d ("tipc: introduce group anycast messaging") Fixes: 27bd9ec027f3 ("tipc: introduce group unicast messaging") Cc: Ying Xue Cc: Jon Maloy Signed-off-by: Cong Wang Acked-by: Ying Xue Signed-off-by: David S. Miller commit 65cab850f0eeaa9180bd2e10a231964f33743edf Author: Dave Taht Date: Tue Dec 11 15:30:34 2018 -0800 net: Allow class-e address assignment via ifconfig ioctl While most distributions long ago switched to the iproute2 suite of utilities, which allow class-e (240.0.0.0/4) address assignment, distributions relying on busybox, toybox and other forms of ifconfig cannot assign class-e addresses without this kernel patch. While CIDR has been obsolete for 2 decades, and a survey of all the open source code in the world shows the IN_whatever macros are also obsolete... rather than obsolete CIDR from this ioctl entirely, this patch merely enables class-e assignment, sanely. Signed-off-by: Dave Taht Signed-off-by: David S. Miller commit 6531e115b7ab84f563fcd7f0d2d05ccf971aaaf9 Merge: 380ef2c9ad4f 3a6ab5c7dc11 Author: Linus Torvalds Date: Fri Dec 14 15:35:30 2018 -0800 Merge branch 'akpm' (patches from Andrew) Merge misc fixes from Andrew Morton: "11 fixes" * emailed patches from Andrew Morton : scripts/spdxcheck.py: always open files in binary mode checkstack.pl: fix for aarch64 userfaultfd: check VM_MAYWRITE was set after verifying the uffd is registered fs/iomap.c: get/put the page in iomap_page_create/release() hugetlbfs: call VM_BUG_ON_PAGE earlier in free_huge_page() memblock: annotate memblock_is_reserved() with __init_memblock psi: fix reference to kernel commandline enable arch/sh/include/asm/io.h: provide prototypes for PCI I/O mapping in asm/io.h mm/sparse: add common helper to mark all memblocks present mm: introduce common STRUCT_PAGE_MAX_SHIFT define alpha: fix hang caused by the bootmem removal commit 69d2c86766da2ded2b70281f1bf242cb0d58a778 Author: Gustavo A. R. Silva Date: Tue Dec 11 14:10:08 2018 -0600 ip6mr: Fix potential Spectre v1 vulnerability vr.mifi is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: net/ipv6/ip6mr.c:1845 ip6mr_ioctl() warn: potential spectre issue 'mrt->vif_table' [r] (local cap) net/ipv6/ip6mr.c:1919 ip6mr_compat_ioctl() warn: potential spectre issue 'mrt->vif_table' [r] (local cap) Fix this by sanitizing vr.mifi before using it to index mrt->vif_table' Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 Signed-off-by: Gustavo A. R. Silva Signed-off-by: David S. Miller commit 3a6ab5c7dc114057fd67750e308e1745dafc0e6a Author: Thierry Reding Date: Fri Dec 14 14:17:24 2018 -0800 scripts/spdxcheck.py: always open files in binary mode The spdxcheck script currently falls over when confronted with a binary file (such as Documentation/logo.gif). To avoid that, always open files in binary mode and decode line-by-line, ignoring encoding errors. One tricky case is when piping data into the script and reading it from standard input. By default, standard input will be opened in text mode, so we need to reopen it in binary mode. The breakage only happens with python3 and results in a UnicodeDecodeError (according to Uwe). Link: http://lkml.kernel.org/r/20181212131210.28024-1-thierry.reding@gmail.com Fixes: 6f4d29df66ac ("scripts/spdxcheck.py: make python3 compliant") Signed-off-by: Thierry Reding Reviewed-by: Jeremy Cline Cc: Thomas Gleixner Cc: Jonathan Corbet Cc: Joe Perches Cc: Uwe Kleine-König Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f1733a1d3cd32a9492f4cf866be37bb46e10163d Author: Qian Cai Date: Fri Dec 14 14:17:20 2018 -0800 checkstack.pl: fix for aarch64 There is actually a space after "sp," like this, ffff2000080813c8: a9bb7bfd stp x29, x30, [sp, #-80]! Right now, checkstack.pl isn't able to print anything on aarch64, because it won't be able to match the stating objdump line of a function due to this missing space. Hence, it displays every stack as zero-size. After this patch, checkpatch.pl is able to match the start of a function's objdump, and is then able to calculate each function's stack correctly. Link: http://lkml.kernel.org/r/20181207195843.38528-1-cai@lca.pw Signed-off-by: Qian Cai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 01e881f5a1fca4677e82733061868c6d6ea05ca7 Author: Andrea Arcangeli Date: Fri Dec 14 14:17:17 2018 -0800 userfaultfd: check VM_MAYWRITE was set after verifying the uffd is registered Calling UFFDIO_UNREGISTER on virtual ranges not yet registered in uffd could trigger an harmless false positive WARN_ON. Check the vma is already registered before checking VM_MAYWRITE to shut off the false positive warning. Link: http://lkml.kernel.org/r/20181206212028.18726-2-aarcange@redhat.com Cc: Fixes: 29ec90660d68 ("userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas") Signed-off-by: Andrea Arcangeli Reported-by: syzbot+06c7092e7d71218a2c16@syzkaller.appspotmail.com Acked-by: Mike Rapoport Acked-by: Hugh Dickins Acked-by: Peter Xu Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 61c6de667263184125d5ca75e894fcad632b0dd3 Author: Piotr Jaroszynski Date: Fri Dec 14 14:17:14 2018 -0800 fs/iomap.c: get/put the page in iomap_page_create/release() migrate_page_move_mapping() expects pages with private data set to have a page_count elevated by 1. This is what used to happen for xfs through the buffer_heads code before the switch to iomap in commit 82cb14175e7d ("xfs: add support for sub-pagesize writeback without buffer_heads"). Not having the count elevated causes move_pages() to fail on memory mapped files coming from xfs. Make iomap compatible with the migrate_page_move_mapping() assumption by elevating the page count as part of iomap_page_create() and lowering it in iomap_page_release(). It causes the move_pages() syscall to misbehave on memory mapped files from xfs. It does not not move any pages, which I suppose is "just" a perf issue, but it also ends up returning a positive number which is out of spec for the syscall. Talking to Michal Hocko, it sounds like returning positive numbers might be a necessary update to move_pages() anyway though (https://lkml.kernel.org/r/20181116114955.GJ14706@dhcp22.suse.cz). I only hit this in tests that verify that move_pages() actually moved the pages. The test also got confused by the positive return from move_pages() (it got treated as a success as positive numbers were not expected and not handled) making it a bit harder to track down what's going on. Link: http://lkml.kernel.org/r/20181115184140.1388751-1-pjaroszynski@nvidia.com Fixes: 82cb14175e7d ("xfs: add support for sub-pagesize writeback without buffer_heads") Signed-off-by: Piotr Jaroszynski Reviewed-by: Christoph Hellwig Cc: William Kucharski Cc: Darrick J. Wong Cc: Brian Foster Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8ace22bce84014957da37e6b8baa49ee81c03366 Author: Yongkai Wu Date: Fri Dec 14 14:17:10 2018 -0800 hugetlbfs: call VM_BUG_ON_PAGE earlier in free_huge_page() A stack trace was triggered by VM_BUG_ON_PAGE(page_mapcount(page), page) in free_huge_page(). Unfortunately, the page->mapping field was set to NULL before this test. This made it more difficult to determine the root cause of the problem. Move the VM_BUG_ON_PAGE tests earlier in the function so that if they do trigger more information is present in the page struct. Link: http://lkml.kernel.org/r/1543491843-23438-1-git-send-email-nic_w@163.com Signed-off-by: Yongkai Wu Acked-by: Michal Hocko Acked-by: Mike Kravetz Reviewed-by: William Kucharski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f5a222dc2f0e893cc6b0fa34d421a41ca7dfb72e Author: Yueyi Li Date: Fri Dec 14 14:17:06 2018 -0800 memblock: annotate memblock_is_reserved() with __init_memblock Found warning: WARNING: EXPORT symbol "gsi_write_channel_scratch" [vmlinux] version generation failed, symbol will not be versioned. WARNING: vmlinux.o(.text+0x1e0a0): Section mismatch in reference from the function valid_phys_addr_range() to the function .init.text:memblock_is_reserved() The function valid_phys_addr_range() references the function __init memblock_is_reserved(). This is often because valid_phys_addr_range lacks a __init annotation or the annotation of memblock_is_reserved is wrong. Use __init_memblock instead of __init. Link: http://lkml.kernel.org/r/BLUPR13MB02893411BF12EACB61888E80DFAE0@BLUPR13MB0289.namprd13.prod.outlook.com Signed-off-by: Yueyi Li Acked-by: Michal Hocko Reviewed-by: David Hildenbrand Acked-by: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 428a1cb4baeb9e5c7feda93af7372ba6d2491558 Author: Baruch Siach Date: Fri Dec 14 14:17:03 2018 -0800 psi: fix reference to kernel commandline enable The kernel commandline parameter named in CONFIG_PSI_DEFAULT_DISABLED help text contradicts the documentation in kernel-parameters.txt, and the code. Fix that. Link: http://lkml.kernel.org/r/20181203213416.GA12627@cmpxchg.org Fixes: e0c274472d ("psi: make disabling/enabling easier for vendor kernels") Signed-off-by: Baruch Siach Acked-by: Johannes Weiner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 915c9e1b6d008fdaebca91b83fa0d2596121d588 Author: Mark Brown Date: Fri Dec 14 14:17:00 2018 -0800 arch/sh/include/asm/io.h: provide prototypes for PCI I/O mapping in asm/io.h Most architectures provide prototypes for the PCI I/O mapping operations when asm/io.h is included but SH doesn't currently do that, leading to for example warnings in sound/pci/hda/patch_ca0132.c when pci_iomap() is used on current -next. Make SH more consistent with other architectures by including asm-generic/pci_iomap.h in asm/io.h. Link: http://lkml.kernel.org/r/20181106175142.27988-1-broonie@kernel.org Signed-off-by: Mark Brown Reported-by: kbuild test robot Cc: Geert Uytterhoeven Cc: Yoshinori Sato Cc: Rich Felker Cc: Arnd Bergmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9def36e0fa9a0d9c5393c039db59f1f2d3a388b3 Author: Logan Gunthorpe Date: Fri Dec 14 14:16:57 2018 -0800 mm/sparse: add common helper to mark all memblocks present Presently the arches arm64, arm and sh have a function which loops through each memblock and calls memory present. riscv will require a similar function. Introduce a common memblocks_present() function that can be used by all the arches. Subsequent patches will cleanup the arches that make use of this. Link: http://lkml.kernel.org/r/20181107205433.3875-3-logang@deltatee.com Signed-off-by: Logan Gunthorpe Acked-by: Andrew Morton Cc: Michal Hocko Cc: Vlastimil Babka Cc: Oscar Salvador Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d1402fc708e4c355813e49df6d15bc3466ba5114 Author: Logan Gunthorpe Date: Fri Dec 14 14:16:53 2018 -0800 mm: introduce common STRUCT_PAGE_MAX_SHIFT define This define is used by arm64 to calculate the size of the vmemmap region. It is defined as the log2 of the upper bound on the size of a struct page. We move it into mm_types.h so it can be defined properly instead of set and checked with a build bug. This also allows us to use the same define for riscv. Link: http://lkml.kernel.org/r/20181107205433.3875-2-logang@deltatee.com Signed-off-by: Logan Gunthorpe Acked-by: Will Deacon Acked-by: Andrew Morton Acked-by: Ard Biesheuvel Acked-by: Catalin Marinas Cc: Arnd Bergmann Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5b5260902af4cf7d2b8da06ba395a722f6d490fa Author: Mike Rapoport Date: Fri Dec 14 14:16:50 2018 -0800 alpha: fix hang caused by the bootmem removal The conversion of alpha to memblock as the early memory manager caused boot to hang as described at [1]. The issue is caused because for CONFIG_DISCTONTIGMEM=y case, memblock_add() is called using memory start PFN that had been rounded down to the nearest 8Mb and it caused memblock to see more memory that is actually present in the system. Besides, memblock allocates memory from high addresses while bootmem was using low memory, which broke the assumption that early allocations are always accessible by the hardware. This patch ensures that memblock_add() is using the correct PFN for the memory start and forces memblock to use bottom-up allocations. [1] https://lkml.org/lkml/2018/11/22/1032 Link: http://lkml.kernel.org/r/1543233216-25833-1-git-send-email-rppt@linux.ibm.com Reported-by: Meelis Roos Signed-off-by: Mike Rapoport Tested-by: Meelis Roos Cc: Richard Henderson Cc: Ivan Kokshaysky Cc: Matt Turner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 51367e423c6501a26e67d91a655d2bc892303462 Author: Arnd Bergmann Date: Mon Dec 10 21:45:07 2018 +0100 w90p910_ether: remove incorrect __init annotation The get_mac_address() function is normally inline, but when it is not, we get a warning that this configuration is broken: WARNING: vmlinux.o(.text+0x4aff00): Section mismatch in reference from the function w90p910_ether_setup() to the function .init.text:get_mac_address() The function w90p910_ether_setup() references the function __init get_mac_address(). This is often because w90p910_ether_setup lacks a __init Remove the __init to make it always do the right thing. Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller commit 8236b08cf50f85bbfaf48910a0b3ee68318b7c4b Author: Lepton Wu Date: Tue Dec 11 11:12:55 2018 -0800 VSOCK: bind to random port for VMADDR_PORT_ANY The old code always starts from fixed port for VMADDR_PORT_ANY. Sometimes when VMM crashed, there is still orphaned vsock which is waiting for close timer, then it could cause connection time out for new started VM if they are trying to connect to same port with same guest cid since the new packets could hit that orphaned vsock. We could also fix this by doing more in vhost_vsock_reset_orphans, but any way, it should be better to start from a random local port instead of a fixed one. Signed-off-by: Lepton Wu Reviewed-by: Jorgen Hansen Signed-off-by: David S. Miller commit 9c27369f4a1393452c17e8708c1b0beb8ac59501 Author: Mario Limonciello Date: Tue Dec 11 08:16:14 2018 -0600 r8152: Add support for MAC address pass through on RTL8153-BND All previous docks and dongles that have supported this feature use the RTL8153-AD chip. RTL8153-BND is a new chip that will be used in upcoming Dell type-C docks. It should be added to the whitelist of devices to activate MAC address pass through. Per confirming with Realtek all devices containing RTL8153-BND should activate MAC pass through and there won't use pass through bit on efuse like in RTL8153-AD. Signed-off-by: Mario Limonciello Signed-off-by: David S. Miller commit 0c3a16be700ea008e1aa8843453bfc182e04b58a Author: Atul Gupta Date: Tue Dec 11 02:20:53 2018 -0800 crypto/chelsio/chtls: send/recv window update recalculated send and receive window using linkspeed. Determine correct value of eck_ok from SYN received and option configured on local system. Signed-off-by: Atul Gupta Signed-off-by: David S. Miller commit 848dd1c1cbc5a16ceae46f04722f9eb1f4b7bb4e Author: Atul Gupta Date: Tue Dec 11 02:20:40 2018 -0800 crypto/chelsio/chtls: macro correction in tx path corrected macro used in tx path. removed redundant hdrlen and check for !page in chtls_sendmsg Signed-off-by: Atul Gupta Signed-off-by: David S. Miller commit 6422ccc5fbefbd219f3fab133f698e58f5aa44eb Author: Atul Gupta Date: Tue Dec 11 02:20:26 2018 -0800 crypto/chelsio/chtls: listen fails with multiadapt listen fails when more than one tls capable device is registered. tls_hw_hash is called for each dev which loops again for each cdev_list causing listen failure. Hence call chtls_listen_start/stop for specific device than loop over all devices. Signed-off-by: Atul Gupta Signed-off-by: David S. Miller commit df9d4a1780223c3ddd4bf0810079b5a75251554e Author: Atul Gupta Date: Tue Dec 11 02:20:09 2018 -0800 net/tls: sleeping function from invalid context HW unhash within mutex for registered tls devices cause sleep when called from tcp_set_state for TCP_CLOSE. Release lock and re-acquire after function call with ref count incr/dec. defined kref and fp release for tls_device to ensure device is not released outside lock. BUG: sleeping function called from invalid context at kernel/locking/mutex.c:748 in_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper/7 INFO: lockdep is turned off. CPU: 7 PID: 0 Comm: swapper/7 Tainted: G W O Call Trace: dump_stack+0x5e/0x8b ___might_sleep+0x222/0x260 __mutex_lock+0x5c/0xa50 ? vprintk_emit+0x1f3/0x440 ? kmem_cache_free+0x22d/0x2a0 ? tls_hw_unhash+0x2f/0x80 ? printk+0x52/0x6e ? tls_hw_unhash+0x2f/0x80 tls_hw_unhash+0x2f/0x80 tcp_set_state+0x5f/0x180 tcp_done+0x2e/0xe0 tcp_rcv_state_process+0x92c/0xdd3 ? lock_acquire+0xf5/0x1f0 ? tcp_v4_rcv+0xa7c/0xbe0 ? tcp_v4_do_rcv+0x70/0x1e0 Signed-off-by: Atul Gupta Signed-off-by: David S. Miller commit 6c0563e442528733219afe15c749eb2cc365da3f Author: Atul Gupta Date: Tue Dec 11 02:19:40 2018 -0800 net/tls: Init routines in create_ctx create_ctx is called from tls_init and tls_hw_prot hence initialize function pointers in common routine. Signed-off-by: Atul Gupta Signed-off-by: David S. Miller commit 2ab4c3426c0cf711d7147e3f559638e4ab88960e Author: Nathan Chancellor Date: Mon Dec 10 21:20:30 2018 -0700 drivers: net: xgene: Remove unnecessary forward declarations Clang warns: drivers/net/ethernet/apm/xgene/xgene_enet_main.c:33:36: warning: tentative array definition assumed to have one element static const struct acpi_device_id xgene_enet_acpi_match[]; ^ 1 warning generated. Both xgene_enet_acpi_match and xgene_enet_of_match are defined before their uses at the bottom of the file so this is unnecessary. When CONFIG_ACPI is disabled, ACPI_PTR becomes NULL so xgene_enet_acpi_match doesn't need to be defined. Signed-off-by: Nathan Chancellor Signed-off-by: David S. Miller commit fb83ed496b9a654f60cd1d58a0e1e79ec5694808 Author: Cong Wang Date: Mon Dec 10 15:23:30 2018 -0800 tipc: compare remote and local protocols in tipc_udp_enable() When TIPC_NLA_UDP_REMOTE is an IPv6 mcast address but TIPC_NLA_UDP_LOCAL is an IPv4 address, a NULL-ptr deref is triggered as the UDP tunnel sock is initialized to IPv4 or IPv6 sock merely based on the protocol in local address. We should just error out when the remote address and local address have different protocols. Reported-by: syzbot+eb4da3a20fad2e52555d@syzkaller.appspotmail.com Cc: Ying Xue Cc: Jon Maloy Signed-off-by: Cong Wang Acked-by: Jon Maloy Signed-off-by: David S. Miller commit acb4a33e9856d5fa3384b87d3d8369229be06d31 Author: Cong Wang Date: Mon Dec 10 12:45:45 2018 -0800 tipc: fix a double kfree_skb() tipc_udp_xmit() drops the packet on error, there is no need to drop it again. Fixes: ef20cd4dd163 ("tipc: introduce UDP replicast") Reported-and-tested-by: syzbot+eae585ba2cc2752d3704@syzkaller.appspotmail.com Cc: Ying Xue Cc: Jon Maloy Signed-off-by: Cong Wang Signed-off-by: David S. Miller commit 15ef70e286176165d28b0b8a969b422561a68dfc Author: Cong Wang Date: Mon Dec 10 11:49:55 2018 -0800 tipc: use lock_sock() in tipc_sk_reinit() lock_sock() must be used in process context to be race-free with other lock_sock() callers, for example, tipc_release(). Otherwise using the spinlock directly can't serialize a parallel tipc_release(). As it is blocking, we have to hold the sock refcnt before rhashtable_walk_stop() and release it after rhashtable_walk_start(). Fixes: 07f6c4bc048a ("tipc: convert tipc reference table to use generic rhashtable") Reported-by: Dmitry Vyukov Cc: Ying Xue Cc: Jon Maloy Signed-off-by: Cong Wang Signed-off-by: David S. Miller commit 380ef2c9ad4fdd5fdd81055857be21ae5f581877 Merge: 743e3c8f19db 927b6b2d69b4 Author: Linus Torvalds Date: Fri Dec 14 12:18:30 2018 -0800 Merge tag 'for-linus-20181214' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "Three small fixes for this week. contains: - spectre indexing fix for aio (Jeff) - fix for the previous zeroing bio fix, we don't need it for user mapped pages, and in fact it breaks some applications if we do (Keith) - allocation failure fix for null_blk with zoned (Shin'ichiro)" * tag 'for-linus-20181214' of git://git.kernel.dk/linux-block: block: Fix null_blk_zoned creation failure with small number of zones aio: fix spectre gadget in lookup_ioctx block/bio: Do not zero user pages commit 743e3c8f19db951ce9d20e6accb290444f4737a4 Merge: eb6cf9f8cb9d 8a034aad4892 Author: Linus Torvalds Date: Fri Dec 14 12:14:41 2018 -0800 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fix from Stephen Boyd: "One fix for the qcom QCS404 clk driver that was merged for this release. It specified the wrong parent for a PLL so a part of the clk tree wasn't rooted correctly. This fixes it by using the right name" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: qcom: qcs404: Fix gpll0_out_main parent commit d3e8869ec82645599e6497d6974593bf00f7b19b Author: Jakub Kicinski Date: Fri Dec 14 11:38:48 2018 -0800 net: netlink: rename NETLINK_DUMP_STRICT_CHK -> NETLINK_GET_STRICT_CHK NETLINK_DUMP_STRICT_CHK can be used for all GET requests, dumps as well as doit handlers. Replace the DUMP in the name with GET make that clearer. Signed-off-by: Jakub Kicinski Reviewed-by: David Ahern Signed-off-by: David S. Miller commit eb6cf9f8cb9dfacf6679f9d6c72aaf568a027edf Merge: 4645453cefce 3238c359acee Author: Linus Torvalds Date: Fri Dec 14 09:36:41 2018 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fix from Catalin Marinas: "Invalidate the caches before clearing the DMA buffer via the non-cacheable alias in the FORCE_CONTIGUOUS case" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: dma-mapping: Fix FORCE_CONTIGUOUS buffer clearing commit 4645453cefcebdff9db26f02cf325607357295c4 Merge: c19bf74fe4d9 a225f1567405 Author: Linus Torvalds Date: Fri Dec 14 09:33:34 2018 -0800 Merge tag 'powerpc-4.20-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "One notable fix for our change to split pt_regs between user/kernel, we forgot to update BPF to use the user-visible type which was an ABI break for BPF programs. A slightly ugly but minimal fix to do_syscall_trace_enter() so that we use tracehook_report_syscall_entry() properly. We'll rework the code in next to avoid the empty if body. Seven commits fixing bugs in the new papr_scm (Storage Class Memory) driver. The driver was finally able to be tested on the other hypervisor which exposed several bugs. The fixes are all fairly minimal at least. Fix a crash in our MSI code if an MSI-capable device is plugged into a non-MSI capable PHB, only seen on older hardware (MPC8378). Fix our legacy serial code to look for "stdout-path" since the device trees were updated to use that instead of "linux,stdout-path". A change to the COFF zImage code to fix booting old powermacs. A couple of minor build fixes. Thanks to: Benjamin Herrenschmidt, Daniel Axtens, Dmitry V. Levin, Elvira Khabirova, Oliver O'Halloran, Paul Mackerras, Radu Rendec, Rob Herring, Sandipan Das" * tag 'powerpc-4.20-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/ptrace: replace ptrace_report_syscall() with a tracehook call powerpc/mm: Fallback to RAM if the altmap is unusable powerpc/papr_scm: Use ibm,unit-guid as the iset cookie powerpc/papr_scm: Fix DIMM device registration race powerpc/papr_scm: Remove endian conversions powerpc/papr_scm: Update DT properties powerpc/papr_scm: Fix resource end address powerpc/papr_scm: Use depend instead of select powerpc/bpf: Fix broken uapi for BPF_PROG_TYPE_PERF_EVENT powerpc/boot: Fix build failures with -j 1 powerpc: Look for "stdout-path" when setting up legacy consoles powerpc/msi: Fix NULL pointer access in teardown code powerpc/mm: Fix linux page tables build with some configs powerpc: Fix COFF zImage booting on old powermacs commit 1063a5148ac9d1606e80886fa53ee57d45fb4589 Author: Yanjiang Jin Date: Fri Dec 14 11:29:37 2018 -0600 PCI/AER: Queue one GHES event, not several uninitialized ones ecae65e133f2 ("PCI/AER: Use kfifo_in_spinlocked() to insert locked elements") replaced kfifo_put() with kfifo_in_spinlocked(), but passed the *size* of the queue entry, where kfifo_in_spinlocked() expects the *number* of entries to be copied. We want to insert only one element into kfifo, not "sizeof(entry) = 16". Without this patch, we would get 15 uninitialized elements. Fixes: ecae65e133f2 ("PCI/AER: Use kfifo_in_spinlocked() to insert locked elements") Signed-off-by: Yanjiang Jin [bhelgaas: changelog] Signed-off-by: Bjorn Helgaas Reviewed-by: Keith Busch commit c19bf74fe4d979455b22a8e998615a3d46e24c92 Merge: 7fb5f5d3738c 6f9718fe41c3 Author: Linus Torvalds Date: Fri Dec 14 09:22:14 2018 -0800 Merge tag 'ceph-for-4.20-rc7' of https://github.com/ceph/ceph-client Pull ceph fix from Ilya Dryomov: "Luis discovered a problem with the new copyfrom offload on the server side. Disable it for now" * tag 'ceph-for-4.20-rc7' of https://github.com/ceph/ceph-client: ceph: make 'nocopyfrom' a default mount option commit 7fb5f5d3738c3a3ed7a3a8685266bc88dc69fbbd Merge: 92de1de51e99 478b6767ad26 Author: Linus Torvalds Date: Fri Dec 14 09:17:17 2018 -0800 Merge tag 'pinctrl-v4.20-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: "Three pin control fixes for the v4.20 series. Just odd drivers, so nothing particularly interesting: - Set the tile property on Qualcomm SDM60. - Fix up enable register calculation for the Meson - Fix an IRQ offset on the Sunxi (Allwinner)" * tag 'pinctrl-v4.20-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: sunxi: a83t: Fix IRQ offset typo for PH11 pinctrl: meson: fix pull enable register calculation pinctrl: sdm660: Set tile property for pingroups commit 92de1de51e99910ff0b45b340c95994573a1ad23 Merge: 880b9df1bf15 1df07a7f2244 Author: Linus Torvalds Date: Fri Dec 14 09:12:02 2018 -0800 Merge tag 'drm-fixes-2018-12-14' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "While I hoped things would calm down, the world hasn't joined with me, but it's a few things scattered over a wide area. The i915 workarounds regression fix is probably the largest, the rest are more usual sized. We also get some new AMD PCI IDs. There is also a patch in here to MAINTAINERS to added Daniel as an official DRM toplevel co-maintainer, he's decided he wants to step up and share the glory, and he'll likely process next weeks fixes while I'm away on holidays. Summary: amdgpu: - some new PCI IDs - fixed firmware image updates - power management fixes - locking warning fix nouveau: - framebuffer flushing fix - memory leak fix - tegra device init regression fix vmwgfx: - OOM kernel memory fix - excess return in function fix i915: - the biggest fix is a regression fix where workarounds weren't getting reapplied after a gpu hang causing further crashing, this fixes the workaround application to make it happen again - GPU hang fixes for Braswell and some GEN3 GPUs - GVT fix for broadwell tiling rockchip: - revert to fix a regression causing a WARN on shutdown mediatek: - avoid crash attaching to non-existant bridges" * tag 'drm-fixes-2018-12-14' of git://anongit.freedesktop.org/drm/drm: (23 commits) drm/vmwgfx: Protect from excessive execbuf kernel memory allocations v3 MAINTAINERS: Daniel for drm co-maintainer drm/amdgpu: drop fclk/gfxclk ratio setting drm/vmwgfx: remove redundant return ret statement drm/i915: Flush GPU relocs harder for gen3 drm/i915: Allocate a common scratch page drm/i915/execlists: Apply a full mb before execution for Braswell drm/nouveau/kms: Fix memory leak in nv50_mstm_del() drm/nouveau/kms/nv50-: also flush fb writes when rewinding push buffer drm/amdgpu: Fix DEBUG_LOCKS_WARN_ON(depth <= 0) in amdgpu_ctx.lock Revert "drm/rockchip: Allow driver to be shutdown on reboot/kexec" drm/nouveau/drm/nouveau: tegra: Call nouveau_drm_device_init() drm/amdgpu/powerplay: Apply avfs cks-off voltages on VI drm/amdgpu: update SMC firmware image for polaris10 variants drm/amdkfd: add new vega20 pci id drm/amdkfd: add new vega10 pci ids drm/amdgpu: add some additional vega20 pci ids drm/amdgpu: add some additional vega10 pci ids drm/amdgpu: update smu firmware images for VI variants (v2) drm/i915: Introduce per-engine workarounds ... commit 93a86395b429c3a68a0d029f584f39890c0801b2 Merge: 45f750c16cae 28a86092b175 Author: Greg Kroah-Hartman Date: Fri Dec 14 17:06:09 2018 +0100 Merge tag 'usb-serial-4.20-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fixes for 4.20-rc7 Here are some new modem device ids. All have been in linux-next with no reported issues. Signed-off-by: Johan Hovold * tag 'usb-serial-4.20-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add Telit LN940 series USB: serial: option: add Fibocom NL668 series USB: serial: option: add Simcom SIM7500/SIM7600 (MBIM mode) USB: serial: option: add GosunCn ZTE WeLink ME3630 USB: serial: option: add HP lt4132 commit 71391bdd2e9aab188f86bf1ecd9b232531ec7eea Author: Xiaozhou Liu Date: Fri Dec 14 22:14:31 2018 +0800 include/linux/compiler_types.h: don't pollute userspace with macro definitions Macros 'inline' and '__gnu_inline' used to be defined in compiler-gcc.h, which was (and is) included entirely in (__KERNEL__ && !__ASSEMBLY__). Commit 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h mutually exclusive") had those macros exposed to userspace, unintentionally. Then commit a3f8a30f3f00 ("Compiler Attributes: use feature checks instead of version checks") moved '__gnu_inline' back into (__KERNEL__ && !__ASSEMBLY__) and 'inline' was left behind. Since 'inline' depends on '__gnu_inline', compiling error showing "unknown type name ‘__gnu_inline’" will pop up, if userspace somehow includes . Other macros like __must_check, notrace, etc. are in a similar situation. So just move all these macros back into (__KERNEL__ && !__ASSEMBLY__). Note: 1. This patch only affects what userspace sees. 2. __must_check (when !CONFIG_ENABLE_MUST_CHECK) and noinline_for_stack were once defined in __KERNEL__ only, but we believe that they can be put into !__ASSEMBLY__ too. Acked-by: Nick Desaulniers Signed-off-by: Xiaozhou Liu Signed-off-by: Miguel Ojeda commit 55449af1a17a4f32178b42d8ba4ee9477fe9a00c Merge: cb4f131e1f2c fc96df16a1ce Author: Greg Kroah-Hartman Date: Fri Dec 14 15:36:56 2018 +0100 Merge tag 'hyperv-fixes-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux into char-misc-linus Sasha writes: hyperv-fixes-4.20-rc6 * tag 'hyperv-fixes-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels x86, hyperv: remove PCI dependency commit 45f750c16cae3625014c14c77bd9005eda975d35 Author: Mathias Nyman Date: Fri Dec 14 10:54:43 2018 +0200 xhci: Don't prevent USB2 bus suspend in state check intended for USB3 only The code to prevent a bus suspend if a USB3 port was still in link training also reacted to USB2 port polling state. This caused bus suspend to busyloop in some cases. USB2 polling state is different from USB3, and should not prevent bus suspend. Limit the USB3 link training state check to USB3 root hub ports only. The origial commit went to stable so this need to be applied there as well Fixes: 2f31a67f01a8 ("usb: xhci: Prevent bus suspend if a port connect change or polling state is detected") Cc: stable@vger.kernel.org Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman commit c3db8d531045774aeee6e0f731ab15b0c450de45 Author: Sudarsana Reddy Kalluru Date: Sun Dec 9 23:27:01 2018 -0800 qed: Fix command number mismatch between driver and the mfw The value for OEM_CFG_UPDATE command differs between driver and the Management firmware (mfw). Fix this gap with adding a reserved field. Fixes: cac6f691546b ("qed: Add support for Unified Fabric Port.") Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Ariel Elior Signed-off-by: David S. Miller commit 38ed22351c80532b26f0e2cb60bff1a654b4e1e7 Merge: 9e69efd45321 fa2bf86bab4b Author: David S. Miller Date: Thu Dec 13 19:21:53 2018 -0800 Merge tag 'mlx5-fixes-2018-12-13' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux mlx5-fixes-2018-12-13 Subject: [pull request][net 0/9] Mellanox, mlx5 fixes 2018-12-13 Saeed Mahameed says: ==================== This series introduces some fixes to the mlx5 core and mlx5e netdevice driver. ======= Conflict with net-next: When merged with net-next this series will cause a moderate conflict: 1) in drivers/net/ethernet/mellanox/mlx5/core/en_tc.c (2 hunks) Take hunks from net only and just replace *attr->mirror_count to *attr->split_count 1.1) there is one more instance of slow_attr->mirror_count to be replaced with slow_attr->split_count, it doesn't appear in the conflict, it will cause a compilation error if left out. 2) in mlx5_ifc.h, take hunks only from net. Example for the merge resolution can be found at: https://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux.git/commit/?h=merge/mlx5-fixes&id=48830adf29804d85d77ed8a251d625db0eb5b8a8 branch merge/mlx5-fixes of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux (I simply merged this pull request tag into net-next and resolved the conflict) I don't know if it's ok with you, but to save your time, you can just: git pull git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux merge/mlx5-fixes Into net-next, before your next net merge, and you will have a clean merge of net into net-next (at least for mlx5 files). ====== Please pull and let me know if there's any problem. For -stable v4.18 338d615be484 ('net/mlx5e: Cancel DIM work on close SQ') 91f40f9904ad ('net/mlx5e: RX, Verify MPWQE stride size is in range') For -stable v4.19 c5c7e1c41bbe ('net/mlx5e: Remove unused UDP GSO remaining counter') ==================== Signed-off-by: David S. Miller commit ea5751ccd665a2fd1b24f9af81f6167f0718c5f6 Author: Ivan Delalande Date: Thu Dec 13 15:20:52 2018 -0800 proc/sysctl: don't return ENOMEM on lookup when a table is unregistering proc_sys_lookup can fail with ENOMEM instead of ENOENT when the corresponding sysctl table is being unregistered. In our case we see this upon opening /proc/sys/net/*/conf files while network interfaces are being deleted, which confuses our configuration daemon. The problem was successfully reproduced and this fix tested on v4.9.122 and v4.20-rc6. v2: return ERR_PTRs in all cases when proc_sys_make_inode fails instead of mixing them with NULL. Thanks Al Viro for the feedback. Fixes: ace0c791e6c3 ("proc/sysctl: Don't grab i_lock under sysctl_lock.") Cc: stable@vger.kernel.org Signed-off-by: Ivan Delalande Signed-off-by: Al Viro commit 880b9df1bf157dc28a2e65beea6183d095e0ccb0 Merge: 65e08c5e8631 48483614de97 Author: Linus Torvalds Date: Thu Dec 13 16:35:58 2018 -0800 Merge tag 'xarray-4.20-rc7' of git://git.infradead.org/users/willy/linux-dax Pull XArray fixes from Matthew Wilcox: "Two bugfixes, each with test-suite updates, two improvements to the test-suite without associated bugs, and one patch adding a missing API" * tag 'xarray-4.20-rc7' of git://git.infradead.org/users/willy/linux-dax: XArray: Fix xa_alloc when id exceeds max XArray tests: Check iterating over multiorder entries XArray tests: Handle larger indices more elegantly XArray: Add xa_cmpxchg_irq and xa_cmpxchg_bh radix tree: Don't return retry entries from lookup commit e58725d51fa8da9133f3f1c54170aa2e43056b91 Author: Richard Weinberger Date: Wed Nov 7 23:04:43 2018 +0100 ubifs: Handle re-linking of inodes correctly while recovery UBIFS's recovery code strictly assumes that a deleted inode will never come back, therefore it removes all data which belongs to that inode as soon it faces an inode with link count 0 in the replay list. Before O_TMPFILE this assumption was perfectly fine. With O_TMPFILE it can lead to data loss upon a power-cut. Consider a journal with entries like: 0: inode X (nlink = 0) /* O_TMPFILE was created */ 1: data for inode X /* Someone writes to the temp file */ 2: inode X (nlink = 0) /* inode was changed, xattr, chmod, … */ 3: inode X (nlink = 1) /* inode was re-linked via linkat() */ Upon replay of entry #2 UBIFS will drop all data that belongs to inode X, this will lead to an empty file after mounting. As solution for this problem, scan the replay list for a re-link entry before dropping data. Fixes: 474b93704f32 ("ubifs: Implement O_TMPFILE") Cc: stable@vger.kernel.org Cc: Russell Senior Cc: Rafał Miłecki Reported-by: Russell Senior Reported-by: Rafał Miłecki Tested-by: Rafał Miłecki Signed-off-by: Richard Weinberger commit e542087701f09418702673631a908429feb3eae0 Author: Pan Bian Date: Wed Nov 28 11:20:03 2018 +0800 ubi: Do not drop UBI device reference before using The UBI device reference is dropped but then the device is used as a parameter of ubi_err. The bug is introduced in changing ubi_err's behavior. The old ubi_err does not require a UBI device as its first parameter, but the new one does. Fixes: 32608703310 ("UBI: Extend UBI layer debug/messaging capabilities") Signed-off-by: Pan Bian Reviewed-by: Boris Brezillon Signed-off-by: Richard Weinberger commit b95f83ab762dd6211351b9140f99f43644076ca8 Author: Pan Bian Date: Wed Nov 28 10:57:33 2018 +0800 ubi: Put MTD device after it is not used The MTD device reference is dropped via put_mtd_device, however its field ->index is read and passed to ubi_msg. To fix this, the patch moves the reference dropping after calling ubi_msg. Signed-off-by: Pan Bian Reviewed-by: Boris Brezillon Signed-off-by: Richard Weinberger commit d62e98ed1efcaa94caa004f622944afdce5f1c3c Author: Gabor Juhos Date: Sun Dec 9 18:12:13 2018 +0100 ubifs: Fix default compression selection in ubifs When ubifs is build without the LZO compressor and no compressor is given the creation of the default file system will fail. before selection the LZO compressor check if it is present and if not fall back to the zlib or none. Signed-off-by: Gabor Juhos Signed-off-by: Hauke Mehrtens Signed-off-by: Richard Weinberger commit 6554a56f352ee2a6ce295fcfb39889eb9ecc79cf Author: Garry McNulty Date: Thu Nov 15 22:25:58 2018 +0000 ubifs: Fix memory leak on error condition If the call to ubifs_read_nnode() fails in ubifs_lpt_calc_hash() an error is returned without freeing the memory allocated to 'buf'. Read and check the root node before allocating the buffer. Detected by CoverityScan, CID 1441025 ("Resource leak") Signed-off-by: Garry McNulty Signed-off-by: Richard Weinberger commit 60eb5da2434b5288291aac533fb4dadc8ec8aed7 Author: Arnd Bergmann Date: Fri Nov 2 12:11:22 2018 +0100 ubifs: auth: Add CONFIG_KEYS dependency The new authentication support causes a build failure when CONFIG_KEYS is disabled, so add a dependency. fs/ubifs/auth.c: In function 'ubifs_init_authentication': fs/ubifs/auth.c:249:16: error: implicit declaration of function 'request_key'; did you mean 'request_irq'? [-Werror=implicit-function-declaration] keyring_key = request_key(&key_type_logon, c->auth_key_name, NULL); Fixes: d8a22773a12c ("ubifs: Enable authentication support") Signed-off-by: Arnd Bergmann Signed-off-by: Richard Weinberger commit aa3d31e08c5707c99feebe53cb713fb43f526f16 Author: Geert Uytterhoeven Date: Mon Nov 5 09:25:40 2018 +0100 ubifs: CONFIG_UBIFS_FS_AUTHENTICATION should depend on UBIFS_FS Instead of adding yet another dependency on UBIFS_FS, wrap the whole block of ubifs config options in a single "if UBIFS_FS". Fixes: d8a22773a12c6d78 ("ubifs: Enable authentication support") Signed-off-by: Geert Uytterhoeven Acked-by: Sascha Hauer Signed-off-by: Richard Weinberger commit eb66eff6636de0e83f74294447b47aec51e069fc Author: Arnd Bergmann Date: Fri Nov 2 16:39:24 2018 +0100 ubifs: replay: Fix high stack usage Having two shash descriptors on the stack cause a very significant kernel stack usage that can cross the warning threshold: fs/ubifs/replay.c: In function 'authenticate_sleb': fs/ubifs/replay.c:633:1: error: the frame size of 1144 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] Normally, gcc optimizes the out, but with CONFIG_CC_OPTIMIZE_FOR_DEBUGGING, it does not. Splitting the two stack allocations into separate functions means that they will use the same memory again. In normal configurations (optimizing for size or performance), those should get inlined and we get the same behavior as before. Signed-off-by: Arnd Bergmann Signed-off-by: Richard Weinberger commit 65e08c5e86311143f45c3e4389561af3107fc8f6 Merge: 76a5cfb8e7c9 2bd61abead58 Author: Linus Torvalds Date: Thu Dec 13 12:57:21 2018 -0800 Merge tag 'linux-kselftest-4.20-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest fix from Shuah Khan: "A single fix for a seccomp test from Kees Cook." * tag 'linux-kselftest-4.20-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/seccomp: Remove SIGSTOP si_pid check commit 76a5cfb8e7c98ae0ea238910f97c17cb1f638918 Merge: e10db791bf73 99c47fcd4daa Author: Linus Torvalds Date: Thu Dec 13 12:02:41 2018 -0800 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal Pull thermal fixes from Eduardo Valentin: "Fixes for STM and HISI thermal drivers" * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal: thermal: stm32: Fix stm_thermal_read_factory_settings thermal: stm32: read factory settings inside stm_thermal_prepare thermal/drivers/hisi: Fix number of sensors on hi3660 thermal/drivers/hisi: Fix wrong platform_get_irq_byname() commit fc96df16a1ce80cbb3c316ab7d4dc8cd5c2852ce Author: Dexuan Cui Date: Thu Dec 13 16:35:43 2018 +0000 Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels Before 98f4c651762c, we returned zeros for unopened channels. With 98f4c651762c, we started to return random on-stack values. We'd better return -EINVAL instead. Fixes: 98f4c651762c ("hv: move ringbuffer bus attributes to dev_groups") Cc: stable@vger.kernel.org Cc: K. Y. Srinivasan Cc: Haiyang Zhang Cc: Stephen Hemminger Signed-off-by: Dexuan Cui Signed-off-by: Sasha Levin commit c629421a990033ba539eb8585e73a2e6fa9ea631 Author: Sinan Kaya Date: Sat Dec 1 21:40:38 2018 +0000 x86, hyperv: remove PCI dependency Need to be able to boot without PCI devices present. Signed-off-by: Sinan Kaya Signed-off-by: Sasha Levin commit 1df07a7f2244947c888dc35bba2b237f714afc56 Merge: a805ce683f4c fd567467753f Author: Dave Airlie Date: Fri Dec 14 05:19:25 2018 +1000 Merge branch 'vmwgfx-fixes-4.20' of git://people.freedesktop.org/~thomash/linux into drm-fixes One regression fix for avoiding kernel OOM, one cleanup return fix. Signed-off-by: Dave Airlie From: Thomas Hellstrom Link: https://patchwork.freedesktop.org/patch/msgid/20181213122815.10581-1-thellstrom@vmware.com commit 28a86092b1753b802ef7e3de8a4c4a69a9c1bb03 Author: Jörgen Storvist Date: Thu Dec 13 17:32:08 2018 +0100 USB: serial: option: add Telit LN940 series Added USB serial option driver support for Telit LN940 series cellular modules. Covering both QMI and MBIM modes. usb-devices output (0x1900): T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 21 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1900 Rev=03.10 S: Manufacturer=Telit S: Product=Telit LN940 Mobile Broadband S: SerialNumber=0123456789ABCDEF C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option usb-devices output (0x1901): T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 20 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1901 Rev=03.10 S: Manufacturer=Telit S: Product=Telit LN940 Mobile Broadband S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 4 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim I: If#= 5 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim Signed-off-by: Jörgen Storvist Cc: stable Signed-off-by: Johan Hovold commit 48483614de97c4f5219abeda630e62b2bebdce62 Author: Matthew Wilcox Date: Thu Dec 13 13:57:42 2018 -0500 XArray: Fix xa_alloc when id exceeds max Specifying a starting ID greater than the maximum ID isn't something attempted very often, but it should fail. It was succeeding due to xas_find_marked() returning the wrong error state, so add tests for both xa_alloc() and xas_find_marked(). Fixes: b803b42823d0 ("xarray: Add XArray iterators") Signed-off-by: Matthew Wilcox commit e10db791bf73c1973f24591897e839db2eb3c804 Merge: e861e11c5900 37fbd834b4e4 Author: Linus Torvalds Date: Thu Dec 13 11:02:23 2018 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Doug Ledford: "We have 5 small fixes for this pull request. One is a performance regression, so not necessarily strictly a fix, but it was small and reasonable and claimed to avoid thrashing in the scheduler, so I took it. The remaining are all legitimate fixes that match the "we take fixes any time" criteria. Summary: - One performance regression for hfi1 - One kasan fix for hfi1 - A couple mlx5 fixes - A core oops fix" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: IB/core: Fix oops in netdev_next_upper_dev_rcu() IB/mlx5: Block DEVX umem from the non applicable cases IB/mlx5: Fix implicit ODP interrupted page fault IB/hfi1: Fix an out-of-bounds access in get_hw_stats IB/hfi1: Fix a latency issue for small messages commit e861e11c5900d21afe0c3a326d1303d6f92c9f6f Merge: 52a7dc28a7b0 b704441e38f6 Author: Linus Torvalds Date: Thu Dec 13 10:59:02 2018 -0800 Merge tag 'mmc-v4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull mmc fixes from Ulf Hansson: "MMC core: - Fixup RPMB requests to use mrq->sbc when sending CMD23 MMC host: - omap: Fix broken MMC/SD on OMAP15XX/OMAP5910/OMAP310 - sdhci-omap: Fix DCRC error handling during tuning - sdhci: Fixup the timeout check window for clock and reset" * tag 'mmc-v4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci: fix the timeout check window for clock and reset mmc: sdhci-omap: Fix DCRC error handling during tuning MMC: OMAP: fix broken MMC on OMAP15XX/OMAP5910/OMAP310 mmc: core: use mrq->sbc when sending CMD23 for RPMB commit 52a7dc28a7b01cdd9ec349a943944dc49d20fc26 Merge: 67f2a93099cc 0bea4cc83835 Author: Linus Torvalds Date: Thu Dec 13 10:54:13 2018 -0800 Merge tag 'sound-4.20-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Only usual suspects here: a few more fixups for Realtek HD-audio on various PCs, including a regression fix in the previous fix for Lenovo X1 Carbon, as well as a typo fix in the recent Fireface patch" * tag 'sound-4.20-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek: Enable audio jacks of ASUS UX433FN/UX333FA with ALC294 ALSA: hda/realtek: Enable audio jacks of ASUS UX533FD with ALC294 ALSA: hda/realtek: ALC294 mic and headset-mode fixups for ASUS X542UN ALSA: fireface: fix reference to wrong register for clock configuration ALSA: hda/realtek - Fix the mute LED regresion on Lenovo X1 Carbon ALSA: hda/realtek - Fixed headphone issue for ALC700 commit 7640ead939247e91e84b7ec6ec001f30193cc7df Author: Jakub Kicinski Date: Wed Dec 12 16:29:07 2018 -0800 bpf: verifier: make sure callees don't prune with caller differences Currently for liveness and state pruning the register parentage chains don't include states of the callee. This makes some sense as the callee can't access those registers. However, this means that READs done after the callee returns will not propagate into the states of the callee. Callee will then perform pruning disregarding differences in caller state. Example: 0: (85) call bpf_user_rnd_u32 1: (b7) r8 = 0 2: (55) if r0 != 0x0 goto pc+1 3: (b7) r8 = 1 4: (bf) r1 = r8 5: (85) call pc+4 6: (15) if r8 == 0x1 goto pc+1 7: (05) *(u64 *)(r9 - 8) = r3 8: (b7) r0 = 0 9: (95) exit 10: (15) if r1 == 0x0 goto pc+0 11: (95) exit Here we acquire unknown state with call to get_random() [1]. Then we store this random state in r8 (either 0 or 1) [1 - 3], and make a call on line 5. Callee does nothing but a trivial conditional jump (to create a pruning point). Upon return caller checks the state of r8 and either performs an unsafe read or not. Verifier will first explore the path with r8 == 1, creating a pruning point at [11]. The parentage chain for r8 will include only callers states so once verifier reaches [6] it will mark liveness only on states in the caller, and not [11]. Now when verifier walks the paths with r8 == 0 it will reach [11] and since REG_LIVE_READ on r8 was not propagated there it will prune the walk entirely (stop walking the entire program, not just the callee). Since [6] was never walked with r8 == 0, [7] will be considered dead and replaced with "goto -1" causing hang at runtime. This patch weaves the callee's explored states onto the callers parentage chain. Rough parentage for r8 would have looked like this before: [0] [1] [2] [3] [4] [5] [10] [11] [6] [7] | | ,---|----. | | | sl0: sl0: / sl0: \ sl0: sl0: sl0: fr0: r8 <-- fr0: r8<+--fr0: r8 `fr0: r8 ,fr0: r8<-fr0: r8 \ fr1: r8 <- fr1: r8 / \__________________/ after: [0] [1] [2] [3] [4] [5] [10] [11] [6] [7] | | | | | | sl0: sl0: sl0: sl0: sl0: sl0: fr0: r8 <-- fr0: r8 <- fr0: r8 <- fr0: r8 <-fr0: r8<-fr0: r8 fr1: r8 <- fr1: r8 Now the mark from instruction 6 will travel through callees states. Note that we don't have to connect r0 because its overwritten by callees state on return and r1 - r5 because those are not alive any more once a call is made. v2: - don't connect the callees registers twice (Alexei: suggestion & code) - add more details to the comment (Ed & Alexei) v1: don't unnecessarily link caller saved regs (Jiong) Fixes: f4d7e40a5b71 ("bpf: introduce function calls (verification)") Reported-by: David Beckett Signed-off-by: Jakub Kicinski Reviewed-by: Jiong Wang Reviewed-by: Edward Cree Signed-off-by: Alexei Starovoitov commit cddfb283af7e5700760362ec6f6ab3a039636e64 Author: Lorenzo Bianconi Date: Mon Dec 10 16:46:28 2018 +0100 mt76: add entry in MAINTAINERS file Add entry for mt76 driver in MAINTAINERS file Signed-off-by: Lorenzo Bianconi Signed-off-by: Kalle Valo commit 7c250f4612ae97aa04500c0d0cff69bb87046e3a Author: Lorenzo Bianconi Date: Fri Nov 16 17:19:21 2018 +0100 mt76: fix potential NULL pointer dereference in mt76_stop_tx_queues Starting from mac80211 commit adf8ed01e4fd ("mac80211: add an optional TXQ for other PS-buffered frames") and commit 0eeb2b674f05 ("mac80211: add an option for station management TXQ") a new per-sta queue has been introduced for bufferable management frames. sta->txq[IEEE80211_NUM_TIDS] is initialized just if the driver reports the following hw flags: - IEEE80211_HW_STA_MMPDU_TXQ - IEEE80211_HW_BUFF_MMPDU_TXQ This can produce a NULL pointer dereference in mt76_stop_tx_queues since mt76 iterates on all available sta tx queues assuming they are initialized by mac80211. This issue has been spotted analyzing the code (it has not triggered any crash yet) Signed-off-by: Lorenzo Bianconi Signed-off-by: Kalle Valo commit 1aa48f088615ebfa5e139951a0d3e7dc2c2af4ec Author: Brian Norris Date: Fri Nov 30 09:59:57 2018 -0800 Revert "mwifiex: restructure rx_reorder_tbl_lock usage" This reverts commit 5188d5453bc9380ccd4ae1086138dd485d13aef2, because it introduced lock recursion: BUG: spinlock recursion on CPU#2, kworker/u13:1/395 lock: 0xffffffc0e28a47f0, .magic: dead4ead, .owner: kworker/u13:1/395, .owner_cpu: 2 CPU: 2 PID: 395 Comm: kworker/u13:1 Not tainted 4.20.0-rc4+ #2 Hardware name: Google Kevin (DT) Workqueue: MWIFIEX_RX_WORK_QUEUE mwifiex_rx_work_queue [mwifiex] Call trace: dump_backtrace+0x0/0x140 show_stack+0x20/0x28 dump_stack+0x84/0xa4 spin_bug+0x98/0xa4 do_raw_spin_lock+0x5c/0xdc _raw_spin_lock_irqsave+0x38/0x48 mwifiex_flush_data+0x2c/0xa4 [mwifiex] call_timer_fn+0xcc/0x1c4 run_timer_softirq+0x264/0x4f0 __do_softirq+0x1a8/0x35c do_softirq+0x54/0x64 netif_rx_ni+0xe8/0x120 mwifiex_recv_packet+0xfc/0x10c [mwifiex] mwifiex_process_rx_packet+0x1d4/0x238 [mwifiex] mwifiex_11n_dispatch_pkt+0x190/0x1ac [mwifiex] mwifiex_11n_rx_reorder_pkt+0x28c/0x354 [mwifiex] mwifiex_process_sta_rx_packet+0x204/0x26c [mwifiex] mwifiex_handle_rx_packet+0x15c/0x16c [mwifiex] mwifiex_rx_work_queue+0x104/0x134 [mwifiex] worker_thread+0x4cc/0x72c kthread+0x134/0x13c ret_from_fork+0x10/0x18 This was clearly not tested well at all. I simply performed 'wget' in a loop and it fell over within a few seconds. Fixes: 5188d5453bc9 ("mwifiex: restructure rx_reorder_tbl_lock usage") Cc: Cc: Ganapathi Bhat Signed-off-by: Brian Norris Signed-off-by: Kalle Valo commit 8cfa272b0d321160ebb5b45073e39ef0a6ad73f2 Author: Larry Finger Date: Sat Nov 17 20:55:03 2018 -0600 rtlwifi: Fix leak of skb when processing C2H_BT_INFO With commit 0a9f8f0a1ba9 ("rtlwifi: fix btmpinfo timeout while processing C2H_BT_INFO"), calling rtl_c2hcmd_enqueue() with rtl_c2h_fast_cmd() true, the routine returns without freeing that skb, thereby leaking it. This issue has been discussed at https://github.com/lwfinger/rtlwifi_new/issues/401 and the fix tested there. Fixes: 0a9f8f0a1ba9 ("rtlwifi: fix btmpinfo timeout while processing C2H_BT_INFO") Reported-and-tested-by: Francisco Machado Magalhães Neto Cc: Francisco Machado Magalhães Neto Cc: Ping-Ke Shih Cc: Stable # 4.18+ Signed-off-by: Larry Finger Signed-off-by: Kalle Valo commit fd567467753fac9f9f477550065018e7f4e3c8f3 Author: Thomas Hellstrom Date: Wed Dec 12 11:52:08 2018 +0100 drm/vmwgfx: Protect from excessive execbuf kernel memory allocations v3 With the new validation code, a malicious user-space app could potentially submit command streams with enough buffer-object and resource references in them to have the resulting allocated validion nodes and relocations make the kernel run out of GFP_KERNEL memory. Protect from this by having the validation code reserve TTM graphics memory when allocating. Signed-off-by: Thomas Hellstrom Reviewed-by: Deepak Rawat --- v2: Removed leftover debug printouts commit 30360224441ce89a98ed627861e735beb4010775 Author: Jörgen Storvist Date: Wed Dec 12 21:47:36 2018 +0100 USB: serial: option: add Fibocom NL668 series Added USB serial option driver support for Fibocom NL668 series cellular modules. Reserved USB endpoints 4, 5 and 6 for network + ADB interfaces. usb-devices output (QMI mode) T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1508 ProdID=1001 Rev=03.18 S: Manufacturer=Nodecom NL668 Modem S: Product=Nodecom NL668-CN Modem S: SerialNumber= C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) usb-devices output (ECM mode) T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 17 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1508 ProdID=1001 Rev=03.18 S: Manufacturer=Nodecom NL668 Modem S: Product=Nodecom NL668-CN Modem S: SerialNumber= C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 4 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether I: If#= 5 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) Signed-off-by: Jörgen Storvist Cc: stable Signed-off-by: Johan Hovold commit fa2bf86bab4bbc61e5678a42a14e40075093a98f Author: Tal Gilboa Date: Thu Nov 22 14:20:45 2018 +0200 net/mlx5e: Cancel DIM work on close SQ TXQ SQ closure is followed by closing the corresponding CQ. A pending DIM work would try to modify the now non-existing CQ. This would trigger an error: [85535.835926] mlx5_core 0000:af:00.0: mlx5_cmd_check:769:(pid 124399): MODIFY_CQ(0x403) op_mod(0x0) failed, status bad resource state(0x9), syndrome (0x1d7771) Fix by making sure to cancel any pending DIM work before destroying the SQ. Fixes: cbce4f444798 ("net/mlx5e: Enable adaptive-TX moderation") Signed-off-by: Tal Gilboa Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit d13b224f431579fe2d712871d4265d7a22ca6c9c Author: Mikhael Goikhman Date: Mon Nov 19 19:11:12 2018 +0200 net/mlx5e: Remove unused UDP GSO remaining counter Remove tx_udp_seg_rem counter from ethtool output, as it is no longer being updated in the driver's data flow. Fixes: 3f44899ef2ce ("net/mlx5e: Use PARTIAL_GSO for UDP segmentation") Signed-off-by: Mikhael Goikhman Reviewed-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed commit 61c806dafe81c58f41fec10fb5cad0d3a4390e3e Author: Or Gerlitz Date: Mon Dec 10 17:05:59 2018 +0200 net/mlx5e: Avoid encap flows deletion attempt the 1st time a neigh is resolved Currently, we are deleting offloaded encap flows in case the relevant neigh becomes unconnected while the encap is valid (a sign that it used to be connected), or if the curr neigh mac is different from the cached mac (a sign that the remote side changed their mac). The 2nd check also applies when the neigh becomes connected on the 1st time (we start with zero mac). Before the offending commit, the deleting handler was practically no op, as no flows were offloaded. But since that commit, we offload neigh-less encap flows to slow path. Under mirroring scheme, we go into the delete handler, attempt to unoffload a mirror rule which was never set (as we were offloading to slow path) and crash. Fix that by calling the delete handler only when the encap is valid, which covers both cases mentioned above. Fixes: 5dbe906ff1d5 ('net/mlx5e: Use a slow path rule instead if vxlan neighbour isn't available') Signed-off-by: Or Gerlitz Signed-off-by: Eli Britstein Reviewed-by: Paul Blakey Signed-off-by: Saeed Mahameed commit 154e62abe9cd07c9b71735d8456a03a7c5251280 Author: Or Gerlitz Date: Mon Dec 10 12:31:42 2018 +0200 net/mlx5e: Properly initialize flow attributes for slow path eswitch rule deletion When a neighbour is resolved, we delete the goto slow path rule from HW. The eswitch flow attributes where not properly initialized on that case, hence we mess up the eswitch refcounts for chain zero (the default one). Fix that along with making sure to use semicolons and not commas on that code; Fixes: 5dbe906ff1d5 ('net/mlx5e: Use a slow path rule instead if vxlan neighbour isn't available') Signed-off-by: Or Gerlitz Reviewed-by: Paul Blakey Signed-off-by: Saeed Mahameed commit d14f6f2a84326dd2751962167b2293fc91751ff8 Author: Or Gerlitz Date: Sun Dec 9 17:15:23 2018 +0200 net/mlx5e: Avoid overriding the user provided priority for offloaded tc rules Just a leftover which was wrongly left there, remove it while spawning a message to suggest firmware upgrade. Fixes: bf07aa730a04 ('net/mlx5e: Support offloading tc priorities and chains for eswitch flows') Signed-off-by: Or Gerlitz Reviewed-by: Paul Blakey Signed-off-by: Saeed Mahameed commit e88afe759a49f8d51d6cc5fc89d65b4a5768703f Author: Or Gerlitz Date: Sun Dec 9 17:03:36 2018 +0200 net/mlx5e: Err if asked to mirror a goto chain tc eswitch rule Currently we are not supporting this and not err-ing on that either. For now, just err if asked to do that. Fixes: bf07aa730a04 ('net/mlx5e: Support offloading tc priorities and chains for eswitch flows') Signed-off-by: Or Gerlitz Reported-by: Eli Britstein Reviewed-by: Eli Britstein Signed-off-by: Saeed Mahameed commit e1c15b62b7015119d3e5915cd2ae3b89d59c2576 Author: Moshe Shemesh Date: Fri Nov 2 06:10:49 2018 +0200 net/mlx5e: RX, Verify MPWQE stride size is in range Add check of MPWQE stride size is within range supported by HW. In case calculated MPWQE stride size exceed range, linear SKB can't be used and we should use non linear MPWQE instead. Fixes: 619a8f2a42f1 ("net/mlx5e: Use linear SKB in Striding RQ") Signed-off-by: Moshe Shemesh Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 8956f0014ea5ed824aae3816fd9e52cf3c85b9d4 Author: Gavi Teitz Date: Mon Nov 19 17:22:30 2018 +0200 net/mlx5e: Fix default amount of channels for VF representors The default amount of channels a representor opens was erroneously changed from one to the maximum amount of channels, restore to its intended value. Fixes: 779d986d60de ("net/mlx5e: Do not ignore netdevice TX/RX queues number") Signed-off-by: Gavi Teitz Reviewed-by: Or Gerlitz Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 663f146f2ecfcc47934cb9f9543f664eeb6adb46 Author: Vu Pham Date: Wed Oct 31 16:03:21 2018 +0200 net/mlx5: E-Switch, Fix fdb cap bits swap The cap bits locations for the fdb caps of multi path to table (used for local mirroring) and multi encap (used for prio/chains) were wrongly used in swapped locations. This went unnoted so far b/c we tested the offending patch with CX5 FW that supports both of them. On different environments where not both caps are supported, we will be messed up, fix that. Fixes: b9aa0ba17af5 ('net/mlx5: Add cap bits for multi fdb encap') Signed-off-by: Vu Pham Reviewed-by: Or Gerlitz Tested-by: Or Gerlitz Signed-off-by: Saeed Mahameed commit 9e69efd453211a3646fba9262d3e7819f80b2949 Merge: 3b076cfe86be 86a07da34380 Author: David S. Miller Date: Wed Dec 12 21:56:20 2018 -0800 Merge branch 'vhost-fixes' Jason Wang says: ==================== Fix various issue of vhost This series tries to fix various issues of vhost: - Patch 1 adds a missing write barrier between used idx updating and logging. - Patch 2-3 brings back the protection of device IOTLB through vq mutex, this fixes possible use after free in device IOTLB entries. Please consider them for -stable. Changes from V2: - drop dirty page fix and make it for net-next Changes from V1: - silent compiler warning for 32bit. - use mutex_trylock() on slowpath instead of mutex_lock() even on fast path. ==================== Signed-off-by: David S. Miller commit 86a07da34380bc9467fa407dc3e484488a8ad40d Author: Jason Wang Date: Thu Dec 13 10:53:39 2018 +0800 Revert "net: vhost: lock the vqs one by one" This reverts commit 78139c94dc8c96a478e67dab3bee84dc6eccb5fd. We don't protect device IOTLB with vq mutex, which will lead e.g use after free for device IOTLB entries. And since we've switched to use mutex_trylock() in previous patch, it's safe to revert it without having deadlock. Fixes: commit 78139c94dc8c ("net: vhost: lock the vqs one by one") Cc: Tonghao Zhang Acked-by: Michael S. Tsirkin Signed-off-by: Jason Wang Signed-off-by: David S. Miller commit 476e8ba712fa6a479192dfc4301cd3765d9ba713 Author: Jason Wang Date: Thu Dec 13 10:53:38 2018 +0800 vhost_net: switch to use mutex_trylock() in vhost_net_busy_poll() We used to hold the mutex of paired virtqueue in vhost_net_busy_poll(). But this will results an inconsistent lock order which may cause deadlock if we try to bring back the protection of device IOTLB with vq mutex that requires to hold mutex of all virtqueues at the same time. Fix this simply by switching to use mutex_trylock(), when fail just skip the busy polling. This can happen when device IOTLB is under updating which should be rare. Fixes: commit 78139c94dc8c ("net: vhost: lock the vqs one by one") Cc: Tonghao Zhang Acked-by: Michael S. Tsirkin Signed-off-by: Jason Wang Signed-off-by: David S. Miller commit 841df922417eb82c835e93d4b93eb6a68c99d599 Author: Jason Wang Date: Thu Dec 13 10:53:37 2018 +0800 vhost: make sure used idx is seen before log in vhost_add_used_n() We miss a write barrier that guarantees used idx is updated and seen before log. This will let userspace sync and copy used ring before used idx is update. Fix this by adding a barrier before log_write(). Fixes: 8dd014adfea6f ("vhost-net: mergeable buffers support") Acked-by: Michael S. Tsirkin Signed-off-by: Jason Wang Signed-off-by: David S. Miller commit 3b076cfe86be3784dee93cfd83d6913a9ef530ee Merge: 18330c58e309 96d1a731611f Author: David S. Miller Date: Wed Dec 12 21:43:43 2018 -0800 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue Jeff Kirsher says: ==================== Intel Wired LAN Driver Fixes 2018-12-12 This series contains fixes to i40e and ixgbe. Stefan Assmann fixes an issue created by a previous fix, where ether_addr_copy() was moved to avoid a race but did not take into account that it alters the MAC address being handed to i40e_del_mac_filter(). Michał Mirosław provides 2 fixes for i40e, first resolves issues in the hardware VLAN offload where VLAN.TCI equal to 0 was being dropped and a race between disabling VLAN receive feature in hardware and processing the receive queue, where packets could have their VLAN information dropped. Ross Lagerwall fixes a racy condition during a ixgbe VF reset, where writing the register to issue a reset and sending the reset message via the mailbox API could result of the mailbox memory getting cleared during the reset before the message gets successfully sent which results in a VF driver malfunction. ==================== Signed-off-by: David S. Miller commit 18330c58e309d88261cf981c04c91f9130402594 Merge: 9463b9a4e0e4 d4e7df16567b Author: David S. Miller Date: Wed Dec 12 21:36:12 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Fix warnings suspicious rcu usage when handling base chain statistics, from Taehee Yoo. 2) Refetch pointer to tcp header from nf_ct_sack_adjust() since skb_make_writable() may reallocate data area, reported by Google folks patch from Florian. 3) Incorrect netlink nest end after previous cancellation from error path in ipset, from Pan Bian. 4) Use dst_hold_safe() from nf_xfrm_me_harder(), from Florian. 5) Use rb_link_node_rcu() for rcu-protected rbtree node in nf_conncount, from Taehee Yoo. ==================== Signed-off-by: David S. Miller commit 67f2a93099cca369c056e591c82f1d1bc726c945 Merge: 14a996c38312 2af6c0703d75 Author: Linus Torvalds Date: Wed Dec 12 18:29:24 2018 -0800 Merge tag 'for-4.20/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - Fix DM cache metadata to verify that a cache has block before trying to continue with operation that requires them. - Fix bio-based DM core's dm_make_request() to properly impose device limits on individual bios by making use of blk_queue_split(). - Fix long-standing race with how DM thinp notified userspace of thin-pool mode state changes before they were actually made. - Fix the zoned target's bio completion handling; this is a fairly invassive fix at this stage but it is localized to the zoned target. Any zoned target users will benefit from this fix. * tag 'for-4.20/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm thin: bump target version dm thin: send event about thin-pool state change _after_ making it dm zoned: Fix target BIO completion handling dm: call blk_queue_split() to impose device limits on bios dm cache metadata: verify cache has blocks in blocks_are_clean_separate_dirty() commit 14a996c383129525e55bab07e4857d08f6b61dda Merge: e6333d72cb37 078ab3ea2c3b Author: Linus Torvalds Date: Wed Dec 12 18:24:32 2018 -0800 Merge tag 'media/v4.20-5' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - one regression at vsp1 driver - some last time changes for the upcoming request API logic and for stateless codec support. As the stateless codec "cedrus" driver is at staging, don't apply the MPEG controls as part of the main V4L2 API, as those may not be ready for production yet. * tag 'media/v4.20-5' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: Add a Kconfig option for the Request API media: extended-controls.rst: add note to the MPEG2 state controls media: mpeg2-ctrls.h: move MPEG2 state controls to non-public header media: vicodec: set state resolution from raw format media: vivid: drop v4l2_ctrl_request_complete() from start_streaming media: vb2: don't unbind/put the object when going to state QUEUED media: vb2: keep a reference to the request until dqbuf media: vb2: skip request checks for VIDIOC_PREPARE_BUF media: vb2: don't call __vb2_queue_cancel if vb2_start_streaming failed media: cedrus: Fix a NULL vs IS_ERR() check media: vsp1: Fix LIF buffer thresholds commit e6333d72cb373239400969f5d10204c094a9712a Merge: 70f4828201e3 ec7ba118b940 Author: Linus Torvalds Date: Wed Dec 12 18:19:44 2018 -0800 Merge tag 'ovl-fixes-4.20-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs Pull overlayfs fixes from Miklos Szeredi: "Needed to revert a patch, because it possibly introduces a security hole. Since the patch is basically a conceptual cleanup, not a bug fix, it's safe to revert. I'm not giving up on this, and discussions seemed to have reached an agreement over how to move forward, but that can wait 'till the next release. The other two patches are fixes for bugs introduced in recent releases" * tag 'ovl-fixes-4.20-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs: Revert "ovl: relax permission checking on underlying layers" ovl: fix decode of dir file handle with multi lower layers ovl: fix missing override creds in link of a metacopy upper commit 70f4828201e3bc9a5ac52d1f7ede06e56194268a Merge: b5884002dc39 2e64ff154ce6 Author: Linus Torvalds Date: Wed Dec 12 18:17:35 2018 -0800 Merge tag 'fuse-fixes-4.20-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse fixes from Miklos Szeredi: "There's one patch fixing a minor but long lived bug, the others are fixing regressions introduced in this cycle" * tag 'fuse-fixes-4.20-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: fuse: continue to send FUSE_RELEASEDIR when FUSE_OPEN returns ENOSYS fuse: Fix memory leak in fuse_dev_free() fuse: fix revalidation of attributes for permission check fuse: fix fsync on directory fuse: Add bad inode check in fuse_destroy_inode() commit b5884002dc39fac45941ec408cd20d7a04f7b9c7 Merge: f5d582777bcb 2840f84f7403 Author: Linus Torvalds Date: Wed Dec 12 18:15:29 2018 -0800 Merge tag 'trace-v4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: "While running various ftrace tests on new development code, the kmemleak detector found some allocations that were not freed correctly. This fixes a couple of leaks in the event trigger code as well as in adding function trace filters in trace instances" * tag 'trace-v4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Fix memory leak of instance function hash filters tracing: Fix memory leak in set_trigger_filter() tracing: Fix memory leak in create_filter() commit 61cce6f6eeced5ddd9cac55e807fe28b4f18c1ba Author: Jens Axboe Date: Wed Dec 12 06:46:55 2018 -0700 scsi: sd: use mempool for discard special page When boxes are run near (or to) OOM, we have a problem with the discard page allocation in sd. If we fail allocating the special page, we return busy, and it'll get retried. But since ordering is honored for dispatch requests, we can keep retrying this same IO and failing. Behind that IO could be requests that want to free memory, but they never get the chance. This means you get repeated spews of traces like this: [1201401.625972] Call Trace: [1201401.631748] dump_stack+0x4d/0x65 [1201401.639445] warn_alloc+0xec/0x190 [1201401.647335] __alloc_pages_slowpath+0xe84/0xf30 [1201401.657722] ? get_page_from_freelist+0x11b/0xb10 [1201401.668475] ? __alloc_pages_slowpath+0x2e/0xf30 [1201401.679054] __alloc_pages_nodemask+0x1f9/0x210 [1201401.689424] alloc_pages_current+0x8c/0x110 [1201401.699025] sd_setup_write_same16_cmnd+0x51/0x150 [1201401.709987] sd_init_command+0x49c/0xb70 [1201401.719029] scsi_setup_cmnd+0x9c/0x160 [1201401.727877] scsi_queue_rq+0x4d9/0x610 [1201401.736535] blk_mq_dispatch_rq_list+0x19a/0x360 [1201401.747113] blk_mq_sched_dispatch_requests+0xff/0x190 [1201401.758844] __blk_mq_run_hw_queue+0x95/0xa0 [1201401.768653] blk_mq_run_work_fn+0x2c/0x30 [1201401.777886] process_one_work+0x14b/0x400 [1201401.787119] worker_thread+0x4b/0x470 [1201401.795586] kthread+0x110/0x150 [1201401.803089] ? rescuer_thread+0x320/0x320 [1201401.812322] ? kthread_park+0x90/0x90 [1201401.820787] ? do_syscall_64+0x53/0x150 [1201401.829635] ret_from_fork+0x29/0x40 Ensure that the discard page allocation has a mempool backing, so we know we can make progress. Cc: stable@vger.kernel.org Signed-off-by: Jens Axboe Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen commit 9e6371d3c6913ff1707fb2c0274c9925f7aaef80 Author: Varun Prakash Date: Fri Nov 9 20:59:46 2018 +0530 scsi: target: iscsi: cxgbit: add missing spin_lock_init() Add missing spin_lock_init() for cdev->np_lock. Signed-off-by: Varun Prakash Signed-off-by: Martin K. Petersen commit ed076c55b359cc9982ca8b065bcc01675f7365f6 Author: Varun Prakash Date: Fri Nov 9 20:59:01 2018 +0530 scsi: target: iscsi: cxgbit: fix csk leak In case of arp failure call cxgbit_put_csk() to free csk. Signed-off-by: Varun Prakash Signed-off-by: Martin K. Petersen commit 9463b9a4e0e480a70d366c0cbbfd0c814fd35d90 Merge: 5146f95df782 9061193c4ee0 Author: David S. Miller Date: Wed Dec 12 16:25:14 2018 -0800 Merge branch 'bnx2x-Fix-series' Sudarsana Reddy Kalluru says: ==================== bnx2x: Fix series The patch series addresses few important issues in the bnx2x driver. Please consider applying it 'net' tree. ==================== Signed-off-by: David S. Miller commit 9061193c4ee065d3240fde06767c2e06ec61decc Author: Sudarsana Reddy Kalluru Date: Wed Dec 12 08:57:03 2018 -0800 bnx2x: Send update-svid ramrod with retry/poll flags enabled Driver sends update-SVID ramrod in the MFW notification path. If there is a pending ramrod, driver doesn't retry the command and storm firmware will never be updated with the SVID value. The patch adds changes to send update-svid ramrod in process context with retry/poll flags set. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Ariel Elior Signed-off-by: David S. Miller commit 07f12622a66320d5f56a71a921cf70a43e7a6b87 Author: Sudarsana Reddy Kalluru Date: Wed Dec 12 08:57:02 2018 -0800 bnx2x: Enable PTP only on the PF that initializes the port There will be only one PHC clock per port. PTP should be enabled only on one PF per port. The change enables PTP functionality on the PF that initializes the port. The change is useful in multi-function modes e.g., NPAR where a port can have more than one PF. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Ariel Elior Signed-off-by: David S. Miller commit 04f05230c5c13b1384f66f5186a68d7499e34622 Author: Sudarsana Reddy Kalluru Date: Wed Dec 12 08:57:01 2018 -0800 bnx2x: Remove configured vlans as part of unload sequence. Vlans are not getting removed when drivers are unloaded. The recent storm firmware versions had added safeguards against re-configuring an already configured vlan. As a result, PF inner reload flows (e.g., mtu change) might trigger an assertion. This change is going to remove vlans (same as we do for MACs) when doing a chip cleanup during unload. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Ariel Elior Signed-off-by: David S. Miller commit bbf666c1af916ed74795493c564df6fad462cc80 Author: Sudarsana Reddy Kalluru Date: Wed Dec 12 08:57:00 2018 -0800 bnx2x: Clear fip MAC when fcoe offload support is disabled On some customer setups it was observed that shmem contains a non-zero fip MAC for 57711 which would lead to enabling of SW FCoE. Add a software workaround to clear the bad fip mac address if no FCoE connections are supported. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Ariel Elior Signed-off-by: David S. Miller commit d4e7df16567b80836a78d31b42f1a9355a636d67 Author: Taehee Yoo Date: Sat Dec 8 11:03:01 2018 +0900 netfilter: nf_conncount: use rb_link_node_rcu() instead of rb_link_node() rbnode in insert_tree() is rcu protected pointer. So, in order to handle this pointer, _rcu function should be used. rb_link_node_rcu() is a rcu version of rb_link_node(). Fixes: 34848d5c896e ("netfilter: nf_conncount: Split insert and traversal") Signed-off-by: Taehee Yoo Signed-off-by: Pablo Neira Ayuso commit 542fbda0f08f1cbbc250f9e59f7537649651d0c8 Author: Florian Westphal Date: Tue Dec 11 07:45:29 2018 +0100 netfilter: nat: can't use dst_hold on noref dst The dst entry might already have a zero refcount, waiting on rcu list to be free'd. Using dst_hold() transitions its reference count to 1, and next dst release will try to free it again -- resulting in a double free: WARNING: CPU: 1 PID: 0 at include/net/dst.h:239 nf_xfrm_me_harder+0xe7/0x130 [nf_nat] RIP: 0010:nf_xfrm_me_harder+0xe7/0x130 [nf_nat] Code: 48 8b 5c 24 60 65 48 33 1c 25 28 00 00 00 75 53 48 83 c4 68 5b 5d 41 5c c3 85 c0 74 0d 8d 48 01 f0 0f b1 0a 74 86 85 c0 75 f3 <0f> 0b e9 7b ff ff ff 29 c6 31 d2 b9 20 00 48 00 4c 89 e7 e8 31 27 Call Trace: nf_nat_ipv4_out+0x78/0x90 [nf_nat_ipv4] nf_hook_slow+0x36/0xd0 ip_output+0x9f/0xd0 ip_forward+0x328/0x440 ip_rcv+0x8a/0xb0 Use dst_hold_safe instead and bail out if we cannot take a reference. Fixes: a4c2fd7f7891 ("net: remove DST_NOCACHE flag") Reported-by: Martin Zaharinov Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 708abf74dd87f8640871b814faa195fb5970b0e3 Author: Pan Bian Date: Mon Dec 10 14:39:37 2018 +0100 netfilter: ipset: do not call ipset_nest_end after nla_nest_cancel In the error handling block, nla_nest_cancel(skb, atd) is called to cancel the nest operation. But then, ipset_nest_end(skb, atd) is unexpected called to end the nest operation. This patch calls the ipset_nest_end only on the branch that nla_nest_cancel is not called. Fixes: 45040978c899 ("netfilter: ipset: Fix set:list type crash when flush/dump set in parallel") Signed-off-by: Pan Bian Signed-off-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso commit a805ce683f4cd7609730ee169dca38644b70e3fa Merge: 28adac6f74ef a0071bc455da Author: Dave Airlie Date: Thu Dec 13 09:55:05 2018 +1000 Merge branch 'mediatek-drm-fixes-4.20' of https://github.com/ckhu-mediatek/linux.git-tags into drm-fixes Single bridge attachment fix. Signed-off-by: Dave Airlie From: CK Hu Link: https://patchwork.freedesktop.org/patch/msgid/1544407975.18825.3.camel@mtksdaap41 commit 96d1a731611f711f0cb82cea93363ae2ea8cb028 Author: Ross Lagerwall Date: Wed Dec 5 13:54:26 2018 +0000 ixgbe: Fix race when the VF driver does a reset When the VF driver does a reset, it (at least the Linux one) writes to the VFCTRL register to issue a reset and then immediately sends a reset message using the mailbox API. This is racy because when the PF driver detects that the VFCTRL register reset pin has been asserted, it clears the mailbox memory. Depending on ordering, the reset message sent by the VF could be cleared by the PF driver. It then responds to the cleared message with a NACK which causes the VF driver to malfunction. Fix this by deferring clearing the mailbox memory until the reset message is received. Fixes: 939b701ad633 ("ixgbe: fix driver behaviour after issuing VFLR") Signed-off-by: Ross Lagerwall Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 800b8f637d07cc00a05e2e0d847d8d7c61745654 Author: Michał Mirosław Date: Tue Dec 4 18:31:15 2018 +0100 i40e: DRY rx_ptype handling code Move rx_ptype extracting to i40e_process_skb_fields() to avoid duplicating the code. Signed-off-by: Michał Mirosław Signed-off-by: Michał Mirosław Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 5146f95df782b0ac61abde36567e718692725c89 Author: Hui Peng Date: Wed Dec 12 12:42:24 2018 +0100 USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data The function hso_probe reads if_num from the USB device (as an u8) and uses it without a length check to index an array, resulting in an OOB memory read in hso_probe or hso_get_config_data. Add a length check for both locations and updated hso_probe to bail on error. This issue has been assigned CVE-2018-19985. Reported-by: Hui Peng Reported-by: Mathias Payer Signed-off-by: Hui Peng Signed-off-by: Mathias Payer Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Greg Kroah-Hartman Signed-off-by: David S. Miller commit 2a508c64ad278d022543ec3360449c7f243eb56b Author: Michał Mirosław Date: Tue Dec 4 18:31:14 2018 +0100 i40e: fix VLAN.TCI == 0 RX HW offload This fixes two bugs in hardware VLAN offload: 1. VLAN.TCI == 0 was being dropped 2. there was a race between disabling of VLAN RX feature in hardware and processing RX queue, where packets processed in this window could have their VLAN information dropped Fix moves the VLAN handling into i40e_process_skb_fields() to save on duplicated code. i40e_receive_skb() becomes trivial and so is removed. Signed-off-by: Michał Mirosław Signed-off-by: Michał Mirosław Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 28adac6f74ef2b3dc0bd10df9fccb2e3d3e52acc Author: Daniel Vetter Date: Mon Dec 10 11:30:01 2018 +0100 MAINTAINERS: Daniel for drm co-maintainer lkml and Linus gained a CoC, and it's serious this time. Which means my no 1 reason for declining to officially step up as drm maintainer is gone, and I didn't find any new good excuse. I chatted with a few people in private already, and the biggest concern is that I mislay my community hat and start running around with my intel hat only. Or some other convenient abuse of trust. That's why this patch doesn't just need a lot of acks that mean "yeah seems fine to me", but a lot of acks that mean "yeah we'll tell you when you're over the line and usurp you from that comfy chair if you don't get it". Which I think we've been done a fairly good job here at dri-devel in general, but better to be clear. Rough idea is that I'll do this for maybe 2-3 years, helping Dave figure out a group model for drm overall. And getting the tooling and infrastructure for that off the ground. Then step down again because some other shiny thing that needs chasing. Of course as plans tend to do, this one will probably pan out a bit different in reality. Cc: David Airlie Cc: Linus Torvalds Signed-off-by: Daniel Vetter Acked-by: Christian König Acked-by: Rodrigo Vivi Acked-by: Alex Deucher Acked-by: Eric Anholt Acked-by: Gerd Hoffmann Acked-by: Daniel Stone Signed-off-by: Daniel Vetter Acked-by: Neil Armstrong Acked-by: Thierry Reding Acked-by: Thomas Hellstrom Acked-by: Sean Paul Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20181210103001.30549-1-daniel.vetter@ffwll.ch commit b5f436e7b4c2fcdb96204dbba346bddc7fc3e850 Merge: 26eacb788b7e 24199c5436f2 Author: Dave Airlie Date: Thu Dec 13 09:32:41 2018 +1000 Merge branch 'linux-4.20' of git://github.com/skeggsb/linux into drm-fixes Three fixes: tegra regression fix display flushing fix mst cleanup fix. Signed-off-by: Dave Airlie From: Ben Skeggs Link: https://patchwork.freedesktop.org/patch/msgid/CACAvsv7WCPzjQZonk+eS1FgEUKirz-4LOrVpMUVMM=D-GjbVpg@mail.gmail.com commit 26eacb788b7e37f9b08e6e6fc9686bf0817c0163 Merge: e59166b59aad 676fff1a5512 Author: Dave Airlie Date: Thu Dec 13 09:24:18 2018 +1000 Merge branch 'drm-fixes-4.20' of git://people.freedesktop.org/~agd5f/linux into drm-fixes Fixes for 4.20: - Stability fixes for new polaris variants (e.g., RX590) - New vega pci ids - Vega20 smu fix - Ctx locking fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20181212203022.3054-1-alexander.deucher@amd.com commit 158daed16efb1170694e420ae06ba8ba954d82e5 Author: Stefan Assmann Date: Tue Dec 4 15:18:52 2018 +0100 i40e: fix mac filter delete when setting mac address A previous commit moved the ether_addr_copy() in i40e_set_mac() before the mac filter del/add to avoid a race. However it wasn't taken into account that this alters the mac address being handed to i40e_del_mac_filter(). Also changed i40e_add_mac_filter() to operate on netdev->dev_addr, hopefully that makes the code easier to read. Fixes: 458867b2ca0c ("i40e: don't remove netdev->dev_addr when syncing uc list") Signed-off-by: Stefan Assmann Tested-by: Andrew Bowers Acked-by: Jacob Keller Signed-off-by: Jeff Kirsher commit e59166b59aad95d313cfc4cfe32240f1608b33d4 Merge: ce07fe9e1cec 63238173b2fa Author: Dave Airlie Date: Thu Dec 13 07:25:00 2018 +1000 Merge tag 'drm-misc-fixes-2018-12-12' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes - rockchip: Revert change causing WARN on shutdown (Brian) Cc: Brian Norris Signed-off-by: Dave Airlie From: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20181212204309.GA150523@art_vandelay commit ce07fe9e1cec520d343e31f1bf61949fe1b4411e Merge: 71fb55397455 5b2e31201c26 Author: Dave Airlie Date: Thu Dec 13 07:22:47 2018 +1000 Merge tag 'drm-intel-fixes-2018-12-12-1' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Two fixes to avoid GPU hangs (on Braswell and Gen3) Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20181212134010.GA18900@jlahtine-desk.ger.corp.intel.com commit 71fb553974556e29ebf6fa3cf6bd73342e7dbc5d Merge: 40e020c129cf d76b21ebf8ff Author: Dave Airlie Date: Thu Dec 13 07:21:29 2018 +1000 Merge tag 'drm-intel-fixes-2018-12-07' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Fix for system crash after GPU hang (Bugzilla #107945) - GVT fix for guest graphics corruption (https://github.com/intel/gvt-linux/issues/61) Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20181207104352.GA18214@jlahtine-desk.ger.corp.intel.com commit 676fff1a5512e7971aa9a235052d253df8f5284a Author: Evan Quan Date: Wed Dec 12 14:56:14 2018 +0800 drm/amdgpu: drop fclk/gfxclk ratio setting Since this is not needed any more on the latest SMC firmware. Signed-off-by: Evan Quan Acked-by: Feifei Xu Signed-off-by: Alex Deucher commit 37fbd834b4e492dc41743830cbe435f35120abd8 Author: Mark Zhang Date: Wed Dec 5 15:50:49 2018 +0200 IB/core: Fix oops in netdev_next_upper_dev_rcu() When support for bonding of RoCE devices was added, there was necessarily a link between the RoCE device and the paired netdevice that was part of the bond. If you remove the mlx4_en module, that paired association is broken (the RoCE device is still present but the paired netdevice has been released). We need to account for this in is_upper_ndev_bond_master_filter() and filter out those links with a broken pairing or else we later oops in netdev_next_upper_dev_rcu(). Fixes: 408f1242d940 ("IB/core: Delete lower netdevice default GID entries in bonding scenario") Signed-off-by: Mark Zhang Reviewed-by: Parav Pandit Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford commit cc6730df08a291e51e145bc65e24ffb5e2f17ab6 Author: Jörgen Storvist Date: Wed Dec 12 08:39:39 2018 +0100 USB: serial: option: add Simcom SIM7500/SIM7600 (MBIM mode) Added USB serial option driver support for Simcom SIM7500/SIM7600 series cellular modules exposing MBIM interface (VID 0x1e0e,PID 0x9003) T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 14 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1e0e ProdID=9003 Rev=03.18 S: Manufacturer=SimTech, Incorporated S: Product=SimTech, Incorporated S: SerialNumber=0123456789ABCDEF C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 5 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim I: If#= 6 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim Signed-off-by: Jörgen Storvist Cc: stable Signed-off-by: Johan Hovold commit 70a7444c550a75584ffcfae95267058817eff6a7 Author: Jörgen Storvist Date: Tue Dec 11 18:28:28 2018 +0100 USB: serial: option: add GosunCn ZTE WeLink ME3630 Added USB serial option driver support for GosunCn ZTE WeLink ME3630 series cellular modules for USB modes ECM/NCM and MBIM. usb-devices output MBIM mode: T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=19d2 ProdID=0602 Rev=03.18 S: Manufacturer=Android S: Product=Android S: SerialNumber= C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim I: If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim usb-devices output ECM/NCM mode: T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=19d2 ProdID=1476 Rev=03.18 S: Manufacturer=Android S: Product=Android S: SerialNumber= C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether I: If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether Signed-off-by: Jörgen Storvist Cc: stable Signed-off-by: Johan Hovold commit 2af6c0703d75fc3ff2e6de19b4b3adab96acc12d Author: Mike Snitzer Date: Wed Dec 12 09:39:54 2018 -0500 dm thin: bump target version Decoupled version bump from commit f6c367585d0 ("dm thin: send event about thin-pool state change _after_ making it") because version bumps just create conflicts when backporting to the stable trees. Signed-off-by: Mike Snitzer commit e06d45d8c165a0b1a7aaa1b794c78d2db911c8f6 Author: Colin Ian King Date: Thu Oct 4 18:49:53 2018 +0100 drm/vmwgfx: remove redundant return ret statement The return statement is redundant as there is a return statement immediately before it so we have dead code that can be removed. Also remove the unused declaration of ret. Detected by CoverityScan, CID#1473793 ("Structurally dead code") Signed-off-by: Colin Ian King Reviewed-by: Thomas Hellstrom Signed-off-by: Thomas Hellstrom commit 5b2e31201c268c2331a209af799d667619216d40 Author: Chris Wilson Date: Fri Dec 7 13:40:37 2018 +0000 drm/i915: Flush GPU relocs harder for gen3 Adding an extra MI_STORE_DWORD_IMM to the gpu relocation path for gen3 was good, but still not good enough. To survive 24+ hours under test we needed to perform not one, not two but three extra store-dw. Doing so for each GPU relocation was a little unsightly and since we need to worry about userspace hitting the same issues, we should apply the dummy store-dw into the EMIT_FLUSH. Fixes: 7dd4f6729f92 ("drm/i915: Async GPU relocation processing") References: 7fa28e146994 ("drm/i915: Write GPU relocs harder with gen3") Testcase: igt/gem_tiled_fence_blits # blb/pnv Signed-off-by: Chris Wilson Cc: Joonas Lahtinen Reviewed-by: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20181207134037.11848-1-chris@chris-wilson.co.uk (cherry picked from commit a889580c087a9cf91fddb3832ece284174214183) Signed-off-by: Joonas Lahtinen commit fe78742d7f84e3803b760cdbb1ddbdedfca9640b Author: Chris Wilson Date: Tue Dec 4 14:15:16 2018 +0000 drm/i915: Allocate a common scratch page Currently we allocate a scratch page for each engine, but since we only ever write into it for post-sync operations, it is not exposed to userspace nor do we care for coherency. As we then do not care about its contents, we can use one page for all, reducing our allocations and avoid complications by not assuming per-engine isolation. For later use, it simplifies engine initialisation (by removing the allocation that required struct_mutex!) and means that we can always rely on there being a scratch page. v2: Check that we allocated a large enough scratch for I830 w/a Fixes: 06e562e7f515 ("drm/i915/ringbuffer: Delay after EMIT_INVALIDATE for gen4/gen5") # v4.18.20 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108850 Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: Mika Kuoppala Reviewed-by: Mika Kuoppala Link: https://patchwork.freedesktop.org/patch/msgid/20181204141522.13640-1-chris@chris-wilson.co.uk Cc: Joonas Lahtinen Cc: # v4.18.20+ (cherry picked from commit 5179749925933575a67f9d8f16d0cc204f98a29f) [Joonas: Use new function in gen9_init_indirectctx_bb too] Signed-off-by: Joonas Lahtinen commit cf66b8a0ba142fbd1bf10ac8f3ae92d1b0cb7b8f Author: Chris Wilson Date: Thu Dec 6 08:44:31 2018 +0000 drm/i915/execlists: Apply a full mb before execution for Braswell Braswell is really picky about having our writes posted to memory before we execute or else the GPU may see stale values. A wmb() is insufficient as it only ensures the writes are visible to other cores, we need a full mb() to ensure the writes are in memory and visible to the GPU. The most frequent failure in flushing before execution is that we see stale PTE values and execute the wrong pages. References: 987abd5c62f9 ("drm/i915/execlists: Force write serialisation into context image vs execution") Signed-off-by: Chris Wilson Cc: Mika Kuoppala Cc: Tvrtko Ursulin Cc: Joonas Lahtinen Cc: stable@vger.kernel.org Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20181206084431.9805-3-chris@chris-wilson.co.uk (cherry picked from commit 490b8c65b9db45896769e1095e78725775f47b3e) Signed-off-by: Joonas Lahtinen commit 24199c5436f267399afed0c4f1f57663c0408f57 Author: Lyude Paul Date: Tue Dec 11 18:56:20 2018 -0500 drm/nouveau/kms: Fix memory leak in nv50_mstm_del() Noticed this while working on redoing the reference counting scheme in the DP MST helpers. Nouveau doesn't attempt to call drm_dp_mst_topology_mgr_destroy() at all, which leaves it leaking all of the resources for drm_dp_mst_topology_mgr and it's children mstbs+ports. Fixes: f479c0ba4a17 ("drm/nouveau/kms/nv50: initial support for DP 1.2 multi-stream") Signed-off-by: Lyude Paul Cc: # v4.10+ Signed-off-by: Ben Skeggs commit 970a5ee41c72df46e3b0f307528c7d8ef7734a2e Author: Ben Skeggs Date: Wed Dec 12 16:51:17 2018 +1000 drm/nouveau/kms/nv50-: also flush fb writes when rewinding push buffer Should hopefully fix a regression some people have been seeing since EVO push buffers were moved to VRAM by default on Pascal GPUs. Fixes: d00ddd9da ("drm/nouveau/kms/nv50-: allocate push buffers in vidmem on pascal") Signed-off-by: Ben Skeggs Cc: # 4.19+ commit ee28b30cbbe0b490f52ba222c9d392b99581545e Author: Heiner Kallweit Date: Sun Dec 9 22:05:11 2018 +0100 r8169: fix crash if CONFIG_DEBUG_SHIRQ is enabled If CONFIG_DEBUG_SHIRQ is enabled __free_irq() intentionally fires a spurious interrupt. This interrupt causes a crash because tp->dev->phydev is NULL at that time. Fixes: 38caff5a445b ("r8169: handle all interrupt events in the hard irq handler") Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit fdadd04931c2d7cd294dc5b2b342863f94be53a3 Author: Daniel Borkmann Date: Tue Dec 11 12:14:12 2018 +0100 bpf: fix bpf_jit_limit knob for PAGE_SIZE >= 64K Michael and Sandipan report: Commit ede95a63b5 introduced a bpf_jit_limit tuneable to limit BPF JIT allocations. At compile time it defaults to PAGE_SIZE * 40000, and is adjusted again at init time if MODULES_VADDR is defined. For ppc64 kernels, MODULES_VADDR isn't defined, so we're stuck with the compile-time default at boot-time, which is 0x9c400000 when using 64K page size. This overflows the signed 32-bit bpf_jit_limit value: root@ubuntu:/tmp# cat /proc/sys/net/core/bpf_jit_limit -1673527296 and can cause various unexpected failures throughout the network stack. In one case `strace dhclient eth0` reported: setsockopt(5, SOL_SOCKET, SO_ATTACH_FILTER, {len=11, filter=0x105dd27f8}, 16) = -1 ENOTSUPP (Unknown error 524) and similar failures can be seen with tools like tcpdump. This doesn't always reproduce however, and I'm not sure why. The more consistent failure I've seen is an Ubuntu 18.04 KVM guest booted on a POWER9 host would time out on systemd/netplan configuring a virtio-net NIC with no noticeable errors in the logs. Given this and also given that in near future some architectures like arm64 will have a custom area for BPF JIT image allocations we should get rid of the BPF_JIT_LIMIT_DEFAULT fallback / default entirely. For 4.21, we have an overridable bpf_jit_alloc_exec(), bpf_jit_free_exec() so therefore add another overridable bpf_jit_alloc_exec_limit() helper function which returns the possible size of the memory area for deriving the default heuristic in bpf_jit_charge_init(). Like bpf_jit_alloc_exec() and bpf_jit_free_exec(), the new bpf_jit_alloc_exec_limit() assumes that module_alloc() is the default JIT memory provider, and therefore in case archs implement their custom module_alloc() we use MODULES_{END,_VADDR} for limits and otherwise for vmalloc_exec() cases like on ppc64 we use VMALLOC_{END,_START}. Additionally, for archs supporting large page sizes, we should change the sysctl to be handled as long to not run into sysctl restrictions in future. Fixes: ede95a63b5e8 ("bpf: add bpf_jit_limit knob to restrict unpriv allocations") Reported-by: Sandipan Das Reported-by: Michael Roth Signed-off-by: Daniel Borkmann Tested-by: Michael Roth Signed-off-by: Alexei Starovoitov commit 51c3fbd89d7554caa3290837604309f8d8669d99 Author: Dan Williams Date: Tue Dec 11 07:49:39 2018 -0800 x86/mm: Fix decoy address handling vs 32-bit builds A decoy address is used by set_mce_nospec() to update the cache attributes for a page that may contain poison (multi-bit ECC error) while attempting to minimize the possibility of triggering a speculative access to that page. When reserve_memtype() is handling a decoy address it needs to convert it to its real physical alias. The conversion, AND'ing with __PHYSICAL_MASK, is broken for a 32-bit physical mask and reserve_memtype() is passed the last physical page. Gert reports triggering the: BUG_ON(start >= end); ...assertion when running a 32-bit non-PAE build on a platform that has a driver resource at the top of physical memory: BIOS-e820: [mem 0x00000000fff00000-0x00000000ffffffff] reserved Given that the decoy address scheme is only targeted at 64-bit builds and assumes that the top of physical address space is free for use as a decoy address range, simply bypass address sanitization in the 32-bit case. Lastly, there was no need to crash the system when this failure occurred, and no need to crash future systems if the assumptions of decoy addresses are ever violated. Change the BUG_ON() to a WARN() with an error return. Fixes: 510ee090abc3 ("x86/mm/pat: Prepare {reserve, free}_memtype() for...") Reported-by: Gert Robben Signed-off-by: Dan Williams Signed-off-by: Thomas Gleixner Tested-by: Gert Robben Cc: stable@vger.kernel.org Cc: Andy Shevchenko Cc: Dave Hansen Cc: Andy Lutomirski Cc: Peter Zijlstra Cc: Borislav Petkov Cc: "H. Peter Anvin" Cc: platform-driver-x86@vger.kernel.org Cc: Link: https://lkml.kernel.org/r/154454337985.789277.12133288391664677775.stgit@dwillia2-desk3.amr.corp.intel.com commit 2bd61abead58c82714a1f6fa6beb0fd0df6a6d13 Author: Kees Cook Date: Thu Dec 6 15:50:38 2018 -0800 selftests/seccomp: Remove SIGSTOP si_pid check Commit f149b3155744 ("signal: Never allocate siginfo for SIGKILL or SIGSTOP") means that the seccomp selftest cannot check si_pid under SIGSTOP anymore. Since it's believed[1] there are no other userspace things depending on the old behavior, this removes the behavioral check in the selftest, since it's more a "extra" sanity check (which turns out, maybe, not to have been useful to test). [1] https://lkml.kernel.org/r/CAGXu5jJaZAOzP1qFz66tYrtbuywqb+UN2SOA1VLHpCCOiYvYeg@mail.gmail.com Reported-by: Tycho Andersen Suggested-by: Eric W. Biederman Signed-off-by: Kees Cook Signed-off-by: Shuah Khan commit 927b6b2d69b4cc900fa50d7e46d8f1fa91c91b3a Author: Shin'ichiro Kawasaki Date: Tue Dec 11 21:08:26 2018 +0900 block: Fix null_blk_zoned creation failure with small number of zones null_blk_zoned creation fails if the number of zones specified is equal to or is smaller than 64 due to a memory allocation failure in blk_alloc_zones(). With such a small number of zones, the required memory size for all zones descriptors fits in a single page, and the page order for alloc_pages_node() is zero. Allow this value in blk_alloc_zones() for the allocation to succeed. Fixes: bf5054569653 "block: Introduce blk_revalidate_disk_zones()" Reviewed-by: Damien Le Moal Signed-off-by: Shin'ichiro Kawasaki Signed-off-by: Jens Axboe commit 80b71c340f17705ec145911b9a193ea781811b16 Author: Reinette Chatre Date: Mon Dec 10 13:21:54 2018 -0800 x86/intel_rdt: Ensure a CPU remains online for the region's pseudo-locking sequence The user triggers the creation of a pseudo-locked region when writing the requested schemata to the schemata resctrl file. The pseudo-locking of a region is required to be done on a CPU that is associated with the cache on which the pseudo-locked region will reside. In order to run the locking code on a specific CPU, the needed CPU has to be selected and ensured to remain online during the entire locking sequence. At this time, the cpu_hotplug_lock is not taken during the pseudo-lock region creation and it is thus possible for a CPU to be selected to run the pseudo-locking code and then that CPU to go offline before the thread is able to run on it. Fix this by ensuring that the cpu_hotplug_lock is taken while the CPU on which code has to run needs to be controlled. Since the cpu_hotplug_lock is always taken before rdtgroup_mutex the lock order is maintained. Fixes: e0bdfe8e36f3 ("x86/intel_rdt: Support creation/removal of pseudo-locked region") Signed-off-by: Reinette Chatre Signed-off-by: Borislav Petkov Cc: "H. Peter Anvin" Cc: Fenghua Yu Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Tony Luck Cc: gavin.hindman@intel.com Cc: jithu.joseph@intel.com Cc: stable Cc: x86-ml Link: https://lkml.kernel.org/r/b7b17432a80f95a1fa21a1698ba643014f58ad31.1544476425.git.reinette.chatre@intel.com commit 2e64ff154ce6ce9a8dc0f9556463916efa6ff460 Author: Chad Austin Date: Mon Dec 10 10:54:52 2018 -0800 fuse: continue to send FUSE_RELEASEDIR when FUSE_OPEN returns ENOSYS When FUSE_OPEN returns ENOSYS, the no_open bit is set on the connection. Because the FUSE_RELEASE and FUSE_RELEASEDIR paths share code, this incorrectly caused the FUSE_RELEASEDIR request to be dropped and never sent to userspace. Pass an isdir bool to distinguish between FUSE_RELEASE and FUSE_RELEASEDIR inside of fuse_file_put. Fixes: 7678ac50615d ("fuse: support clients that don't implement 'open'") Cc: # v3.14 Signed-off-by: Chad Austin Signed-off-by: Miklos Szeredi commit 32774a8153b4c62e408297fba352248afb2e0143 Author: Arnd Bergmann Date: Mon Dec 10 21:53:45 2018 +0100 i2c: nvidia-gpu: mark resume function as __maybe_unused When CONFIG_PM is disabled, this is needed to avoid a harmless unused-function warning: drivers/i2c/busses/i2c-nvidia-gpu.c:345:12: error: 'gpu_i2c_resume' defined but not used [-Werror=unused-function] Fixes: c71bcdcb42a7 ("i2c: add i2c bus driver for NVIDIA GPU") Signed-off-by: Arnd Bergmann Reviewed-by: Andy Shevchenko Signed-off-by: Wolfram Sang commit a4f98be7dc31ba2a5046e3fe509dab399ecc191f Author: Adamski, Krzysztof (Nokia - PL/Wroclaw) Date: Tue Dec 11 09:17:52 2018 +0000 MAINTAINERS: add entry for i2c-axxia driver Create separate entry for i2c-axxia and set myself as maintainer. Even though I don't work for Intel/LSI who is the manufacturer of this IP, I do have access to some documentation and the actual hardware using this driver and I'm familiar with the code. Signed-off-by: Krzysztof Adamski Reviewed-by: Alexander Sverdlin Signed-off-by: Wolfram Sang commit f6c367585d0d851349d3a9e607c43e5bea993fa1 Author: Mike Snitzer Date: Tue Dec 11 13:31:40 2018 -0500 dm thin: send event about thin-pool state change _after_ making it Sending a DM event before a thin-pool state change is about to happen is a bug. It wasn't realized until it became clear that userspace response to the event raced with the actual state change that the event was meant to notify about. Fix this by first updating internal thin-pool state to reflect what the DM event is being issued about. This fixes a long-standing racey/buggy userspace device-mapper-test-suite 'resize_io' test that would get an event but not find the state it was looking for -- so it would just go on to hang because no other events caused the test to reevaluate the thin-pool's state. Cc: stable@vger.kernel.org Signed-off-by: Mike Snitzer commit 0afa99648350dbd6d08ee3efd2376db240a6c458 Author: Jeff Moyer Date: Tue Dec 11 12:37:49 2018 -0500 aio: fix spectre gadget in lookup_ioctx Matthew pointed out that the ioctx_table is susceptible to spectre v1, because the index can be controlled by an attacker. The below patch should mitigate the attack for all of the aio system calls. Reported-by: Matthew Wilcox Signed-off-by: Jeff Moyer Signed-off-by: Al Viro commit 2f1a9f666751bdcf20de7c120b20c5d156b87cf7 Merge: 290974d43478 8e41cae64b08 Author: David S. Miller Date: Tue Dec 11 11:04:22 2018 -0800 Merge branch 'ieee802154-for-davem-2018-12-11' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan Stefan Schmidt says: ==================== pull-request: ieee802154 for net 2018-12-11 An update from ieee802154 for your *net* tree. Just two more fixes for ieee802154 dribver before the final 4.20 release. Alexander Aring fixes a problem in the nested parsing code of the hwsim driver interface. A fix for a potential overflow in the ca8210 driver by Yue Habing. ==================== Signed-off-by: David S. Miller commit 2840f84f74035e5a535959d5f17269c69fa6edc5 Author: Steven Rostedt (VMware) Date: Mon Dec 10 23:58:01 2018 -0500 tracing: Fix memory leak of instance function hash filters The following commands will cause a memory leak: # cd /sys/kernel/tracing # mkdir instances/foo # echo schedule > instance/foo/set_ftrace_filter # rmdir instances/foo The reason is that the hashes that hold the filters to set_ftrace_filter and set_ftrace_notrace are not freed if they contain any data on the instance and the instance is removed. Found by kmemleak detector. Cc: stable@vger.kernel.org Fixes: 591dffdade9f ("ftrace: Allow for function tracing instance to filter functions") Signed-off-by: Steven Rostedt (VMware) commit 3cec638b3d793b7cacdec5b8072364b41caeb0e1 Author: Steven Rostedt (VMware) Date: Sun Dec 9 21:17:30 2018 -0500 tracing: Fix memory leak in set_trigger_filter() When create_event_filter() fails in set_trigger_filter(), the filter may still be allocated and needs to be freed. The caller expects the data->filter to be updated with the new filter, even if the new filter failed (we could add an error message by setting set_str parameter of create_event_filter(), but that's another update). But because the error would just exit, filter was left hanging and nothing could free it. Found by kmemleak detector. Cc: stable@vger.kernel.org Fixes: bac5fb97a173a ("tracing: Add and use generic set_trigger_filter() implementation") Reviewed-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit b61c19209c2c35ea2a2fe502d484703686eba98c Author: Steven Rostedt (VMware) Date: Sat Dec 8 21:10:04 2018 -0500 tracing: Fix memory leak in create_filter() The create_filter() calls create_filter_start() which allocates a "parse_error" descriptor, but fails to call create_filter_finish() that frees it. The op_stack and inverts in predicate_parse() were also not freed. Found by kmemleak detector. Cc: stable@vger.kernel.org Fixes: 80765597bc587 ("tracing: Rewrite filter logic to be simpler and faster") Reviewed-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) commit a538e3ff9dabcdf6c3f477a373c629213d1c3066 Author: Jeff Moyer Date: Tue Dec 11 12:37:49 2018 -0500 aio: fix spectre gadget in lookup_ioctx Matthew pointed out that the ioctx_table is susceptible to spectre v1, because the index can be controlled by an attacker. The below patch should mitigate the attack for all of the aio system calls. Cc: stable@vger.kernel.org Reported-by: Matthew Wilcox Reported-by: Dan Carpenter Signed-off-by: Jeff Moyer Signed-off-by: Jens Axboe commit cb4f131e1f2ca5dd7e2f905e4cb9fb4c5c9dcffd Author: Sasha Levin Date: Tue Dec 11 12:09:49 2018 -0500 MAINTAINERS: Patch monkey for the Hyper-V code Now the Hyper-V code has it's own monkey on a tree! Make it easier to manage patch flow to upper level maintainers. Acked-by: Haiyang Zhang Acked-by: K. Y. Srinivasan Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman commit 6f9718fe41c3a47e4362bddf145e2db6ad7d8e87 Author: Luis Henriques Date: Mon Dec 10 10:23:12 2018 +0000 ceph: make 'nocopyfrom' a default mount option Since we found a problem with the 'copy-from' operation after objects have been truncated, offloading object copies to OSDs should be discouraged until the issue is fixed. Thus, this patch adds the 'nocopyfrom' mount option to the default mount options which effectily means that remote copies won't be done in copy_file_range unless they are explicitly enabled at mount time. [ Adjust ceph_show_options() accordingly. ] Link: https://tracker.ceph.com/issues/37378 Signed-off-by: Luis Henriques Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit c554206077428af56cc2e0314b86b41cd030458c Author: Andrey Grodzovsky Date: Thu Dec 6 15:51:37 2018 -0500 drm/amdgpu: Fix DEBUG_LOCKS_WARN_ON(depth <= 0) in amdgpu_ctx.lock If CS is submitted using guilty ctx, we terminate amdgpu_cs_parser_init before locking ctx->lock, latter in amdgpu_cs_parser_fini we still are trying to release the lock just becase parser->ctx != NULL. Signed-off-by: Andrey Grodzovsky Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 63238173b2faf3d6b85a416f1c69af6c7be2413f Author: Brian Norris Date: Wed Dec 5 10:16:57 2018 -0800 Revert "drm/rockchip: Allow driver to be shutdown on reboot/kexec" This reverts commit 7f3ef5dedb146e3d5063b6845781ad1bb59b92b5. It causes new warnings [1] on shutdown when running the Google Kevin or Scarlet (RK3399) boards under Chrome OS. Presumably our usage of DRM is different than what Marc and Heiko test. We're looking at a different approach (e.g., [2]) to replace this, but IMO the revert should be taken first, as it already propagated to -stable. [1] Report here: http://lkml.kernel.org/lkml/20181205030127.GA200921@google.com WARNING: CPU: 4 PID: 2035 at drivers/gpu/drm/drm_mode_config.c:477 drm_mode_config_cleanup+0x1c4/0x294 ... Call trace: drm_mode_config_cleanup+0x1c4/0x294 rockchip_drm_unbind+0x4c/0x8c component_master_del+0x88/0xb8 rockchip_drm_platform_remove+0x2c/0x44 rockchip_drm_platform_shutdown+0x20/0x2c platform_drv_shutdown+0x2c/0x38 device_shutdown+0x164/0x1b8 kernel_restart_prepare+0x40/0x48 kernel_restart+0x20/0x68 ... Memory manager not clean during takedown. WARNING: CPU: 4 PID: 2035 at drivers/gpu/drm/drm_mm.c:950 drm_mm_takedown+0x34/0x44 ... drm_mm_takedown+0x34/0x44 rockchip_drm_unbind+0x64/0x8c component_master_del+0x88/0xb8 rockchip_drm_platform_remove+0x2c/0x44 rockchip_drm_platform_shutdown+0x20/0x2c platform_drv_shutdown+0x2c/0x38 device_shutdown+0x164/0x1b8 kernel_restart_prepare+0x40/0x48 kernel_restart+0x20/0x68 ... [2] https://patchwork.kernel.org/patch/10556151/ https://www.spinics.net/lists/linux-rockchip/msg21342.html [PATCH] drm/rockchip: shutdown drm subsystem on shutdown Fixes: 7f3ef5dedb14 ("drm/rockchip: Allow driver to be shutdown on reboot/kexec") Cc: Jeffy Chen Cc: Robin Murphy Cc: Vicente Bergas Cc: Marc Zyngier Cc: Heiko Stuebner Cc: stable@vger.kernel.org Signed-off-by: Brian Norris Signed-off-by: Heiko Stuebner Link: https://patchwork.freedesktop.org/patch/msgid/20181205181657.177703-1-briannorris@chromium.org commit 5e3c420dcca53766dec57d5bf4df8eecdb953c03 Author: Stephen Hemminger Date: Mon Dec 10 10:18:19 2018 -0800 uio_hv_generic: set callbacks on open This fixes the problem where uio application was unable to use multple queues on restart. The root cause is that the callbacks are cleared on disconnect. Change to setting up callbacks everytime in open. Fixes: cdfa835c6e5e ("uio_hv_generic: defer opening vmbus until first use") Reported-by: Mohammed Gamal Signed-off-by: Stephen Hemminger Signed-off-by: Greg Kroah-Hartman commit 3238c359acee4ab57f15abb5a82b8ab38a661ee7 Author: Robin Murphy Date: Mon Dec 10 19:33:31 2018 +0000 arm64: dma-mapping: Fix FORCE_CONTIGUOUS buffer clearing We need to invalidate the caches *before* clearing the buffer via the non-cacheable alias, else in the worst case __dma_flush_area() may write back dirty lines over the top of our nice new zeros. Fixes: dd65a941f6ba ("arm64: dma-mapping: clear buffers allocated with FORCE_CONTIGUOUS flag") Cc: # 4.18.x- Acked-by: Will Deacon Signed-off-by: Robin Murphy Signed-off-by: Catalin Marinas commit 254eb5505ca0ca749d3a491fc6668b6c16647a99 Author: Kirill A. Shutemov Date: Fri Nov 30 23:23:28 2018 +0300 x86/dump_pagetables: Fix LDT remap address marker The LDT remap placement has been changed. It's now placed before the direct mapping in the kernel virtual address space for both paging modes. Change address markers order accordingly. Fixes: d52888aa2753 ("x86/mm: Move LDT remap out of KASLR region on 5-level paging") Signed-off-by: Kirill A. Shutemov Signed-off-by: Thomas Gleixner Cc: bp@alien8.de Cc: hpa@zytor.com Cc: dave.hansen@linux.intel.com Cc: luto@kernel.org Cc: peterz@infradead.org Cc: boris.ostrovsky@oracle.com Cc: jgross@suse.com Cc: bhe@redhat.com Cc: hans.van.kranenburg@mendix.com Cc: linux-mm@kvack.org Cc: xen-devel@lists.xenproject.org Link: https://lkml.kernel.org/r/20181130202328.65359-3-kirill.shutemov@linux.intel.com commit 16877a5570e0c5f4270d5b17f9bab427bcae9514 Author: Kirill A. Shutemov Date: Fri Nov 30 23:23:27 2018 +0300 x86/mm: Fix guard hole handling There is a guard hole at the beginning of the kernel address space, also used by hypervisors. It occupies 16 PGD entries. This reserved range is not defined explicitely, it is calculated relative to other entities: direct mapping and user space ranges. The calculation got broken by recent changes of the kernel memory layout: LDT remap range is now mapped before direct mapping and makes the calculation invalid. The breakage leads to crash on Xen dom0 boot[1]. Define the reserved range explicitely. It's part of kernel ABI (hypervisors expect it to be stable) and must not depend on changes in the rest of kernel memory layout. [1] https://lists.xenproject.org/archives/html/xen-devel/2018-11/msg03313.html Fixes: d52888aa2753 ("x86/mm: Move LDT remap out of KASLR region on 5-level paging") Reported-by: Hans van Kranenburg Signed-off-by: Kirill A. Shutemov Signed-off-by: Thomas Gleixner Tested-by: Hans van Kranenburg Reviewed-by: Juergen Gross Cc: bp@alien8.de Cc: hpa@zytor.com Cc: dave.hansen@linux.intel.com Cc: luto@kernel.org Cc: peterz@infradead.org Cc: boris.ostrovsky@oracle.com Cc: bhe@redhat.com Cc: linux-mm@kvack.org Cc: xen-devel@lists.xenproject.org Link: https://lkml.kernel.org/r/20181130202328.65359-2-kirill.shutemov@linux.intel.com commit 8e41cae64b08fe2e86a9ffb88b295c6b4b3a3322 Author: YueHaibing Date: Tue Dec 11 11:13:39 2018 +0800 ieee802154: ca8210: fix possible u8 overflow in ca8210_rx_done gcc warning this: drivers/net/ieee802154/ca8210.c:730:10: warning: comparison is always false due to limited range of data type [-Wtype-limits] 'len' is u8 type, we get it from buf[1] adding 2, which can overflow. This patch change the type of 'len' to unsigned int to avoid this,also fix the gcc warning. Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver") Signed-off-by: YueHaibing Signed-off-by: Stefan Schmidt commit 4ac0a807da6f79d5f2a65f991030aee503fece3a Author: Thierry Reding Date: Fri Nov 23 13:11:51 2018 +0100 drm/nouveau/drm/nouveau: tegra: Call nouveau_drm_device_init() As part of commit cfea88a4d866 ("drm/nouveau: Start using new drm_dev initialization helpers"), the initialization of the Nouveau DRM device was reworked and along the way the platform driver initialization was left incomplete. Add a call to nouveau_drm_device_init() to make sure all of the structures are properly initialized. Signed-off-by: Thierry Reding Reviewed-by: Lyude Paul Tested-by: Marcel Ziswiler Signed-off-by: Ben Skeggs commit 99c47fcd4daa2b9a1348872ba49226dcdc58cb40 Author: David HERNANDEZ SANCHEZ Date: Thu Dec 6 13:23:32 2018 +0000 thermal: stm32: Fix stm_thermal_read_factory_settings Adding brackets allows to multiply the register value, masked by TS1_RAMP_COEFF_MASK, by an ADJUST value properly and not to multiply ADJUST by register value and then mask the whole. Fixes: 1d693155 ("thermal: add stm32 thermal driver") Reviewed-by: Daniel Lezcano Signed-off-by: David Hernandez Sanchez Signed-off-by: Eduardo Valentin commit 3c9d082064b5ec5876f7e20bc50959d1915c5ab0 Author: David HERNANDEZ SANCHEZ Date: Thu Dec 6 13:23:32 2018 +0000 thermal: stm32: read factory settings inside stm_thermal_prepare Calling stm_thermal_read_factory_settings before clocking internal peripheral causes bad register values and makes temperature computation wrong. Calling stm_thermal_read_factory_settings inside stm_thermal_prepare fixes this problem as internal peripheral is well clocked at this stage. Fixes: 1d693155 ("thermal: add stm32 thermal driver") Reviewed-by: Daniel Lezcano Signed-off-by: David Hernandez Sanchez Signed-off-by: Eduardo Valentin commit 7d3a2a2bbadb4bf5856ed394ba09b8fbb7a80460 Author: Daniel Lezcano Date: Fri Nov 30 09:00:32 2018 +0100 thermal/drivers/hisi: Fix number of sensors on hi3660 Without this patch the thermal driver is broken on hi3660. The dual sensors support patchset was partially merged, unfortunately the dual thermal zones definition is not available in the DT yet, so when the driver tries to register all the sensors that fails. By reducing to 1 the number of sensors on the hi3660, we switch back to the previous functionnality. Fixes: 8c6c36846f11 (thermal/drivers/hisi: Add the dual clusters sensors for hi3660) Signed-off-by: Daniel Lezcano Signed-off-by: Eduardo Valentin commit 5d7ab8f0bc1410ee9d4099284ea05bf31a2e39ec Author: Daniel Lezcano Date: Fri Nov 30 09:00:31 2018 +0100 thermal/drivers/hisi: Fix wrong platform_get_irq_byname() Without this patch, the thermal driver on hi6220 and hi3660 is broken. That is due because part of the posted patchset was merged but a small change in the DT was dropped. The hi6220 and hi3660 do not have an interrupt name in the DT, so finding interrupt by name fails. Fix this by returning back to the platform_get_irq() function call. Fixes: 2cffaeff083f (thermal/drivers/hisi: Use platform_get_irq_byname) Signed-off-by: Daniel Lezcano Signed-off-by: Eduardo Valentin commit 290974d434783624c13a9530a23c45f9c5ffe018 Author: Pieter Jansen van Vuuren Date: Mon Dec 10 15:03:43 2018 -0800 nfp: flower: ensure TCP flags can be placed in IPv6 frame Previously we did not ensure tcp flags have a place to be stored when using IPv6. We correct this by including IPv6 key layer when we match tcp flags and the IPv6 key layer has not been included already. Fixes: 07e1671cfca5 ("nfp: flower: refactor shared ip header in match offload") Signed-off-by: Pieter Jansen van Vuuren Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller commit 6cbe721095fec97e1ffb542e3f8cb766aacb251f Merge: 5648451e30a0 1d1bbc37f89b Author: David S. Miller Date: Mon Dec 10 17:34:26 2018 -0800 Merge branch 'ibmvnic-Fix-reset-work-item-locking-bugs' Thomas Falcon says: ==================== net/ibmvnic: Fix reset work item locking bugs This patch set fixes issues with scheduling reset work items in a tasklet context. Since ibmvnic_reset can called in an interrupt, it should not use a mutex or allocate memory non-atomically. ==================== Signed-off-by: David S. Miller commit 1d1bbc37f89b0559c9e913682f2489d89cfde6b8 Author: Thomas Falcon Date: Mon Dec 10 15:22:23 2018 -0600 ibmvnic: Fix non-atomic memory allocation in IRQ context ibmvnic_reset allocated new reset work item objects in a non-atomic context. This can be called from a tasklet, generating the output below. Allocate work items with the GFP_ATOMIC flag instead. BUG: sleeping function called from invalid context at mm/slab.h:421 in_atomic(): 1, irqs_disabled(): 1, pid: 93, name: kworker/0:2 INFO: lockdep is turned off. irq event stamp: 66049 hardirqs last enabled at (66048): [] tasklet_action_common.isra.12+0x78/0x1c0 hardirqs last disabled at (66049): [] _raw_spin_lock_irqsave+0x48/0xf0 softirqs last enabled at (66044): [] dev_deactivate_queue.constprop.28+0xc8/0x160 softirqs last disabled at (66045): [] call_do_softirq+0x14/0x24 CPU: 0 PID: 93 Comm: kworker/0:2 Kdump: loaded Not tainted 4.20.0-rc6-00001-g1b50a8f03706 #7 Workqueue: events linkwatch_event Call Trace: [c0000003fffe7ae0] [c000000000bc83e4] dump_stack+0xe8/0x164 (unreliable) [c0000003fffe7b30] [c00000000015ba0c] ___might_sleep+0x2dc/0x320 [c0000003fffe7bb0] [c000000000391514] kmem_cache_alloc_trace+0x3e4/0x440 [c0000003fffe7c30] [d000000005b2309c] ibmvnic_reset+0x16c/0x360 [ibmvnic] [c0000003fffe7cc0] [d000000005b29834] ibmvnic_tasklet+0x1054/0x2010 [ibmvnic] [c0000003fffe7e00] [c0000000001224c8] tasklet_action_common.isra.12+0xd8/0x1c0 [c0000003fffe7e60] [c000000000bf1238] __do_softirq+0x1a8/0x64c [c0000003fffe7f90] [c0000000000306e0] call_do_softirq+0x14/0x24 [c0000003f3967980] [c00000000001ba50] do_softirq_own_stack+0x60/0xb0 [c0000003f39679c0] [c0000000001218a8] do_softirq+0xa8/0x100 [c0000003f39679f0] [c000000000121a74] __local_bh_enable_ip+0x174/0x180 [c0000003f3967a60] [c000000000bf003c] _raw_spin_unlock_bh+0x5c/0x80 [c0000003f3967a90] [c000000000a8ac78] dev_deactivate_queue.constprop.28+0xc8/0x160 [c0000003f3967ad0] [c000000000a8c8b0] dev_deactivate_many+0xd0/0x520 [c0000003f3967b70] [c000000000a8cd40] dev_deactivate+0x40/0x60 [c0000003f3967ba0] [c000000000a5e0c4] linkwatch_do_dev+0x74/0xd0 [c0000003f3967bd0] [c000000000a5e694] __linkwatch_run_queue+0x1a4/0x1f0 [c0000003f3967c30] [c000000000a5e728] linkwatch_event+0x48/0x60 [c0000003f3967c50] [c0000000001444e8] process_one_work+0x238/0x710 [c0000003f3967d20] [c000000000144a48] worker_thread+0x88/0x4e0 [c0000003f3967db0] [c00000000014e3a8] kthread+0x178/0x1c0 [c0000003f3967e20] [c00000000000bfd0] ret_from_kernel_thread+0x5c/0x6c Signed-off-by: Thomas Falcon Signed-off-by: David S. Miller commit 6c5c7489089608d89b7ce310bca44812e2b0a4a5 Author: Thomas Falcon Date: Mon Dec 10 15:22:22 2018 -0600 ibmvnic: Convert reset work item mutex to spin lock ibmvnic_reset can create and schedule a reset work item from an IRQ context, so do not use a mutex, which can sleep. Convert the reset work item mutex to a spin lock. Locking debugger generated the trace output below. BUG: sleeping function called from invalid context at kernel/locking/mutex.c:908 in_atomic(): 1, irqs_disabled(): 1, pid: 120, name: kworker/8:1 4 locks held by kworker/8:1/120: #0: 0000000017c05720 ((wq_completion)"events"){+.+.}, at: process_one_work+0x188/0x710 #1: 00000000ace90706 ((linkwatch_work).work){+.+.}, at: process_one_work+0x188/0x710 #2: 000000007632871f (rtnl_mutex){+.+.}, at: rtnl_lock+0x30/0x50 #3: 00000000fc36813a (&(&crq->lock)->rlock){..-.}, at: ibmvnic_tasklet+0x88/0x2010 [ibmvnic] irq event stamp: 26293 hardirqs last enabled at (26292): [] tasklet_action_common.isra.12+0x78/0x1c0 hardirqs last disabled at (26293): [] _raw_spin_lock_irqsave+0x48/0xf0 softirqs last enabled at (26288): [] dev_deactivate_queue.constprop.28+0xc8/0x160 softirqs last disabled at (26289): [] call_do_softirq+0x14/0x24 CPU: 8 PID: 120 Comm: kworker/8:1 Kdump: loaded Not tainted 4.20.0-rc6 #6 Workqueue: events linkwatch_event Call Trace: [c0000003fffa7a50] [c000000000bc83e4] dump_stack+0xe8/0x164 (unreliable) [c0000003fffa7aa0] [c00000000015ba0c] ___might_sleep+0x2dc/0x320 [c0000003fffa7b20] [c000000000be960c] __mutex_lock+0x8c/0xb40 [c0000003fffa7c30] [d000000006202ac8] ibmvnic_reset+0x78/0x330 [ibmvnic] [c0000003fffa7cc0] [d0000000062097f4] ibmvnic_tasklet+0x1054/0x2010 [ibmvnic] [c0000003fffa7e00] [c0000000001224c8] tasklet_action_common.isra.12+0xd8/0x1c0 [c0000003fffa7e60] [c000000000bf1238] __do_softirq+0x1a8/0x64c [c0000003fffa7f90] [c0000000000306e0] call_do_softirq+0x14/0x24 [c0000003f3f87980] [c00000000001ba50] do_softirq_own_stack+0x60/0xb0 [c0000003f3f879c0] [c0000000001218a8] do_softirq+0xa8/0x100 [c0000003f3f879f0] [c000000000121a74] __local_bh_enable_ip+0x174/0x180 [c0000003f3f87a60] [c000000000bf003c] _raw_spin_unlock_bh+0x5c/0x80 [c0000003f3f87a90] [c000000000a8ac78] dev_deactivate_queue.constprop.28+0xc8/0x160 [c0000003f3f87ad0] [c000000000a8c8b0] dev_deactivate_many+0xd0/0x520 [c0000003f3f87b70] [c000000000a8cd40] dev_deactivate+0x40/0x60 [c0000003f3f87ba0] [c000000000a5e0c4] linkwatch_do_dev+0x74/0xd0 [c0000003f3f87bd0] [c000000000a5e694] __linkwatch_run_queue+0x1a4/0x1f0 [c0000003f3f87c30] [c000000000a5e728] linkwatch_event+0x48/0x60 [c0000003f3f87c50] [c0000000001444e8] process_one_work+0x238/0x710 [c0000003f3f87d20] [c000000000144a48] worker_thread+0x88/0x4e0 [c0000003f3f87db0] [c00000000014e3a8] kthread+0x178/0x1c0 [c0000003f3f87e20] [c00000000000bfd0] ret_from_kernel_thread+0x5c/0x6c Signed-off-by: Thomas Falcon Signed-off-by: David S. Miller commit aca1a80ebe3e4d49adaf6516c61a6786b1ee7dad Author: Stanislav Fomichev Date: Mon Dec 10 15:25:04 2018 -0800 selftests/bpf: use proper type when passing prog_type Use bpf_prog_type instead of bpf_map_type when passing prog_type. -Wenum-conversion might be unhappy about it: error: implicit conversion from enumeration type 'enum bpf_map_type' to different enumeration type 'enum bpf_prog_type' Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit f55adad601c6a97c8c9628195453e0fb23b4a0ae Author: Keith Busch Date: Mon Dec 10 08:44:42 2018 -0700 block/bio: Do not zero user pages We don't need to zero fill the bio if not using kernel allocated pages. Fixes: f3587d76da05 ("block: Clear kernel memory before copying to user") # v4.20-rc2 Reported-by: Todd Aiken Cc: Laurence Oberman Cc: stable@vger.kernel.org Cc: Bart Van Assche Tested-by: Laurence Oberman Signed-off-by: Keith Busch Signed-off-by: Jens Axboe commit cf4197ed5796234a53beb71228198c7d1e678947 Author: Kenneth Feng Date: Thu Dec 6 11:56:14 2018 +0800 drm/amdgpu/powerplay: Apply avfs cks-off voltages on VI Instead of EVV cks-off voltages, avfs cks-off voltages can avoid the overshoot voltages when switching sclk. Signed-off-by: Kenneth Feng Acked-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit d55d8be0747c96db28a1d08fc24d22ccd9b448ac Author: Junwei Zhang Date: Fri Dec 7 15:15:03 2018 +0800 drm/amdgpu: update SMC firmware image for polaris10 variants Some new variants require different firmwares. Signed-off-by: Junwei Zhang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 9bd206f89fa758f130fde09bf6f876f955ed989a Author: Alex Deucher Date: Fri Dec 7 16:24:33 2018 -0500 drm/amdkfd: add new vega20 pci id New vega20 id. Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 756e16bf79f2815e7c83a04881b5545b55a99fd3 Author: Alex Deucher Date: Fri Dec 7 16:23:19 2018 -0500 drm/amdkfd: add new vega10 pci ids New vega10 ids. Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit ec5b2020726bffc893d5bddca39502e116da1fbc Author: Alex Deucher Date: Fri Dec 7 16:00:27 2018 -0500 drm/amdgpu: add some additional vega20 pci ids New vega ids. Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 2244b5887c6865b9e9cf14ee12a312b776aeeb58 Author: Alex Deucher Date: Fri Dec 7 15:58:23 2018 -0500 drm/amdgpu: add some additional vega10 pci ids New vega ids. Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 5648451e30a0d13d11796574919a359025d52cce Author: Gustavo A. R. Silva Date: Mon Dec 10 12:41:24 2018 -0600 ipv4: Fix potential Spectre v1 vulnerability vr.vifi is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: net/ipv4/ipmr.c:1616 ipmr_ioctl() warn: potential spectre issue 'mrt->vif_table' [r] (local cap) net/ipv4/ipmr.c:1690 ipmr_compat_ioctl() warn: potential spectre issue 'mrt->vif_table' [r] (local cap) Fix this by sanitizing vr.vifi before using it to index mrt->vif_table' Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 Signed-off-by: Gustavo A. R. Silva Signed-off-by: David S. Miller commit 4a2eb0c37b4759416996fbb4c45b932500cf06d3 Author: Xin Long Date: Mon Dec 10 18:00:52 2018 +0800 sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event syzbot reported a kernel-infoleak, which is caused by an uninitialized field(sin6_flowinfo) of addr->a.v6 in sctp_inet6addr_event(). The call trace is as below: BUG: KMSAN: kernel-infoleak in _copy_to_user+0x19a/0x230 lib/usercopy.c:33 CPU: 1 PID: 8164 Comm: syz-executor2 Not tainted 4.20.0-rc3+ #95 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x32d/0x480 lib/dump_stack.c:113 kmsan_report+0x12c/0x290 mm/kmsan/kmsan.c:683 kmsan_internal_check_memory+0x32a/0xa50 mm/kmsan/kmsan.c:743 kmsan_copy_to_user+0x78/0xd0 mm/kmsan/kmsan_hooks.c:634 _copy_to_user+0x19a/0x230 lib/usercopy.c:33 copy_to_user include/linux/uaccess.h:183 [inline] sctp_getsockopt_local_addrs net/sctp/socket.c:5998 [inline] sctp_getsockopt+0x15248/0x186f0 net/sctp/socket.c:7477 sock_common_getsockopt+0x13f/0x180 net/core/sock.c:2937 __sys_getsockopt+0x489/0x550 net/socket.c:1939 __do_sys_getsockopt net/socket.c:1950 [inline] __se_sys_getsockopt+0xe1/0x100 net/socket.c:1947 __x64_sys_getsockopt+0x62/0x80 net/socket.c:1947 do_syscall_64+0xcf/0x110 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 sin6_flowinfo is not really used by SCTP, so it will be fixed by simply setting it to 0. The issue exists since very beginning. Thanks Alexander for the reproducer provided. Reported-by: syzbot+ad5d327e6936a2e284be@syzkaller.appspotmail.com Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Acked-by: Neil Horman Signed-off-by: David S. Miller commit 8a034aad4892baf82f8c9082f969c5ebc1143a05 Author: Srinivas Kandagatla Date: Fri Dec 7 14:11:49 2018 +0530 clk: qcom: qcs404: Fix gpll0_out_main parent gpll0_out_main parent is cxo so fix it. Fixes: 652f1813c113 ("clk: qcom: gcc: Add global clock controller driver for QCS404") Signed-off-by: Srinivas Kandagatla Reviewed-by: Bjorn Andersson Signed-off-by: Vinod Koul Signed-off-by: Stephen Boyd commit c2a20a2731df11f9b7b7030f7ac3fc222c9ce39d Author: Stanislav Fomichev Date: Thu Dec 6 20:14:11 2018 -0800 selftests/bpf: add missing pointer dereference for map stacktrace fixup I get a segfault without it, other fixups always do dereference, and without dereference I don't understand how it can ever work. Fixes: 7c85c448e7d74 ("selftests/bpf: test_verifier, check bpf_map_lookup_elem access in bpf prog") Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann commit f5d582777bcb1c7ff19a5a2343f66ea01de401c6 Merge: 9bb40f010885 c201e3808e0e Author: Linus Torvalds Date: Mon Dec 10 11:04:41 2018 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID subsystem fixes from Jiri Kosina: - two device-specific quirks from Hans de Goede and Nic Soudée - reintroduction of (mistakenly remocved) ABS_RESERVED from Peter Hutterer * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: Input: restore EV_ABS ABS_RESERVED HID: quirks: fix RetroUSB.com devices HID: ite: Add USB id match for another ITE based keyboard rfkill key quirk commit 9bb40f0108857ddb93e7480a7f38c1a9ad432e1d Merge: 1dffab5e9896 d347d0c82a99 Author: Linus Torvalds Date: Mon Dec 10 09:47:42 2018 -0800 Merge tag 'backlight-fixes-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight fix from Lee Jones: "Fix brightness levels when !DT in pwm_bl driver" * tag 'backlight-fixes-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: pwm_bl: Fix brightness levels for non-DT case. commit 1dffab5e98969087039fefa8cde4699c7353b71e Merge: 40e020c129cf 0603a9a84679 Author: Linus Torvalds Date: Mon Dec 10 09:06:22 2018 -0800 Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Olof Johansson: "The usual batch; most of them are DT tweaks to fix misdescribed hardware. Beyond that: - A bugfix for MMP2 CPU detection, it's been there quite a while but makes sense to fix now anyway. - Some power management tweaks: + disabling of CPU idle power state on Marvell Armada 7K/8K (Macchiatobin et al) + Increase of minimum voltage on BananaPi M3 + Tweak of power ramp time for DVFS on NXP/Freescale i.MX7SX - A couple of MAINTAINER updates: + MMP has a new volunteer to look after it + Mediatek adds a few keywords, IRC channel and wiki URL" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: ARM: dts: imx7d-nitrogen7: Fix the description of the Wifi clock ARM: imx: update the cpu power up timing setting on i.mx6sx Revert "arm64: dts: marvell: add CPU Idle power state support on Armada 7K/8K" ARM: dts: imx7d-pico: Describe the Wifi clock ARM: dts: realview: Fix some more duplicate regulator nodes MAINTAINERS: update entry for MMP platform ARM: mmp/mmp2: fix cpu_is_mmp2() on mmp2-dt MAINTAINERS: mediatek: Update SoC entry ARM: dts: bcm2837: Fix polarity of wifi reset GPIOs arm64: dts: mt7622: Drop the general purpose timer node arm64: dts: mt7622: fix no more console output on BPI-R64 board arm64: dts: mt7622: fix no more console output on rfb1 ARM: dts: sun8i: a83t: bananapi-m3: increase vcc-pd voltage to 3.3V commit d347d0c82a99b41efc2770fc01a04066903300df Author: Enric Balletbo i Serra Date: Mon Dec 10 13:14:37 2018 +0100 backlight: pwm_bl: Fix brightness levels for non-DT case. Commit '88ba95bedb79 ("backlight: pwm_bl: Compute brightness of LED linearly to human eye")' allows the possibility to compute a default brightness table when there isn't the brightness-levels property in the DT. Unfortunately the changes made broke the pwm backlight for the non-DT boards. Usually, the non-DT boards don't pass the brightness levels via platform data, instead, it sets the max_brightness in their platform data and the driver calculates the level without a table. The offending patch assumed that when there is no brightness levels table we should create one, but this is clearly wrong for the non-DT case. After this patch the code handles the DT and the non-DT case taking in consideration also if max_brightness is set or not. Fixes: 88ba95bedb79 ("backlight: pwm_bl: Compute brightness of LED linearly to human eye") Reported-by: Robert Jarzmik Signed-off-by: Enric Balletbo i Serra Tested-by: Robert Jarzmik Acked-by: Daniel Thompson Signed-off-by: Lee Jones commit 0bea4cc8383519f78f3f74caca7bdebdfb346d3b Author: Jian-Hong Pan Date: Fri Dec 7 17:17:13 2018 +0800 ALSA: hda/realtek: Enable audio jacks of ASUS UX433FN/UX333FA with ALC294 The ASUS UX433FN and UX333FA with ALC294 cannot detect the headset MIC and output through the internal speaker and the headphone until ALC294_FIXUP_ASUS_SPK and ALC294_FIXUP_ASUS_HEADSET_MIC quirk applied. Signed-off-by: Daniel Drake Signed-off-by: Jian-Hong Pan Cc: Signed-off-by: Takashi Iwai commit 4e051106730dfc640a8b49db88440af304726f4d Author: Jian-Hong Pan Date: Fri Dec 7 17:17:12 2018 +0800 ALSA: hda/realtek: Enable audio jacks of ASUS UX533FD with ALC294 The ASUS UX533FD with ALC294 cannot detect the headset MIC and outputs through the internal speaker and the headphone until ALC294_FIXUP_ASUS_SPK and ALC294_FIXUP_ASUS_HEADSET_MIC quirk applied. Signed-off-by: Daniel Drake Signed-off-by: Jian-Hong Pan Cc: Signed-off-by: Takashi Iwai commit d8ae458eeca9ed686e09a1b894867cb91fc4c1cb Author: Chris Chiu Date: Fri Dec 7 17:17:11 2018 +0800 ALSA: hda/realtek: ALC294 mic and headset-mode fixups for ASUS X542UN The known ALC256_FIXUP_ASUS_MIC fixup can fix the headphone jack sensing and enable use of the internal microphone on this laptop X542UN. However, it's ALC294 so create a new fixup named ALC294_FIXUP_ASUS_MIC to avoid confusion. Signed-off-by: Jian-Hong Pan Signed-off-by: Daniel Drake Signed-off-by: Chris Chiu Cc: Signed-off-by: Takashi Iwai commit d57ec3c83b5153217a70b561d4fb6ed96f2f7a25 Author: Tore Anderson Date: Sat Dec 8 19:05:12 2018 +0100 USB: serial: option: add HP lt4132 The HP lt4132 is a rebranded Huawei ME906s-158 LTE modem. The interface with protocol 0x16 is "CDC ECM & NCM" according to the *.inf files included with the Windows driver. Attaching the option driver to it doesn't result in a /dev/ttyUSB* device being created, so I've excluded it. Note that it is also excluded for corresponding Huawei-branded devices, cf. commit d544db293a44 ("USB: support new huawei devices in option.c"). T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=ff MxPS=64 #Cfgs= 3 P: Vendor=03f0 ProdID=a31d Rev=01.02 S: Manufacturer=HP Inc. S: Product=HP lt4132 LTE/HSPA+ 4G Module S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=2mA I: If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=06 Prot=10 Driver=option I: If#=0x1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=13 Driver=option I: If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=12 Driver=option I: If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=06 Prot=16 Driver=(none) I: If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=14 Driver=option I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=1b Driver=option T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=ff MxPS=64 #Cfgs= 3 P: Vendor=03f0 ProdID=a31d Rev=01.02 S: Manufacturer=HP Inc. S: Product=HP lt4132 LTE/HSPA+ 4G Module S: SerialNumber=0123456789ABCDEF C: #Ifs= 7 Cfg#= 2 Atr=a0 MxPwr=2mA I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether I: If#=0x1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=06 Prot=00 Driver=cdc_ether I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=06 Prot=10 Driver=option I: If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=13 Driver=option I: If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=12 Driver=option I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=14 Driver=option I: If#=0x6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=1b Driver=option T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=ff MxPS=64 #Cfgs= 3 P: Vendor=03f0 ProdID=a31d Rev=01.02 S: Manufacturer=HP Inc. S: Product=HP lt4132 LTE/HSPA+ 4G Module S: SerialNumber=0123456789ABCDEF C: #Ifs= 3 Cfg#= 3 Atr=a0 MxPwr=2mA I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I: If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=14 Driver=option Signed-off-by: Tore Anderson Cc: stable@vger.kernel.org [ johan: drop id defines ] Signed-off-by: Johan Hovold commit d72f70da60de1af4bfd0f0a3d0ecbc28eea07679 Author: Takeshi Misawa Date: Sun Dec 9 14:30:15 2018 +0900 fuse: Fix memory leak in fuse_dev_free() When ntfs is unmounted, the following leak is reported by kmemleak. kmemleak report: unreferenced object 0xffff880052bf4400 (size 4096): comm "mount.ntfs", pid 16530, jiffies 4294861127 (age 3215.836s) hex dump (first 32 bytes): 00 44 bf 52 00 88 ff ff 00 44 bf 52 00 88 ff ff .D.R.....D.R.... 10 44 bf 52 00 88 ff ff 10 44 bf 52 00 88 ff ff .D.R.....D.R.... backtrace: [<00000000bf4a2f8d>] fuse_fill_super+0xb22/0x1da0 [fuse] [<000000004dde0f0c>] mount_bdev+0x263/0x320 [<0000000025aebc66>] mount_fs+0x82/0x2bf [<0000000042c5a6be>] vfs_kern_mount.part.33+0xbf/0x480 [<00000000ed10cd5b>] do_mount+0x3de/0x2ad0 [<00000000d59ff068>] ksys_mount+0xba/0xd0 [<000000001bda1bcc>] __x64_sys_mount+0xba/0x150 [<00000000ebe26304>] do_syscall_64+0x151/0x490 [<00000000d25f2b42>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [<000000002e0abd2c>] 0xffffffffffffffff fuse_dev_alloc() allocate fud->pq.processing. But this hash table is not freed. Fix this by freeing fud->pq.processing. Signed-off-by: Takeshi Misawa Signed-off-by: Miklos Szeredi Fixes: be2ff42c5d6e ("fuse: Use hash table to link processing request") commit a225f1567405558fb5410e9b2b90805819df1c67 Author: Elvira Khabirova Date: Fri Dec 7 18:56:05 2018 +0300 powerpc/ptrace: replace ptrace_report_syscall() with a tracehook call Arch code should use tracehook_*() helpers, as documented in include/linux/tracehook.h, ptrace_report_syscall() is not expected to be used outside that file. The patch does not look very nice, but at least it is correct and opens the way for PTRACE_GET_SYSCALL_INFO API. Co-authored-by: Dmitry V. Levin Fixes: 5521eb4bca2d ("powerpc/ptrace: Add support for PTRACE_SYSEMU") Signed-off-by: Elvira Khabirova Signed-off-by: Dmitry V. Levin [mpe: Take this as a minimal fix for 4.20, we'll rework it later] Signed-off-by: Michael Ellerman commit 40e020c129cfc991e8ab4736d2665351ffd1468d Author: Linus Torvalds Date: Sun Dec 9 15:31:00 2018 -0800 Linux 4.20-rc6 commit d48f782e4fb20dc7ec935ca0ca41ae31e4a69362 Merge: 8586ca8a2144 35cc3cefc4de Author: Linus Torvalds Date: Sun Dec 9 15:12:33 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: "A decent batch of fixes here. I'd say about half are for problems that have existed for a while, and half are for new regressions added in the 4.20 merge window. 1) Fix 10G SFP phy module detection in mvpp2, from Baruch Siach. 2) Revert bogus emac driver change, from Benjamin Herrenschmidt. 3) Handle BPF exported data structure with pointers when building 32-bit userland, from Daniel Borkmann. 4) Memory leak fix in act_police, from Davide Caratti. 5) Check RX checksum offload in RX descriptors properly in aquantia driver, from Dmitry Bogdanov. 6) SKB unlink fix in various spots, from Edward Cree. 7) ndo_dflt_fdb_dump() only works with ethernet, enforce this, from Eric Dumazet. 8) Fix FID leak in mlxsw driver, from Ido Schimmel. 9) IOTLB locking fix in vhost, from Jean-Philippe Brucker. 10) Fix SKB truesize accounting in ipv4/ipv6/netfilter frag memory limits otherwise namespace exit can hang. From Jiri Wiesner. 11) Address block parsing length fixes in x25 from Martin Schiller. 12) IRQ and ring accounting fixes in bnxt_en, from Michael Chan. 13) For tun interfaces, only iface delete works with rtnl ops, enforce this by disallowing add. From Nicolas Dichtel. 14) Use after free in liquidio, from Pan Bian. 15) Fix SKB use after passing to netif_receive_skb(), from Prashant Bhole. 16) Static key accounting and other fixes in XPS from Sabrina Dubroca. 17) Partially initialized flow key passed to ip6_route_output(), from Shmulik Ladkani. 18) Fix RTNL deadlock during reset in ibmvnic driver, from Thomas Falcon. 19) Several small TCP fixes (off-by-one on window probe abort, NULL deref in tail loss probe, SNMP mis-estimations) from Yuchung Cheng" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (93 commits) net/sched: cls_flower: Reject duplicated rules also under skip_sw bnxt_en: Fix _bnxt_get_max_rings() for 57500 chips. bnxt_en: Fix NQ/CP rings accounting on the new 57500 chips. bnxt_en: Keep track of reserved IRQs. bnxt_en: Fix CNP CoS queue regression. net/mlx4_core: Correctly set PFC param if global pause is turned off. Revert "net/ibm/emac: wrong bit is used for STA control" neighbour: Avoid writing before skb->head in neigh_hh_output() ipv6: Check available headroom in ip6_xmit() even without options tcp: lack of available data can also cause TSO defer ipv6: sr: properly initialize flowi6 prior passing to ip6_route_output mlxsw: spectrum_switchdev: Fix VLAN device deletion via ioctl mlxsw: spectrum_router: Relax GRE decap matching check mlxsw: spectrum_switchdev: Avoid leaking FID's reference count mlxsw: spectrum_nve: Remove easily triggerable warnings ipv4: ipv6: netfilter: Adjust the frag mem limit when truesize changes sctp: frag_point sanity check tcp: fix NULL ref in tail loss probe tcp: Do not underestimate rwnd_limited net: use skb_list_del_init() to remove from RX sublists ... commit 8586ca8a214471e4573d76356aabe890bfecdc8a Merge: ebbd30004d6c ac3e233d29f7 Author: Linus Torvalds Date: Sun Dec 9 15:09:55 2018 -0800 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "Three fixes: a boot parameter re-(re-)fix, a retpoline build artifact fix and an LLVM workaround" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/vdso: Drop implicit common-page-size linker flag x86/build: Fix compiler support check for CONFIG_RETPOLINE x86/boot: Clear RSDP address in boot_params for broken loaders commit 51a11b14c29c6c7cc985c6ce7dd9e20f61cf7f0a Author: Sandipan Das Date: Thu Dec 6 14:57:01 2018 +0530 bpf: powerpc: fix broken uapi for BPF_PROG_TYPE_PERF_EVENT Now that there are different variants of pt_regs for userspace and kernel, the uapi for the BPF_PROG_TYPE_PERF_EVENT program type must be changed by exporting the user_pt_regs structure instead of the pt_regs structure that is in-kernel only. Fixes: 002af9391bfb ("powerpc: Split user/kernel definitions of struct pt_regs") Signed-off-by: Sandipan Das Signed-off-by: Alexei Starovoitov commit ebbd30004d6cfa747723b3ac6ee1a97795f797ba Merge: 4b04e73a78c5 a50480cb6d61 Author: Linus Torvalds Date: Sun Dec 9 14:21:33 2018 -0800 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull kprobes fixes from Ingo Molnar: "Two kprobes fixes: a blacklist fix and an instruction patching related corruption fix" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: kprobes/x86: Blacklist non-attachable interrupt functions kprobes/x86: Fix instruction patching corruption when copying more than one RIP-relative instruction commit 4b04e73a78c5c89dc1a75fb35dea6c947c1d2ac7 Merge: 0844895a2e51 79c2206d369b Author: Linus Torvalds Date: Sun Dec 9 14:03:56 2018 -0800 Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI fixes from Ingo Molnar: "Two fixes: a large-system fix and an earlyprintk fix with certain resolutions" * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/earlyprintk/efi: Fix infinite loop on some screen widths x86/efi: Allocate e820 buffer before calling efi_exit_boot_service commit 35cc3cefc4de90001c9137e2d01dd9d06b11acfb Author: Or Gerlitz Date: Sun Dec 9 18:10:24 2018 +0200 net/sched: cls_flower: Reject duplicated rules also under skip_sw Currently, duplicated rules are rejected only for skip_hw or "none", hence allowing users to push duplicates into HW for no reason. Use the flower tables to protect for that. Signed-off-by: Or Gerlitz Signed-off-by: Paul Blakey Reported-by: Chris Mi Signed-off-by: David S. Miller commit d4b60e94e9bbe8c3b57e9cd126bed4a411ac5f6e Merge: bd5122cd1e06 e30fbc33190b Author: David S. Miller Date: Sun Dec 9 11:46:59 2018 -0800 Merge branch 'bnxt_en-Bug-fixes' Michael Chan says: ==================== bnxt_en: Bug fixes. The first patch fixes a regression on CoS queue setup, introduced recently by the 57500 new chip support patches. The rest are fixes related to ring and resource accounting on the new 57500 chips. ==================== Signed-off-by: David S. Miller commit e30fbc33190b8ba1d6e8ff4864627f7414b5ca99 Author: Michael Chan Date: Sun Dec 9 07:01:02 2018 -0500 bnxt_en: Fix _bnxt_get_max_rings() for 57500 chips. The CP rings are accounted differently on the new 57500 chips. There must be enough CP rings for the sum of RX and TX rings on the new chips. The current logic may be over-estimating the RX and TX rings. The output parameter max_cp should be the maximum NQs capped by MSIX vectors available for networking in the context of 57500 chips. The existing code which uses CMPL rings capped by the MSIX vectors works most of the time but is not always correct. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit c0b8cda05e1d8151f57a79e525c2c7d51cec2f4e Author: Michael Chan Date: Sun Dec 9 07:01:01 2018 -0500 bnxt_en: Fix NQ/CP rings accounting on the new 57500 chips. The new 57500 chips have introduced the NQ structure in addition to the existing CP rings in all chips. We need to introduce a new bnxt_nq_rings_in_use(). On legacy chips, the 2 functions are the same and one will just call the other. On the new chips, they refer to the 2 separate ring structures. The new function is now called to determine the resource (NQ or CP rings) associated with MSIX that are in use. On 57500 chips, the RDMA driver does not use the CP rings so we don't need to do the subtraction adjustment. Fixes: 41e8d7983752 ("bnxt_en: Modify the ring reservation functions for 57500 series chips.") Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 75720e6323a1d195ae3ebf1a7b5e17c2e687f552 Author: Michael Chan Date: Sun Dec 9 07:01:00 2018 -0500 bnxt_en: Keep track of reserved IRQs. The new 57500 chips use 1 NQ per MSIX vector, whereas legacy chips use 1 CP ring per MSIX vector. To better unify this, add a resv_irqs field to struct bnxt_hw_resc. On legacy chips, we initialize resv_irqs with resv_cp_rings. On new chips, we initialize it with the allocated MSIX resources. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 804fba4e9f508c8004a4bfbdf3f300ca237c56df Author: Michael Chan Date: Sun Dec 9 07:00:59 2018 -0500 bnxt_en: Fix CNP CoS queue regression. Recent changes to support the 57500 devices have created this regression. The bnxt_hwrm_queue_qportcfg() call was moved to be called earlier before the RDMA support was determined, causing the CoS queues configuration to be set before knowing whether RDMA was supported or not. Fix it by moving it to the right place right after RDMA support is determined. Fixes: 98f04cf0f1fc ("bnxt_en: Check context memory requirements from firmware.") Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 0844895a2e5161d2fc1674e870a0fd8286a3e18b Merge: 47dcb0802d28 dbde117c3126 Author: Linus Torvalds Date: Sun Dec 9 10:43:17 2018 -0800 Merge tag 'char-misc-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small driver fixes for 4.20-rc6. There is a hyperv fix that for some reaon took forever to get into a shape that could be applied to the tree properly, but resolves a much reported issue. The others are some gnss patches, one a bugfix and the two others updates to the MAINTAINERS file to properly match the gnss files in the tree. All have been in linux-next for a while with no reported issues" * tag 'char-misc-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: MAINTAINERS: exclude gnss from SIRFPRIMA2 regex matching MAINTAINERS: add gnss scm tree gnss: sirf: fix activation retry handling Drivers: hv: vmbus: Offload the handling of channels to two workqueues commit 47dcb0802d28813e4600192ce27475681f96f230 Merge: 822b7683fff1 87e4a5405f08 Author: Linus Torvalds Date: Sun Dec 9 10:35:33 2018 -0800 Merge tag 'staging-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging fixes from Greg KH: "Here are two staging driver bugfixes for 4.20-rc6. One is a revert of a previously incorrect patch that was merged a while ago, and the other resolves a possible buffer overrun that was found by code inspection. Both of these have been in the linux-next tree with no reported issues" * tag 'staging-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: Revert commit ef9209b642f "staging: rtl8723bs: Fix indenting errors and an off-by-one mistake in core/rtw_mlme_ext.c" staging: rtl8712: Fix possible buffer overrun commit 0603a9a84679eb12d9dadb97f4e0ba017e684c7b Merge: f53de38ea64d dae522045094 Author: Olof Johansson Date: Sun Dec 9 10:28:02 2018 -0800 Merge tag 'mvebu-fixes-4.20-1' of git://git.infradead.org/linux-mvebu into fixes mvebu fixes for 4.20 Adding CPU Idle state in the device tree for Armada 8040 seems to breaks boot on some board, so let's revert it waiting for a better solution. * tag 'mvebu-fixes-4.20-1' of git://git.infradead.org/linux-mvebu: Revert "arm64: dts: marvell: add CPU Idle power state support on Armada 7K/8K" Signed-off-by: Olof Johansson commit f53de38ea64d7cbc0ecbae8548178e1f431225a6 Merge: 69dcddecaa78 5f8208f55706 Author: Olof Johansson Date: Sun Dec 9 10:27:17 2018 -0800 Merge tag 'sunxi-fixes-for-4.20' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into fixes Allwinner fixes for 4.20 One small fix for a regulator range on the Banana Pi M3 * tag 'sunxi-fixes-for-4.20' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: ARM: dts: sun8i: a83t: bananapi-m3: increase vcc-pd voltage to 3.3V Signed-off-by: Olof Johansson commit 69dcddecaa78a8765705cdf3eefc1b56f383dedc Merge: d9536e809801 f15096f12a4e Author: Olof Johansson Date: Sun Dec 9 10:26:36 2018 -0800 Merge tag 'imx-fixes-4.20-3' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into fixes i.MX fixes for 4.20, round 3: - A couple of fixes on imx7d-pico and imx7d-nitrogen7 boards to correct the description of the Wifi clock. - Change SW2ISO count to get a safer ARM LDO ramp-up time, so that different boards can be covered. This fixes the ARM LDO failure seen on some customer boards. * tag 'imx-fixes-4.20-3' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: ARM: dts: imx7d-nitrogen7: Fix the description of the Wifi clock ARM: imx: update the cpu power up timing setting on i.mx6sx ARM: dts: imx7d-pico: Describe the Wifi clock Signed-off-by: Olof Johansson commit 822b7683fff11f152e74c404b3d915f6e5b13698 Merge: 50a5528a4b19 dada6a43b040 Author: Linus Torvalds Date: Sun Dec 9 10:24:29 2018 -0800 Merge tag 'tty-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty driver fixes from Greg KH: "Here are three small tty driver fixes for 4.20-rc6 Nothing major, just some bug fixes for reported issues. Full details are in the shortlog. All of these have been in linux-next for a while with no reported issues" * tag 'tty-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: kgdboc: fix KASAN global-out-of-bounds bug in param_set_kgdboc_var() tty: serial: 8250_mtk: always resume the device in probe. tty: do not set TTY_IO_ERROR flag if console port commit 50a5528a4b19b7324f0796ea2fedf32530a11ff8 Merge: bc4caf186fb6 3caad34eab57 Author: Linus Torvalds Date: Sun Dec 9 10:18:24 2018 -0800 Merge tag 'usb-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB fixes for 4.20-rc6 The "largest" here are some xhci fixes for reported issues. Also here is a USB core fix, some quirk additions, and a usb-serial fix which required the export of one of the tty layer's functions to prevent code duplication. The tty maintainer agreed with this change. All of these have been in linux-next with no reported issues" * tag 'usb-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: xhci: Prevent U1/U2 link pm states if exit latency is too long xhci: workaround CSS timeout on AMD SNPS 3.0 xHC USB: check usb_get_extra_descriptor for proper size USB: serial: console: fix reported terminal settings usb: quirk: add no-LPM quirk on SanDisk Ultra Flair device USB: Fix invalid-free bug in port_over_current_notify() usb: appledisplay: Add 27" Apple Cinema Display commit bc4caf186fb691ad56adbe578d356a262f3a7d10 Merge: fa82dcbf2aed 6ac79291fb7d Author: Linus Torvalds Date: Sun Dec 9 10:15:13 2018 -0800 Merge tag '4.20-rc5-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "Three small fixes: a fix for smb3 direct i/o, a fix for CIFS DFS for stable and a minor cifs Kconfig fix" * tag '4.20-rc5-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: CIFS: Avoid returning EBUSY to upper layer VFS cifs: Fix separator when building path from dentry cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs) commit fa82dcbf2aed65dc3ea78eaca9ea56fd926b2b10 Merge: bd799eb63db4 27359fd6e5f3 Author: Linus Torvalds Date: Sun Dec 9 09:54:04 2018 -0800 Merge tag 'dax-fixes-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull dax fixes from Dan Williams: "The last of the known regression fixes and fallout from the Xarray conversion of the filesystem-dax implementation. On the path to debugging why the dax memory-failure injection test started failing after the Xarray conversion a couple more fixes for the dax_lock_mapping_entry(), now called dax_lock_page(), surfaced. Those plus the bug that started the hunt are now addressed. These patches have appeared in a -next release with no issues reported. Note the touches to mm/memory-failure.c are just the conversion to the new function signature for dax_lock_page(). Summary: - Fix the Xarray conversion of fsdax to properly handle dax_lock_mapping_entry() in the presense of pmd entries - Fix inode destruction racing a new lock request" * tag 'dax-fixes-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: dax: Fix unlock mismatch with updated API dax: Don't access a freed inode dax: Check page->mapping isn't NULL commit bd799eb63db4c61a5f2dc941672391fbca5bcab4 Merge: 6ec067e3a449 b5fd2e00a602 Author: Linus Torvalds Date: Sun Dec 9 09:46:54 2018 -0800 Merge tag 'libnvdimm-fixes-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm fixes from Dan Williams: "A regression fix for the Address Range Scrub implementation, yes another one, and support for platforms that misalign persistent memory relative to the Linux memory hotplug section constraint. Longer term, support for sub-section memory hotplug would alleviate alignment waste, but until then this hack allows a 'struct page' memmap to be established for these misaligned memory regions. These have all appeared in a -next release, and thanks to Patrick for reporting and testing the alignment padding fix. Summary: - Unless and until the core mm handles memory hotplug units smaller than a section (128M), persistent memory namespaces must be padded to section alignment. The libnvdimm core already handled section collision with "System RAM", but some configurations overlap independent "Persistent Memory" ranges within a section, so additional padding injection is added for that case. - The recent reworks of the ARS (address range scrub) state machine to reduce the number of state flags inadvertantly missed a conversion of acpi_nfit_ars_rescan() call sites. Fix the regression whereby user-requested ARS results in a "short" scrub rather than a "long" scrub. - Fixup the unit tests to handle / test the 128M section alignment of mocked test resources. * tag 'libnvdimm-fixes-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: acpi/nfit: Fix user-initiated ARS to be "ARS-long" rather than "ARS-short" libnvdimm, pfn: Pad pfn namespaces relative to other regions tools/testing/nvdimm: Align test resources to 128M commit 9ef34630a4614ee1cd478f9859ebea55d55f10ec Author: Oliver O'Halloran Date: Fri Dec 7 02:17:14 2018 +1100 powerpc/mm: Fallback to RAM if the altmap is unusable The "altmap" is used to provide a pool of memory that is reserved for the vmemmap backing of hot-plugged memory. This is useful when adding large amount of ZONE_DEVICE memory to a system with a limited amount of normal memory. On ppc64 we use huge pages to map the vmemmap which requires the backing storage to be contigious and aligned to the hugepage size. The altmap implementation allows for the altmap provider to reserve a few PFNs at the start of the range for it's own uses and when this occurs the first chunk of the altmap is not usable for hugepage mappings. On hash there is no sane way to fall back to a normal sized page mapping so we fail the allocation. This results in memory hotplug failing with ENOMEM when the new range doesn't fall into an existing vmemmap block. This patch handles this case by falling back to using system memory rather than failing if we cannot allocate from the altmap. This fallback should only ever be used for the first vmemmap block so it should not cause excess memory consumption. Fixes: 7b73d978a5d0 ("mm: pass the vmem_altmap to vmemmap_populate") Signed-off-by: Oliver O'Halloran Signed-off-by: Michael Ellerman commit 43001c52b603cac041783cc392094ea560bd9444 Author: Oliver O'Halloran Date: Fri Dec 7 02:17:13 2018 +1100 powerpc/papr_scm: Use ibm,unit-guid as the iset cookie The interleave set cookie is used to determine if a label stored in the metadata space should be applied to the current region. This is important in the case of NVDIMMs since the firmware may change the interleaving configuration of a DIMM which would invalidate the existing labels. In our case the hypervisor hides those details from us so we don't really care, but libnvdimm still requires the interleave set cookie to be non-zero. For our purposes we just need the set cookie to be unique and fixed for a given PAPR SCM region and using the unit-guid (really a UUID) is fine for this purpose. Fixes: b5beae5e224f ("powerpc/pseries: Add driver for PAPR SCM regions") Signed-off-by: Oliver O'Halloran [mpe: Use kernel types (u64)] Signed-off-by: Michael Ellerman commit b0d65a8cbcb097d2110885c3660add97b0125867 Author: Oliver O'Halloran Date: Fri Dec 7 02:17:12 2018 +1100 powerpc/papr_scm: Fix DIMM device registration race When a new nvdimm device is registered with libnvdimm via nvdimm_create() it is added as a device on the nvdimm bus. The probe function for the DIMM driver is potentially quite slow so actually registering and probing the device is done in an async domain rather than immediately after device creation. This can result in a race where the region device (created 2nd) is probed first and fails to activate at boot. To fix this we use the same approach as the ACPI/NFIT driver which is to check that all the DIMM devices registered successfully. LibNVDIMM provides the nvdimm_bus_count_dimms() function which synchronises with the async domain and verifies that the dimm was successfully registered with the bus. If either of these does not occur then we bail. Fixes: b5beae5e224f ("powerpc/pseries: Add driver for PAPR SCM regions") Signed-off-by: Oliver O'Halloran Signed-off-by: Michael Ellerman commit 409dd7dc83eb54c4bc156aea890cc95bc21dc6f0 Author: Oliver O'Halloran Date: Fri Dec 7 02:17:11 2018 +1100 powerpc/papr_scm: Remove endian conversions The return values of a h-call are returned in the CPU registers and written to the provided buffer by the plpar_hcall() wrapper. As a result the values written to memory are always in the native endian and should not be byte swapped. The inital implementation of the H-Call interface was done in qemu and the returned values were byte swapped unnecessarily in both the hypervisor and in the driver so this was only noticed when bringing up the PowerVM implementation. Fixes: b5beae5e224f ("powerpc/pseries: Add driver for PAPR SCM regions") Signed-off-by: Oliver O'Halloran Signed-off-by: Michael Ellerman commit 683ec0e04ab7e2d86d2656c71322dfb2ebf063fc Author: Oliver O'Halloran Date: Fri Dec 7 02:17:10 2018 +1100 powerpc/papr_scm: Update DT properties The ibm,unit-sizes property was originally specified as an array of two u32s corresponding to the memory block size, and the number of blocks available in that region. A fairly last-minute change to the SCM DT specification was splitting that into two seperate u64 properties: ibm,block-sizes and ibm,number-of-blocks that convey the same information. No firmware / hypervisor that emitted the ibm,unit-size property ever appeared in the wild. Fixes: b5beae5e224f ("powerpc/pseries: Add driver for PAPR SCM regions") Signed-off-by: Oliver O'Halloran [mpe: Use kernel types (u32/u64)] Signed-off-by: Michael Ellerman commit fa9c98e4b975bb3192ed6af09d9fa282ed3cd8a0 Author: Takashi Sakamoto Date: Sun Dec 9 17:04:19 2018 +0900 ALSA: fireface: fix reference to wrong register for clock configuration In an initial commit, 'SYNC_STATUS' register is referred to get clock configuration, however this is wrong, according to my local note at hand for reverse-engineering about packet dump. It should be 'CLOCK_CONFIG' register. Actually, ff400_dump_clock_config() is correctly programmed. This commit fixes the bug. Cc: # v4.12+ Fixes: 76fdb3a9e13a ('ALSA: fireface: add support for Fireface 400') Signed-off-by: Takashi Sakamoto Signed-off-by: Takashi Iwai commit 6ba189c5c1a4bda70dc1e4826c58b0246068bb8d Author: Hui Wang Date: Sun Dec 9 09:16:43 2018 +0800 ALSA: hda/realtek - Fix the mute LED regresion on Lenovo X1 Carbon Users reported a mute LED regression on Lenovo X1 Carbon, the root cause is we applied the fixup of ALC285_FIXUP_LENOVO_HEADPHONE_NOISE to this machine, then the machine can't apply the fixup of ALC269_FIXUP_THINKPAD_ACPI anymore. To fix it, we chain two fixup together. Fixes: c4cfcf6f4297 ("ALSA: hda/realtek - fix the pop noise on headphone for lenovo laptops") Cc: Signed-off-by: Hui Wang Signed-off-by: Takashi Iwai commit ca5047286c9c93a01e1f471d00a6019536992954 Author: Yussuf Khalil Date: Sat Dec 8 20:13:35 2018 -0800 Input: synaptics - enable RMI on ThinkPad T560 Before commit 7fd6d98b89f3 ("i2c: i801: Allow ACPI AML access I/O ports not reserved for SMBus"), enabling RMI on the T560 would cause the touchpad to stop working after resuming from suspend. Now that this issue is fixed, RMI can be enabled safely and works fine. Reviewed-by: Benjamin Tissoires Signed-off-by: Yussuf Khalil Signed-off-by: Dmitry Torokhov commit e2ca26ec4f01486661b55b03597c13e2b9c18b73 Author: Tony Lindgren Date: Tue Dec 4 13:52:49 2018 -0800 Input: omap-keypad - fix idle configuration to not block SoC idle states With PM enabled, I noticed that pressing a key on the droid4 keyboard will block deeper idle states for the SoC. Let's fix this by using IRQF_ONESHOT and stop constantly toggling the device OMAP4_KBD_IRQENABLE register as suggested by Dmitry Torokhov . From the hardware point of view, looks like we need to manage the registers for OMAP4_KBD_IRQENABLE and OMAP4_KBD_WAKEUPENABLE together to avoid blocking deeper SoC idle states. And with toggling of OMAP4_KBD_IRQENABLE register now gone with IRQF_ONESHOT, also the SoC idle state problem is gone during runtime. We still also need to clear OMAP4_KBD_WAKEUPENABLE in omap4_keypad_close() though to pair it with omap4_keypad_open() to prevent blocking deeper SoC idle states after rmmod omap4-keypad. Reported-by: Pavel Machek Signed-off-by: Tony Lindgren Signed-off-by: Dmitry Torokhov commit bd5122cd1e0644d8bd8dd84517c932773e999766 Author: Tarick Bedeir Date: Fri Dec 7 00:30:26 2018 -0800 net/mlx4_core: Correctly set PFC param if global pause is turned off. rx_ppp and tx_ppp can be set between 0 and 255, so don't clamp to 1. Fixes: 6e8814ceb7e8 ("net/mlx4_en: Fix mixed PFC and Global pause user control requests") Signed-off-by: Tarick Bedeir Reviewed-by: Eran Ben Elisha Signed-off-by: David S. Miller commit 6ec067e3a4492569699676d75a21fcee22fefc5b Merge: 8214bdf7d3e6 1aea7aee805e Author: Linus Torvalds Date: Sat Dec 8 17:45:20 2018 -0800 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal Pull thermal SoC fixes from Eduardo Valentin: "Fixes for armada and broadcom thermal drivers" * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal: thermal: broadcom: constify thermal_zone_of_device_ops structure thermal: armada: constify thermal_zone_of_device_ops structure thermal: bcm2835: Switch to SPDX identifier thermal: armada: fix legacy resource fixup thermal: armada: fix legacy validity test sense commit 8214bdf7d3e69050221aad19ec28826ed6cb4934 Merge: 570c9139c358 b7d624ab4312 Author: Linus Torvalds Date: Sat Dec 8 11:44:04 2018 -0800 Merge tag 'asm-generic-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull asm-generic fix from Arnd Bergmann: "Multiple people reported a bug I introduced in asm-generic/unistd.h in 4.20, this is the obvious bugfix to get glibc and others to correctly build again on new architectures that no longer provide the old fstatat64() family of system calls" * tag 'asm-generic-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: asm-generic: unistd.h: fixup broken macro include. commit 570c9139c358d45ab4d52fb0c4e478e2bd7123a2 Merge: f896adc42d53 9a43be9cedd5 Author: Linus Torvalds Date: Sat Dec 8 11:33:26 2018 -0800 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "A few clk driver fixes this time: - Introduce protected-clock DT binding to fix breakage on qcom sdm845-mtp boards where the qspi clks introduced this merge window cause the firmware on those boards to take down the system if we try to read the clk registers - Fix a couple off-by-one errors found by Dan Carpenter - Handle failure in zynq fixed factor clk driver to avoid using uninitialized data" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: zynqmp: Off by one in zynqmp_is_valid_clock() clk: mmp: Off by one in mmp_clk_add() clk: mvebu: Off by one bugs in cp110_of_clk_get() arm64: dts: qcom: sdm845-mtp: Mark protected gcc clocks clk: qcom: Support 'protected-clocks' property dt-bindings: clk: Introduce 'protected-clocks' property clk: zynqmp: handle fixed factor param query error commit f896adc42d5399eb68c9900bd4fd471ccea895e4 Merge: 356ff8a9a78f 8f67b5adc030 Author: Linus Torvalds Date: Sat Dec 8 11:25:02 2018 -0800 Merge tag 'xfs-4.20-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Darrick Wong: "Here are hopefully the last set of fixes for 4.20. There's a fix for a longstanding statfs reporting problem with project quotas, a correction for page cache invalidation behaviors when fallocating near EOF, and a fix for a broken metadata verifier return code. Finally, the most important fix is to the pipe splicing code (aka the generic copy_file_range fallback) to avoid pointless short directio reads by only asking the filesystem for as much data as there are available pages in the pipe buffer. Our previous fix (simulated short directio reads because the number of pages didn't match the length of the read requested) caused subtle problems on overlayfs, so that part is reverted. Anyhow, this series passes fstests -g all on xfs and overlay+xfs, and has passed 17 billion fsx operations problem-free since I started testing Summary: - Fix broken project quota inode counts - Fix incorrect PAGE_MASK/PAGE_SIZE usage - Fix incorrect return value in btree verifier - Fix WARN_ON remap flags false positive - Fix splice read overflows" * tag 'xfs-4.20-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: iomap: partially revert 4721a601099 (simulated directio short read on EFAULT) splice: don't read more than available pipe space vfs: allow some remap flags to be passed to vfs_clone_file_range xfs: fix inverted return from xfs_btree_sblock_verify_crc xfs: fix PAGE_MASK usage in xfs_free_file_space fs/xfs: fix f_ffree value for statfs when project quota is set commit 356ff8a9a78fb35d6482584d260c3754dcbdf669 Author: David Rientjes Date: Fri Dec 7 14:50:16 2018 -0800 Revert "mm, thp: consolidate THP gfp handling into alloc_hugepage_direct_gfpmask" This reverts commit 89c83fb539f95491be80cdd5158e6f0ce329e317. This should have been done as part of 2f0799a0ffc0 ("mm, thp: restore node-local hugepage allocations"). The movement of the thp allocation policy from alloc_pages_vma() to alloc_hugepage_direct_gfpmask() was intended to only set __GFP_THISNODE for mempolicies that are not MPOL_BIND whereas the revert could set this regardless of mempolicy. While the check for MPOL_BIND between alloc_hugepage_direct_gfpmask() and alloc_pages_vma() was racy, that has since been removed since the revert. What is left is the possibility to use __GFP_THISNODE in policy_node() when it is unexpected because the special handling for hugepages in alloc_pages_vma() was removed as part of the consolidation. Secondly, prior to 89c83fb539f9, alloc_pages_vma() implemented a somewhat different policy for hugepage allocations, which were allocated through alloc_hugepage_vma(). For hugepage allocations, if the allocating process's node is in the set of allowed nodes, allocate with __GFP_THISNODE for that node (for MPOL_PREFERRED, use that node with __GFP_THISNODE instead). This was changed for shmem_alloc_hugepage() to allow fallback to other nodes in 89c83fb539f9 as it did for new_page() in mm/mempolicy.c which is functionally different behavior and removes the requirement to only allocate hugepages locally. So this commit does a full revert of 89c83fb539f9 instead of the partial revert that was done in 2f0799a0ffc0. The result is the same thp allocation policy for 4.20 that was in 4.19. Fixes: 89c83fb539f9 ("mm, thp: consolidate THP gfp handling into alloc_hugepage_direct_gfpmask") Fixes: 2f0799a0ffc0 ("mm, thp: restore node-local hugepage allocations") Signed-off-by: David Rientjes Acked-by: Vlastimil Babka Cc: Andrea Arcangeli Cc: Mel Gorman Cc: Michal Hocko Cc: Andrew Morton Signed-off-by: Linus Torvalds commit 5b3279e2cba2238b37f6c18adfdea8bddb32715a Author: Benjamin Herrenschmidt Date: Fri Dec 7 15:05:04 2018 +1100 Revert "net/ibm/emac: wrong bit is used for STA control" This reverts commit 624ca9c33c8a853a4a589836e310d776620f4ab9. This commit is completely bogus. The STACR register has two formats, old and new, depending on the version of the IP block used. There's a pair of device-tree properties that can be used to specify the format used: has-inverted-stacr-oc has-new-stacr-staopc What this commit did was to change the bit definition used with the old parts to match the new parts. This of course breaks the driver on all the old ones. Instead, the author should have set the appropriate properties in the device-tree for the variant used on his board. Signed-off-by: Benjamin Herrenschmidt Signed-off-by: David S. Miller commit 60a89a3ce0cce515dc663bc1b45ac89202ad6c79 Author: Martin K. Petersen Date: Tue Dec 4 20:58:33 2018 -0500 scsi: t10-pi: Return correct ref tag when queue has no integrity profile Commit ddd0bc756983 ("block: move ref_tag calculation func to the block layer") moved ref tag calculation from SCSI to a library function. However, this change broke returning the correct ref tag for devices operating in DIF mode since these do not have an associated block integrity profile. This in turn caused read/write failures on PI-formatted disks attached to an mpt3sas controller. Fixes: ddd0bc756983 ("block: move ref_tag calculation func to the block layer") Cc: stable@vger.kernel.org # 4.19+ Reported-by: John Garry Tested-by: Xiang Chen Signed-off-by: Martin K. Petersen commit 9ae4f8420ed7be4b13c96600e3568c144d101a23 Author: Dan Carpenter Date: Thu Nov 1 08:25:30 2018 +0300 scsi: bnx2fc: Fix NULL dereference in error handling If "interface" is NULL then we can't release it and trying to will only lead to an Oops. Fixes: aea71a024914 ("[SCSI] bnx2fc: Introduce interface structure for each vlan interface") Signed-off-by: Dan Carpenter Signed-off-by: Martin K. Petersen commit c64a87f9518409d0a439895f09f6149ffdd427b8 Author: Himanshu Madhani Date: Thu Dec 6 21:49:42 2018 -0800 Revert "scsi: qla2xxx: Fix NVMe Target discovery" This reverts commit db186382af21e926e90df19499475f2552192b77. This commit introduced regression with FCP discovery so revert it to fix discovery for FCP luns. Signed-off-by: Himanshu Madhani Signed-off-by: Martin K. Petersen commit 8b78903bc5f1786f7f988d26de48819144a13d6c Merge: f9bfe4e6a9d0 e6ac64d4c4d0 Author: David S. Miller Date: Fri Dec 7 16:24:40 2018 -0800 Merge branch 'skb-headroom-slab-out-of-bounds' Stefano Brivio says: ==================== Fix slab out-of-bounds on insufficient headroom for IPv6 packets Patch 1/2 fixes a slab out-of-bounds occurring with short SCTP packets over IPv4 over L2TP over IPv6 on a configuration with relatively low HEADER_MAX. Patch 2/2 makes sure we avoid writing before the allocated buffer in neigh_hh_output() in case the headroom is enough for the unaligned hardware header size, but not enough for the aligned one, and that we warn if we hit this condition. ==================== Signed-off-by: David S. Miller commit e6ac64d4c4d095085d7dd71cbd05704ac99829b2 Author: Stefano Brivio Date: Thu Dec 6 19:30:37 2018 +0100 neighbour: Avoid writing before skb->head in neigh_hh_output() While skb_push() makes the kernel panic if the skb headroom is less than the unaligned hardware header size, it will proceed normally in case we copy more than that because of alignment, and we'll silently corrupt adjacent slabs. In the case fixed by the previous patch, "ipv6: Check available headroom in ip6_xmit() even without options", we end up in neigh_hh_output() with 14 bytes headroom, 14 bytes hardware header and write 16 bytes, starting 2 bytes before the allocated buffer. Always check we're not writing before skb->head and, if the headroom is not enough, warn and drop the packet. v2: - instead of panicking with BUG_ON(), WARN_ON_ONCE() and drop the packet (Eric Dumazet) - if we avoid the panic, though, we need to explicitly check the headroom before the memcpy(), otherwise we'll have corrupted slabs on a running kernel, after we warn - use __skb_push() instead of skb_push(), as the headroom check is already implemented here explicitly (Eric Dumazet) Signed-off-by: Stefano Brivio Signed-off-by: David S. Miller commit 66033f47ca60294a95fc85ec3a3cc909dab7b765 Author: Stefano Brivio Date: Thu Dec 6 19:30:36 2018 +0100 ipv6: Check available headroom in ip6_xmit() even without options Even if we send an IPv6 packet without options, MAX_HEADER might not be enough to account for the additional headroom required by alignment of hardware headers. On a configuration without HYPERV_NET, WLAN, AX25, and with IPV6_TUNNEL, sending short SCTP packets over IPv4 over L2TP over IPv6, we start with 100 bytes of allocated headroom in sctp_packet_transmit(), end up with 54 bytes after l2tp_xmit_skb(), and 14 bytes in ip6_finish_output2(). Those would be enough to append our 14 bytes header, but we're going to align that to 16 bytes, and write 2 bytes out of the allocated slab in neigh_hh_output(). KASan says: [ 264.967848] ================================================================== [ 264.967861] BUG: KASAN: slab-out-of-bounds in ip6_finish_output2+0x1aec/0x1c70 [ 264.967866] Write of size 16 at addr 000000006af1c7fe by task netperf/6201 [ 264.967870] [ 264.967876] CPU: 0 PID: 6201 Comm: netperf Not tainted 4.20.0-rc4+ #1 [ 264.967881] Hardware name: IBM 2827 H43 400 (z/VM 6.4.0) [ 264.967887] Call Trace: [ 264.967896] ([<00000000001347d6>] show_stack+0x56/0xa0) [ 264.967903] [<00000000017e379c>] dump_stack+0x23c/0x290 [ 264.967912] [<00000000007bc594>] print_address_description+0xf4/0x290 [ 264.967919] [<00000000007bc8fc>] kasan_report+0x13c/0x240 [ 264.967927] [<000000000162f5e4>] ip6_finish_output2+0x1aec/0x1c70 [ 264.967935] [<000000000163f890>] ip6_finish_output+0x430/0x7f0 [ 264.967943] [<000000000163fe44>] ip6_output+0x1f4/0x580 [ 264.967953] [<000000000163882a>] ip6_xmit+0xfea/0x1ce8 [ 264.967963] [<00000000017396e2>] inet6_csk_xmit+0x282/0x3f8 [ 264.968033] [<000003ff805fb0ba>] l2tp_xmit_skb+0xe02/0x13e0 [l2tp_core] [ 264.968037] [<000003ff80631192>] l2tp_eth_dev_xmit+0xda/0x150 [l2tp_eth] [ 264.968041] [<0000000001220020>] dev_hard_start_xmit+0x268/0x928 [ 264.968069] [<0000000001330e8e>] sch_direct_xmit+0x7ae/0x1350 [ 264.968071] [<000000000122359c>] __dev_queue_xmit+0x2b7c/0x3478 [ 264.968075] [<00000000013d2862>] ip_finish_output2+0xce2/0x11a0 [ 264.968078] [<00000000013d9b14>] ip_finish_output+0x56c/0x8c8 [ 264.968081] [<00000000013ddd1e>] ip_output+0x226/0x4c0 [ 264.968083] [<00000000013dbd6c>] __ip_queue_xmit+0x894/0x1938 [ 264.968100] [<000003ff80bc3a5c>] sctp_packet_transmit+0x29d4/0x3648 [sctp] [ 264.968116] [<000003ff80b7bf68>] sctp_outq_flush_ctrl.constprop.5+0x8d0/0xe50 [sctp] [ 264.968131] [<000003ff80b7c716>] sctp_outq_flush+0x22e/0x7d8 [sctp] [ 264.968146] [<000003ff80b35c68>] sctp_cmd_interpreter.isra.16+0x530/0x6800 [sctp] [ 264.968161] [<000003ff80b3410a>] sctp_do_sm+0x222/0x648 [sctp] [ 264.968177] [<000003ff80bbddac>] sctp_primitive_ASSOCIATE+0xbc/0xf8 [sctp] [ 264.968192] [<000003ff80b93328>] __sctp_connect+0x830/0xc20 [sctp] [ 264.968208] [<000003ff80bb11ce>] sctp_inet_connect+0x2e6/0x378 [sctp] [ 264.968212] [<0000000001197942>] __sys_connect+0x21a/0x450 [ 264.968215] [<000000000119aff8>] sys_socketcall+0x3d0/0xb08 [ 264.968218] [<000000000184ea7a>] system_call+0x2a2/0x2c0 [...] Just like ip_finish_output2() does for IPv4, check that we have enough headroom in ip6_xmit(), and reallocate it if we don't. This issue is older than git history. Reported-by: Jianlin Shi Signed-off-by: Stefano Brivio Signed-off-by: David S. Miller commit f9bfe4e6a9d08d405fe7b081ee9a13e649c97ecf Author: Eric Dumazet Date: Thu Dec 6 09:58:24 2018 -0800 tcp: lack of available data can also cause TSO defer tcp_tso_should_defer() can return true in three different cases : 1) We are cwnd-limited 2) We are rwnd-limited 3) We are application limited. Neal pointed out that my recent fix went too far, since it assumed that if we were not in 1) case, we must be rwnd-limited Fix this by properly populating the is_cwnd_limited and is_rwnd_limited booleans. After this change, we can finally move the silly check for FIN flag only for the application-limited case. The same move for EOR bit will be handled in net-next, since commit 1c09f7d073b1 ("tcp: do not try to defer skbs with eor mark (MSG_EOR)") is scheduled for linux-4.21 Tested by running 200 concurrent netperf -t TCP_RR -- -r 60000,100 and checking none of them was rwnd_limited in the chrono_stat output from "ss -ti" command. Fixes: 41727549de3e ("tcp: Do not underestimate rwnd_limited") Signed-off-by: Eric Dumazet Suggested-by: Neal Cardwell Reviewed-by: Neal Cardwell Acked-by: Soheil Hassas Yeganeh Reviewed-by: Yuchung Cheng Signed-off-by: David S. Miller commit 5f179793f0a73965681db6a3203fa1baabd9b3c3 Merge: b8bf4692c980 834e772c8db0 Author: Linus Torvalds Date: Fri Dec 7 14:34:10 2018 -0800 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull vhost/virtio fixes from Michael Tsirkin: "A couple of last-minute fixes" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: vhost/vsock: fix use-after-free in network stack callers virtio/s390: fix race in ccw_io_helper() virtio/s390: avoid race on vcdev->config vhost/vsock: fix reset orphans race with close timeout commit b8bf4692c98038a1ec98faf09e545d1a32429b54 Merge: 1cdc3624a1df b4aecf78083d Author: Linus Torvalds Date: Fri Dec 7 14:18:49 2018 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fix from Catalin Marinas: "Avoid sending IPIs with interrupts disabled" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: hibernate: Avoid sending cross-calling with interrupts disabled commit ec3d837aac5dca7cb8a69c9f101690c182da79c4 Author: Stanislav Fomichev Date: Wed Dec 5 20:40:48 2018 -0800 net/flow_dissector: correctly cap nhoff and thoff in case of BPF We want to make sure that the following condition holds: 0 <= nhoff <= thoff <= skb->len BPF program can set out-of-bounds nhoff and thoff, which is dangerous, see recent commit d0c081b49137 ("flow_dissector: properly cap thoff field")'. Signed-off-by: Stanislav Fomichev Acked-by: Song Liu Signed-off-by: Alexei Starovoitov commit 13e56ec2cc9860aa22e01ffc7a3160f35a96b728 Author: Stanislav Fomichev Date: Wed Dec 5 20:40:47 2018 -0800 selftests/bpf: use thoff instead of nhoff in BPF flow dissector We are returning thoff from the flow dissector, not the nhoff. Pass thoff along with nhoff to the bpf program (initially thoff == nhoff) and expect flow dissector amend/return thoff, not nhoff. This avoids confusion, when by the time bpf flow dissector exits, nhoff == thoff, which doesn't make much sense. Signed-off-by: Stanislav Fomichev Acked-by: Song Liu Signed-off-by: Alexei Starovoitov commit 1cdc3624a1df5b10519481763ec7a2b2481495ca Merge: 52ab2ec00518 8fb2dfb228df Author: Linus Torvalds Date: Fri Dec 7 13:13:07 2018 -0800 Merge tag 'gcc-plugins-v4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull gcc stackleak plugin fixes from Kees Cook: - Remove tracing for inserted stack depth marking function (Anders Roxell) - Move gcc-plugin pass location to avoid objtool warnings (Alexander Popov) * tag 'gcc-plugins-v4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: stackleak: Register the 'stackleak_cleanup' pass before the '*free_cfg' pass stackleak: Mark stackleak_track_stack() as notrace commit 52ab2ec00518a164884c5670932557cd868b0193 Merge: 7b24f6c082b3 e61efff4ae94 Author: Linus Torvalds Date: Fri Dec 7 13:07:10 2018 -0800 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: - Disable the new crypto stats interface as it's still being changed - Fix potential uses-after-free in cbc/cfb/pcbc. * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: user - Disable statistics interface crypto: do not free algorithm before using commit d57f9da890696af1484f4a47f7f123560197865a Author: Damien Le Moal Date: Fri Nov 30 15:31:48 2018 +0900 dm zoned: Fix target BIO completion handling struct bioctx includes the ref refcount_t to track the number of I/O fragments used to process a target BIO as well as ensure that the zone of the BIO is kept in the active state throughout the lifetime of the BIO. However, since decrementing of this reference count is done in the target .end_io method, the function bio_endio() must be called multiple times for read and write target BIOs, which causes problems with the value of the __bi_remaining struct bio field for chained BIOs (e.g. the clone BIO passed by dm core is large and splits into fragments by the block layer), resulting in incorrect values and inconsistencies with the BIO_CHAIN flag setting. This is turn triggers the BUG_ON() call: BUG_ON(atomic_read(&bio->__bi_remaining) <= 0); in bio_remaining_done() called from bio_endio(). Fix this ensuring that bio_endio() is called only once for any target BIO by always using internal clone BIOs for processing any read or write target BIO. This allows reference counting using the target BIO context counter to trigger the target BIO completion bio_endio() call once all data, metadata and other zone work triggered by the BIO complete. Overall, this simplifies the code too as the target .end_io becomes unnecessary and differences between read and write BIO issuing and completion processing disappear. Fixes: 3b1a94c88b79 ("dm zoned: drive-managed zoned block device target") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Mike Snitzer commit 89f5fa47476eda56402e29fff3c5097f5c2a1e19 Author: Mike Snitzer Date: Mon Dec 3 16:47:21 2018 -0500 dm: call blk_queue_split() to impose device limits on bios Otherwise the incoming bios, of various types, won't be shaped based on the DM device's advertised limits. Depends-on: af67c31fba ("blk: remove bio_set arg from blk_queue_split()") Fixes: 744889b7cb ("block: don't deal with discard limit in blkdev_issue_discard()") Cc: stable@vger.kernel.org Signed-off-by: Mike Snitzer commit 687cf4412a343a63928a5c9d91bdc0f522939d43 Author: Mike Snitzer Date: Fri Nov 9 11:56:03 2018 -0500 dm cache metadata: verify cache has blocks in blocks_are_clean_separate_dirty() Otherwise dm_bitset_cursor_begin() return -ENODATA. Other calls to dm_bitset_cursor_begin() have similar negative checks. Fixes inability to create a cache in passthrough mode (even though doing so makes no sense). Fixes: 0d963b6e65 ("dm cache metadata: fix metadata2 format's blocks_are_clean_separate_dirty") Cc: stable@vger.kernel.org Reported-by: David Teigland Signed-off-by: Mike Snitzer commit 7b24f6c082b3777749ccd19c9beb8643fa718480 Merge: 0b43a299794e b07b864ee423 Author: Linus Torvalds Date: Fri Dec 7 12:58:34 2018 -0800 Merge tag 'pci-v4.20-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fixes from Bjorn Helgaas: "Revert ASPM change that caused a regression" * tag 'pci-v4.20-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: Revert "PCI/ASPM: Do not initialize link state when aspm_disabled is set" commit 1b4e5ad5d6b9f15cd0b5121f86d4719165958417 Author: Shmulik Ladkani Date: Fri Dec 7 09:50:17 2018 +0200 ipv6: sr: properly initialize flowi6 prior passing to ip6_route_output In 'seg6_output', stack variable 'struct flowi6 fl6' was missing initialization. Fixes: 6c8702c60b88 ("ipv6: sr: add support for SRH encapsulation and injection with lwtunnels") Signed-off-by: Shmulik Ladkani Signed-off-by: David S. Miller commit 0b43a299794ee9dba2dc1b0f0290b1acab9d445d Merge: 52f842ccd615 8b878ee247ef Author: Linus Torvalds Date: Fri Dec 7 10:40:37 2018 -0800 Merge tag 'for-linus-20181207' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "Let's try this again... We're finally happy with the DM livelock issue, and it's also passed overnight testing and the corruption regression test. The end result is much nicer now too, which is great. Outside of that fix, there's a pull request for NVMe with two small fixes, and a regression fix for BFQ from this merge window. The BFQ fix looks bigger than it is, it's 90% comment updates" * tag 'for-linus-20181207' of git://git.kernel.dk/linux-block: blk-mq: punt failed direct issue to dispatch list nvmet-rdma: fix response use after free nvme: validate controller state before rescheduling keep alive block, bfq: fix decrement of num_active_groups commit 52f842ccd615564a75ef45f8a0985ff14a0a61ce Merge: c431b42058ec ece27a337d42 Author: Linus Torvalds Date: Fri Dec 7 10:31:31 2018 -0800 Merge branch 'i2c/for-current-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "A set of driver bugfixes for the I2C subsystem" * 'i2c/for-current-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: uniphier-f: fix violation of tLOW requirement for Fast-mode i2c: uniphier: fix violation of tLOW requirement for Fast-mode i2c: uniphier-f: fill TX-FIFO only in IRQ handler for repeated START i2c: uniphier-f: fix timeout error after reading 8 bytes i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI device node i2c: axxia: properly handle master timeout i2c: rcar: check bus state before reinitializing i2c: nvidia-gpu: limit reads also for combined messages i2c: nvidia-gpu: adhere to I2C fault codes commit c431b42058ecad834d87fea002604dc38feccfd2 Merge: d387ac13ad12 ffe843b18211 Author: Linus Torvalds Date: Fri Dec 7 09:58:34 2018 -0800 Merge tag 'dmaengine-fix-4.20-rc6' of git://git.infradead.org/users/vkoul/slave-dma Pull dmaengine fixes from Vinod Koul: "Another pull request for dmaengine. We got bunch of fixes early this week and all are tagged to stable. Hope this is last fix for this cycle: - Fix imx-sdma handling of channel terminations, this involves reverting two commits and implement async termination - Fix cppi dma channel deletion from pending list on stop - Fix FIFO size for dw controller in Intel Merrifield" * tag 'dmaengine-fix-4.20-rc6' of git://git.infradead.org/users/vkoul/slave-dma: dmaengine: dw: Fix FIFO size for Intel Merrifield dmaengine: cppi41: delete channel from pending list when stop channel dmaengine: imx-sdma: use GFP_NOWAIT for dma descriptor allocations dmaengine: imx-sdma: implement channel termination via worker Revert "dmaengine: imx-sdma: alloclate bd memory from dma pool" Revert "dmaengine: imx-sdma: Use GFP_NOWAIT for dma allocations" commit ac3e233d29f7f77f28243af0132057d378d3ea58 Author: Nick Desaulniers Date: Thu Dec 6 11:12:31 2018 -0800 x86/vdso: Drop implicit common-page-size linker flag GNU linker's -z common-page-size's default value is based on the target architecture. arch/x86/entry/vdso/Makefile sets it to the architecture default, which is implicit and redundant. Drop it. Fixes: 2aae950b21e4 ("x86_64: Add vDSO for x86-64 with gettimeofday/clock_gettime/getcpu") Reported-by: Dmitry Golovin Reported-by: Bill Wendling Suggested-by: Dmitry Golovin Suggested-by: Rui Ueyama Signed-off-by: Nick Desaulniers Signed-off-by: Borislav Petkov Acked-by: Andy Lutomirski Cc: Andi Kleen Cc: Fangrui Song Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Thomas Gleixner Cc: x86-ml Link: https://lkml.kernel.org/r/20181206191231.192355-1-ndesaulniers@google.com Link: https://bugs.llvm.org/show_bug.cgi?id=38774 Link: https://github.com/ClangBuiltLinux/linux/issues/31 commit 153573d8870e1c173721bdc1ced72b3ad0d85de4 Author: Alex Deucher Date: Wed Oct 17 11:24:26 2018 -0500 drm/amdgpu: update smu firmware images for VI variants (v2) Some new variants require updated firmware. V2: add MODULE_FIRMWARE for new firmwares Reviewed-by: Huang Rui (v1) Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit b4aecf78083d8c6424657c1746c7c3de6e61669f Author: Will Deacon Date: Fri Dec 7 12:47:10 2018 +0000 arm64: hibernate: Avoid sending cross-calling with interrupts disabled Since commit 3b8c9f1cdfc50 ("arm64: IPI each CPU after invalidating the I-cache for kernel mappings"), a call to flush_icache_range() will use an IPI to cross-call other online CPUs so that any stale instructions are flushed from their pipelines. This triggers a WARN during the hibernation resume path, where flush_icache_range() is called with interrupts disabled and is therefore prone to deadlock: | Disabling non-boot CPUs ... | CPU1: shutdown | psci: CPU1 killed. | CPU2: shutdown | psci: CPU2 killed. | CPU3: shutdown | psci: CPU3 killed. | WARNING: CPU: 0 PID: 1 at ../kernel/smp.c:416 smp_call_function_many+0xd4/0x350 | Modules linked in: | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.20.0-rc4 #1 Since all secondary CPUs have been taken offline prior to invalidating the I-cache, there's actually no need for an IPI and we can simply call __flush_icache_range() instead. Cc: Fixes: 3b8c9f1cdfc50 ("arm64: IPI each CPU after invalidating the I-cache for kernel mappings") Reported-by: Kunihiko Hayashi Tested-by: Kunihiko Hayashi Tested-by: James Morse Signed-off-by: Will Deacon Signed-off-by: Catalin Marinas commit 8b878ee247ef2691bd69e1bc3df5ae93738ea028 Merge: c616cbee97ae d7dcdf9d4e15 Author: Jens Axboe Date: Fri Dec 7 08:40:13 2018 -0700 Merge branch 'nvme-4.20' of git://git.infradead.org/nvme into for-linus Pull NVMe fixes from Christoph. * 'nvme-4.20' of git://git.infradead.org/nvme: nvmet-rdma: fix response use after free nvme: validate controller state before rescheduling keep alive commit c616cbee97aed4bc6178f148a7240206dcdb85a6 Author: Jens Axboe Date: Thu Dec 6 22:17:44 2018 -0700 blk-mq: punt failed direct issue to dispatch list After the direct dispatch corruption fix, we permanently disallow direct dispatch of non read/write requests. This works fine off the normal IO path, as they will be retried like any other failed direct dispatch request. But for the blk_insert_cloned_request() that only DM uses to bypass the bottom level scheduler, we always first attempt direct dispatch. For some types of requests, that's now a permanent failure, and no amount of retrying will make that succeed. This results in a livelock. Instead of making special cases for what we can direct issue, and now having to deal with DM solving the livelock while still retaining a BUSY condition feedback loop, always just add a request that has been through ->queue_rq() to the hardware queue dispatch list. These are safe to use as no merging can take place there. Additionally, if requests do have prepped data from drivers, we aren't dependent on them not sharing space in the request structure to safely add them to the IO scheduler lists. This basically reverts ffe81d45322c and is based on a patch from Ming, but with the list insert case covered as well. Fixes: ffe81d45322c ("blk-mq: fix corruption with direct issue") Cc: stable@vger.kernel.org Suggested-by: Ming Lei Reported-by: Bart Van Assche Tested-by: Ming Lei Acked-by: Mike Snitzer Signed-off-by: Jens Axboe commit d7dcdf9d4e15189ecfda24cc87339a3425448d5c Author: Israel Rukshin Date: Wed Dec 5 16:54:57 2018 +0000 nvmet-rdma: fix response use after free nvmet_rdma_release_rsp() may free the response before using it at error flow. Fixes: 8407879 ("nvmet-rdma: fix possible bogus dereference under heavy load") Signed-off-by: Israel Rukshin Reviewed-by: Sagi Grimberg Reviewed-by: Max Gurtovoy Signed-off-by: Christoph Hellwig commit 86880d646122240596d6719b642fee3213239994 Author: James Smart Date: Tue Nov 27 17:04:44 2018 -0800 nvme: validate controller state before rescheduling keep alive Delete operations are seeing NULL pointer references in call_timer_fn. Tracking these back, the timer appears to be the keep alive timer. nvme_keep_alive_work() which is tied to the timer that is cancelled by nvme_stop_keep_alive(), simply starts the keep alive io but doesn't wait for it's completion. So nvme_stop_keep_alive() only stops a timer when it's pending. When a keep alive is in flight, there is no timer running and the nvme_stop_keep_alive() will have no affect on the keep alive io. Thus, if the io completes successfully, the keep alive timer will be rescheduled. In the failure case, delete is called, the controller state is changed, the nvme_stop_keep_alive() is called while the io is outstanding, and the delete path continues on. The keep alive happens to successfully complete before the delete paths mark it as aborted as part of the queue termination, so the timer is restarted. The delete paths then tear down the controller, and later on the timer code fires and the timer entry is now corrupt. Fix by validating the controller state before rescheduling the keep alive. Testing with the fix has confirmed the condition above was hit. Signed-off-by: James Smart Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit ba7aeae5539c7a7cccc4cf07a2bc61281a93c50e Author: Paolo Valente Date: Thu Dec 6 19:18:18 2018 +0100 block, bfq: fix decrement of num_active_groups Since commit '2d29c9f89fcd ("block, bfq: improve asymmetric scenarios detection")', if there are process groups with I/O requests waiting for completion, then BFQ tags the scenario as 'asymmetric'. This detection is needed for preserving service guarantees (for details, see comments on the computation * of the variable asymmetric_scenario in the function bfq_better_to_idle). Unfortunately, commit '2d29c9f89fcd ("block, bfq: improve asymmetric scenarios detection")' contains an error exactly in the updating of the number of groups with I/O requests waiting for completion: if a group has more than one descendant process, then the above number of groups, which is renamed from num_active_groups to a more appropriate num_groups_with_pending_reqs by this commit, may happen to be wrongly decremented multiple times, namely every time one of the descendant processes gets all its pending I/O requests completed. A correct, complete solution should work as follows. Consider a group that is inactive, i.e., that has no descendant process with pending I/O inside BFQ queues. Then suppose that num_groups_with_pending_reqs is still accounting for this group, because the group still has some descendant process with some I/O request still in flight. num_groups_with_pending_reqs should be decremented when the in-flight request of the last descendant process is finally completed (assuming that nothing else has changed for the group in the meantime, in terms of composition of the group and active/inactive state of child groups and processes). To accomplish this, an additional pending-request counter must be added to entities, and must be updated correctly. To avoid this additional field and operations, this commit resorts to the following tradeoff between simplicity and accuracy: for an inactive group that is still counted in num_groups_with_pending_reqs, this commit decrements num_groups_with_pending_reqs when the first descendant process of the group remains with no request waiting for completion. This simplified scheme provides a fix to the unbalanced decrements introduced by 2d29c9f89fcd. Since this error was also caused by lack of comments on this non-trivial issue, this commit also adds related comments. Fixes: 2d29c9f89fcd ("block, bfq: improve asymmetric scenarios detection") Reported-by: Steven Barrett Tested-by: Steven Barrett Tested-by: Lucjan Lucjanov Reviewed-by: Federico Motta Signed-off-by: Paolo Valente Signed-off-by: Jens Axboe commit c201e3808e0e4be9b98d192802085a9f491bd80c Author: Peter Hutterer Date: Thu Dec 6 09:03:36 2018 +1000 Input: restore EV_ABS ABS_RESERVED ABS_RESERVED was added in d9ca1c990a7 and accidentally removed as part of ffe0e7cf290f5c9 when the high-resolution scrolling code was removed. Signed-off-by: Peter Hutterer Reviewed-by: Martin Kepplinger Acked-by: Benjamin Tissoires Acked-by: Dmitry Torokhov Signed-off-by: Benjamin Tissoires commit 868613f1c0ccf7b832f38b48b18cca31cdeb3d26 Author: Nic Soudée Date: Thu Dec 6 11:59:25 2018 -0500 HID: quirks: fix RetroUSB.com devices SNES RetroPort and RetroPad register only 4 gamepad buttons when they should register all 8 buttons. This is described here: https://ask.fedoraproject.org/en/question/128102 This is happening because of: Commit 190d7f02ce8e ("HID: input: do not increment usages when duplicate is found") Here, I add the quirk HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE (created for backward compatibility with the change in 190d7f02ce8e) for the two products. Tested with both RetroPort and RetroPad. Cc: stable@vger.kernel.org # v4.18+ Signed-off-by: Nic Soudée Signed-off-by: Benjamin Tissoires commit dbde117c31263fb632a5bfcafe4fe769663e8991 Merge: 37c2578c0c40 63cea1f73528 Author: Greg Kroah-Hartman Date: Fri Dec 7 14:05:28 2018 +0100 Merge tag 'gnss-4.20-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/gnss into char-misc-linus Johan writes: GNSS fixes for 4.20-rc6 Here's a fix for a broken activation retry loop in the sirf driver. Included are also two MAINTAINERS updates. All have been in linux-next with no reported issues. Signed-off-by: Johan Hovold * tag 'gnss-4.20-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/gnss: MAINTAINERS: exclude gnss from SIRFPRIMA2 regex matching MAINTAINERS: add gnss scm tree gnss: sirf: fix activation retry handling commit 478b6767ad26ab86d9ecc341027dd09a87b1f997 Author: Chen-Yu Tsai Date: Tue Dec 4 17:04:57 2018 +0800 pinctrl: sunxi: a83t: Fix IRQ offset typo for PH11 Pin PH11 is used on various A83T board to detect a change in the OTG port's ID pin, as in when an OTG host cable is plugged in. The incorrect offset meant the gpiochip/irqchip was activating the wrong pin for interrupts. Fixes: 4730f33f0d82 ("pinctrl: sunxi: add allwinner A83T PIO controller support") Cc: Signed-off-by: Chen-Yu Tsai Acked-by: Maxime Ripard Signed-off-by: Linus Walleij commit 59613526117b0595cb7b04835390ecd5175f9cd4 Author: Oliver O'Halloran Date: Fri Dec 7 02:17:09 2018 +1100 powerpc/papr_scm: Fix resource end address Fix an off-by-one error in the memory resource range. This resource is used to determine the address range of the memory to be hot-plugged as ZONE_DEVICE memory. The current end address results in the kernel attempting to map an additional memblock and the hypervisor may reject the mapping resulting in the entire hot-plug failing. Fixes: b5beae5e224f ("powerpc/pseries: Add driver for PAPR SCM regions") Signed-off-by: Oliver O'Halloran Signed-off-by: Michael Ellerman commit 14ebfec0712f66a4ef037fb7ac0df6a600584356 Author: Oliver O'Halloran Date: Fri Dec 7 02:17:08 2018 +1100 powerpc/papr_scm: Use depend instead of select Making PAPR_SCM select LIBNVDIMM results in circular dependencies in Kconfig when another symbol depends on it. Fix this by replacing the select with a depends. Fixes: b5beae5e224f ("powerpc/pseries: Add driver for PAPR SCM regions") Reported-by: Alastair D'Silva Signed-off-by: Oliver O'Halloran Signed-off-by: Michael Ellerman commit a6460b03f945ee216dbf42a0d9ee78d52fd470c2 Author: Sandipan Das Date: Thu Dec 6 14:57:01 2018 +0530 powerpc/bpf: Fix broken uapi for BPF_PROG_TYPE_PERF_EVENT Now that there are different variants of pt_regs for userspace and kernel, the uapi for the BPF_PROG_TYPE_PERF_EVENT program type must be changed by exporting the user_pt_regs structure instead of the pt_regs structure that is in-kernel only. Fixes: 002af9391bfb ("powerpc: Split user/kernel definitions of struct pt_regs") Signed-off-by: Sandipan Das Signed-off-by: Michael Ellerman commit e59f5e08ece1060073d92c66ded52e1f2c43b5bb Author: Hans de Goede Date: Wed Nov 28 17:57:55 2018 +0100 gpiolib-acpi: Only defer request_irq for GpioInt ACPI event handlers Commit 78d3a92edbfb ("gpiolib-acpi: Register GpioInt ACPI event handlers from a late_initcall") deferred the entire acpi_gpiochip_request_interrupt call for each event resource. This means it also delays the gpiochip_request_own_desc(..., "ACPI:Event") call. This is a problem if some AML code reads the GPIO pin before we run the deferred acpi_gpiochip_request_interrupt, because in that case acpi_gpio_adr_space_handler() will already have called gpiochip_request_own_desc(..., "ACPI:OpRegion") causing the call from acpi_gpiochip_request_interrupt to fail with -EBUSY and we will fail to register an event handler. acpi_gpio_adr_space_handler is prepared for acpi_gpiochip_request_interrupt already having claimed the pin, but the other way around does not work. One example of a problem this causes, is the event handler for the OTG ID pin on a Prowise PT301 tablet not registering, keeping the port stuck in whatever mode it was in during boot and e.g. only allowing charging after a reboot. This commit fixes this by only deferring the request_irq call and the initial run of edge-triggered IRQs instead of deferring all of acpi_gpiochip_request_interrupt. Cc: stable@vger.kernel.org Fixes: 78d3a92edbfb ("gpiolib-acpi: Register GpioInt ACPI event ...") Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Acked-by: Mika Westerberg Signed-off-by: Linus Walleij commit 530aad77010b81526586dfc09130ec875cd084e4 Author: Florian Westphal Date: Wed Dec 5 14:12:19 2018 +0100 netfilter: seqadj: re-load tcp header pointer after possible head reallocation When adjusting sack block sequence numbers, skb_make_writable() gets called to make sure tcp options are all in the linear area, and buffer is not shared. This can cause tcp header pointer to get reallocated, so we must reaload it to avoid memory corruption. This bug pre-dates git history. Reported-by: Neel Mehta Reported-by: Shane Huntley Reported-by: Heather Adkins Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit bde1a7459623a66c2abec4d0a841e4b06cc88d9a Author: Kailang Yang Date: Fri Dec 7 15:14:59 2018 +0800 ALSA: hda/realtek - Fixed headphone issue for ALC700 If it plugged headphone or headset into the jack, then do the reboot, it will have a chance to cause headphone no sound. It just need to run the headphone mode procedure after boot time. The issue will be fixed. It also suitable for ALC234 ALC274 and ALC294. Signed-off-by: Kailang Yang Cc: Signed-off-by: Takashi Iwai commit 6ac79291fb7dae4402b306789b1cb85f84687e44 Author: Long Li Date: Thu Dec 6 04:51:06 2018 +0000 CIFS: Avoid returning EBUSY to upper layer VFS EBUSY is not handled by VFS, and will be passed to user-mode. This is not correct as we need to wait for more credits. This patch also fixes a bug where rsize or wsize is used uninitialized when the call to server->ops->wait_mtu_credits() fails. Reported-by: Dan Carpenter Signed-off-by: Long Li Signed-off-by: Steve French Reviewed-by: Pavel Shilovsky commit e61efff4ae94f4509707a5e03f8edb6455f490e1 Author: Herbert Xu Date: Fri Dec 7 13:56:08 2018 +0800 crypto: user - Disable statistics interface Since this user-space API is still undergoing significant changes, this patch disables it for the current merge window. Signed-off-by: Herbert Xu commit d387ac13ad12194a62d268a6b7a0633ef832f6bd Merge: 7f80c7325be4 e594a5e349dd Author: Linus Torvalds Date: Thu Dec 6 19:35:50 2018 -0800 Merge tag 'drm-fixes-2018-12-07' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "There's a bit more in here than I'd like, and I'm hoping things calm down when I'm out. msm: - a bunch of display fixes for the new DPU - a couple of command submission fixes omap: - some DSI fixes ast: - driver unload crash fix core: - fix the lease uevent so userspace can distinguish it amd: - fix a bpc regression - fix lru handling regression - fixed firmware support for new GPUs - power management fixes for vega20" * tag 'drm-fixes-2018-12-07' of git://anongit.freedesktop.org/drm/drm: (37 commits) drm/ast: Fix connector leak during driver unload drm/amdgpu/vcn: Update vcn.cur_state during suspend drm/amd/display: Fix overflow/truncation from strncpy. drm/amd/powerplay: improve OD code robustness drm/amdgpu: enlarge maximum waiting time of KIQ drm/fb-helper: Fix typo in parameter description drm/amd/powerplay: support SoftMin/Max setting for some specific DPM drm/amd/powerplay: issue pre-display settings for display change event drm/amd/powerplay: support new pptable upload on Vega20 drm/amdgpu/gmc8: always load MC firmware in the driver drm/amdgpu/gmc8: update MC firmware for polaris drm/amdgpu: update mc firmware image for polaris12 variants drm/msm: Fix error return checking drm/msm/dpu: Ignore alpha for XBGR8888 format drm/msm: dpu: Fix "WARNING: invalid free of devm_ allocated data" drm/msm/hdmi: Drop pointless static qualifier in msm_hdmi_bind() drm/msm: Move fence put to where failure occurs drm/msm: dpu: Don't set legacy plane->crtc pointer drm/msm/gpu: Don't map command buffers with nr_relocs equal to 0 drm/msm/hdmi: Enable HPD after HDMI IRQ is set up ... commit 7f80c7325be49db3fb8b5f343f47691b7999fda7 Merge: b72f711a4efa 79462857eb54 Author: Linus Torvalds Date: Thu Dec 6 18:57:04 2018 -0800 Merge tag 'nfs-for-4.20-5' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client bugfixes from Trond Myklebust: "This is mainly fallout from the updates to the SUNRPC code that is being triggered from less common combinations of NFS mount options. Highlights include: Stable fixes: - Fix a page leak when using RPCSEC_GSS/krb5p to encrypt data. Bugfixes: - Fix a regression that causes the RPC receive code to hang - Fix call_connect_status() so that it handles tasks that got transmitted while queued waiting for the socket lock. - Fix a memory leak in call_encode() - Fix several other connect races. - Fix receive code error handling. - Use the discard iterator rather than MSG_TRUNC for compatibility with AF_UNIX/AF_LOCAL sockets. - nfs: don't dirty kernel pages read by direct-io - pnfs/Flexfiles fix to enforce per-mirror stateid only for NFSv4 data servers" * tag 'nfs-for-4.20-5' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: SUNRPC: Don't force a redundant disconnection in xs_read_stream() SUNRPC: Fix up socket polling SUNRPC: Use the discard iterator rather than MSG_TRUNC SUNRPC: Treat EFAULT as a truncated message in xs_read_stream_request() SUNRPC: Fix up handling of the XDRBUF_SPARSE_PAGES flag SUNRPC: Fix RPC receive hangs SUNRPC: Fix a potential race in xprt_connect() SUNRPC: Fix a memory leak in call_encode() SUNRPC: Fix leak of krb5p encode pages SUNRPC: call_connect_status() must handle tasks that got transmitted nfs: don't dirty kernel pages read by direct-io flexfiles: enforce per-mirror stateid only for v4 DSes commit b72f711a4efadfaa8a16f9cb708bfe1ce6125906 Merge: 7e40b56c776f 3a4d0c2172bc Author: Linus Torvalds Date: Thu Dec 6 16:45:36 2018 -0800 Merge branch 'spectre' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM spectre fix from Russell King: "Exynos folk noticed that CPU hotplug wasn't working with their kernel configuration, and have tested this as fixing the problem" * 'spectre' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: ensure that processor vtables is not lost after boot commit 7e40b56c776f75a35838360bf6360e2aa9311f92 Merge: abb8d6ecbd8f c2a3831df6dc Author: Linus Torvalds Date: Thu Dec 6 16:39:44 2018 -0800 Merge branch 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM fixes from Russell King: "Some small fixes that have been accumulated: - Chris Cole noticed that in a SMP environment, the DMA cache coherence handling can produce undesirable results in a corner case - Propagate that fix for ARMv7M as well - Fix a false positive with source fortification - Fix an uninitialised return that Nathan Jones spotted" * 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 8816/1: dma-mapping: fix potential uninitialized return ARM: 8815/1: V7M: align v7m_dma_inv_range() with v7 counterpart ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address handling ARM: 8806/1: kprobes: Fix false positive with FORTIFY_SOURCE commit ece27a337d42a3197935711997f2880f0957ed7e Author: Masahiro Yamada Date: Thu Dec 6 12:55:28 2018 +0900 i2c: uniphier-f: fix violation of tLOW requirement for Fast-mode Currently, the clock duty is set as tLOW/tHIGH = 1/1. For Fast-mode, tLOW is set to 1.25 us while the I2C spec requires tLOW >= 1.3 us. tLOW/tHIGH = 5/4 would meet both Standard-mode and Fast-mode: Standard-mode: tLOW = 5.56 us, tHIGH = 4.44 us Fast-mode: tLOW = 1.39 us, tHIGH = 1.11 us Signed-off-by: Masahiro Yamada Signed-off-by: Wolfram Sang commit 8469636ab5d8c77645b953746c10fda6983a8830 Author: Masahiro Yamada Date: Thu Dec 6 12:55:27 2018 +0900 i2c: uniphier: fix violation of tLOW requirement for Fast-mode Currently, the clock duty is set as tLOW/tHIGH = 1/1. For Fast-mode, tLOW is set to 1.25 us while the I2C spec requires tLOW >= 1.3 us. tLOW/tHIGH = 5/4 would meet both Standard-mode and Fast-mode: Standard-mode: tLOW = 5.56 us, tHIGH = 4.44 us Fast-mode: tLOW = 1.39 us, tHIGH = 1.11 us Signed-off-by: Masahiro Yamada Signed-off-by: Wolfram Sang commit cd8843f541cc0ef057e27f1afba46374bbb84219 Author: Masahiro Yamada Date: Thu Dec 6 12:55:26 2018 +0900 i2c: uniphier-f: fill TX-FIFO only in IRQ handler for repeated START - For a repeated START condition, this controller starts data transfer immediately after the slave address is written to the TX-FIFO. - Once the TX-FIFO empty interrupt is asserted, the controller makes a pause even if additional data are written to the TX-FIFO. Given those circumstances, the data after a repeated START may not be transferred if the interrupt is asserted while the TX-FIFO is being filled up. A more reliable way is to append TX data only in the interrupt handler. Signed-off-by: Masahiro Yamada Signed-off-by: Wolfram Sang commit c2a653deaa81f5a750c0dfcbaf9f8e5195cbe4a5 Author: Masahiro Yamada Date: Thu Dec 6 12:55:25 2018 +0900 i2c: uniphier-f: fix timeout error after reading 8 bytes I was totally screwed up in commit eaba68785c2d ("i2c: uniphier-f: fix race condition when IRQ is cleared"). Since that commit, if the number of read bytes is multiple of the FIFO size (8, 16, 24... bytes), the STOP condition could be issued twice, depending on the timing. If this happens, the controller will go wrong, resulting in the timeout error. It was more than 3 years ago when I wrote this driver, so my memory about this hardware was vague. Please let me correct the description in the commit log of eaba68785c2d. Clearing the IRQ status on exiting the IRQ handler is absolutely fine. This controller makes a pause while any IRQ status is asserted. If the IRQ status is cleared first, the hardware may start the next transaction before the IRQ handler finishes what it supposed to do. This partially reverts the bad commit with clear comments so that I will never repeat this mistake. I also investigated what is happening at the last moment of the read mode. The UNIPHIER_FI2C_INT_RF interrupt is asserted a bit earlier (by half a period of the clock cycle) than UNIPHIER_FI2C_INT_RB. I consulted a hardware engineer, and I got the following information: UNIPHIER_FI2C_INT_RF asserted at the falling edge of SCL at the 8th bit. UNIPHIER_FI2C_INT_RB asserted at the rising edge of SCL at the 9th (ACK) bit. In order to avoid calling uniphier_fi2c_stop() twice, check the latter interrupt. I also commented this because it is obscure hardware internal. Fixes: eaba68785c2d ("i2c: uniphier-f: fix race condition when IRQ is cleared") Signed-off-by: Masahiro Yamada Signed-off-by: Wolfram Sang commit 0544ee4b1ad574aec3b6379af5f5cdee42840971 Author: Hans de Goede Date: Wed Nov 21 10:19:55 2018 +0100 i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI device node Some AMD based HP laptops have a SMB0001 ACPI device node which does not define any methods. This leads to the following error in dmesg: [ 5.222731] cmi: probe of SMB0001:00 failed with error -5 This commit makes acpi_smbus_cmi_add() return -ENODEV instead in this case silencing the error. In case of a failure of the i2c_add_adapter() call this commit now propagates the error from that call instead of -EIO. Signed-off-by: Hans de Goede Signed-off-by: Wolfram Sang commit 6c7f25cae54b840302e4f1b371dbf318fbf09ab2 Author: Adamski, Krzysztof (Nokia - PL/Wroclaw) Date: Fri Nov 16 13:24:41 2018 +0000 i2c: axxia: properly handle master timeout According to Intel (R) Axxia TM Lionfish Communication Processor Peripheral Subsystem Hardware Reference Manual, the AXXIA I2C module have a programmable Master Wait Timer, which among others, checks the time between commands send in manual mode. When a timeout (25ms) passes, TSS bit is set in Master Interrupt Status register and a Stop command is issued by the hardware. The axxia_i2c_xfer(), does not properly handle this situation, however. For each message a separate axxia_i2c_xfer_msg() is called and this function incorrectly assumes that any interrupt might happen only when waiting for completion. This is mostly correct but there is one exception - a master timeout can trigger if enough time has passed between individual transfers. It will, by definition, happen between transfers when the interrupts are disabled by the code. If that happens, the hardware issues Stop command. The interrupt indicating timeout will not be triggered as soon as we enable them since the Master Interrupt Status is cleared when master mode is entered again (which happens before enabling irqs) meaning this error is lost and the transfer is continued even though the Stop was issued on the bus. The subsequent operations completes without error but a bogus value (0xFF in case of read) is read as the client device is confused because aborted transfer. No error is returned from master_xfer() making caller believe that a valid value was read. To fix the problem, the TSS bit (indicating timeout) in Master Interrupt Status register is checked before each transfer. If it is set, there was a timeout before this transfer and (as described above) the hardware already issued Stop command so the transaction should be aborted thus -ETIMEOUT is returned from the master_xfer() callback. In order to be sure no timeout was issued we can't just read the status just before starting new transaction as there will always be a small window of time (few CPU cycles at best) where this might still happen. For this reason we have to temporally disable the timer before checking for TSS bit. Disabling it will, however, clear the TSS bit so in order to preserve that information, we have to read it in ISR so we have to ensure that the TSS interrupt is not masked between transfers of one transaction. There is no need to call bus recovery or controller reinitialization if that happens so it's skipped. Signed-off-by: Krzysztof Adamski Reviewed-by: Alexander Sverdlin Signed-off-by: Wolfram Sang commit cd9d1a2332b01b043935c0ec9bb675effb67aac9 Merge: ebaf39e6032f 993107fea5ee Author: David S. Miller Date: Thu Dec 6 13:31:09 2018 -0800 Merge branch 'mlxsw-Various-fixes' Ido Schimmel says: ==================== mlxsw: Various fixes Patches #1 and #2 fix two VxLAN related issues. The first patch removes warnings that can currently be triggered from user space. Second patch avoids leaking a FID in an error path. Patch #3 fixes a too strict check that causes certain host routes not to be promoted to perform GRE decapsulation in hardware. Last patch avoids a use-after-free when deleting a VLAN device via an ioctl when it is enslaved to a bridge. I have a patchset for net-next that reworks this code and makes the driver more robust. ==================== Signed-off-by: David S. Miller commit 993107fea5eefdfdfde1ca38d3f01f0bebf76e77 Author: Ido Schimmel Date: Thu Dec 6 17:44:53 2018 +0000 mlxsw: spectrum_switchdev: Fix VLAN device deletion via ioctl When deleting a VLAN device using an ioctl the netdev is unregistered before the VLAN filter is updated via ndo_vlan_rx_kill_vid(). It can lead to a use-after-free in mlxsw in case the VLAN device is deleted while being enslaved to a bridge. The reason for the above is that when mlxsw receives the CHANGEUPPER event, it wrongly assumes that the VLAN device is no longer its upper and thus destroys the internal representation of the bridge port despite the reference count being non-zero. Fix this by checking if the VLAN device is our upper using its real device. In net-next I'm going to remove this trick and instead make mlxsw completely agnostic to the order of the events. Fixes: c57529e1d5d8 ("mlxsw: spectrum: Replace vPorts with Port-VLAN") Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller commit da93d2913fdf43d5cde3c5a53ac9cc29684d5c7c Author: Nir Dotan Date: Thu Dec 6 17:44:52 2018 +0000 mlxsw: spectrum_router: Relax GRE decap matching check GRE decap offload is configured when local routes prefix correspond to the local address of one of the offloaded GRE tunnels. The matching check was found to be too strict, such that for a flat GRE configuration, in which the overlay and underlay traffic share the same non-default VRF, decap flow was not offloaded. Relax the check for decap flow offloading. A match occurs if the local address of the tunnel matches the local route address while both share the same VRF table. Fixes: 4607f6d26950 ("mlxsw: spectrum_router: Support IPv4 underlay decap") Signed-off-by: Nir Dotan Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit f58a83c207b791c6586b9675a589db5c6ac7909e Author: Ido Schimmel Date: Thu Dec 6 17:44:51 2018 +0000 mlxsw: spectrum_switchdev: Avoid leaking FID's reference count It should never be possible for a user to set a VNI on a FID in case one is already set. The driver therefore returns an error, but fails to drop the reference count taken earlier when calling mlxsw_sp_fid_8021d_lookup(). Drop the reference when this unlikely error is hit. Fixes: 1c30d1836aeb ("mlxsw: spectrum: Enable VxLAN enslavement to bridges") Signed-off-by: Ido Schimmel Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit 050fc01fb1d916058605569cd7f4e15152afc3af Author: Ido Schimmel Date: Thu Dec 6 17:44:50 2018 +0000 mlxsw: spectrum_nve: Remove easily triggerable warnings It is possible to trigger a warning in mlxsw in case a flood entry which mlxsw is not aware of is deleted from the VxLAN device. This is because mlxsw expects to find a singly linked list where the flood entry is present in. Fix by removing these warnings for now. Will re-add them in the next release after we teach mlxsw to ask for a dump of FDB entries from the VxLAN device, once it is enslaved to a bridge mlxsw cares about. Fixes: 6e6030bd5412 ("mlxsw: spectrum_nve: Implement common NVE core") Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller commit 834e772c8db0c6a275d75315d90aba4ebbb1e249 Author: Stefan Hajnoczi Date: Mon Nov 5 10:35:47 2018 +0000 vhost/vsock: fix use-after-free in network stack callers If the network stack calls .send_pkt()/.cancel_pkt() during .release(), a struct vhost_vsock use-after-free is possible. This occurs because .release() does not wait for other CPUs to stop using struct vhost_vsock. Switch to an RCU-enabled hashtable (indexed by guest CID) so that .release() can wait for other CPUs by calling synchronize_rcu(). This also eliminates vhost_vsock_lock acquisition in the data path so it could have a positive effect on performance. This is CVE-2018-14625 "kernel: use-after-free Read in vhost_transport_send_pkt". Cc: stable@vger.kernel.org Reported-and-tested-by: syzbot+bd391451452fb0b93039@syzkaller.appspotmail.com Reported-by: syzbot+e3e074963495f92a89ed@syzkaller.appspotmail.com Reported-by: syzbot+d5a0a170c5069658b141@syzkaller.appspotmail.com Signed-off-by: Stefan Hajnoczi Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 78b1a52e05c9db11d293342e8d6d8a230a04b4e7 Author: Halil Pasic Date: Wed Sep 26 18:48:30 2018 +0200 virtio/s390: fix race in ccw_io_helper() While ccw_io_helper() seems like intended to be exclusive in a sense that it is supposed to facilitate I/O for at most one thread at any given time, there is actually nothing ensuring that threads won't pile up at vcdev->wait_q. If they do, all threads get woken up and see the status that belongs to some other request than their own. This can lead to bugs. For an example see: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1788432 This race normally does not cause any problems. The operations provided by struct virtio_config_ops are usually invoked in a well defined sequence, normally don't fail, and are normally used quite infrequent too. Yet, if some of the these operations are directly triggered via sysfs attributes, like in the case described by the referenced bug, userspace is given an opportunity to force races by increasing the frequency of the given operations. Let us fix the problem by ensuring, that for each device, we finish processing the previous request before starting with a new one. Signed-off-by: Halil Pasic Reported-by: Colin Ian King Cc: stable@vger.kernel.org Message-Id: <20180925121309.58524-3-pasic@linux.ibm.com> Signed-off-by: Cornelia Huck Signed-off-by: Michael S. Tsirkin commit 2448a299ec416a80f699940a86f4a6d9a4f643b1 Author: Halil Pasic Date: Wed Sep 26 18:48:29 2018 +0200 virtio/s390: avoid race on vcdev->config Currently we have a race on vcdev->config in virtio_ccw_get_config() and in virtio_ccw_set_config(). This normally does not cause problems, as these are usually infrequent operations. However, for some devices writing to/reading from the config space can be triggered through sysfs attributes. For these, userspace can force the race by increasing the frequency. Signed-off-by: Halil Pasic Cc: stable@vger.kernel.org Message-Id: <20180925121309.58524-2-pasic@linux.ibm.com> Signed-off-by: Cornelia Huck Signed-off-by: Michael S. Tsirkin commit c38f57da428b033f2721b611d84b1f40bde674a8 Author: Stefan Hajnoczi Date: Thu Dec 6 19:14:34 2018 +0000 vhost/vsock: fix reset orphans race with close timeout If a local process has closed a connected socket and hasn't received a RST packet yet, then the socket remains in the table until a timeout expires. When a vhost_vsock instance is released with the timeout still pending, the socket is never freed because vhost_vsock has already set the SOCK_DONE flag. Check if the close timer is pending and let it close the socket. This prevents the race which can leak sockets. Reported-by: Maximilian Riemensberger Cc: Graham Whaley Signed-off-by: Stefan Hajnoczi Signed-off-by: Michael S. Tsirkin commit abb8d6ecbd8f7801c048f6543f79d22d24cead7b Merge: 2acee31cce65 1aed58e67a6e Author: Linus Torvalds Date: Thu Dec 6 10:35:19 2018 -0800 Merge tag 'trace-v4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fix from Steven Rostedt: "This is a single commit that fixes a bug in uprobes SDT code due to a missing mutex protection" * tag 'trace-v4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: Uprobes: Fix kernel oops with delayed_uprobe_remove() commit 2acee31cce656cca9e81072c330c1322e1376155 Merge: 002f421a84c5 b72f936f6b32 Author: Linus Torvalds Date: Thu Dec 6 09:25:53 2018 -0800 Merge tag 'sound-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Still more incoming fixes than wished at this stage, but all look like small and reasonable fixes. In addition to the usual HD-audio and USB-audio quirks for various devices, two notable changes are included: - a fix for USB-audio UAF at probing a malformed descriptor - workarounds for PCM rwsem mutex starvation" * tag 'sound-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek: Fix mic issue on Acer AIO Veriton Z4860G/Z6860G ALSA: hda/realtek: Fix mic issue on Acer AIO Veriton Z4660G ALSA: hda/realtek - Add support for Acer Aspire C24-860 headset mic ALSA: hda/realtek: ALC286 mic and headset-mode fixups for Acer Aspire U27-880 ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c ALSA: hda/realtek - Fix speaker output regression on Thinkpad T570 ALSA: pcm: Fix interval evaluation with openmin/max ALSA: hda: Add support for AMD Stoney Ridge ALSA: usb-audio: Add SMSL D1 to quirks for native DSD support ALSA: pcm: Fix starvation on down_write_nonblock() ALSA: pcm: Call snd_pcm_unlink() conditionally at closing commit 002f421a84c5a9260bf0e312af5d5043b3555511 Merge: cf76c364a1e1 63e19c8216bb Author: Linus Torvalds Date: Thu Dec 6 09:23:34 2018 -0800 Merge tag 'csky-4.20-rc6' of github.com:c-sky/csky-linux Pull C-SKY fixes from Guo Ren: - bugfix for tlb_get_pgd() error - update MAINTAINERS file for C-SKY drivers * tag 'csky-4.20-rc6' of github.com:c-sky/csky-linux: csky: bugfix tlb_get_pgd error. MAINTAINERS: add maintainer for C-SKY drivers commit ffe843b18211301ad25893eba09f402c19d12304 Author: Andy Shevchenko Date: Wed Dec 5 18:33:59 2018 +0200 dmaengine: dw: Fix FIFO size for Intel Merrifield Intel Merrifield has a reduced size of FIFO used in iDMA 32-bit controller, i.e. 512 bytes instead of 1024. Fix this by partitioning it as 64 bytes per channel. Note, in the future we might switch to 'fifo-size' property instead of hard coded value. Fixes: 199244d69458 ("dmaengine: dw: add support of iDMA 32-bit hardware") Signed-off-by: Andy Shevchenko Cc: stable@vger.kernel.org Signed-off-by: Vinod Koul commit 8fb2dfb228df785bbeb4d055a74402ef4b07fc25 Author: Alexander Popov Date: Thu Dec 6 18:13:07 2018 +0300 stackleak: Register the 'stackleak_cleanup' pass before the '*free_cfg' pass Currently the 'stackleak_cleanup' pass deleting a CALL insn is executed after the 'reload' pass. That allows gcc to do some weird optimization in function prologues and epilogues, which are generated later [1]. Let's avoid that by registering the 'stackleak_cleanup' pass before the '*free_cfg' pass. It's the moment when the stack frame size is already final, function prologues and epilogues are generated, and the machine-dependent code transformations are not done. [1] https://www.openwall.com/lists/kernel-hardening/2018/11/23/2 Reported-by: kbuild test robot Signed-off-by: Alexander Popov Signed-off-by: Kees Cook commit 3caad34eab57e622dad48086af7f89c19001664e Merge: 0472bf06c6fd f51ccf46217c Author: Greg Kroah-Hartman Date: Thu Dec 6 18:02:58 2018 +0100 Merge tag 'usb-serial-4.20-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fix for v4.20-rc6 Here's a fix for a reported USB-console regression in 4.18 which revealed a long-standing bug in the console implementation. The patch has been in linux-next over night with no reported issues. Signed-off-by: Johan Hovold * tag 'usb-serial-4.20-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: console: fix reported terminal settings commit 3a4d0c2172bcf15b7a3d9d498b2b355f9864286b Author: Russell King Date: Thu Dec 6 16:36:38 2018 +0000 ARM: ensure that processor vtables is not lost after boot Marek Szyprowski reported problems with CPU hotplug in current kernels. This was tracked down to the processor vtables being located in an init section, and therefore discarded after kernel boot, despite being required after boot to properly initialise the non-boot CPUs. Arrange for these tables to end up in .rodata when required. Reported-by: Marek Szyprowski Tested-by: Krzysztof Kozlowski Fixes: 383fb3ee8024 ("ARM: spectre-v2: per-CPU vtables to work around big.Little systems") Signed-off-by: Russell King commit 47f07f03b5ee436fe074c4fb1fb28d013c36a0d8 Author: Yishai Hadas Date: Wed Dec 5 15:50:21 2018 +0200 IB/mlx5: Block DEVX umem from the non applicable cases Blocks creating a DEVX UMEM with the non applicable access flags as of ODP, MW_BIND, etc. Specifically when an ODP flag is used below WARN call trace is issued. [ 2510.404131] RIP: 0010:__mlx5_ib_populate_pas+0x207/0x220 [mlx5_ib] ... [ 2510.404143] Call Trace: [ 2510.404150] ? __kmalloc_node+0x1b3/0x280 [ 2510.404156] ? _uverbs_alloc+0x63/0x90 [ib_uverbs] [ 2510.404158] ? _uverbs_alloc+0x63/0x90 [ib_uverbs] [ 2510.404162] mlx5_ib_populate_pas+0x53/0x60 [mlx5_ib] [ 2510.404167] mlx5_ib_handler_MLX5_IB_METHOD_DEVX_UMEM_REG+0x273/0x3f0 [mlx5_ib] Fixes: aeae94579caf ("IB/mlx5: Add DEVX support for memory registration") Signed-off-by: Yishai Hadas Reviewed-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford commit 63cea1f735284b2244e3f031625c65373520eff9 Author: Johan Hovold Date: Thu Dec 6 07:23:18 2018 +0100 MAINTAINERS: exclude gnss from SIRFPRIMA2 regex matching Exclude the gnss subsystem from SIRMPRIMA2 regex matching, which would otherwise match the unrelated gnss sirf driver. Cc: Barry Song Signed-off-by: Johan Hovold commit 85280de450f1ce8997b3ccfd0e504a942e5fa2d8 Author: Johan Hovold Date: Thu Dec 6 07:23:17 2018 +0100 MAINTAINERS: add gnss scm tree Add SCM tree for the gnss subsystem. Signed-off-by: Johan Hovold commit 06fd9ab12b804451b14d538adbf98a57c2d6846b Author: Johan Hovold Date: Wed Dec 5 11:21:49 2018 +0100 gnss: sirf: fix activation retry handling Fix activation helper which would return -ETIMEDOUT even if the last retry attempt was successful. Also change the semantics of the retries variable so that it actually holds the number of retries (rather than tries). Fixes: d2efbbd18b1e ("gnss: add driver for sirfstar-based receivers") Cc: stable # 4.19 Signed-off-by: Johan Hovold commit b7d624ab431227af376787148cd7d474088c03aa Author: Guo Ren Date: Thu Dec 6 10:07:40 2018 +0800 asm-generic: unistd.h: fixup broken macro include. The broken macros make the glibc compile error. If there is no __NR3264_fstat*, we should also removed related definitions. Reported-by: Marcin Juszkiewicz Fixes: bf4b6a7d371e ("y2038: Remove stat64 family from default syscall set") [arnd: Both Marcin and Guo provided this patch to fix up my clearly broken commit, I applied the version with the better changelog.] Signed-off-by: Guo Ren Signed-off-by: Mao Han Cc: Arnd Bergmann Signed-off-by: Arnd Bergmann commit a50480cb6d61d5c5fc13308479407b628b6bc1c5 Author: Andrea Righi Date: Thu Dec 6 10:56:48 2018 +0100 kprobes/x86: Blacklist non-attachable interrupt functions These interrupt functions are already non-attachable by kprobes. Blacklist them explicitly so that they can show up in /sys/kernel/debug/kprobes/blacklist and tools like BCC can use this additional information. Signed-off-by: Andrea Righi Cc: Andy Lutomirski Cc: Anil S Keshavamurthy Cc: Borislav Petkov Cc: David S. Miller Cc: Linus Torvalds Cc: Masami Hiramatsu Cc: Naveen N. Rao Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Yonghong Song Link: http://lkml.kernel.org/r/20181206095648.GA8249@Dell Signed-off-by: Ingo Molnar commit dada6a43b0402eba438a17ac86fdc64ac56a4607 Author: Macpaul Lin Date: Wed Oct 17 23:08:38 2018 +0800 kgdboc: fix KASAN global-out-of-bounds bug in param_set_kgdboc_var() This patch is trying to fix KE issue due to "BUG: KASAN: global-out-of-bounds in param_set_kgdboc_var+0x194/0x198" reported by Syzkaller scan." [26364:syz-executor0][name:report8t]BUG: KASAN: global-out-of-bounds in param_set_kgdboc_var+0x194/0x198 [26364:syz-executor0][name:report&]Read of size 1 at addr ffffff900e44f95f by task syz-executor0/26364 [26364:syz-executor0][name:report&] [26364:syz-executor0]CPU: 7 PID: 26364 Comm: syz-executor0 Tainted: G W 0 [26364:syz-executor0]Call trace: [26364:syz-executor0][] dump_bacIctrace+Ox0/0x470 [26364:syz-executor0][] show_stack+0x20/0x30 [26364:syz-executor0][] dump_stack+Oxd8/0x128 [26364:syz-executor0][] print_address_description +0x80/0x4a8 [26364:syz-executor0][] kasan_report+Ox178/0x390 [26364:syz-executor0][] _asan_report_loadi_noabort+Ox18/0x20 [26364:syz-executor0][] param_set_kgdboc_var+Ox194/0x198 [26364:syz-executor0][] param_attr_store+Ox14c/0x270 [26364:syz-executor0][] module_attr_store+0x60/0x90 [26364:syz-executor0][] sysfs_kl_write+Ox100/0x158 [26364:syz-executor0][] kernfs_fop_write+0x27c/0x3a8 [26364:syz-executor0][] do_loop_readv_writev+0x114/0x1b0 [26364:syz-executor0][] do_readv_writev+0x4f8/0x5e0 [26364:syz-executor0][] vfs_writev+0x7c/Oxb8 [26364:syz-executor0][] SyS_writev+Oxcc/0x208 [26364:syz-executor0][] elO_svc_naked +0x24/0x28 [26364:syz-executor0][name:report&] [26364:syz-executor0][name:report&]The buggy address belongs to the variable: [26364:syz-executor0][name:report&] kgdb_tty_line+Ox3f/0x40 [26364:syz-executor0][name:report&] [26364:syz-executor0][name:report&]Memory state around the buggy address: [26364:syz-executor0] ffffff900e44f800: 00 00 00 00 00 04 fa fa fa fa fa fa 00 fa fa fa [26364:syz-executor0] ffffff900e44f880: fa fa fa fa 00 fa fa fa fa fa fa fa 00 fa fa fa [26364:syz-executor0]> ffffff900e44f900: fa fa fa fa 04 fa fa fa fa fa fa fa 00 00 00 00 [26364:syz-executor0][name:report&] ^ [26364:syz-executor0] ffffff900e44f980: 00 fa fa fa fa fa fa fa 04 fa fa fa fa fa fa fa [26364:syz-executor0] ffffff900e44fa00: 04 fa fa fa fa fa fa fa 00 fa fa fa fa fa fa fa [26364:syz-executor0][name:report&] [26364:syz-executor0][name:panic&]Disabling lock debugging due to kernel taint [26364:syz-executor0]------------[cut here]------------ After checking the source code, we've found there might be an out-of-bounds access to "config[len - 1]" array when the variable "len" is zero. Signed-off-by: Macpaul Lin Acked-by: Daniel Thompson Cc: stable Signed-off-by: Greg Kroah-Hartman commit 4f145cd66a1a76136ff5a03a99e37ba082715dc6 Author: Matthew Wilcox Date: Thu Nov 29 16:04:35 2018 -0500 XArray tests: Check iterating over multiorder entries There was no bug here, but there was no test coverage for this scenario. Signed-off-by: Matthew Wilcox commit b7677a132a4c2ff877986c5b30f9427127b9897a Author: Matthew Wilcox Date: Mon Nov 5 13:19:54 2018 -0500 XArray tests: Handle larger indices more elegantly xa_mk_value() only handles values up to LONG_MAX. I successfully hid that inside xa_store_index() and xa_erase_index(), but it turned out I also needed it for testing xa_alloc() on 32-bit machines. So extract xa_mk_index() from the above two functions, and convert the non-constant users of xa_mk_value() to xa_mk_index(). Signed-off-by: Matthew Wilcox commit 55f3f7eab75c10d9b33d122670b5935ab64db50f Author: Matthew Wilcox Date: Mon Nov 26 16:08:43 2018 -0500 XArray: Add xa_cmpxchg_irq and xa_cmpxchg_bh These convenience wrappers match the other _irq and _bh wrappers we already have. It turns out I'd already open-coded xa_cmpxchg_irq() in the shmem code, so convert that. Signed-off-by: Matthew Wilcox commit eff3860bbfedbac6edac57fb0d7f3a60e860c1c3 Author: Matthew Wilcox Date: Thu Dec 6 08:19:13 2018 -0500 radix tree: Don't return retry entries from lookup Commit 66ee620f06f9 ("idr: Permit any valid kernel pointer to be stored") changed the radix tree lookup so that it stops when reaching the bottom of the tree. However, the condition was added in the wrong place, making it possible to return retry entries to the caller. Reorder the tests to check for the retry entry before checking whether we're at the bottom of the tree. The retry entry should never be found in the tree root, so it's safe to defer the check until the end of the loop. Add a regression test to the test-suite to be sure this doesn't come back. Fixes: 66ee620f06f9 ("idr: Permit any valid kernel pointer to be stored") Reported-by: Greg Kurz Signed-off-by: Matthew Wilcox commit 0472bf06c6fd33c1a18aaead4c8f91e5a03d8d7b Author: Mathias Nyman Date: Wed Dec 5 14:22:39 2018 +0200 xhci: Prevent U1/U2 link pm states if exit latency is too long Don't allow USB3 U1 or U2 if the latency to wake up from the U-state reaches the service interval for a periodic endpoint. This is according to xhci 1.1 specification section 4.23.5.2 extra note: "Software shall ensure that a device is prevented from entering a U-state where its worst case exit latency approaches the ESIT." Allowing too long exit latencies for periodic endpoint confuses xHC internal scheduling, and new devices may fail to enumerate with a "Not enough bandwidth for new device state" error from the host. Cc: Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman commit a7d57abcc8a5bdeb53bbf8e87558e8e0a2c2a29d Author: Sandeep Singh Date: Wed Dec 5 14:22:38 2018 +0200 xhci: workaround CSS timeout on AMD SNPS 3.0 xHC Occasionally AMD SNPS 3.0 xHC does not respond to CSS when set, also it does not flag anything on SRE and HCE to point the internal xHC errors on USBSTS register. This stalls the entire system wide suspend and there is no point in stalling just because of xHC CSS is not responding. To work around this problem, if the xHC does not flag anything on SRE and HCE, we can skip the CSS timeout and allow the system to continue the suspend. Once the system resume happens we can internally reset the controller using XHCI_RESET_ON_RESUME quirk Signed-off-by: Shyam Sundar S K Signed-off-by: Sandeep Singh cc: Nehal Shah Cc: Tested-by: Kai-Heng Feng Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman commit b704441e38f645dcfba1348ca3cc1ba43d1a9f31 Author: Alek Du Date: Thu Dec 6 17:24:59 2018 +0800 mmc: sdhci: fix the timeout check window for clock and reset We observed some premature timeouts on a virtualization platform, the log is like this: case 1: [159525.255629] mmc1: Internal clock never stabilised. [159525.255818] mmc1: sdhci: ============ SDHCI REGISTER DUMP =========== [159525.256049] mmc1: sdhci: Sys addr: 0x00000000 | Version: 0x00001002 ... [159525.257205] mmc1: sdhci: Wake-up: 0x00000000 | Clock: 0x0000fa03 From the clock control register dump, we are pretty sure the clock was stablized. case 2: [ 914.550127] mmc1: Reset 0x2 never completed. [ 914.550321] mmc1: sdhci: ============ SDHCI REGISTER DUMP =========== [ 914.550608] mmc1: sdhci: Sys addr: 0x00000010 | Version: 0x00001002 After checking the sdhci code, we found the timeout check actually has a little window that the CPU can be scheduled out and when it comes back, the original time set or check is not valid. Fixes: 5a436cc0af62 ("mmc: sdhci: Optimize delay loops") Cc: stable@vger.kernel.org # v4.12+ Signed-off-by: Alek Du Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit c988de29ca161823db6a7125e803d597ef75b49c Author: Paulo Alcantara Date: Thu Nov 15 15:20:52 2018 +0100 cifs: Fix separator when building path from dentry Make sure to use the CIFS_DIR_SEP(cifs_sb) as path separator for prefixpath too. Fixes a bug with smb1 UNIX extensions. Fixes: a6b5058fafdf ("fs/cifs: make share unaccessible at root level mountable") Signed-off-by: Paulo Alcantara Reviewed-by: Aurelien Aptel Signed-off-by: Steve French CC: Stable commit 6e785302dad32228819d8066e5376acd15d0e6ba Author: Steve French Date: Sat Nov 3 15:02:44 2018 -0500 cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs) Missing a dependency. Shouldn't show cifs posix extensions in Kconfig if CONFIG_CIFS_ALLOW_INSECURE_DIALECTS (ie SMB1 protocol) is disabled. Signed-off-by: Steve French Reviewed-by: Pavel Shilovsky commit f15096f12a4e9340168df5fdd9201aa8ed60d59e Author: Fabio Estevam Date: Wed Dec 5 09:05:30 2018 -0200 ARM: dts: imx7d-nitrogen7: Fix the description of the Wifi clock According to bindings/regulator/fixed-regulator.txt the 'clocks' and 'clock-names' properties are not valid ones. In order to turn on the Wifi clock the correct location for describing the CLKO2 clock is via a mmc-pwrseq handle, so do it accordingly. Fixes: 56354959cfec ("ARM: dts: imx: add Boundary Devices Nitrogen7 board") Signed-off-by: Fabio Estevam Acked-by: Troy Kisky Signed-off-by: Shawn Guo commit e41b93a6be57e26a4a123345f826a6ac3a213551 Author: Michael Ellerman Date: Mon Dec 3 19:55:55 2018 +1100 powerpc/boot: Fix build failures with -j 1 In commit 5e9dcb6188a4 ("powerpc/boot: Expose Kconfig symbols to wrapper") we added a dependency to serial.c on autoconf.h: $(obj)/serial.c: $(obj)/autoconf.h This works when building in-tree (ie. with KBUILD_OUTPUT unset) because the obj tree is the src tree. But when building with eg. O=build and -j 1 the build fails: gcc ... -I../arch/powerpc/boot -c -o arch/powerpc/boot/serial.o arch/powerpc/boot/serial.c gcc: error: arch/powerpc/boot/serial.c: No such file or directory Why this is only happening with -j 1 is not clear, when building with -j greater than 1 somehow we decide to look for serial.c in the src tree (../), eg: gcc -I../arch/powerpc/boot -c -o arch/powerpc/boot/serial.o ../arch/powerpc/boot/serial.c Regardless we shouldn't be specifying a dependency on serial.c in the build tree, we want to add a dependency to the version in $(srctree) so fix the rule to say that. Fixes: 5e9dcb6188a4 ("powerpc/boot: Expose Kconfig symbols to wrapper") Tested-by: Daniel Axtens Signed-off-by: Michael Ellerman commit ebaf39e6032faf77218220707fc3fa22487784e0 Author: Jiri Wiesner Date: Wed Dec 5 16:55:29 2018 +0100 ipv4: ipv6: netfilter: Adjust the frag mem limit when truesize changes The *_frag_reasm() functions are susceptible to miscalculating the byte count of packet fragments in case the truesize of a head buffer changes. The truesize member may be changed by the call to skb_unclone(), leaving the fragment memory limit counter unbalanced even if all fragments are processed. This miscalculation goes unnoticed as long as the network namespace which holds the counter is not destroyed. Should an attempt be made to destroy a network namespace that holds an unbalanced fragment memory limit counter the cleanup of the namespace never finishes. The thread handling the cleanup gets stuck in inet_frags_exit_net() waiting for the percpu counter to reach zero. The thread is usually in running state with a stacktrace similar to: PID: 1073 TASK: ffff880626711440 CPU: 1 COMMAND: "kworker/u48:4" #5 [ffff880621563d48] _raw_spin_lock at ffffffff815f5480 #6 [ffff880621563d48] inet_evict_bucket at ffffffff8158020b #7 [ffff880621563d80] inet_frags_exit_net at ffffffff8158051c #8 [ffff880621563db0] ops_exit_list at ffffffff814f5856 #9 [ffff880621563dd8] cleanup_net at ffffffff814f67c0 #10 [ffff880621563e38] process_one_work at ffffffff81096f14 It is not possible to create new network namespaces, and processes that call unshare() end up being stuck in uninterruptible sleep state waiting to acquire the net_mutex. The bug was observed in the IPv6 netfilter code by Per Sundstrom. I thank him for his analysis of the problem. The parts of this patch that apply to IPv4 and IPv6 fragment reassembly are preemptive measures. Signed-off-by: Jiri Wiesner Reported-by: Per Sundstrom Acked-by: Peter Oskolkov Signed-off-by: David S. Miller commit afd0a8006e98b1890908f81746c94ca5dae29d7c Author: Jakub Audykowicz Date: Tue Dec 4 20:27:41 2018 +0100 sctp: frag_point sanity check If for some reason an association's fragmentation point is zero, sctp_datamsg_from_user will try to endlessly try to divide a message into zero-sized chunks. This eventually causes kernel panic due to running out of memory. Although this situation is quite unlikely, it has occurred before as reported. I propose to add this simple last-ditch sanity check due to the severity of the potential consequences. Signed-off-by: Jakub Audykowicz Acked-by: Neil Horman Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller commit e594a5e349ddbfdaca1951bb3f8d72f3f1660d73 Author: Sam Bobroff Date: Mon Dec 3 11:53:21 2018 +1100 drm/ast: Fix connector leak during driver unload When unloading the ast driver, a warning message is printed by drm_mode_config_cleanup() because a reference is still held to one of the drm_connector structs. Correct this by calling drm_crtc_force_disable_all() in ast_fbdev_destroy(). Signed-off-by: Sam Bobroff Reviewed-by: Daniel Vetter Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/1e613f3c630c7bbc72e04a44b178259b9164d2f6.1543798395.git.sbobroff@linux.ibm.com commit 6ccd895e41520db9364b79896446e0f4de97e7f0 Merge: c6c2097a19d8 b31a3ca745a4 Author: Dave Airlie Date: Thu Dec 6 14:09:53 2018 +1000 Merge tag 'drm-misc-fixes-2018-12-05' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes UAPI: - Distinguish lease events from hotplug (Daniel) Other: - omap: Restore panel-dpi bus flags (Tomi) - omap: Fix a couple of dsi issues (Sebastian) Cc: Sebastian Reichel Cc: Tomi Valkeinen Cc: Daniel Vetter Signed-off-by: Dave Airlie From: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20181205201428.GA35447@art_vandelay commit c6c2097a19d895d31285ae4a251f182c13430af6 Merge: 534c6307beb4 0a9b89b2e2e7 Author: Dave Airlie Date: Thu Dec 6 14:08:43 2018 +1000 Merge branch 'drm-fixes-4.20' of git://people.freedesktop.org/~agd5f/linux into drm-fixes Fixes for 4.20: - Fix banding regression on 6 bpc panels - Vega20 fix for six 4k displays - Fix LRU handling in ttm_buffer_object_transfer - Use proper MC firmware for newer polaris variants - Vega20 powerplay fixes - VCN suspend/resume fix for PCO - Misc other fixes Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20181205192934.2857-1-alexander.deucher@amd.com commit 534c6307beb40a6154368210f70c04516de82510 Merge: 2595646791c3 098336deb946 Author: Dave Airlie Date: Thu Dec 6 14:07:26 2018 +1000 Merge tag 'msm-fixes-2018-12-04' of https://gitlab.freedesktop.org/seanpaul/dpu-staging into drm-fixes - Several related to incorrect error checking/handling (Various) - Prevent IRQ storm on MDP5 HDMI hotplug (Todor) - Don't capture crash state if unsupported (Sharat) - Properly grab vblank reference in atomic wait for commit done (Sean) Cc: Sharat Masetty Cc: Todor Tomov Cc: Sean Paul Signed-off-by: Dave Airlie From: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20181205194207.GY154160@art_vandelay commit 1aed58e67a6ec1e7a18bfabe8ba6ec2d27c15636 Author: Ravi Bangoria Date: Wed Dec 5 09:04:23 2018 +0530 Uprobes: Fix kernel oops with delayed_uprobe_remove() There could be a race between task exit and probe unregister: exit_mm() mmput() __mmput() uprobe_unregister() uprobe_clear_state() put_uprobe() delayed_uprobe_remove() delayed_uprobe_remove() put_uprobe() is calling delayed_uprobe_remove() without taking delayed_uprobe_lock and thus the race sometimes results in a kernel crash. Fix this by taking delayed_uprobe_lock before calling delayed_uprobe_remove() from put_uprobe(). Detailed crash log can be found at: Link: http://lkml.kernel.org/r/000000000000140c370577db5ece@google.com Link: http://lkml.kernel.org/r/20181205033423.26242-1-ravi.bangoria@linux.ibm.com Acked-by: Oleg Nesterov Reviewed-by: Srikar Dronamraju Reported-by: syzbot+cb1fb754b771caca0a88@syzkaller.appspotmail.com Fixes: 1cc33161a83d ("uprobes: Support SDT markers having reference count (semaphore)") Signed-off-by: Ravi Bangoria Signed-off-by: Steven Rostedt (VMware) commit e9c7d656610e3fff7c96b199d418add2528aea6e Author: Anders Roxell Date: Fri Nov 30 16:08:59 2018 +0100 stackleak: Mark stackleak_track_stack() as notrace Function graph tracing recurses into itself when stackleak is enabled, causing the ftrace graph selftest to run for up to 90 seconds and trigger the softlockup watchdog. Breakpoint 2, ftrace_graph_caller () at ../arch/arm64/kernel/entry-ftrace.S:200 200 mcount_get_lr_addr x0 // pointer to function's saved lr (gdb) bt \#0 ftrace_graph_caller () at ../arch/arm64/kernel/entry-ftrace.S:200 \#1 0xffffff80081d5280 in ftrace_caller () at ../arch/arm64/kernel/entry-ftrace.S:153 \#2 0xffffff8008555484 in stackleak_track_stack () at ../kernel/stackleak.c:106 \#3 0xffffff8008421ff8 in ftrace_ops_test (ops=0xffffff8009eaa840 , ip=18446743524091297036, regs=) at ../kernel/trace/ftrace.c:1507 \#4 0xffffff8008428770 in __ftrace_ops_list_func (regs=, ignored=, parent_ip=, ip=) at ../kernel/trace/ftrace.c:6286 \#5 ftrace_ops_no_ops (ip=18446743524091297036, parent_ip=18446743524091242824) at ../kernel/trace/ftrace.c:6321 \#6 0xffffff80081d5280 in ftrace_caller () at ../arch/arm64/kernel/entry-ftrace.S:153 \#7 0xffffff800832fd10 in irq_find_mapping (domain=0xffffffc03fc4bc80, hwirq=27) at ../kernel/irq/irqdomain.c:876 \#8 0xffffff800832294c in __handle_domain_irq (domain=0xffffffc03fc4bc80, hwirq=27, lookup=true, regs=0xffffff800814b840) at ../kernel/irq/irqdesc.c:650 \#9 0xffffff80081d52b4 in ftrace_graph_caller () at ../arch/arm64/kernel/entry-ftrace.S:205 Rework so we mark stackleak_track_stack as notrace Co-developed-by: Arnd Bergmann Signed-off-by: Arnd Bergmann Signed-off-by: Anders Roxell Acked-by: Steven Rostedt (VMware) Signed-off-by: Kees Cook commit 1e434b703248580b7aaaf8a115d93e682f57d29f Author: Anson Huang Date: Tue Dec 4 03:17:45 2018 +0000 ARM: imx: update the cpu power up timing setting on i.mx6sx The sw2iso count should cover ARM LDO ramp-up time, the MAX ARM LDO ramp-up time may be up to more than 100us on some boards, this patch sets sw2iso to 0xf (~384us) which is the reset value, and it is much more safe to cover different boards, since we have observed that some customer boards failed with current setting of 0x2. Fixes: 05136f0897b5 ("ARM: imx: support arm power off in cpuidle for i.mx6sx") Signed-off-by: Anson Huang Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit cf76c364a1e1e5224af80edf70a1e3023e1fcf8c Merge: 369af92ce47a c967590457ca Author: Linus Torvalds Date: Wed Dec 5 17:06:31 2018 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Four obvious bug fixes. The vmw_pscsi is so old that it's amazing no-one noticed before now" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: storvsc: Fix a race in sub-channel creation that can cause panic scsi: vmw_pscsi: Rearrange code to avoid multiple calls to free_irq during unload scsi: libiscsi: Fix NULL pointer dereference in iscsi_eh_session_reset scsi: lpfc: fix block guard enablement on SLI3 adapters commit b2b7af861122a0c0f6260155c29a1b2e594cd5b5 Author: Yuchung Cheng Date: Wed Dec 5 14:38:38 2018 -0800 tcp: fix NULL ref in tail loss probe TCP loss probe timer may fire when the retranmission queue is empty but has a non-zero tp->packets_out counter. tcp_send_loss_probe will call tcp_rearm_rto which triggers NULL pointer reference by fetching the retranmission queue head in its sub-routines. Add a more detailed warning to help catch the root cause of the inflight accounting inconsistency. Reported-by: Rafael Tinoco Signed-off-by: Yuchung Cheng Signed-off-by: Eric Dumazet Signed-off-by: Neal Cardwell Signed-off-by: David S. Miller commit 41727549de3e7281feb174d568c6e46823db8684 Author: Eric Dumazet Date: Wed Dec 5 14:24:31 2018 -0800 tcp: Do not underestimate rwnd_limited If available rwnd is too small, tcp_tso_should_defer() can decide it is worth waiting before splitting a TSO packet. This really means we are rwnd limited. Fixes: 5615f88614a4 ("tcp: instrument how long TCP is limited by receive window") Signed-off-by: Eric Dumazet Acked-by: Soheil Hassas Yeganeh Reviewed-by: Yuchung Cheng Signed-off-by: David S. Miller commit e37d05a538a6656e108f7704ad66e1ccc13d6f68 Merge: 22f6bbb7bcfc a92a72a24d48 Author: David S. Miller Date: Wed Dec 5 16:30:30 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Alexei Starovoitov says: ==================== pull-request: bpf 2018-12-05 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) fix bpf uapi pointers for 32-bit architectures, from Daniel. 2) improve verifer ability to handle progs with a lot of branches, from Alexei. 3) strict btf checks, from Yonghong. 4) bpf_sk_lookup api cleanup, from Joe. 5) other misc fixes ==================== Signed-off-by: David S. Miller commit 22f6bbb7bcfcef0b373b0502a7ff390275c575dd Author: Edward Cree Date: Tue Dec 4 17:37:57 2018 +0000 net: use skb_list_del_init() to remove from RX sublists list_del() leaves the skb->next pointer poisoned, which can then lead to a crash in e.g. OVS forwarding. For example, setting up an OVS VXLAN forwarding bridge on sfc as per: ======== $ ovs-vsctl show 5dfd9c47-f04b-4aaa-aa96-4fbb0a522a30 Bridge "br0" Port "br0" Interface "br0" type: internal Port "enp6s0f0" Interface "enp6s0f0" Port "vxlan0" Interface "vxlan0" type: vxlan options: {key="1", local_ip="10.0.0.5", remote_ip="10.0.0.4"} ovs_version: "2.5.0" ======== (where 10.0.0.5 is an address on enp6s0f1) and sending traffic across it will lead to the following panic: ======== general protection fault: 0000 [#1] SMP PTI CPU: 5 PID: 0 Comm: swapper/5 Not tainted 4.20.0-rc3-ehc+ #701 Hardware name: Dell Inc. PowerEdge R710/0M233H, BIOS 6.4.0 07/23/2013 RIP: 0010:dev_hard_start_xmit+0x38/0x200 Code: 53 48 89 fb 48 83 ec 20 48 85 ff 48 89 54 24 08 48 89 4c 24 18 0f 84 ab 01 00 00 48 8d 86 90 00 00 00 48 89 f5 48 89 44 24 10 <4c> 8b 33 48 c7 03 00 00 00 00 48 8b 05 c7 d1 b3 00 4d 85 f6 0f 95 RSP: 0018:ffff888627b437e0 EFLAGS: 00010202 RAX: 0000000000000000 RBX: dead000000000100 RCX: ffff88862279c000 RDX: ffff888614a342c0 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff888618a88000 R08: 0000000000000001 R09: 00000000000003e8 R10: 0000000000000000 R11: ffff888614a34140 R12: 0000000000000000 R13: 0000000000000062 R14: dead000000000100 R15: ffff888616430000 FS: 0000000000000000(0000) GS:ffff888627b40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6d2bc6d000 CR3: 000000000200a000 CR4: 00000000000006e0 Call Trace: __dev_queue_xmit+0x623/0x870 ? masked_flow_lookup+0xf7/0x220 [openvswitch] ? ep_poll_callback+0x101/0x310 do_execute_actions+0xaba/0xaf0 [openvswitch] ? __wake_up_common+0x8a/0x150 ? __wake_up_common_lock+0x87/0xc0 ? queue_userspace_packet+0x31c/0x5b0 [openvswitch] ovs_execute_actions+0x47/0x120 [openvswitch] ovs_dp_process_packet+0x7d/0x110 [openvswitch] ovs_vport_receive+0x6e/0xd0 [openvswitch] ? dst_alloc+0x64/0x90 ? rt_dst_alloc+0x50/0xd0 ? ip_route_input_slow+0x19a/0x9a0 ? __udp_enqueue_schedule_skb+0x198/0x1b0 ? __udp4_lib_rcv+0x856/0xa30 ? __udp4_lib_rcv+0x856/0xa30 ? cpumask_next_and+0x19/0x20 ? find_busiest_group+0x12d/0xcd0 netdev_frame_hook+0xce/0x150 [openvswitch] __netif_receive_skb_core+0x205/0xae0 __netif_receive_skb_list_core+0x11e/0x220 netif_receive_skb_list+0x203/0x460 ? __efx_rx_packet+0x335/0x5e0 [sfc] efx_poll+0x182/0x320 [sfc] net_rx_action+0x294/0x3c0 __do_softirq+0xca/0x297 irq_exit+0xa6/0xb0 do_IRQ+0x54/0xd0 common_interrupt+0xf/0xf ======== So, in all listified-receive handling, instead pull skbs off the lists with skb_list_del_init(). Fixes: 9af86f933894 ("net: core: fix use-after-free in __netif_receive_skb_list_core") Fixes: 7da517a3bc52 ("net: core: Another step of skb receive list processing") Fixes: a4ca8b7df73c ("net: ipv4: fix drop handling in ip_list_rcv() and ip_list_rcv_finish()") Fixes: d8269e2cbf90 ("net: ipv6: listify ipv6_rcv() and ip6_rcv_finish()") Signed-off-by: Edward Cree Signed-off-by: David S. Miller commit 369af92ce47a04b2523ec4feea1febcacf8419b1 Merge: 2f0799a0ffc0 10d443431dc2 Author: Linus Torvalds Date: Wed Dec 5 15:51:41 2018 -0800 Merge tag 'arc-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC fixes/updates from Vineet Gupta - Missing reads{x}()/writes{x}() getting in the way of some drivers [Jose Abreu] - Builds defaulting to ARCv2 ISA based configsa [Kevin Hilman] - Misc fixes * tag 'arc-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: ARC: io.h: Implement reads{x}()/writes{x}() ARC: change defconfig defaults to ARCv2 arc: [devboards] Add support of NFSv3 ACL ARC: mm: fix uninitialised signal code in do_page_fault ARC: [plat-hsdk] Enable DW APB GPIO support ARCv2: boot log unaligned access in use ARC: IOC: panic if kernel was started with previously enabled IOC ARC: remove redundant 'default n' from Kconfig commit 2f0799a0ffc033bf3cc82d5032acc3ec633464c2 Author: David Rientjes Date: Wed Dec 5 15:45:54 2018 -0800 mm, thp: restore node-local hugepage allocations This is a full revert of ac5b2c18911f ("mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings") and a partial revert of 89c83fb539f9 ("mm, thp: consolidate THP gfp handling into alloc_hugepage_direct_gfpmask"). By not setting __GFP_THISNODE, applications can allocate remote hugepages when the local node is fragmented or low on memory when either the thp defrag setting is "always" or the vma has been madvised with MADV_HUGEPAGE. Remote access to hugepages often has much higher latency than local pages of the native page size. On Haswell, ac5b2c18911f was shown to have a 13.9% access regression after this commit for binaries that remap their text segment to be backed by transparent hugepages. The intent of ac5b2c18911f is to address an issue where a local node is low on memory or fragmented such that a hugepage cannot be allocated. In every scenario where this was described as a fix, there is abundant and unfragmented remote memory available to allocate from, even with a greater access latency. If remote memory is also low or fragmented, not setting __GFP_THISNODE was also measured on Haswell to have a 40% regression in allocation latency. Restore __GFP_THISNODE for thp allocations. Fixes: ac5b2c18911f ("mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings") Fixes: 89c83fb539f9 ("mm, thp: consolidate THP gfp handling into alloc_hugepage_direct_gfpmask") Cc: Andrea Arcangeli Cc: Mel Gorman Cc: Vlastimil Babka Cc: Michal Hocko Cc: Andrew Morton Signed-off-by: David Rientjes Signed-off-by: Linus Torvalds commit b5fd2e00a60248902315fb32210550ac3cb9f44c Author: Dan Williams Date: Mon Dec 3 10:30:25 2018 -0800 acpi/nfit: Fix user-initiated ARS to be "ARS-long" rather than "ARS-short" A "short" ARS (address range scrub) instructs the platform firmware to return known errors. In contrast, a "long" ARS instructs platform firmware to arrange every data address on the DIMM to be read / checked for poisoned data. The conversion of the flags in commit d3abaf43bab8 "acpi, nfit: Fix Address Range Scrub completion tracking", changed the meaning of passing '0' to acpi_nfit_ars_rescan(). Previously '0' meant "not short", now '0' is ARS_REQ_SHORT. Pass ARS_REQ_LONG to restore the expected scrub-type behavior of user-initiated ARS sessions. Fixes: d3abaf43bab8 ("acpi, nfit: Fix Address Range Scrub completion tracking") Reported-by: Jacek Zloch Cc: Vishal Verma Reviewed-by: Dave Jiang Reviewed-by: Vishal Verma Signed-off-by: Dan Williams commit ae86cbfef3818300f1972e52f67a93211acb0e24 Author: Dan Williams Date: Sat Nov 24 10:47:04 2018 -0800 libnvdimm, pfn: Pad pfn namespaces relative to other regions Commit cfe30b872058 "libnvdimm, pmem: adjust for section collisions with 'System RAM'" enabled Linux to workaround occasions where platform firmware arranges for "System RAM" and "Persistent Memory" to collide within a single section boundary. Unfortunately, as reported in this issue [1], platform firmware can inflict the same collision between persistent memory regions. The approach of interrogating iomem_resource does not work in this case because platform firmware may merge multiple regions into a single iomem_resource range. Instead provide a method to interrogate regions that share the same parent bus. This is a stop-gap until the core-MM can grow support for hotplug on sub-section boundaries. [1]: https://github.com/pmem/ndctl/issues/76 Fixes: cfe30b872058 ("libnvdimm, pmem: adjust for section collisions with...") Cc: Reported-by: Patrick Geary Tested-by: Patrick Geary Reviewed-by: Vishal Verma Signed-off-by: Dan Williams commit e3f5df762d4a6ef6326c3c09bc9f89ea8a2eab2c Author: Dan Williams Date: Wed Dec 5 14:11:48 2018 -0800 tools/testing/nvdimm: Align test resources to 128M In preparation for libnvdimm growing new restrictions to detect section conflicts between persistent memory regions, enable nfit_test to allocate aligned resources. Use a gen_pool to allocate nfit_test's fake resources in a separate address space from the virtual translation of the same. Reviewed-by: Vishal Verma Tested-by: Vishal Verma Signed-off-by: Dan Williams commit 4eaaa2b99e30305f4bc677f4abfe56c1f8b39670 Merge: d08970904582 ffe81d45322c Author: Linus Torvalds Date: Wed Dec 5 13:28:01 2018 -0800 Merge tag 'for-linus-20181205' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "A bit earlier in the week as usual, but there's a fix here that should go in sooner rather than later. Under a combination of circumstance, the direct issue path in blk-mq could corrupt data. This wasn't easy to hit, but the ones that are affected by it, seem to hit it pretty easily. Full explanation in the patch. None of the regular filesystem and storage testing has triggered it, even though it's been around since 4.19-rc1. Outside of that, whitelist trim tweak for certain Samsung devices for libata" * tag 'for-linus-20181205' of git://git.kernel.dk/linux-block: blk-mq: fix corruption with direct issue libata: whitelist all SAMSUNG MZ7KM* solid-state disks commit 704620afc70cf47abb9d6a1a57f3825d2bca49cf Author: Mathias Payer Date: Wed Dec 5 21:19:59 2018 +0100 USB: check usb_get_extra_descriptor for proper size When reading an extra descriptor, we need to properly check the minimum and maximum size allowed, to prevent from invalid data being sent by a device. Reported-by: Hui Peng Reported-by: Mathias Payer Co-developed-by: Linus Torvalds Signed-off-by: Hui Peng Signed-off-by: Mathias Payer Signed-off-by: Linus Torvalds Cc: stable Signed-off-by: Greg Kroah-Hartman commit 64d47902fea3dcd3f2d0f3366259984dbc31653b Merge: 0fb628f0f250 312ca38ddda6 Author: David S. Miller Date: Wed Dec 5 11:46:06 2018 -0800 Merge tag 'mac80211-for-davem-2018-12-05' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg: ==================== As it's been a while, we have various fixes for * hwsim * AP mode (client powersave related) * CSA/FTM interaction * a busy loop in IE handling * and similar ==================== Signed-off-by: David S. Miller commit 0a9b89b2e2e7b6d90f81ddc47e489be1043e01b1 Author: James Zhu Date: Mon Dec 3 22:04:28 2018 -0500 drm/amdgpu/vcn: Update vcn.cur_state during suspend Replace vcn_v1_0_stop with vcn_v1_0_set_powergating_state during suspend, to keep adev->vcn.cur_state update. It will fix VCN S3 hung issue. Signed-off-by: James Zhu Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit 078ab3ea2c3bb69cb989d52346fefa1246055e5b Author: Sakari Ailus Date: Wed Dec 5 12:23:54 2018 -0500 media: Add a Kconfig option for the Request API The Request API is now merged to the kernel but the confidence on the stability of that API is not great, especially regarding the interaction with V4L2. Add a Kconfig option for the API, with a scary-looking warning. The patch itself disables request creation as well as does not advertise them as buffer flags. The driver requiring requests (cedrus) now depends on the Kconfig option as well. Signed-off-by: Sakari Ailus Acked-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit cd9fd6f12fc762246607c77673acdfb55f8096b6 Author: Hans Verkuil Date: Wed Dec 5 06:36:13 2018 -0500 media: extended-controls.rst: add note to the MPEG2 state controls Add a note mentioning that these two controls are not part of the public API while they still stabilizing. Signed-off-by: Hans Verkuil Reviewed-by: Paul Kocialkowski Signed-off-by: Mauro Carvalho Chehab commit 9514063498cbff9a351f4bc25e1b1bfca8eccb7a Author: Hans Verkuil Date: Wed Dec 5 06:28:20 2018 -0500 media: mpeg2-ctrls.h: move MPEG2 state controls to non-public header The MPEG2 state controls for the cedrus stateless MPEG2 driver are not yet stable. Move them out of the public headers into media/mpeg2-ctrls.h. Eventually, once this has stabilized, they will be moved back to the public headers. Unfortunately I had to cast the control type to a u32 in two switch statements to prevent a compiler warning about a control type define not being part of the enum. Signed-off-by: Hans Verkuil Reviewed-by: Paul Kocialkowski Signed-off-by: Mauro Carvalho Chehab commit d0897090458211f9c6b2d7f5af87f4d3b0403f69 Merge: 91dd51f6e7ce 10950929e994 Author: Linus Torvalds Date: Wed Dec 5 09:58:17 2018 -0800 Merge tag 'for-4.20-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fix from David Sterba: "A patch in 4.19 introduced a sanity check that was too strict and a filesystem cannot be mounted. This happens for filesystems with more than 10 devices and has been reported by a few users so we need the fix to propagate to stable" * tag 'for-4.20-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: tree-checker: Don't check max block group size as current max chunk size limit is unreliable commit 91dd51f6e7ce7f1eba5d7b583790e134367d0fbb Merge: 5e0dc1a7ce1f a72173ecfc67 Author: Linus Torvalds Date: Wed Dec 5 09:51:10 2018 -0800 Merge tag 'pm-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Revert a problematic recent commit that attempted to fix a system-wide suspend issue related to the freezer" * tag 'pm-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Revert "exec: make de_thread() freezable" commit 5e0dc1a7ce1f322c06e993845def2c73cfc485fd Merge: a517af52cb57 48a2ca0ee399 Author: Linus Torvalds Date: Wed Dec 5 09:45:34 2018 -0800 Merge tag 'mfd-fixes-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull mfd bugfix from Lee Jones: "Replace release function in cros_ec_dev" * tag 'mfd-fixes-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: Revert "mfd: cros_ec: Use devm_kzalloc for private data" commit b72f936f6b325f4fde06b02e4b6ab682f6f2e73f Author: Chris Chiu Date: Wed Dec 5 14:48:56 2018 +0800 ALSA: hda/realtek: Fix mic issue on Acer AIO Veriton Z4860G/Z6860G Acer AIO Veriton Z4860G/Z6860G with the same ALC286 codec has issues with the input from external microphone. The issue can be fixed by the fixup ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE for Veriton Z4660G. Signed-off-by: Jian-Hong Pan Signed-off-by: Daniel Drake Signed-off-by: Chris Chiu Cc: Signed-off-by: Takashi Iwai commit 9f8aefed9623a91dec54eab8908f3810b7f8d73a Author: Chris Chiu Date: Wed Dec 5 14:48:55 2018 +0800 ALSA: hda/realtek: Fix mic issue on Acer AIO Veriton Z4660G Acer AIO Veriton Z4660G with ALC286 codec has issue with the input from external microphones connecting via 'Front Mic' jack. The fixup ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE enables the jack sensing of the headset and fix the audio input issue of external microphone. Signed-off-by: Jian-Hong Pan Signed-off-by: Daniel Drake Signed-off-by: Chris Chiu Cc: Signed-off-by: Takashi Iwai commit 705b65f107470499442240ff7afee5021a7002a6 Author: Chris Chiu Date: Wed Dec 5 14:48:54 2018 +0800 ALSA: hda/realtek - Add support for Acer Aspire C24-860 headset mic The Acer AIO Aspire C24-860 with ALC286 can't detect the headset microphone. Just like another Acer AIO U27-880, it needs a different pin value for 0x18 and the headset fixup to make headset mic work. Signed-off-by: Jian-Hong Pan Signed-off-by: Daniel Drake Signed-off-by: Chris Chiu Cc: Signed-off-by: Takashi Iwai commit 33aaebd48ae2d2c78fef5063a0381e17db19b060 Author: Chris Chiu Date: Wed Dec 5 14:48:53 2018 +0800 ALSA: hda/realtek: ALC286 mic and headset-mode fixups for Acer Aspire U27-880 Acer Aspire U27-880(AIO) with ALC286 codec can not detect headset mic and internal mic not working either. It needs the similar quirk like Sony laptops to fix headphone jack sensing and enables use of the internal microphone. Unfortunately jack sensing for the headset mic is still not working. Signed-off-by: Jian-Hong Pan Signed-off-by: Daniel Drake Signed-off-by: Chris Chiu Cc: Signed-off-by: Takashi Iwai commit 1aea7aee805e3d1288f9f1fa4484964b51664960 Author: Julia Lawall Date: Tue Oct 30 16:15:00 2018 +0100 thermal: broadcom: constify thermal_zone_of_device_ops structure The thermal_zone_of_device_ops structure can be const as it is only passed as the last argument of thermal_zone_of_sensor_register and the corresponding parameter is declared as const. Done with the help of Coccinelle. Signed-off-by: Julia Lawall Reviewed-by: Daniel Lezcano Signed-off-by: Eduardo Valentin commit 13cfb713c8c2035c058af3233c3432165c97ceeb Author: Julia Lawall Date: Tue Oct 30 16:14:59 2018 +0100 thermal: armada: constify thermal_zone_of_device_ops structure The thermal_zone_of_device_ops structure can be const as it is only passed as the last argument of devm_thermal_zone_of_sensor_register and the corresponding parameter is declared as const. Done with the help of Coccinelle. Signed-off-by: Julia Lawall Reviewed-by: Daniel Lezcano Signed-off-by: Eduardo Valentin commit d76b21ebf8ff0ec5030e98c64c50dca2254474f3 Merge: 90098efacc4c a40fa231bb64 Author: Joonas Lahtinen Date: Wed Dec 5 15:51:46 2018 +0200 Merge tag 'gvt-fixes-2018-12-04' of https://github.com/intel/gvt-linux into drm-intel-fixes gvt-fixes-2018-12-04 - Fix tiling mode format on BDW for VFIO gfx dmabuf (Tina) Signed-off-by: Joonas Lahtinen From: Zhenyu Wang Link: https://patchwork.freedesktop.org/patch/msgid/20181204050633.GY12743@zhen-hp.sh.intel.com commit 79462857eb547e5d17fc8445b9768615e02dc1cf Author: Trond Myklebust Date: Mon Dec 3 18:49:00 2018 -0500 SUNRPC: Don't force a redundant disconnection in xs_read_stream() If the connection is broken, then xs_tcp_state_change() will take care of scheduling the socket close as soon as appropriate. xs_read_stream() just needs to report the error. Signed-off-by: Trond Myklebust commit dfcf0380858b4e760ae02665649d884d1baa50c9 Author: Trond Myklebust Date: Tue Dec 4 07:50:06 2018 -0500 SUNRPC: Fix up socket polling Ensure that we do not exit the socket read callback without clearing XPRT_SOCK_DATA_READY. Signed-off-by: Trond Myklebust commit b76a5afdce6c6dacfbd51863b31b3d7cc61ca21e Author: Trond Myklebust Date: Mon Dec 3 15:58:58 2018 -0500 SUNRPC: Use the discard iterator rather than MSG_TRUNC When discarding message data from the stream, we're better off using the discard iterator, since that will work with non-TCP streams. Signed-off-by: Trond Myklebust commit 26781eab48ece79000ffc4e69be402f2524e1137 Author: Trond Myklebust Date: Mon Dec 3 15:41:38 2018 -0500 SUNRPC: Treat EFAULT as a truncated message in xs_read_stream_request() Signed-off-by: Trond Myklebust commit 16e5e90f0e4f9b7b2e4d08558a2f695e2fa1fb0d Author: Trond Myklebust Date: Sun Dec 2 15:22:48 2018 -0500 SUNRPC: Fix up handling of the XDRBUF_SPARSE_PAGES flag If the allocator fails before it has reached the target number of pages, then we need to recheck that we're not seeking past the page buffer. Signed-off-by: Trond Myklebust commit c443305529d1d3d3bee0d68fdd14ae89835e091f Author: Trond Myklebust Date: Tue Dec 4 07:52:11 2018 -0500 SUNRPC: Fix RPC receive hangs The RPC code is occasionally hanging when the receive code fails to empty the socket buffer due to a partial read of the data. When we convert that to an EAGAIN, it appears we occasionally leave data in the socket. The fix is to just keep reading until the socket returns EAGAIN/EWOULDBLOCK. Reported-by: Catalin Marinas Reported-by: Cristian Marussi Reported-by: Chuck Lever Signed-off-by: Trond Myklebust Tested-by: Catalin Marinas Tested-by: Cristian Marussi commit db2039fcfd5754d15986340152e4503737f68f8d Author: Faiz Abbas Date: Wed Nov 21 16:03:55 2018 +0530 mmc: sdhci-omap: Fix DCRC error handling during tuning Commit 7d33c3581536 ("mmc: sdhci-omap: Workaround for Errata i802") disabled DCRC interrupts during tuning. This write to the interrupt enable register gets overwritten in sdhci_prepare_data() and the interrupt is not in fact disabled. Fix this by disabling the interrupt in the host->ier variable. Fixes: 7d33c3581536 ("mmc: sdhci-omap: Workaround for Errata i802") Cc: Signed-off-by: Faiz Abbas Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit 312ca38ddda64bac6513ec68e0ac3789b4eb44dc Author: Jouni Malinen Date: Wed Dec 5 12:55:54 2018 +0200 cfg80211: Fix busy loop regression in ieee80211_ie_split_ric() This function was modified to support the information element extension case (WLAN_EID_EXTENSION) in a manner that would result in an infinite loop when going through set of IEs that include WLAN_EID_RIC_DATA and contain an IE that is in the after_ric array. The only place where this can currently happen is in mac80211 ieee80211_send_assoc() where ieee80211_ie_split_ric() is called with after_ric[]. This can be triggered by valid data from user space nl80211 association/connect request (i.e., requiring GENL_UNS_ADMIN_PERM). The only known application having an option to include WLAN_EID_RIC_DATA in these requests is wpa_supplicant and it had a bug that prevented this specific contents from being used (and because of that, not triggering this kernel bug in an automated test case ap_ft_ric) and now that this bug is fixed, it has a workaround to avoid this kernel issue. WLAN_EID_RIC_DATA is currently used only for testing purposes, so this does not cause significant harm for production use cases. Fixes: 2512b1b18d07 ("mac80211: extend ieee80211_ie_split to support EXTENSION") Cc: stable@vger.kernel.org Signed-off-by: Jouni Malinen Signed-off-by: Johannes Berg commit 90098efacc4c3e2e4f6262a657d6b520ecfb2555 Author: Tvrtko Ursulin Date: Wed Dec 5 11:33:24 2018 +0000 drm/i915: Introduce per-engine workarounds We stopped re-applying the GT workarounds after engine reset since commit 59b449d5c82a ("drm/i915: Split out functions for different kinds of workarounds"). Issue with this is that some of the GT workarounds live in the MMIO space which gets lost during engine resets. So far the registers in 0x2xxx and 0xbxxx address range have been identified to be affected. This losing of applied workarounds has obvious negative effects and can even lead to hard system hangs (see the linked Bugzilla). Rather than just restoring this re-application, because we have also observed that it is not safe to just re-write all GT workarounds after engine resets (GPU might be live and weird hardware states can happen), we introduce a new class of per-engine workarounds and move only the affected GT workarounds over. Using the framework introduced in the previous patch, we therefore after engine reset, re-apply only the workarounds living in the affected MMIO address ranges. v2: * Move Wa_1406609255:icl to engine workarounds as well. * Rename API. (Chris Wilson) * Drop redundant IS_KABYLAKE. (Chris Wilson) * Re-order engine wa/ init so latest platforms are first. (Rodrigo Vivi) Signed-off-by: Tvrtko Ursulin Bugzilla: https://bugzilla.freedesktop.org/show_bug.cgi?id=107945 Fixes: 59b449d5c82a ("drm/i915: Split out functions for different kinds of workarounds") Cc: Mika Kuoppala Cc: Ville Syrjälä Cc: Chris Wilson Cc: Jani Nikula Cc: Joonas Lahtinen Cc: Rodrigo Vivi Cc: intel-gfx@lists.freedesktop.org Acked-by: Rodrigo Vivi Reviewed-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20181203133341.10258-1-tvrtko.ursulin@linux.intel.com (cherry picked from commit 4a15c75c42460252a63d30f03b4766a52945fb47) Signed-off-by: Joonas Lahtinen commit 009367791f31afa0842854e7ea0acc9edf70ccaf Author: Tvrtko Ursulin Date: Wed Dec 5 11:33:23 2018 +0000 drm/i915: Record GT workarounds in a list To enable later verification of GT workaround state at various stages of driver lifetime, we record the list of applicable ones per platforms to a list, from which they are also applied. The added data structure is a simple array of register, mask and value items, which is allocated on demand as workarounds are added to the list. This is a temporary implementation which later in the series gets fused with the existing per context workaround list handling. It is separated at this stage since the following patch fixes a bug which needs to be as easy to backport as possible. Also, since in the following patch we will be adding a new class of workarounds (per engine) which can be applied from interrupt context, we straight away make the provision for safe read-modify-write cycle. v2: * Change dev_priv to i915 along the init path. (Chris Wilson) * API rename. (Chris Wilson) v3: * Remove explicit list size tracking in favour of growing the allocation in power of two chunks. (Chris Wilson) v4: Chris Wilson: * Change wa_list_finish to early return. * Copy workarounds using the compiler for static checking. * Do not bother zeroing unused entries. * Re-order struct i915_wa_list. v5: * kmalloc_array. * Whitespace cleanup. Signed-off-by: Tvrtko Ursulin Reviewed-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20181203133319.10174-1-tvrtko.ursulin@linux.intel.com (cherry picked from commit 25d140faaa25f728159eb8c304eae53d88a7f14e) Fixes: 59b449d5c82a ("drm/i915: Split out functions for different kinds of workarounds") Signed-off-by: Joonas Lahtinen commit 990d71846a0b7281bd933c34d734e6afc7408e7e Author: Emmanuel Grumbach Date: Mon Dec 3 21:16:07 2018 +0200 mac80211: ignore NullFunc frames in the duplicate detection NullFunc packets should never be duplicate just like QoS-NullFunc packets. We saw a client that enters / exits power save with NullFunc frames (and not with QoS-NullFunc) despite the fact that the association supports HT. This specific client also re-uses a non-zero sequence number for different NullFunc frames. At some point, the client had to send a retransmission of the NullFunc frame and we dropped it, leading to a misalignment in the power save state. Fix this by never consider a NullFunc frame as duplicate, just like we do for QoS NullFunc frames. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=201449 CC: Signed-off-by: Emmanuel Grumbach Signed-off-by: Johannes Berg commit 9ec1190d065998650fd9260dea8cf3e1f56c0e8c Author: Felix Fietkau Date: Wed Nov 28 22:39:16 2018 +0100 mac80211: fix reordering of buffered broadcast packets If the buffered broadcast queue contains packets, letting new packets bypass that queue can lead to heavy reordering, since the driver is probably throttling transmission of buffered multicast packets after beacons. Keep buffering packets until the buffer has been cleared (and no client is in powersave mode). Cc: stable@vger.kernel.org Signed-off-by: Felix Fietkau Signed-off-by: Johannes Berg commit a317e65face482371de30246b6494feb093ff7f9 Author: Felix Fietkau Date: Tue Nov 13 20:32:13 2018 +0100 mac80211: ignore tx status for PS stations in ieee80211_tx_status_ext Make it behave like regular ieee80211_tx_status calls, except for the lack of filtered frame processing. This fixes spurious low-ack triggered disconnections with powersave clients connected to an AP. Fixes: f027c2aca0cf4 ("mac80211: add ieee80211_tx_status_noskb") Cc: stable@vger.kernel.org Signed-off-by: Felix Fietkau Signed-off-by: Johannes Berg commit 100bc3e2bebf95506da57cbdf5f26b25f6da4c81 Author: Peter Shih Date: Tue Nov 27 12:49:50 2018 +0800 tty: serial: 8250_mtk: always resume the device in probe. serial8250_register_8250_port calls uart_config_port, which calls config_port on the port before it tries to power on the port. So we need the port to be on before calling serial8250_register_8250_port. Change the code to always do a runtime resume in probe before registering port, and always do a runtime suspend in remove. This basically reverts the change in commit 68e5fc4a255a ("tty: serial: 8250_mtk: use pm_runtime callbacks for enabling"), but still use pm_runtime callbacks. Fixes: 68e5fc4a255a ("tty: serial: 8250_mtk: use pm_runtime callbacks for enabling") Signed-off-by: Peter Shih Cc: stable Signed-off-by: Greg Kroah-Hartman commit f51ccf46217c28758b1f3b5bc0ccfc00eca658b2 Author: Johan Hovold Date: Tue Dec 4 17:00:36 2018 +0100 USB: serial: console: fix reported terminal settings The USB-serial console implementation has never reported the actual terminal settings used. Despite storing the corresponding cflags in its struct console, these were never honoured on later tty open() where the tty termios would be left initialised to the driver defaults. Unlike the serial console implementation, the USB-serial code calls subdriver open() already at console setup. While calling set_termios() and write() before open() looks like it could work for some USB-serial drivers, others definitely do not expect this, so modelling this after serial core is going to be intrusive, if at all possible. Instead, use a (renamed) tty helper to save the termios data used at console setup so that the tty termios reflects the actual terminal settings after a subsequent tty open(). Note that the calls to tty_init_termios() (tty_driver_install()) and tty_save_termios() are serialised using the disconnect mutex. This specifically fixes a regression that was triggered by a recent change adding software flow control to the pl2303 driver: a getty trying to disable flow control while leaving the baud rate unchanged would now also set the baud rate to the driver default (prior to the flow-control change this had been a noop). Fixes: 7041d9c3f01b ("USB: serial: pl2303: add support for tx xon/xoff flow control") Cc: stable # 4.18 Cc: Florian Zumbiehl Reported-by: Jarkko Nikula Tested-by: Jarkko Nikula Acked-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit 48a2ca0ee3994df53da230c7079a18a70ec914f9 Author: Enric Balletbo i Serra Date: Tue Dec 4 16:58:43 2018 +0100 Revert "mfd: cros_ec: Use devm_kzalloc for private data" This reverts commit 3aa2177e47878f7e7616da8a2050c44f22301b6e. That commit triggered a new WARN when unloading the module (see at the end of the commit message). When a class_dev is embedded in a structure then that class_dev is the thing that controls the lifetime of that structure, for that reason device managed allocations can't be used here. See Documentation/kobject.txt. Revert the above patch, so the struct is allocated using kzalloc and we have a release function for it that frees the allocated memory, otherwise it is broken. ------------[ cut here ]------------ Device 'cros_ec' does not have a release() function, it is broken and must be fixed. WARNING: CPU: 3 PID: 3675 at drivers/base/core.c:895 device_release+0x80/0x90 Modules linked in: btusb btrtl btintel btbcm bluetooth ... CPU: 3 PID: 3675 Comm: rmmod Not tainted 4.20.0-rc4 #76 Hardware name: Google Kevin (DT) pstate: 40000005 (nZcv daif -PAN -UAO) pc : device_release+0x80/0x90 lr : device_release+0x80/0x90 sp : ffff00000c47bc70 x29: ffff00000c47bc70 x28: ffff8000e86b0d40 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000056000000 x24: 0000000000000015 x23: ffff8000f0bbf860 x22: ffff000000d320a0 x21: ffff8000ee93e100 x20: ffff8000ed931428 x19: ffff8000ed931418 x18: 0000000000000020 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000400 x14: 0000000000000143 x13: 0000000000000000 x12: 0000000000000400 x11: 0000000000000157 x10: 0000000000000960 x9 : ffff00000c47b9b0 x8 : ffff8000e86b1700 x7 : 0000000000000000 x6 : ffff8000f7d520b8 x5 : ffff8000f7d520b8 x4 : 0000000000000000 x3 : ffff8000f7d58e68 x2 : ffff8000e86b0d40 x1 : 37d859939c964800 x0 : 0000000000000000 Call trace: device_release+0x80/0x90 kobject_put+0x74/0xe8 device_unregister+0x20/0x30 ec_device_remove+0x34/0x48 [cros_ec_dev] platform_drv_remove+0x28/0x48 device_release_driver_internal+0x1a8/0x240 driver_detach+0x40/0x80 bus_remove_driver+0x54/0xa8 driver_unregister+0x2c/0x58 platform_driver_unregister+0x10/0x18 cros_ec_dev_exit+0x1c/0x2d8 [cros_ec_dev] __arm64_sys_delete_module+0x16c/0x1f8 el0_svc_common+0x84/0xd8 el0_svc_handler+0x2c/0x80 el0_svc+0x8/0xc ---[ end trace a57c4625f3c60ae8 ]--- Cc: stable@vger.kernel.org Fixes: 3aa2177e4787 ("mfd: cros_ec: Use devm_kzalloc for private data") Signed-off-by: Enric Balletbo i Serra Reviewed-by: Guenter Roeck Reviewed-by: Dmitry Torokhov Signed-off-by: Lee Jones commit 2f2dde6ba89b1ef1fe23c1138131b315d9aa4019 Author: Harry Pan Date: Thu Nov 29 00:40:41 2018 +0800 usb: quirk: add no-LPM quirk on SanDisk Ultra Flair device Some lower volume SanDisk Ultra Flair in 16GB, which the VID:PID is in 0781:5591, will aggressively request LPM of U1/U2 during runtime, when using this thumb drive as the OS installation key we found the device will generate failure during U1 exit path making it dropped from the USB bus, this causes a corrupted installation in system at the end. i.e., [ 166.918296] hub 2-0:1.0: state 7 ports 7 chg 0000 evt 0004 [ 166.918327] usb usb2-port2: link state change [ 166.918337] usb usb2-port2: do warm reset [ 166.970039] usb usb2-port2: not warm reset yet, waiting 50ms [ 167.022040] usb usb2-port2: not warm reset yet, waiting 200ms [ 167.276043] usb usb2-port2: status 02c0, change 0041, 5.0 Gb/s [ 167.276050] usb 2-2: USB disconnect, device number 2 [ 167.276058] usb 2-2: unregistering device [ 167.276060] usb 2-2: unregistering interface 2-2:1.0 [ 167.276170] xhci_hcd 0000:00:15.0: shutdown urb ffffa3c7cc695cc0 ep1in-bulk [ 167.284055] sd 0:0:0:0: [sda] tag#0 FAILED Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK [ 167.284064] sd 0:0:0:0: [sda] tag#0 CDB: Read(10) 28 00 00 33 04 90 00 01 00 00 ... Analyzed the USB trace in the link layer we realized it is because of the 6-ms timer of tRecoveryConfigurationTimeout which documented on the USB 3.2 Revision 1.0, the section 7.5.10.4.2 of "Exit from Recovery.Configuration"; device initiates U1 exit -> Recovery.Active -> Recovery.Configuration, then the host timer timeout makes the link transits to eSS.Inactive -> Rx.Detect follows by a Warm Reset. Interestingly, the other higher volume of SanDisk Ultra Flair sharing the same VID:PID, such as 64GB, would not request LPM during runtime, it sticks at U0 always, thus disabling LPM does not affect those thumb drives at all. The same odd occures in SanDisk Ultra Fit 16GB, VID:PID in 0781:5583. Signed-off-by: Harry Pan Cc: stable Signed-off-by: Greg Kroah-Hartman commit d81bb019d7bb30091e3c796102c00935d6dd7ca9 Author: Alan Stern Date: Wed Nov 28 11:25:58 2018 -0500 USB: Fix invalid-free bug in port_over_current_notify() Syzbot and KASAN found the following invalid-free bug in port_over_current_notify(): -------------------------------------------------------------------------- BUG: KASAN: double-free or invalid-free in port_over_current_notify drivers/usb/core/hub.c:5192 [inline] BUG: KASAN: double-free or invalid-free in port_event drivers/usb/core/hub.c:5241 [inline] BUG: KASAN: double-free or invalid-free in hub_event+0xd97/0x4140 drivers/usb/core/hub.c:5384 CPU: 1 PID: 32710 Comm: kworker/1:3 Not tainted 4.20.0-rc3+ #129 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x244/0x39d lib/dump_stack.c:113 print_address_description.cold.7+0x9/0x1ff mm/kasan/report.c:256 kasan_report_invalid_free+0x64/0xa0 mm/kasan/report.c:336 __kasan_slab_free+0x13a/0x150 mm/kasan/kasan.c:501 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 __cache_free mm/slab.c:3498 [inline] kfree+0xcf/0x230 mm/slab.c:3817 port_over_current_notify drivers/usb/core/hub.c:5192 [inline] port_event drivers/usb/core/hub.c:5241 [inline] hub_event+0xd97/0x4140 drivers/usb/core/hub.c:5384 process_one_work+0xc90/0x1c40 kernel/workqueue.c:2153 worker_thread+0x17f/0x1390 kernel/workqueue.c:2296 kthread+0x35a/0x440 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 -------------------------------------------------------------------------- The problem is caused by use of a static array to store environment-string pointers. When the routine is called by multiple threads concurrently, the pointers from one thread can overwrite those from another. The solution is to use an ordinary automatic array instead of a static array. Signed-off-by: Alan Stern Reported-by: syzbot+98881958e1410ec7e53c@syzkaller.appspotmail.com Cc: stable Signed-off-by: Greg Kroah-Hartman commit d7859905301880ad3e16272399d26900af3ac496 Author: Alexander Theissen Date: Tue Dec 4 23:43:35 2018 +0100 usb: appledisplay: Add 27" Apple Cinema Display Add another Apple Cinema Display to the list of supported displays. Signed-off-by: Alexander Theissen Cc: stable Signed-off-by: Greg Kroah-Hartman commit 87e4a5405f087427fbf8b437d2796283dce2b38f Author: Young Xiao Date: Tue Nov 27 09:12:20 2018 +0000 Revert commit ef9209b642f "staging: rtl8723bs: Fix indenting errors and an off-by-one mistake in core/rtw_mlme_ext.c" pstapriv->max_num_sta is always <= NUM_STA, since max_num_sta is either set in _rtw_init_sta_priv() or rtw_set_beacon(). Fixes: ef9209b642f1 ("staging: rtl8723bs: Fix indenting errors and an off-by-one mistake in core/rtw_mlme_ext.c") Signed-off-by: Young Xiao Reviewed-by: Dan Carpenter Cc: stable Signed-off-by: Greg Kroah-Hartman commit 300cd664865bed5d50ae0a42fb4e3a6f415e8a10 Author: Young Xiao Date: Wed Nov 28 08:06:53 2018 +0000 staging: rtl8712: Fix possible buffer overrun In commit 8b7a13c3f404 ("staging: r8712u: Fix possible buffer overrun") we fix a potential off by one by making the limit smaller. The better fix is to make the buffer larger. This makes it match up with the similar code in other drivers. Fixes: 8b7a13c3f404 ("staging: r8712u: Fix possible buffer overrun") Signed-off-by: Young Xiao Cc: stable Reviewed-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman commit 59861547ec9a9736e7882f6fb0c096a720ff811a Author: Bin Liu Date: Mon Nov 12 09:43:22 2018 -0600 dmaengine: cppi41: delete channel from pending list when stop channel The driver defines three states for a cppi channel. - idle: .chan_busy == 0 && not in .pending list - pending: .chan_busy == 0 && in .pending list - busy: .chan_busy == 1 && not in .pending list There are cases in which the cppi channel could be in the pending state when cppi41_dma_issue_pending() is called after cppi41_runtime_suspend() is called. cppi41_stop_chan() has a bug for these cases to set channels to idle state. It only checks the .chan_busy flag, but not the .pending list, then later when cppi41_runtime_resume() is called the channels in .pending list will be transitioned to busy state. Removing channels from the .pending list solves the problem. Fixes: 975faaeb9985 ("dma: cppi41: start tear down only if channel is busy") Cc: stable@vger.kernel.org # v3.15+ Signed-off-by: Bin Liu Reviewed-by: Peter Ujfalusi Signed-off-by: Vinod Koul commit dae522045094ebfa9a10cf7951a8f79b02da8e15 Author: Baruch Siach Date: Tue Dec 4 17:46:02 2018 +0200 Revert "arm64: dts: marvell: add CPU Idle power state support on Armada 7K/8K" This reverts commit 8ed46368776b3bc93d74c1f8f2bfb9fd8a9ad805. This commit breaks boot on Armada 8K based systems. Reverting it makes affected systems boot again. Reported-by: Sergey Matyukevich Signed-off-by: Baruch Siach Signed-off-by: Gregory CLEMENT commit 64068853bc77786d1a28abb4087d6a3e93aedbe2 Author: Lucas Stach Date: Tue Nov 6 03:40:37 2018 +0000 dmaengine: imx-sdma: use GFP_NOWAIT for dma descriptor allocations DMA buffer descriptors aren't allocated from atomic context, so they can use the less heavyweigth GFP_NOWAIT. Signed-off-by: Lucas Stach Signed-off-by: Robin Gong Cc: stable Signed-off-by: Vinod Koul commit b8603d2a5795c42f78998e70dc792336e0dc20c9 Author: Lucas Stach Date: Tue Nov 6 03:40:33 2018 +0000 dmaengine: imx-sdma: implement channel termination via worker The dmaengine documentation states that device_terminate_all may be asynchronous and need not wait for the active transfers to stop. This allows us to move most of the functionality currently implemented in the sdma channel termination function to run in a worker, outside of any atomic context. Moving this out of atomic context has two benefits: we can now sleep while waiting for the channel to terminate, instead of busy waiting and the freeing of the dma descriptors happens with IRQs enabled, getting rid of a warning in the dma mapping code. As the termination is now async, we need to implement the device_synchronize dma engine function which simply waits for the worker to finish its execution. Signed-off-by: Lucas Stach Signed-off-by: Robin Gong Cc: stable Signed-off-by: Vinod Koul commit ebb853b1bd5f659b92c71dc6a9de44cfc37c78c0 Author: Lucas Stach Date: Tue Nov 6 03:40:28 2018 +0000 Revert "dmaengine: imx-sdma: alloclate bd memory from dma pool" This reverts commit fe5b85c656bc. The SDMA engine needs the descriptors to be contiguous in memory. As the dma pool API is only able to provide a single descriptor per alloc invocation there is no guarantee that multiple descriptors satisfy this requirement. Also the code in question is broken as it only allocates memory for a single descriptor, without looking at the number of descriptors required for the transfer, leading to out-of-bounds accesses when the descriptors are written. Signed-off-by: Lucas Stach Signed-off-by: Robin Gong Cc: stable Signed-off-by: Vinod Koul commit c06abca69218ac42fa58d1ba7a7b0d9bab5f1b18 Author: Lucas Stach Date: Tue Nov 6 03:40:25 2018 +0000 Revert "dmaengine: imx-sdma: Use GFP_NOWAIT for dma allocations" This reverts commit c1199875d327, as this depends on another commit that is going to be reverted. Signed-off-by: Lucas Stach Signed-off-by: Robin Gong Cc: stable Signed-off-by: Vinod Koul commit 25896d073d8a0403b07e6dec56f58e6c33678207 Author: Masahiro Yamada Date: Wed Dec 5 15:27:19 2018 +0900 x86/build: Fix compiler support check for CONFIG_RETPOLINE It is troublesome to add a diagnostic like this to the Makefile parse stage because the top-level Makefile could be parsed with a stale include/config/auto.conf. Once you are hit by the error about non-retpoline compiler, the compilation still breaks even after disabling CONFIG_RETPOLINE. The easiest fix is to move this check to the "archprepare" like this commit did: 829fe4aa9ac1 ("x86: Allow generating user-space headers without a compiler") Reported-by: Meelis Roos Tested-by: Meelis Roos Signed-off-by: Masahiro Yamada Acked-by: Zhenzhong Duan Cc: Borislav Petkov Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Zhenzhong Duan Fixes: 4cd24de3a098 ("x86/retpoline: Make CONFIG_RETPOLINE depend on compiler support") Link: http://lkml.kernel.org/r/1543991239-18476-1-git-send-email-yamada.masahiro@socionext.com Link: https://lkml.org/lkml/2018/12/4/206 Signed-off-by: Ingo Molnar commit 6085c13351ebab4a427215082d11e2f02bd3fb46 Author: Stefan Wahren Date: Sat Nov 10 17:55:27 2018 +0100 thermal: bcm2835: Switch to SPDX identifier Adopt the SPDX license identifier headers to ease license compliance management. Cc: Martin Sperl Signed-off-by: Stefan Wahren Signed-off-by: Eduardo Valentin commit 27359fd6e5f3c5db8fe544b63238b6170e8806d8 Author: Matthew Wilcox Date: Fri Nov 30 11:05:06 2018 -0500 dax: Fix unlock mismatch with updated API Internal to dax_unlock_mapping_entry(), dax_unlock_entry() is used to store a replacement entry in the Xarray at the given xas-index with the DAX_LOCKED bit clear. When called, dax_unlock_entry() expects the unlocked value of the entry relative to the current Xarray state to be specified. In most contexts dax_unlock_entry() is operating in the same scope as the matched dax_lock_entry(). However, in the dax_unlock_mapping_entry() case the implementation needs to recall the original entry. In the case where the original entry is a 'pmd' entry it is possible that the pfn performed to do the lookup is misaligned to the value retrieved in the Xarray. Change the api to return the unlock cookie from dax_lock_page() and pass it to dax_unlock_page(). This fixes a bug where dax_unlock_page() was assuming that the page was PMD-aligned if the entry was a PMD entry with signatures like: WARNING: CPU: 38 PID: 1396 at fs/dax.c:340 dax_insert_entry+0x2b2/0x2d0 RIP: 0010:dax_insert_entry+0x2b2/0x2d0 [..] Call Trace: dax_iomap_pte_fault.isra.41+0x791/0xde0 ext4_dax_huge_fault+0x16f/0x1f0 ? up_read+0x1c/0xa0 __do_fault+0x1f/0x160 __handle_mm_fault+0x1033/0x1490 handle_mm_fault+0x18b/0x3d0 Link: https://lkml.kernel.org/r/20181130154902.GL10377@bombadil.infradead.org Fixes: 9f32d221301c ("dax: Convert dax_lock_mapping_entry to XArray") Reported-by: Dan Williams Signed-off-by: Matthew Wilcox Tested-by: Dan Williams Reviewed-by: Jan Kara Signed-off-by: Dan Williams commit dc6946cbef38f10b9617250fa851e3cc550d9602 Author: Russell King Date: Fri Nov 9 17:01:05 2018 +0000 thermal: armada: fix legacy resource fixup When the armada thermal module is inserted, removed and then reinserted, the system panics as per the messages below. The reason is that "edit" a live resource in the resource tree twice, and end up with it pointing to some other hardware. Editing live resources (resources that are part of the registered resource tree) is not permissible - the resource tree is an ordered set of resources, sorted by start address, and when a new resource is inserted, it is validated that it (a) fits within its parent resource and (b) does not overlap a neighbouring resource. Get rid of this resource editing. We can instead adjust the return value from ioremap() as ioremap() deals with the creation of page- based mappings - provided the adjustment does not cross a page boundary. SError Interrupt on CPU1, code 0xbf000000 -- SError CPU: 1 PID: 2749 Comm: modprobe Not tainted 4.19.0+ #175 Hardware name: Marvell 8040 MACCHIATOBin Double shot (DT) pstate: 20400085 (nzCv daIf +PAN -UAO) pc : regmap_mmio_read+0x3c/0x60 lr : regmap_mmio_read+0x3c/0x60 sp : ffffff800d453900 x29: ffffff800d453900 x28: ffffff800096a1d0 x27: 0000000000000100 x26: ffffff80009696d8 x25: ffffff8000969000 x24: ffffffc13a588918 x23: ffffffc13a9a28a8 x22: ffffff800d4539dc x21: 0000000000000084 x20: ffffff800d4539dc x19: ffffffc13a5d5480 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000030 x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f x9 : 0000000000000000 x8 : ffffffc13a5d5a80 x7 : 0000000000000000 x6 : 000000000000003f x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffffff800851be70 x2 : ffffff800851bd60 x1 : ffffff800d492ff8 x0 : 0000000000000000 Kernel panic - not syncing: Asynchronous SError Interrupt CPU: 1 PID: 2749 Comm: modprobe Not tainted 4.19.0+ #175 Hardware name: Marvell 8040 MACCHIATOBin Double shot (DT) Call trace: dump_backtrace+0x0/0x158 show_stack+0x14/0x1c dump_stack+0x90/0xb0 panic+0x128/0x298 print_tainted+0x0/0xa8 arm64_serror_panic+0x74/0x80 do_serror+0x5c/0xb8 el1_error+0xb4/0x144 regmap_mmio_read+0x3c/0x60 _regmap_bus_reg_read+0x18/0x20 _regmap_read+0x64/0x180 regmap_read+0x44/0x6c armada_ap806_init+0x24/0x5c [armada_thermal] armada_thermal_probe+0x2c8/0x37c [armada_thermal] platform_drv_probe+0x4c/0xb0 really_probe+0x21c/0x2b4 driver_probe_device+0x58/0xfc __driver_attach+0xd4/0xd8 bus_for_each_dev+0x50/0xa0 driver_attach+0x20/0x28 bus_add_driver+0x1c4/0x228 driver_register+0x6c/0x124 __platform_driver_register+0x4c/0x54 armada_thermal_driver_init+0x20/0x1000 [armada_thermal] do_one_initcall+0x30/0x204 do_init_module+0x5c/0x1d4 load_module+0x1a88/0x212c __se_sys_finit_module+0xa0/0xac __arm64_sys_finit_module+0x1c/0x24 el0_svc_common+0x94/0xf0 el0_svc_handler+0x24/0x80 el0_svc+0x8/0x3c0 SMP: stopping secondary CPUs Kernel Offset: disabled CPU features: 0x0,21806000 Memory Limit: none Signed-off-by: Russell King Tested-by: Miquel Raynal Signed-off-by: Eduardo Valentin commit 0fb628f0f250c74b1023edd0ca4a57c8b35b9b2c Author: Baruch Siach Date: Tue Dec 4 16:03:53 2018 +0200 net: mvpp2: fix phylink handling of invalid PHY modes The .validate phylink callback should empty the supported bitmap when the interface mode is invalid. Cc: Maxime Chevallier Cc: Antoine Tenart Reported-by: Russell King Signed-off-by: Baruch Siach Signed-off-by: David S. Miller commit 01b3fd5ac97caffb8e5d5bd85086da33db3b361f Author: Baruch Siach Date: Tue Dec 4 16:03:52 2018 +0200 net: mvpp2: fix detection of 10G SFP modules The mvpp2_phylink_validate() relies on the interface field of phylink_link_state to determine valid link modes. However, when called from phylink_sfp_module_insert() this field in not initialized. The default switch case then excludes 10G link modes. This allows 10G SFP modules that are detected correctly to be configured at max rate of 2.5G. Catch the uninitialized PHY mode case, and allow 10G rates. Fixes: d97c9f4ab000b ("net: mvpp2: 1000baseX support") Cc: Maxime Chevallier Cc: Antoine Tenart Acked-by: Russell King Signed-off-by: Baruch Siach Signed-off-by: David S. Miller commit 70bb27b79adf63ea39e37371d09c823c7a8f93ce Author: Russell King Date: Fri Nov 9 16:44:14 2018 +0000 thermal: armada: fix legacy validity test sense Commit 8c0e64ac4075 ("thermal: armada: get rid of the ->is_valid() pointer") removed the unnecessary indirection through a function pointer, but in doing so, also removed the negation operator too: - if (priv->data->is_valid && !priv->data->is_valid(priv)) { + if (armada_is_valid(priv)) { which results in: armada_thermal f06f808c.thermal: Temperature sensor reading not valid armada_thermal f2400078.thermal: Temperature sensor reading not valid armada_thermal f4400078.thermal: Temperature sensor reading not valid at boot, or whenever the "temp" sysfs file is read. Replace the negation operator. Fixes: 8c0e64ac4075 ("thermal: armada: get rid of the ->is_valid() pointer") Signed-off-by: Russell King Signed-off-by: Eduardo Valentin commit ecb239d96d369c23c33d41708646df646de669f4 Author: Nicolas Saenz Julienne Date: Mon Dec 3 13:21:01 2018 +0100 ethernet: fman: fix wrong of_node_put() in probe function After getting a reference to the platform device's of_node the probe function ends up calling of_find_matching_node() using the node as an argument. The function takes care of decreasing the refcount on it. We are then incorrectly decreasing the refcount on that node again. This patch removes the unwarranted call to of_node_put(). Fixes: 414fd46e7762 ("fsl/fman: Add FMan support") Signed-off-by: Nicolas Saenz Julienne Signed-off-by: David S. Miller commit 688838934c231bb08f46db687e57f6d8bf82709c Author: Eric Dumazet Date: Tue Dec 4 09:40:35 2018 -0800 rtnetlink: ndo_dflt_fdb_dump() only work for ARPHRD_ETHER devices kmsan was able to trigger a kernel-infoleak using a gre device [1] nlmsg_populate_fdb_fill() has a hard coded assumption that dev->addr_len is ETH_ALEN, as normally guaranteed for ARPHRD_ETHER devices. A similar issue was fixed recently in commit da71577545a5 ("rtnetlink: Disallow FDB configuration for non-Ethernet device") [1] BUG: KMSAN: kernel-infoleak in copyout lib/iov_iter.c:143 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x4c0/0x2700 lib/iov_iter.c:576 CPU: 0 PID: 6697 Comm: syz-executor310 Not tainted 4.20.0-rc3+ #95 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x32d/0x480 lib/dump_stack.c:113 kmsan_report+0x12c/0x290 mm/kmsan/kmsan.c:683 kmsan_internal_check_memory+0x32a/0xa50 mm/kmsan/kmsan.c:743 kmsan_copy_to_user+0x78/0xd0 mm/kmsan/kmsan_hooks.c:634 copyout lib/iov_iter.c:143 [inline] _copy_to_iter+0x4c0/0x2700 lib/iov_iter.c:576 copy_to_iter include/linux/uio.h:143 [inline] skb_copy_datagram_iter+0x4e2/0x1070 net/core/datagram.c:431 skb_copy_datagram_msg include/linux/skbuff.h:3316 [inline] netlink_recvmsg+0x6f9/0x19d0 net/netlink/af_netlink.c:1975 sock_recvmsg_nosec net/socket.c:794 [inline] sock_recvmsg+0x1d1/0x230 net/socket.c:801 ___sys_recvmsg+0x444/0xae0 net/socket.c:2278 __sys_recvmsg net/socket.c:2327 [inline] __do_sys_recvmsg net/socket.c:2337 [inline] __se_sys_recvmsg+0x2fa/0x450 net/socket.c:2334 __x64_sys_recvmsg+0x4a/0x70 net/socket.c:2334 do_syscall_64+0xcf/0x110 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 RIP: 0033:0x441119 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db 0a fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fffc7f008a8 EFLAGS: 00000207 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000441119 RDX: 0000000000000040 RSI: 00000000200005c0 RDI: 0000000000000003 RBP: 00000000006cc018 R08: 0000000000000100 R09: 0000000000000100 R10: 0000000000000100 R11: 0000000000000207 R12: 0000000000402080 R13: 0000000000402110 R14: 0000000000000000 R15: 0000000000000000 Uninit was stored to memory at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:246 [inline] kmsan_save_stack mm/kmsan/kmsan.c:261 [inline] kmsan_internal_chain_origin+0x13d/0x240 mm/kmsan/kmsan.c:469 kmsan_memcpy_memmove_metadata+0x1a9/0xf70 mm/kmsan/kmsan.c:344 kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:362 __msan_memcpy+0x61/0x70 mm/kmsan/kmsan_instr.c:162 __nla_put lib/nlattr.c:744 [inline] nla_put+0x20a/0x2d0 lib/nlattr.c:802 nlmsg_populate_fdb_fill+0x444/0x810 net/core/rtnetlink.c:3466 nlmsg_populate_fdb net/core/rtnetlink.c:3775 [inline] ndo_dflt_fdb_dump+0x73a/0x960 net/core/rtnetlink.c:3807 rtnl_fdb_dump+0x1318/0x1cb0 net/core/rtnetlink.c:3979 netlink_dump+0xc79/0x1c90 net/netlink/af_netlink.c:2244 __netlink_dump_start+0x10c4/0x11d0 net/netlink/af_netlink.c:2352 netlink_dump_start include/linux/netlink.h:216 [inline] rtnetlink_rcv_msg+0x141b/0x1540 net/core/rtnetlink.c:4910 netlink_rcv_skb+0x394/0x640 net/netlink/af_netlink.c:2477 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:4965 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline] netlink_unicast+0x1699/0x1740 net/netlink/af_netlink.c:1336 netlink_sendmsg+0x13c7/0x1440 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] ___sys_sendmsg+0xe3b/0x1240 net/socket.c:2116 __sys_sendmsg net/socket.c:2154 [inline] __do_sys_sendmsg net/socket.c:2163 [inline] __se_sys_sendmsg+0x305/0x460 net/socket.c:2161 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2161 do_syscall_64+0xcf/0x110 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:246 [inline] kmsan_internal_poison_shadow+0x6d/0x130 mm/kmsan/kmsan.c:170 kmsan_kmalloc+0xa1/0x100 mm/kmsan/kmsan_hooks.c:186 __kmalloc+0x14c/0x4d0 mm/slub.c:3825 kmalloc include/linux/slab.h:551 [inline] __hw_addr_create_ex net/core/dev_addr_lists.c:34 [inline] __hw_addr_add_ex net/core/dev_addr_lists.c:80 [inline] __dev_mc_add+0x357/0x8a0 net/core/dev_addr_lists.c:670 dev_mc_add+0x6d/0x80 net/core/dev_addr_lists.c:687 ip_mc_filter_add net/ipv4/igmp.c:1128 [inline] igmp_group_added+0x4d4/0xb80 net/ipv4/igmp.c:1311 __ip_mc_inc_group+0xea9/0xf70 net/ipv4/igmp.c:1444 ip_mc_inc_group net/ipv4/igmp.c:1453 [inline] ip_mc_up+0x1c3/0x400 net/ipv4/igmp.c:1775 inetdev_event+0x1d03/0x1d80 net/ipv4/devinet.c:1522 notifier_call_chain kernel/notifier.c:93 [inline] __raw_notifier_call_chain kernel/notifier.c:394 [inline] raw_notifier_call_chain+0x13d/0x240 kernel/notifier.c:401 __dev_notify_flags+0x3da/0x860 net/core/dev.c:1733 dev_change_flags+0x1ac/0x230 net/core/dev.c:7569 do_setlink+0x165f/0x5ea0 net/core/rtnetlink.c:2492 rtnl_newlink+0x2ad7/0x35a0 net/core/rtnetlink.c:3111 rtnetlink_rcv_msg+0x1148/0x1540 net/core/rtnetlink.c:4947 netlink_rcv_skb+0x394/0x640 net/netlink/af_netlink.c:2477 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:4965 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline] netlink_unicast+0x1699/0x1740 net/netlink/af_netlink.c:1336 netlink_sendmsg+0x13c7/0x1440 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] ___sys_sendmsg+0xe3b/0x1240 net/socket.c:2116 __sys_sendmsg net/socket.c:2154 [inline] __do_sys_sendmsg net/socket.c:2163 [inline] __se_sys_sendmsg+0x305/0x460 net/socket.c:2161 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2161 do_syscall_64+0xcf/0x110 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 Bytes 36-37 of 105 are uninitialized Memory access of size 105 starts at ffff88819686c000 Data copied to user address 0000000020000380 Fixes: d83b06036048 ("net: add fdb generic dump routine") Signed-off-by: Eric Dumazet Cc: John Fastabend Cc: Ido Schimmel Cc: David Ahern Reviewed-by: Ido Schimmel Signed-off-by: David S. Miller commit c3b9ab5db11d8098ca7674175f12ab21cdce1bbb Author: Fabio Estevam Date: Fri Nov 30 08:31:29 2018 -0200 ARM: dts: imx7d-pico: Describe the Wifi clock The Wifi chip should be clocked by a 32kHz clock coming from i.MX7D CLKO2 output pin, so describe the pinmux and clock hierarchy in the device tree to allow the Wifi chip to be properly clocked. Managed to successfully test Wifi with such change. Used the standard nvram.txt file provided by TechNexion, which selects an external 32kHz clock for the Wifi chip by default. Fixes: 99a52450c707 ("ARM: dts: imx7d-pico: Add Wifi support") Suggested-by: Arend van Spriel Tested-by: Otavio Salvador Signed-off-by: Fabio Estevam Signed-off-by: Shawn Guo commit ffe81d45322cc3cb140f0db080a4727ea284661e Author: Jens Axboe Date: Tue Dec 4 20:06:48 2018 -0700 blk-mq: fix corruption with direct issue If we attempt a direct issue to a SCSI device, and it returns BUSY, then we queue the request up normally. However, the SCSI layer may have already setup SG tables etc for this particular command. If we later merge with this request, then the old tables are no longer valid. Once we issue the IO, we only read/write the original part of the request, not the new state of it. This causes data corruption, and is most often noticed with the file system complaining about the just read data being invalid: [ 235.934465] EXT4-fs error (device sda1): ext4_iget:4831: inode #7142: comm dpkg-query: bad extra_isize 24937 (inode size 256) because most of it is garbage... This doesn't happen from the normal issue path, as we will simply defer the request to the hardware queue dispatch list if we fail. Once it's on the dispatch list, we never merge with it. Fix this from the direct issue path by flagging the request as REQ_NOMERGE so we don't change the size of it before issue. See also: https://bugzilla.kernel.org/show_bug.cgi?id=201685 Tested-by: Guenter Roeck Fixes: 6ce3dd6eec1 ("blk-mq: issue directly if hw queue isn't busy in case of 'none'") Cc: stable@vger.kernel.org Signed-off-by: Jens Axboe commit c2a3831df6dc164af66d8d86cf356a90c021b86f Author: Nathan Jones Date: Tue Dec 4 10:05:32 2018 +0100 ARM: 8816/1: dma-mapping: fix potential uninitialized return While trying to use the dma_mmap_*() interface, it was noticed that this interface returns strange values when passed an incorrect length. If neither of the if() statements fire then the return value is uninitialized. In the worst case it returns 0 which means the caller will think the function succeeded. Fixes: 1655cf8829d8 ("ARM: dma-mapping: Remove traces of NOMMU code") Signed-off-by: Nathan Jones Reviewed-by: Robin Murphy Acked-by: Vladimir Murzin Signed-off-by: Russell King commit 3d0358d0ba048c5afb1385787aaec8fa5ad78fcc Author: Vladimir Murzin Date: Fri Nov 23 12:25:21 2018 +0100 ARM: 8815/1: V7M: align v7m_dma_inv_range() with v7 counterpart Chris has discovered and reported that v7_dma_inv_range() may corrupt memory if address range is not aligned to cache line size. Since the whole cache-v7m.S was lifted form cache-v7.S the same observation applies to v7m_dma_inv_range(). So the fix just mirrors what has been done for v7 with a little specific of M-class. Cc: Chris Cole Signed-off-by: Vladimir Murzin Signed-off-by: Russell King commit a1208f6a822ac29933e772ef1f637c5d67838da9 Author: Chris Cole Date: Fri Nov 23 12:20:45 2018 +0100 ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address handling This patch addresses possible memory corruption when v7_dma_inv_range(start_address, end_address) address parameters are not aligned to whole cache lines. This function issues "invalidate" cache management operations to all cache lines from start_address (inclusive) to end_address (exclusive). When start_address and/or end_address are not aligned, the start and/or end cache lines are first issued "clean & invalidate" operation. The assumption is this is done to ensure that any dirty data addresses outside the address range (but part of the first or last cache lines) are cleaned/flushed so that data is not lost, which could happen if just an invalidate is issued. The problem is that these first/last partial cache lines are issued "clean & invalidate" and then "invalidate". This second "invalidate" is not required and worse can cause "lost" writes to addresses outside the address range but part of the cache line. If another component writes to its part of the cache line between the "clean & invalidate" and "invalidate" operations, the write can get lost. This fix is to remove the extra "invalidate" operation when unaligned addressed are used. A kernel module is available that has a stress test to reproduce the issue and a unit test of the updated v7_dma_inv_range(). It can be downloaded from http://ftp.sageembedded.com/outgoing/linux/cache-test-20181107.tgz. v7_dma_inv_range() is call by dmac_[un]map_area(addr, len, direction) when the direction is DMA_FROM_DEVICE. One can (I believe) successfully argue that DMA from a device to main memory should use buffers aligned to cache line size, because the "clean & invalidate" might overwrite data that the device just wrote using DMA. But if a driver does use unaligned buffers, at least this fix will prevent memory corruption outside the buffer. Signed-off-by: Chris Cole Signed-off-by: Russell King commit 090afc1e40f411144e112431da279bafe7e734ff Author: Nicholas Kazlauskas Date: Fri Jul 20 10:17:29 2018 -0400 drm/amd/display: Fix overflow/truncation from strncpy. [Why] New GCC warnings for stringop-truncation and stringop-overflow help catch common misuse of strncpy. This patch suppresses these warnings by fixing bugs identified by them. [How] Since the parameter passed for name in amdpgu_dm_create_common_mode has no fixed length, if the string is >= DRM_DISPLAY_MODE_LEN then mode->name will not be null-terminated. The truncation in fill_audio_info won't actually occur (and the string will be null-terminated since the buffer is initialized to zero), but the warning can be suppressed by using the proper buffer size. This patch fixes both issues by using the real size for the buffer and making use of strscpy (which always terminates). Signed-off-by: Nicholas Kazlauskas Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit 1b3b27b2a1044457d7dbf1b13bfdbd9a0c1c1108 Author: tianci yin Date: Tue Dec 4 16:07:18 2018 +0800 drm/amd/powerplay: improve OD code robustness add protection code to avoid lower frequency trigger over drive. Reviewed-by: Rex Zhu Signed-off-by: Tianci Yin Signed-off-by: Alex Deucher commit 4944af670bc2c7da77ac17b295656d913e3898f4 Author: wentalou Date: Mon Dec 3 10:49:50 2018 +0800 drm/amdgpu: enlarge maximum waiting time of KIQ KIQ in VF’s init delayed by another VF’s reset, which would cause late_init failed occasionally. MAX_KIQ_REG_TRY enlarged from 20 to 80 would fix this issue. Reviewed-by: Christian König Signed-off-by: Wentao Lou Signed-off-by: Alex Deucher commit 8f67b5adc030553fbc877124306f3f3bdab89aa8 Author: Darrick J. Wong Date: Sun Dec 2 08:38:07 2018 -0800 iomap: partially revert 4721a601099 (simulated directio short read on EFAULT) In commit 4721a601099, we tried to fix a problem wherein directio reads into a splice pipe will bounce EFAULT/EAGAIN all the way out to userspace by simulating a zero-byte short read. This happens because some directio read implementations (xfs) will call bio_iov_iter_get_pages to grab pipe buffer pages and issue asynchronous reads, but as soon as we run out of pipe buffers that _get_pages call returns EFAULT, which the splice code translates to EAGAIN and bounces out to userspace. In that commit, the iomap code catches the EFAULT and simulates a zero-byte read, but that causes assertion errors on regular splice reads because xfs doesn't allow short directio reads. This causes infinite splice() loops and assertion failures on generic/095 on overlayfs because xfs only permit total success or total failure of a directio operation. The underlying issue in the pipe splice code has now been fixed by changing the pipe splice loop to avoid avoid reading more data than there is space in the pipe. Therefore, it's no longer necessary to simulate the short directio, so remove the hack from iomap. Fixes: 4721a601099 ("iomap: dio data corruption and spurious errors when pipes fill") Reported-by: Murphy Zhou Ranted-by: Amir Goldstein Reviewed-by: Christoph Hellwig Signed-off-by: Darrick J. Wong commit a517af52cb57f972cee2378765e1c5dd10141f0d Merge: adac0753c252 1e8249b8a4e9 Author: Linus Torvalds Date: Tue Dec 4 09:10:39 2018 -0800 Merge branch 'parisc-4.20-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fix from Helge Deller: "On parisc, use -ffunction-sections compiler option when building 32-bit kernel modules to avoid sysfs-warnings when loading such modules. This got broken with kernel v4.18" * 'parisc-4.20-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Enable -ffunction-sections for modules on 32-bit kernel commit 17614445576b6af24e9cf36607c6448164719c96 Author: Darrick J. Wong Date: Fri Nov 30 10:37:49 2018 -0800 splice: don't read more than available pipe space In commit 4721a601099, we tried to fix a problem wherein directio reads into a splice pipe will bounce EFAULT/EAGAIN all the way out to userspace by simulating a zero-byte short read. This happens because some directio read implementations (xfs) will call bio_iov_iter_get_pages to grab pipe buffer pages and issue asynchronous reads, but as soon as we run out of pipe buffers that _get_pages call returns EFAULT, which the splice code translates to EAGAIN and bounces out to userspace. In that commit, the iomap code catches the EFAULT and simulates a zero-byte read, but that causes assertion errors on regular splice reads because xfs doesn't allow short directio reads. The brokenness is compounded by splice_direct_to_actor immediately bailing on do_splice_to returning <= 0 without ever calling ->actor (which empties out the pipe), so if userspace calls back we'll EFAULT again on the full pipe, and nothing ever gets copied. Therefore, teach splice_direct_to_actor to clamp its requests to the amount of free space in the pipe and remove the simulated short read from the iomap directio code. Fixes: 4721a601099 ("iomap: dio data corruption and spurious errors when pipes fill") Reported-by: Murphy Zhou Ranted-by: Amir Goldstein Reviewed-by: Christoph Hellwig Signed-off-by: Darrick J. Wong commit 6744557b53a2b710ebce3736a5c27a0119685fcc Author: Darrick J. Wong Date: Fri Nov 30 12:32:38 2018 -0800 vfs: allow some remap flags to be passed to vfs_clone_file_range In overlayfs, ovl_remap_file_range calls vfs_clone_file_range on the lower filesystem's inode, passing through whatever remap flags it got from its caller. Since vfs_copy_file_range first tries a filesystem's remap function with REMAP_FILE_CAN_SHORTEN, this can get passed through to the second vfs_copy_file_range call, and this isn't an issue. Change the WARN_ON to look only for the DEDUP flag. Signed-off-by: Darrick J. Wong Reviewed-by: Amir Goldstein Reviewed-by: Christoph Hellwig commit 7d048df4e9b05ba89b74d062df59498aa81f3785 Author: Eric Sandeen Date: Fri Nov 30 07:55:57 2018 -0800 xfs: fix inverted return from xfs_btree_sblock_verify_crc xfs_btree_sblock_verify_crc is a bool so should not be returning a failaddr_t; worse, if xfs_log_check_lsn fails it returns __this_address which looks like a boolean true (i.e. success) to the caller. (interestingly xfs_btree_lblock_verify_crc doesn't have the issue) Signed-off-by: Eric Sandeen Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit a579121f94aba4e8bad1a121a0fad050d6925296 Author: Darrick J. Wong Date: Tue Nov 27 11:01:43 2018 -0800 xfs: fix PAGE_MASK usage in xfs_free_file_space In commit e53c4b598, I *tried* to teach xfs to force writeback when we fzero/fpunch right up to EOF so that if EOF is in the middle of a page, the post-EOF part of the page gets zeroed before we return to userspace. Unfortunately, I missed the part where PAGE_MASK is ~(PAGE_SIZE - 1), which means that we totally fail to zero if we're fpunching and EOF is within the first page. Worse yet, the same PAGE_MASK thinko plagues the filemap_write_and_wait_range call, so we'd initiate writeback of the entire file, which (mostly) masked the thinko. Drop the tricky PAGE_MASK and replace it with correct usage of PAGE_SIZE and the proper rounding macros. Fixes: e53c4b598 ("xfs: ensure post-EOF zeroing happens after zeroing part of a file") Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Reviewed-by: Christoph Hellwig commit 7b566f70e1bf65b189b66eb3de6f431c30f7dff2 Author: David S. Miller Date: Tue Dec 4 08:47:44 2018 -0800 phy: Revert toggling reset changes. This reverts: ef1b5bf506b1 ("net: phy: Fix not to call phy_resume() if PHY is not attached") 8c85f4b81296 ("net: phy: micrel: add toggling phy reset if PHY is not attached") Andrew Lunn informs me that there are alternative efforts underway to fix this more properly. Signed-off-by: David S. Miller commit adac0753c25217a2365b132c87cb2540b51fa89b Merge: 0072a0c14d5b 6c3516fed7b6 Author: Linus Torvalds Date: Tue Dec 4 08:47:04 2018 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: "Mostly new IDs for Elan/Synaptics touchpads, plus a few small fixups" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: omap-keypad - fix keyboard debounce configuration Input: xpad - quirk all PDP Xbox One gamepads Input: synaptics - enable SMBus for HP 15-ay000 Input: synaptics - add PNP ID for ThinkPad P50 to SMBus Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15ARR Input: elan_i2c - add support for ELAN0621 touchpad Input: hyper-v - fix wakeup from suspend-to-idle Input: atkbd - clean up indentation issue Input: st1232 - convert to SPDX identifiers Input: migor_ts - convert to SPDX identifiers Input: dt-bindings - fix a typo in file input-reset.txt Input: cros_ec_keyb - fix button/switch capability reports Input: elan_i2c - add ELAN0620 to the ACPI table Input: matrix_keypad - check for errors from of_get_named_gpio() commit a92a72a24d48080f6c49bb514c082fbb1e5bf8fc Merge: 025dceb0fab3 ceefbc96fa5c Author: Daniel Borkmann Date: Tue Dec 4 17:22:02 2018 +0100 Merge branch 'bpf-verifier-resilience' Alexei Starovoitov says: ==================== Three patches to improve verifier ability to handle pathological bpf programs with a lot of branches: - make sure prog_load syscall can be aborted - improve branch taken analysis - introduce per-insn complexity limit for unprivileged programs ==================== Signed-off-by: Daniel Borkmann commit ceefbc96fa5c5b975d87bf8e89ba8416f6b764d9 Author: Alexei Starovoitov Date: Mon Dec 3 22:46:06 2018 -0800 bpf: add per-insn complexity limit malicious bpf program may try to force the verifier to remember a lot of distinct verifier states. Put a limit to number of per-insn 'struct bpf_verifier_state'. Note that hitting the limit doesn't reject the program. It potentially makes the verifier do more steps to analyze the program. It means that malicious programs will hit BPF_COMPLEXITY_LIMIT_INSNS sooner instead of spending cpu time walking long link list. The limit of BPF_COMPLEXITY_LIMIT_STATES==64 affects cilium progs with slight increase in number of "steps" it takes to successfully verify the programs: before after bpf_lb-DLB_L3.o 1940 1940 bpf_lb-DLB_L4.o 3089 3089 bpf_lb-DUNKNOWN.o 1065 1065 bpf_lxc-DDROP_ALL.o 28052 | 28162 bpf_lxc-DUNKNOWN.o 35487 | 35541 bpf_netdev.o 10864 10864 bpf_overlay.o 6643 6643 bpf_lcx_jit.o 38437 38437 But it also makes malicious program to be rejected in 0.4 seconds vs 6.5 Hence apply this limit to unprivileged programs only. Signed-off-by: Alexei Starovoitov Acked-by: Daniel Borkmann Acked-by: Edward Cree Signed-off-by: Daniel Borkmann commit 4f7b3e82589e0de723780198ec7983e427144c0a Author: Alexei Starovoitov Date: Mon Dec 3 22:46:05 2018 -0800 bpf: improve verifier branch analysis pathological bpf programs may try to force verifier to explode in the number of branch states: 20: (d5) if r1 s<= 0x24000028 goto pc+0 21: (b5) if r0 <= 0xe1fa20 goto pc+2 22: (d5) if r1 s<= 0x7e goto pc+0 23: (b5) if r0 <= 0xe880e000 goto pc+0 24: (c5) if r0 s< 0x2100ecf4 goto pc+0 25: (d5) if r1 s<= 0xe880e000 goto pc+1 26: (c5) if r0 s< 0xf4041810 goto pc+0 27: (d5) if r1 s<= 0x1e007e goto pc+0 28: (b5) if r0 <= 0xe86be000 goto pc+0 29: (07) r0 += 16614 30: (c5) if r0 s< 0x6d0020da goto pc+0 31: (35) if r0 >= 0x2100ecf4 goto pc+0 Teach verifier to recognize always taken and always not taken branches. This analysis is already done for == and != comparison. Expand it to all other branches. It also helps real bpf programs to be verified faster: before after bpf_lb-DLB_L3.o 2003 1940 bpf_lb-DLB_L4.o 3173 3089 bpf_lb-DUNKNOWN.o 1080 1065 bpf_lxc-DDROP_ALL.o 29584 28052 bpf_lxc-DUNKNOWN.o 36916 35487 bpf_netdev.o 11188 10864 bpf_overlay.o 6679 6643 bpf_lcx_jit.o 39555 38437 Reported-by: Anatoly Trosinenko Signed-off-by: Alexei Starovoitov Acked-by: Daniel Borkmann Acked-by: Edward Cree Signed-off-by: Daniel Borkmann commit c3494801cd1785e2c25f1a5735fa19ddcf9665da Author: Alexei Starovoitov Date: Mon Dec 3 22:46:04 2018 -0800 bpf: check pending signals while verifying programs Malicious user space may try to force the verifier to use as much cpu time and memory as possible. Hence check for pending signals while verifying the program. Note that suspend of sys_bpf(PROG_LOAD) syscall will lead to EAGAIN, since the kernel has to release the resources used for program verification. Reported-by: Anatoly Trosinenko Signed-off-by: Alexei Starovoitov Acked-by: Daniel Borkmann Acked-by: Edward Cree Signed-off-by: Daniel Borkmann commit a72173ecfc6774cf2d55de9fb29421ce69e3428c Author: Rafael J. Wysocki Date: Mon Dec 3 13:04:18 2018 +0100 Revert "exec: make de_thread() freezable" Revert commit c22397888f1e "exec: make de_thread() freezable" as requested by Ingo Molnar: "So there's a new regression in v4.20-rc4, my desktop produces this lockdep splat: [ 1772.588771] WARNING: pkexec/4633 still has locks held! [ 1772.588773] 4.20.0-rc4-custom-00213-g93a49841322b #1 Not tainted [ 1772.588775] ------------------------------------ [ 1772.588776] 1 lock held by pkexec/4633: [ 1772.588778] #0: 00000000ed85fbf8 (&sig->cred_guard_mutex){+.+.}, at: prepare_bprm_creds+0x2a/0x70 [ 1772.588786] stack backtrace: [ 1772.588789] CPU: 7 PID: 4633 Comm: pkexec Not tainted 4.20.0-rc4-custom-00213-g93a49841322b #1 [ 1772.588792] Call Trace: [ 1772.588800] dump_stack+0x85/0xcb [ 1772.588803] flush_old_exec+0x116/0x890 [ 1772.588807] ? load_elf_phdrs+0x72/0xb0 [ 1772.588809] load_elf_binary+0x291/0x1620 [ 1772.588815] ? sched_clock+0x5/0x10 [ 1772.588817] ? search_binary_handler+0x6d/0x240 [ 1772.588820] search_binary_handler+0x80/0x240 [ 1772.588823] load_script+0x201/0x220 [ 1772.588825] search_binary_handler+0x80/0x240 [ 1772.588828] __do_execve_file.isra.32+0x7d2/0xa60 [ 1772.588832] ? strncpy_from_user+0x40/0x180 [ 1772.588835] __x64_sys_execve+0x34/0x40 [ 1772.588838] do_syscall_64+0x60/0x1c0 The warning gets triggered by an ancient lockdep check in the freezer: (gdb) list *0xffffffff812ece06 0xffffffff812ece06 is in flush_old_exec (./include/linux/freezer.h:57). 52 * DO NOT ADD ANY NEW CALLERS OF THIS FUNCTION 53 * If try_to_freeze causes a lockdep warning it means the caller may deadlock 54 */ 55 static inline bool try_to_freeze_unsafe(void) 56 { 57 might_sleep(); 58 if (likely(!freezing(current))) 59 return false; 60 return __refrigerator(false); 61 } I reviewed the ->cred_guard_mutex code, and the mutex is held across all of exec() - and we always did this. But there's this recent -rc4 commit: > Chanho Min (1): > exec: make de_thread() freezable c22397888f1e: exec: make de_thread() freezable I believe this commit is bogus, you cannot call try_to_freeze() from de_thread(), because it's holding the ->cred_guard_mutex." Reported-by: Ingo Molnar Tested-by: Ingo Molnar Signed-off-by: Rafael J. Wysocki commit 10950929e994c5ecee149ff0873388d3c98f12b5 Author: Qu Wenruo Date: Fri Nov 23 09:06:36 2018 +0800 btrfs: tree-checker: Don't check max block group size as current max chunk size limit is unreliable [BUG] A completely valid btrfs will refuse to mount, with error message like: BTRFS critical (device sdb2): corrupt leaf: root=2 block=239681536 slot=172 \ bg_start=12018974720 bg_len=10888413184, invalid block group size, \ have 10888413184 expect (0, 10737418240] This has been reported several times as the 4.19 kernel is now being used. The filesystem refuses to mount, but is otherwise ok and booting 4.18 is a workaround. Btrfs check returns no error, and all kernels used on this fs is later than 2011, which should all have the 10G size limit commit. [CAUSE] For a 12 devices btrfs, we could allocate a chunk larger than 10G due to stripe stripe bump up. __btrfs_alloc_chunk() |- max_stripe_size = 1G |- max_chunk_size = 10G |- data_stripe = 11 |- if (1G * 11 > 10G) { stripe_size = 976128930; stripe_size = round_up(976128930, SZ_16M) = 989855744 However the final stripe_size (989855744) * 11 = 10888413184, which is still larger than 10G. [FIX] For the comprehensive check, we need to do the full check at chunk read time, and rely on bg <-> chunk mapping to do the check. We could just skip the length check for now. Fixes: fce466eab7ac ("btrfs: tree-checker: Verify block_group_item") Cc: stable@vger.kernel.org # v4.19+ Reported-by: Wang Yugui Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit e8cde625bfe8a714a856e1366bcbb259d7346095 Author: Aaro Koskinen Date: Tue Nov 20 01:14:00 2018 +0200 MMC: OMAP: fix broken MMC on OMAP15XX/OMAP5910/OMAP310 Since v2.6.22 or so there has been reports [1] about OMAP MMC being broken on OMAP15XX based hardware (OMAP5910 and OMAP310). The breakage seems to have been caused by commit 46a6730e3ff9 ("mmc-omap: Fix omap to use MMC_POWER_ON") that changed clock enabling to be done on MMC_POWER_ON. This can happen multiple times in a row, and on 15XX the hardware doesn't seem to like it and the MMC just stops responding. Fix by memorizing the power mode and do the init only when necessary. Before the patch (on Palm TE): mmc0: new SD card at address b368 mmcblk0: mmc0:b368 SDC 977 MiB mmci-omap mmci-omap.0: command timeout (CMD18) mmci-omap mmci-omap.0: command timeout (CMD13) mmci-omap mmci-omap.0: command timeout (CMD13) mmci-omap mmci-omap.0: command timeout (CMD12) [x 6] mmci-omap mmci-omap.0: command timeout (CMD13) [x 6] mmcblk0: error -110 requesting status mmci-omap mmci-omap.0: command timeout (CMD8) mmci-omap mmci-omap.0: command timeout (CMD18) mmci-omap mmci-omap.0: command timeout (CMD13) mmci-omap mmci-omap.0: command timeout (CMD13) mmci-omap mmci-omap.0: command timeout (CMD12) [x 6] mmci-omap mmci-omap.0: command timeout (CMD13) [x 6] mmcblk0: error -110 requesting status mmcblk0: recovery failed! print_req_error: I/O error, dev mmcblk0, sector 0 Buffer I/O error on dev mmcblk0, logical block 0, async page read mmcblk0: unable to read partition table After the patch: mmc0: new SD card at address b368 mmcblk0: mmc0:b368 SDC 977 MiB mmcblk0: p1 The patch is based on a fix and analysis done by Ladislav Michl. Tested on OMAP15XX/OMAP310 (Palm TE), OMAP1710 (Nokia 770) and OMAP2420 (Nokia N810). [1] https://marc.info/?t=123175197000003&r=1&w=2 Fixes: 46a6730e3ff9 ("mmc-omap: Fix omap to use MMC_POWER_ON") Reported-by: Ladislav Michl Reported-by: Andrzej Zaborowski Tested-by: Ladislav Michl Acked-by: Tony Lindgren Signed-off-by: Aaro Koskinen Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit b31a3ca745a4a47ba63208d37cd50abffe58280f Author: Wei Yongjun Date: Tue Dec 4 06:32:15 2018 +0000 drm/fb-helper: Fix typo in parameter description Fix typo in parameter description. Fixes: 4be9bd10e22d ("drm/fb_helper: Allow leaking fbdev smem_start") Signed-off-by: Wei Yongjun Acked-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/1543905135-35293-1-git-send-email-weiyongjun1@huawei.com commit ec7ba118b9407c9b4d998b8065167afae5ed04be Author: Miklos Szeredi Date: Tue Dec 4 11:31:30 2018 +0100 Revert "ovl: relax permission checking on underlying layers" This reverts commit 007ea44892e6fa963a0876a979e34890325c64eb. The commit broke some selinux-testsuite cases, and it looks like there's no straightforward fix keeping the direction of this patch, so revert for now. The original patch was trying to fix the consistency of permission checks, and not an observed bug. So reverting should be safe. Signed-off-by: Miklos Szeredi commit a44f7cb937321d4961bfc8f28912126b06e701c5 Author: Wolfram Sang Date: Mon Nov 26 14:38:13 2018 +0100 mmc: core: use mrq->sbc when sending CMD23 for RPMB When sending out CMD23 in the blk preparation, the comment there rightfully says: * However, it is not sufficient to just send CMD23, * and avoid the final CMD12, as on an error condition * CMD12 (stop) needs to be sent anyway. This, coupled * with Auto-CMD23 enhancements provided by some * hosts, means that the complexity of dealing * with this is best left to the host. If CMD23 is * supported by card and host, we'll fill sbc in and let * the host deal with handling it correctly. Let's do this behaviour for RPMB as well, and not send CMD23 independently. Otherwise IP cores (like Renesas SDHI) may timeout because of automatic CMD23/CMD12 handling. Reported-by: Masaharu Hayakawa Signed-off-by: Wolfram Sang Tested-by: Clément Péron Reviewed-by: Avri Altman Reviewed-by: Niklas Söderlund Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 43a1b0cb4cd6dbfd3cd9c10da663368394d299d8 Author: Masami Hiramatsu Date: Fri Aug 24 02:16:12 2018 +0900 kprobes/x86: Fix instruction patching corruption when copying more than one RIP-relative instruction After copy_optimized_instructions() copies several instructions to the working buffer it tries to fix up the real RIP address, but it adjusts the RIP-relative instruction with an incorrect RIP address for the 2nd and subsequent instructions due to a bug in the logic. This will break the kernel pretty badly (with likely outcomes such as a kernel freeze, a crash, or worse) because probed instructions can refer to the wrong data. For example putting kprobes on cpumask_next() typically hits this bug. cpumask_next() is normally like below if CONFIG_CPUMASK_OFFSTACK=y (in this case nr_cpumask_bits is an alias of nr_cpu_ids): : 48 89 f0 mov %rsi,%rax 8b 35 7b fb e2 00 mov 0xe2fb7b(%rip),%esi # ffffffff82db9e64 55 push %rbp ... If we put a kprobe on it and it gets jump-optimized, it gets patched by the kprobes code like this: : e9 95 7d 07 1e jmpq 0xffffffffa000207a 7b fb jnp 0xffffffff81f8a2e2 e2 00 loop 0xffffffff81f8a2e9 55 push %rbp This shows that the first two MOV instructions were copied to a trampoline buffer at 0xffffffffa000207a. Here is the disassembled result of the trampoline, skipping the optprobe template instructions: # Dump of assembly code from 0xffffffffa000207a to 0xffffffffa00020ea: 54 push %rsp ... 48 83 c4 08 add $0x8,%rsp 9d popfq 48 89 f0 mov %rsi,%rax 8b 35 82 7d db e2 mov -0x1d24827e(%rip),%esi # 0xffffffff82db9e67 This dump shows that the second MOV accesses *(nr_cpu_ids+3) instead of the original *nr_cpu_ids. This leads to a kernel freeze because cpumask_next() always returns 0 and for_each_cpu() never ends. Fix this by adding 'len' correctly to the real RIP address while copying. [ mingo: Improved the changelog. ] Reported-by: Michael Rodin Signed-off-by: Masami Hiramatsu Reviewed-by: Steven Rostedt (VMware) Cc: Arnaldo Carvalho de Melo Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Steven Rostedt Cc: Thomas Gleixner Cc: stable@vger.kernel.org # v4.15+ Fixes: 63fef14fc98a ("kprobes/x86: Make insn buffer always ROX and use text_poke()") Link: http://lkml.kernel.org/r/153504457253.22602.1314289671019919596.stgit@devbox Signed-off-by: Ingo Molnar commit 4c05ec47384ab3627b62814e8f886e90cc38ce15 Author: Taehee Yoo Date: Mon Nov 26 20:03:30 2018 +0900 netfilter: nf_tables: fix suspicious RCU usage in nft_chain_stats_replace() basechain->stats is rcu protected data which is updated from nft_chain_stats_replace(). This function is executed from the commit phase which holds the pernet nf_tables commit mutex - not the global nfnetlink subsystem mutex. Test commands to reproduce the problem are: %iptables-nft -I INPUT %iptables-nft -Z %iptables-nft -Z This patch uses RCU calls to handle basechain->stats updates to fix a splat that looks like: [89279.358755] ============================= [89279.363656] WARNING: suspicious RCU usage [89279.368458] 4.20.0-rc2+ #44 Tainted: G W L [89279.374661] ----------------------------- [89279.379542] net/netfilter/nf_tables_api.c:1404 suspicious rcu_dereference_protected() usage! [...] [89279.406556] 1 lock held by iptables-nft/5225: [89279.411728] #0: 00000000bf45a000 (&net->nft.commit_mutex){+.+.}, at: nf_tables_valid_genid+0x1f/0x70 [nf_tables] [89279.424022] stack backtrace: [89279.429236] CPU: 0 PID: 5225 Comm: iptables-nft Tainted: G W L 4.20.0-rc2+ #44 [89279.430135] Call Trace: [89279.430135] dump_stack+0xc9/0x16b [89279.430135] ? show_regs_print_info+0x5/0x5 [89279.430135] ? lockdep_rcu_suspicious+0x117/0x160 [89279.430135] nft_chain_commit_update+0x4ea/0x640 [nf_tables] [89279.430135] ? sched_clock_local+0xd4/0x140 [89279.430135] ? check_flags.part.35+0x440/0x440 [89279.430135] ? __rhashtable_remove_fast.constprop.67+0xec0/0xec0 [nf_tables] [89279.430135] ? sched_clock_cpu+0x126/0x170 [89279.430135] ? find_held_lock+0x39/0x1c0 [89279.430135] ? hlock_class+0x140/0x140 [89279.430135] ? is_bpf_text_address+0x5/0xf0 [89279.430135] ? check_flags.part.35+0x440/0x440 [89279.430135] ? __lock_is_held+0xb4/0x140 [89279.430135] nf_tables_commit+0x2555/0x39c0 [nf_tables] Fixes: f102d66b335a4 ("netfilter: nf_tables: use dedicated mutex to guard transactions") Signed-off-by: Taehee Yoo Signed-off-by: Pablo Neira Ayuso commit a2c741dfe7db0f628b7b3d98074ebb546ff0a137 Merge: bf29e9e9b6d2 1b603f9e4313 Author: David S. Miller Date: Mon Dec 3 16:16:23 2018 -0800 Merge branch 'mlx4-fixes' Tariq Toukan says: ==================== mlx4 fixes for 4.20-rc This patchset includes small fixes for the mlx4_en driver. First patch by Eran fixes the value used to init the netdevice's min_mtu field. Please queue it to -stable >= v4.10. Second patch by Saeed adds missing Kconfig build dependencies. Series generated against net commit: 35b827b6d061 tun: forbid iface creation with rtnl ops ==================== Signed-off-by: David S. Miller commit 1b603f9e4313348608f256b564ed6e3d9e67f377 Author: Saeed Mahameed Date: Sun Dec 2 14:34:37 2018 +0200 net/mlx4_en: Fix build break when CONFIG_INET is off MLX4_EN depends on NETDEVICES, ETHERNET and INET Kconfigs. Make sure they are listed in MLX4_EN Kconfig dependencies. This fixes the following build break: drivers/net/ethernet/mellanox/mlx4/en_rx.c:582:18: warning: ‘struct iphdr’ declared inside parameter list [enabled by default] struct iphdr *iph) ^ drivers/net/ethernet/mellanox/mlx4/en_rx.c:582:18: warning: its scope is only this definition or declaration, which is probably not what you want [enabled by default] drivers/net/ethernet/mellanox/mlx4/en_rx.c: In function ‘get_fixed_ipv4_csum’: drivers/net/ethernet/mellanox/mlx4/en_rx.c:586:20: error: dereferencing pointer to incomplete type _u8 ipproto = iph->protocol; Signed-off-by: Saeed Mahameed Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller commit 24be19e47779d604d1492c114459dca9a92acf78 Author: Eran Ben Elisha Date: Sun Dec 2 14:34:36 2018 +0200 net/mlx4_en: Change min MTU size to ETH_MIN_MTU NIC driver minimal MTU size shall be set to ETH_MIN_MTU, as defined in the RFC791 and in the network stack. Remove old mlx4_en only define for it, which was set to wrong value. Fixes: b80f71f5816f ("ethernet/mellanox: use core min/max MTU checking") Signed-off-by: Eran Ben Elisha Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller commit bf29e9e9b6d2f09cdbf39b48d028f0b49e944f85 Author: Qian Cai Date: Sat Dec 1 21:11:19 2018 -0500 net/core: tidy up an error message netif_napi_add() could report an error like this below due to it allows to pass a format string for wildcarding before calling dev_get_valid_name(), "netif_napi_add() called with weight 256 on device eth%d" For example, hns_enet_drv module does this. hns_nic_try_get_ae hns_nic_init_ring_data netif_napi_add register_netdev dev_get_valid_name Hence, make it a bit more human-readable by using netdev_err_once() instead. Signed-off-by: Qian Cai Signed-off-by: David S. Miller commit b07b864ee4232b03125992a8f6a490b040adcb6a Author: Bjorn Helgaas Date: Mon Dec 3 18:05:17 2018 -0600 Revert "PCI/ASPM: Do not initialize link state when aspm_disabled is set" This reverts commit 17c91487364fb33797ed84022564ee7544ac4945. Rafael found that this commit broke the SD card reader in his Acer Aspire S5. Details of the problem are in the bugzilla below. Fixes: 17c91487364f ("PCI/ASPM: Do not initialize link state when aspm_disabled is set") Link: https://bugzilla.kernel.org/show_bug.cgi?id=201801 Signed-off-by: Bjorn Helgaas commit a74515604a7b171f2702bdcbd1e231225fb456d0 Author: Anderson Luiz Alves Date: Fri Nov 30 21:58:36 2018 -0200 mv88e6060: disable hardware level MAC learning Disable hardware level MAC learning because it breaks station roaming. When enabled it drops all frames that arrive from a MAC address that is on a different port at learning table. Signed-off-by: Anderson Luiz Alves Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 59f997b088d26a774958cb7b17b0763cd82de7ec Author: Matteo Croce Date: Sat Dec 1 00:26:27 2018 +0100 macvlan: return correct error value A MAC address must be unique among all the macvlan devices with the same lower device. The only exception is the passthru [sic] mode, which shares the lower device address. When duplicate addresses are detected, EBUSY is returned when bringing the interface up: # ip link add macvlan0 link eth0 type macvlan # read addr Signed-off-by: David S. Miller commit fb6df5a6234c38a9c551559506a49a677ac6f07a Author: Xin Long Date: Sat Dec 1 01:36:59 2018 +0800 sctp: kfree_rcu asoc In sctp_hash_transport/sctp_epaddr_lookup_transport, it dereferences a transport's asoc under rcu_read_lock while asoc is freed not after a grace period, which leads to a use-after-free panic. This patch fixes it by calling kfree_rcu to make asoc be freed after a grace period. Note that only the asoc's memory is delayed to free in the patch, it won't cause sk to linger longer. Thanks Neil and Marcelo to make this clear. Fixes: 7fda702f9315 ("sctp: use new rhlist interface on sctp transport rhashtable") Fixes: cd2b70875058 ("sctp: check duplicate node before inserting a new transport") Reported-by: syzbot+0b05d8aa7cb185107483@syzkaller.appspotmail.com Reported-by: syzbot+aad231d51b1923158444@syzkaller.appspotmail.com Suggested-by: Neil Horman Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Acked-by: Neil Horman Signed-off-by: David S. Miller commit 986103e7920cabc0b910749e77ae5589d3934d52 Author: Thomas Falcon Date: Fri Nov 30 10:59:08 2018 -0600 net/ibmvnic: Fix RTNL deadlock during device reset Commit a5681e20b541 ("net/ibmnvic: Fix deadlock problem in reset") made the change to hold the RTNL lock during driver reset but still calls netdev_notify_peers, which results in a deadlock. Instead, use call_netdevice_notifiers, which is functionally the same except that it does not take the RTNL lock again. Fixes: a5681e20b541 ("net/ibmnvic: Fix deadlock problem in reset") Signed-off-by: Thomas Falcon Signed-off-by: David S. Miller commit e3f787189e10f5fafce77ba8aa948741ebb93c2b Author: Jean-Philippe Brucker Date: Fri Nov 30 16:05:53 2018 +0000 vhost: fix IOTLB locking Commit 78139c94dc8c ("net: vhost: lock the vqs one by one") moved the vq lock to improve scalability, but introduced a possible deadlock in vhost-iotlb. vhost_iotlb_notify_vq() now takes vq->mutex while holding the device's IOTLB spinlock. And on the vhost_iotlb_miss() path, the spinlock is taken while holding vq->mutex. Since calling vhost_poll_queue() doesn't require any lock, avoid the deadlock by not taking vq->mutex. Fixes: 78139c94dc8c ("net: vhost: lock the vqs one by one") Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Signed-off-by: Jean-Philippe Brucker Signed-off-by: David S. Miller commit 4763c9f926d8907beaacea4fd883c784696d84ef Merge: 4e4b08e55889 8c85f4b81296 Author: David S. Miller Date: Mon Dec 3 15:20:19 2018 -0800 Merge branch 'phy-micrel-toggling-reset' Yoshihiro Shimoda says: ==================== net: phy: micrel: add toggling phy reset This patch set is for R-Car Gen3 Salvator-XS boards. If we do the following method, the phy cannot link up correctly. 1) Kernel boots by using initramfs. --> No open the nic, so phy_device_register() and phy_probe() deasserts the reset. 2) Kernel enters the suspend. --> So, keep the reset signal as deassert. --> On R-Car Salvator-XS board, unfortunately, the board power is turned off. 3) Kernel returns from suspend. 4) ifconfig eth0 up --> Then, since edge signal of the reset doesn't happen, it cannot link up. 5) ifconfig eth0 down 6) ifconfig eth0 up --> In this case, it can link up. When resolving this issue after I got feedback from Andrew and Heiner, I found an issue that the phy_device.c didn't call phy_resume() if the PHY was not attached. So, patch 1 fixes it and add toggling the phy reset to the micrel phy driver. Changes from v1 (as RFC): - No remove the current code of phy_device.c to avoid any side effects. - Fix the mdio_bus_phy_resume() in phy_device.c. - Add toggling the phy reset in micrel.c if the PHY is not attached. ==================== Signed-off-by: David S. Miller commit 8c85f4b81296a530b8af2796c110fa482ac42d4f Author: Yoshihiro Shimoda Date: Wed Nov 28 09:02:42 2018 +0000 net: phy: micrel: add toggling phy reset if PHY is not attached This patch adds toggling phy reset if PHY is not attached. Otherwise, some boards (e.g. R-Car H3 Salvator-XS) cannot link up correctly if we do the following method: 1) Kernel boots by using initramfs. --> No open the nic, so phy_device_register() and phy_probe() deasserts the reset. 2) Kernel enters the suspend. --> So, keep the reset signal as deassert. --> On R-Car Salvator-XS board, unfortunately, the board power is turned off. 3) Kernel returns from suspend. 4) ifconfig eth0 up --> Then, since edge signal of the reset doesn't happen, it cannot link up. 5) ifconfig eth0 down 6) ifconfig eth0 up --> In this case, it can link up. Reported-by: Hiromitsu Yamasaki Signed-off-by: Yoshihiro Shimoda Signed-off-by: David S. Miller commit ef1b5bf506b1f0ee3edc98533e1f3ecb105eb46a Author: Yoshihiro Shimoda Date: Wed Nov 28 09:02:41 2018 +0000 net: phy: Fix not to call phy_resume() if PHY is not attached This patch fixes an issue that mdio_bus_phy_resume() doesn't call phy_resume() if the PHY is not attached. Fixes: 803dd9c77ac3 ("net: phy: avoid suspending twice a PHY") Signed-off-by: Yoshihiro Shimoda Signed-off-by: David S. Miller commit 025dceb0fab31c912c41b8f32577432231d83e6b Author: Sandipan Das Date: Mon Dec 3 17:51:04 2018 +0530 bpf: powerpc64: optimize JIT passes for bpf function calls Once the JITed images for each function in a multi-function program are generated after the first three JIT passes, we only need to fix the target address for the branch instruction corresponding to each bpf-to-bpf function call. This introduces the following optimizations for reducing the work done by the JIT compiler when handling multi-function programs: [1] Instead of doing two extra passes to fix the bpf function calls, do just one as that would be sufficient. [2] During the extra pass, only overwrite the instruction sequences for the bpf-to-bpf function calls as everything else would still remain exactly the same. This also reduces the number of writes to the JITed image. [3] Do not regenerate the prologue and the epilogue during the extra pass as that would be redundant. Signed-off-by: Sandipan Das Signed-off-by: Daniel Borkmann commit 4e4b08e55889da97dec750759f3ade8cc92b4644 Author: Prashant Bhole Date: Mon Dec 3 18:09:24 2018 +0900 tun: remove skb access after netif_receive_skb In tun.c skb->len was accessed while doing stats accounting after a call to netif_receive_skb. We can not access skb after this call because buffers may be dropped. The fix for this bug would be to store skb->len in local variable and then use it after netif_receive_skb(). IMO using xdp data size for accounting bytes will be better because input for tun_xdp_one() is xdp_buff. Hence this patch: - fixes a bug by removing skb access after netif_receive_skb() - uses xdp data size for accounting bytes [613.019057] BUG: KASAN: use-after-free in tun_sendmsg+0x77c/0xc50 [tun] [613.021062] Read of size 4 at addr ffff8881da9ab7c0 by task vhost-1115/1155 [613.023073] [613.024003] CPU: 0 PID: 1155 Comm: vhost-1115 Not tainted 4.20.0-rc3-vm+ #232 [613.026029] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 [613.029116] Call Trace: [613.031145] dump_stack+0x5b/0x90 [613.032219] print_address_description+0x6c/0x23c [613.034156] ? tun_sendmsg+0x77c/0xc50 [tun] [613.036141] kasan_report.cold.5+0x241/0x308 [613.038125] tun_sendmsg+0x77c/0xc50 [tun] [613.040109] ? tun_get_user+0x1960/0x1960 [tun] [613.042094] ? __isolate_free_page+0x270/0x270 [613.045173] vhost_tx_batch.isra.14+0xeb/0x1f0 [vhost_net] [613.047127] ? peek_head_len.part.13+0x90/0x90 [vhost_net] [613.049096] ? get_tx_bufs+0x5a/0x2c0 [vhost_net] [613.051106] ? vhost_enable_notify+0x2d8/0x420 [vhost] [613.053139] handle_tx_copy+0x2d0/0x8f0 [vhost_net] [613.053139] ? vhost_net_buf_peek+0x340/0x340 [vhost_net] [613.053139] ? __mutex_lock+0x8d9/0xb30 [613.053139] ? finish_task_switch+0x8f/0x3f0 [613.053139] ? handle_tx+0x32/0x120 [vhost_net] [613.053139] ? mutex_trylock+0x110/0x110 [613.053139] ? finish_task_switch+0xcf/0x3f0 [613.053139] ? finish_task_switch+0x240/0x3f0 [613.053139] ? __switch_to_asm+0x34/0x70 [613.053139] ? __switch_to_asm+0x40/0x70 [613.053139] ? __schedule+0x506/0xf10 [613.053139] handle_tx+0xc7/0x120 [vhost_net] [613.053139] vhost_worker+0x166/0x200 [vhost] [613.053139] ? vhost_dev_init+0x580/0x580 [vhost] [613.053139] ? __kthread_parkme+0x77/0x90 [613.053139] ? vhost_dev_init+0x580/0x580 [vhost] [613.053139] kthread+0x1b1/0x1d0 [613.053139] ? kthread_park+0xb0/0xb0 [613.053139] ret_from_fork+0x35/0x40 [613.088705] [613.088705] Allocated by task 1155: [613.088705] kasan_kmalloc+0xbf/0xe0 [613.088705] kmem_cache_alloc+0xdc/0x220 [613.088705] __build_skb+0x2a/0x160 [613.088705] build_skb+0x14/0xc0 [613.088705] tun_sendmsg+0x4f0/0xc50 [tun] [613.088705] vhost_tx_batch.isra.14+0xeb/0x1f0 [vhost_net] [613.088705] handle_tx_copy+0x2d0/0x8f0 [vhost_net] [613.088705] handle_tx+0xc7/0x120 [vhost_net] [613.088705] vhost_worker+0x166/0x200 [vhost] [613.088705] kthread+0x1b1/0x1d0 [613.088705] ret_from_fork+0x35/0x40 [613.088705] [613.088705] Freed by task 1155: [613.088705] __kasan_slab_free+0x12e/0x180 [613.088705] kmem_cache_free+0xa0/0x230 [613.088705] ip6_mc_input+0x40f/0x5a0 [613.088705] ipv6_rcv+0xc9/0x1e0 [613.088705] __netif_receive_skb_one_core+0xc1/0x100 [613.088705] netif_receive_skb_internal+0xc4/0x270 [613.088705] br_pass_frame_up+0x2b9/0x2e0 [613.088705] br_handle_frame_finish+0x2fb/0x7a0 [613.088705] br_handle_frame+0x30f/0x6c0 [613.088705] __netif_receive_skb_core+0x61a/0x15b0 [613.088705] __netif_receive_skb_one_core+0x8e/0x100 [613.088705] netif_receive_skb_internal+0xc4/0x270 [613.088705] tun_sendmsg+0x738/0xc50 [tun] [613.088705] vhost_tx_batch.isra.14+0xeb/0x1f0 [vhost_net] [613.088705] handle_tx_copy+0x2d0/0x8f0 [vhost_net] [613.088705] handle_tx+0xc7/0x120 [vhost_net] [613.088705] vhost_worker+0x166/0x200 [vhost] [613.088705] kthread+0x1b1/0x1d0 [613.088705] ret_from_fork+0x35/0x40 [613.088705] [613.088705] The buggy address belongs to the object at ffff8881da9ab740 [613.088705] which belongs to the cache skbuff_head_cache of size 232 Fixes: 043d222f93ab ("tuntap: accept an array of XDP buffs through sendmsg()") Reviewed-by: Toshiaki Makita Signed-off-by: Prashant Bhole Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Signed-off-by: David S. Miller commit a5d4a89245ead1f37ed135213653c5beebea4237 Author: Su Yanjun Date: Mon Dec 3 15:33:07 2018 +0800 net: 8139cp: fix a BUG triggered by changing mtu with network traffic When changing mtu many times with traffic, a bug is triggered: [ 1035.684037] kernel BUG at lib/dynamic_queue_limits.c:26! [ 1035.684042] invalid opcode: 0000 [#1] SMP [ 1035.684049] Modules linked in: loop binfmt_misc 8139cp(OE) macsec tcp_diag udp_diag inet_diag unix_diag af_packet_diag netlink_diag tcp_lp fuse uinput xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT nf_reject_ipv4 tun bridge stp llc ebtable_filter ebtables ip6table_filter devlink ip6_tables iptable_filter sunrpc snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep ppdev snd_seq iosf_mbi crc32_pclmul parport_pc snd_seq_device ghash_clmulni_intel parport snd_pcm aesni_intel joydev lrw snd_timer virtio_balloon sg gf128mul glue_helper ablk_helper cryptd snd soundcore i2c_piix4 pcspkr ip_tables xfs libcrc32c sr_mod sd_mod cdrom crc_t10dif crct10dif_generic ata_generic [ 1035.684102] pata_acpi virtio_console qxl drm_kms_helper syscopyarea sysfillrect sysimgblt floppy fb_sys_fops crct10dif_pclmul crct10dif_common ttm crc32c_intel serio_raw ata_piix drm libata 8139too virtio_pci drm_panel_orientation_quirks virtio_ring virtio mii dm_mirror dm_region_hash dm_log dm_mod [last unloaded: 8139cp] [ 1035.684132] CPU: 9 PID: 25140 Comm: if-mtu-change Kdump: loaded Tainted: G OE ------------ T 3.10.0-957.el7.x86_64 #1 [ 1035.684134] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 1035.684136] task: ffff8f59b1f5a080 ti: ffff8f5a2e32c000 task.ti: ffff8f5a2e32c000 [ 1035.684149] RIP: 0010:[] [] dql_completed+0x180/0x190 [ 1035.684162] RSP: 0000:ffff8f5a75483e50 EFLAGS: 00010093 [ 1035.684162] RAX: 00000000000000c2 RBX: ffff8f5a6f91c000 RCX: 0000000000000000 [ 1035.684162] RDX: 0000000000000000 RSI: 0000000000000184 RDI: ffff8f599fea3ec0 [ 1035.684162] RBP: ffff8f5a75483ea8 R08: 00000000000000c2 R09: 0000000000000000 [ 1035.684162] R10: 00000000000616ef R11: ffff8f5a75483b56 R12: ffff8f599fea3e00 [ 1035.684162] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000184 [ 1035.684162] FS: 00007fa8434de740(0000) GS:ffff8f5a75480000(0000) knlGS:0000000000000000 [ 1035.684162] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1035.684162] CR2: 00000000004305d0 CR3: 000000024eb66000 CR4: 00000000001406e0 [ 1035.684162] Call Trace: [ 1035.684162] [ 1035.684162] [] ? cp_interrupt+0x478/0x580 [8139cp] [ 1035.684162] [] __handle_irq_event_percpu+0x44/0x1c0 [ 1035.684162] [] handle_irq_event_percpu+0x32/0x80 [ 1035.684162] [] handle_irq_event+0x3c/0x60 [ 1035.684162] [] handle_fasteoi_irq+0x59/0x110 [ 1035.684162] [] handle_irq+0xe4/0x1a0 [ 1035.684162] [] do_IRQ+0x4d/0xf0 [ 1035.684162] [] common_interrupt+0x162/0x162 [ 1035.684162] [ 1035.684162] [] ? __wake_up_bit+0x24/0x70 [ 1035.684162] [] ? do_set_pte+0xd5/0x120 [ 1035.684162] [] unlock_page+0x2b/0x30 [ 1035.684162] [] do_read_fault.isra.61+0x139/0x1b0 [ 1035.684162] [] handle_pte_fault+0x2f4/0xd10 [ 1035.684162] [] handle_mm_fault+0x39d/0x9b0 [ 1035.684162] [] __do_page_fault+0x203/0x500 [ 1035.684162] [] trace_do_page_fault+0x56/0x150 [ 1035.684162] [] do_async_page_fault+0x22/0xf0 [ 1035.684162] [] async_page_fault+0x28/0x30 [ 1035.684162] Code: 54 c7 47 54 ff ff ff ff 44 0f 49 ce 48 8b 35 48 2f 9c 00 48 89 77 58 e9 fe fe ff ff 0f 1f 80 00 00 00 00 41 89 d1 e9 ef fe ff ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 55 8d 42 ff 48 [ 1035.684162] RIP [] dql_completed+0x180/0x190 [ 1035.684162] RSP It's not the same as in 7fe0ee09 patch described. As 8139cp uses shared irq mode, other device irq will trigger cp_interrupt to execute. cp_change_mtu -> cp_close -> cp_open In cp_close routine just before free_irq(), some interrupt may occur. In my environment, cp_interrupt exectutes and IntrStatus is 0x4, exactly TxOk. That will cause cp_tx to wake device queue. As device queue is started, cp_start_xmit and cp_open will run at same time which will cause kernel BUG. For example: [#] for tx descriptor At start: [#][#][#] num_queued=3 After cp_init_hw->cp_start_hw->netdev_reset_queue: [#][#][#] num_queued=0 When 8139cp starts to work then cp_tx will check num_queued mismatchs the complete_bytes. The patch will check IntrMask before check IntrStatus in cp_interrupt. When 8139cp interrupt is disabled, just return. Signed-off-by: Su Yanjun Signed-off-by: David S. Miller commit 37b06e5078975bb4efe3cbd91e254112851b125f Author: Artemy Kovalyov Date: Tue Nov 27 08:51:25 2018 +0200 IB/mlx5: Fix implicit ODP interrupted page fault Since any page fault may be interrupted by a MMU invalidation and implicit leaf MR may be released during this process. The check for parent value is unreliable condition for an implicit MR. Use other condition that we can rely on to determine if MR is implicit. Fixes: b4cfe447d47b ("IB/mlx5: Implement on demand paging by adding support for MMU notifiers") Signed-off-by: Artemy Kovalyov Signed-off-by: Moni Shoua Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford commit d2a36971ef595069b7a600d1144c2e0881a930a1 Author: Heiner Kallweit Date: Mon Dec 3 08:19:33 2018 +0100 net: phy: don't allow __set_phy_supported to add unsupported modes Currently __set_phy_supported allows to add modes w/o checking whether the PHY supports them. This is wrong, it should never add modes but only remove modes we don't want to support. The commit marked as fixed didn't do anything wrong, it just copied existing functionality to the helper which is being fixed now. Fixes: f3a6bd393c2c ("phylib: Add phy_set_max_speed helper") Signed-off-by: Heiner Kallweit Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit d9536e809801687600a02b9b3fc755e1b3bde1af Merge: f3b2f758ec1e e25b6783c7b1 Author: Olof Johansson Date: Mon Dec 3 13:05:34 2018 -0800 Merge tag 'arm-soc/for-4.20/devicetree-fixes' of https://github.com/Broadcom/stblinux into fixes This pull request contains Broadcom ARM-based SoCs Device Tree fixes, please pull the following for 4.20: - Stefan fixes the polariy of the Wi-Fi reset GPIOs signals which would break on Raspberry Pi 3B and 3B+ * tag 'arm-soc/for-4.20/devicetree-fixes' of https://github.com/Broadcom/stblinux: ARM: dts: bcm2837: Fix polarity of wifi reset GPIOs Signed-off-by: Olof Johansson commit 36d842194a57f1b21fbc6a6875f2fa2f9a7f8679 Author: Piotr Stankiewicz Date: Wed Nov 28 06:44:46 2018 -0800 IB/hfi1: Fix an out-of-bounds access in get_hw_stats When running with KASAN, the following trace is produced: [ 62.535888] ================================================================== [ 62.544930] BUG: KASAN: slab-out-of-bounds in gut_hw_stats+0x122/0x230 [hfi1] [ 62.553856] Write of size 8 at addr ffff88080e8d6330 by task kworker/0:1/14 [ 62.565333] CPU: 0 PID: 14 Comm: kworker/0:1 Not tainted 4.19.0-test-build-kasan+ #8 [ 62.575087] Hardware name: Intel Corporation S2600KPR/S2600KPR, BIOS SE5C610.86B.01.01.0019.101220160604 10/12/2016 [ 62.587951] Workqueue: events work_for_cpu_fn [ 62.594050] Call Trace: [ 62.598023] dump_stack+0xc6/0x14c [ 62.603089] ? dump_stack_print_info.cold.1+0x2f/0x2f [ 62.610041] ? kmsg_dump_rewind_nolock+0x59/0x59 [ 62.616615] ? get_hw_stats+0x122/0x230 [hfi1] [ 62.622985] print_address_description+0x6c/0x23c [ 62.629744] ? get_hw_stats+0x122/0x230 [hfi1] [ 62.636108] kasan_report.cold.6+0x241/0x308 [ 62.642365] get_hw_stats+0x122/0x230 [hfi1] [ 62.648703] ? hfi1_alloc_rn+0x40/0x40 [hfi1] [ 62.655088] ? __kmalloc+0x110/0x240 [ 62.660695] ? hfi1_alloc_rn+0x40/0x40 [hfi1] [ 62.667142] setup_hw_stats+0xd8/0x430 [ib_core] [ 62.673972] ? show_hfi+0x50/0x50 [hfi1] [ 62.680026] ib_device_register_sysfs+0x165/0x180 [ib_core] [ 62.687995] ib_register_device+0x5a2/0xa10 [ib_core] [ 62.695340] ? show_hfi+0x50/0x50 [hfi1] [ 62.701421] ? ib_unregister_device+0x2e0/0x2e0 [ib_core] [ 62.709222] ? __vmalloc_node_range+0x2d0/0x380 [ 62.716131] ? rvt_driver_mr_init+0x11f/0x2d0 [rdmavt] [ 62.723735] ? vmalloc_node+0x5c/0x70 [ 62.729697] ? rvt_driver_mr_init+0x11f/0x2d0 [rdmavt] [ 62.737347] ? rvt_driver_mr_init+0x1f5/0x2d0 [rdmavt] [ 62.744998] ? __rvt_alloc_mr+0x110/0x110 [rdmavt] [ 62.752315] ? rvt_rc_error+0x140/0x140 [rdmavt] [ 62.759434] ? rvt_vma_open+0x30/0x30 [rdmavt] [ 62.766364] ? mutex_unlock+0x1d/0x40 [ 62.772445] ? kmem_cache_create_usercopy+0x15d/0x230 [ 62.780115] rvt_register_device+0x1f6/0x360 [rdmavt] [ 62.787823] ? rvt_get_port_immutable+0x180/0x180 [rdmavt] [ 62.796058] ? __get_txreq+0x400/0x400 [hfi1] [ 62.802969] ? memcpy+0x34/0x50 [ 62.808611] hfi1_register_ib_device+0xde6/0xeb0 [hfi1] [ 62.816601] ? hfi1_get_npkeys+0x10/0x10 [hfi1] [ 62.823760] ? hfi1_init+0x89f/0x9a0 [hfi1] [ 62.830469] ? hfi1_setup_eagerbufs+0xad0/0xad0 [hfi1] [ 62.838204] ? pcie_capability_clear_and_set_word+0xcd/0xe0 [ 62.846429] ? pcie_capability_read_word+0xd0/0xd0 [ 62.853791] ? hfi1_pcie_init+0x187/0x4b0 [hfi1] [ 62.860958] init_one+0x67f/0xae0 [hfi1] [ 62.867301] ? hfi1_init+0x9a0/0x9a0 [hfi1] [ 62.873876] ? wait_woken+0x130/0x130 [ 62.879860] ? read_word_at_a_time+0xe/0x20 [ 62.886329] ? strscpy+0x14b/0x280 [ 62.891998] ? hfi1_init+0x9a0/0x9a0 [hfi1] [ 62.898405] local_pci_probe+0x70/0xd0 [ 62.904295] ? pci_device_shutdown+0x90/0x90 [ 62.910833] work_for_cpu_fn+0x29/0x40 [ 62.916750] process_one_work+0x584/0x960 [ 62.922974] ? rcu_work_rcufn+0x40/0x40 [ 62.928991] ? __schedule+0x396/0xdc0 [ 62.934806] ? __sched_text_start+0x8/0x8 [ 62.941020] ? pick_next_task_fair+0x68b/0xc60 [ 62.947674] ? run_rebalance_domains+0x260/0x260 [ 62.954471] ? __list_add_valid+0x29/0xa0 [ 62.960607] ? move_linked_works+0x1c7/0x230 [ 62.967077] ? trace_event_raw_event_workqueue_execute_start+0x140/0x140 [ 62.976248] ? mutex_lock+0xa6/0x100 [ 62.982029] ? __mutex_lock_slowpath+0x10/0x10 [ 62.988795] ? __switch_to+0x37a/0x710 [ 62.994731] worker_thread+0x62e/0x9d0 [ 63.000602] ? max_active_store+0xf0/0xf0 [ 63.006828] ? __switch_to_asm+0x40/0x70 [ 63.012932] ? __switch_to_asm+0x34/0x70 [ 63.019013] ? __switch_to_asm+0x40/0x70 [ 63.025042] ? __switch_to_asm+0x34/0x70 [ 63.031030] ? __switch_to_asm+0x40/0x70 [ 63.037006] ? __schedule+0x396/0xdc0 [ 63.042660] ? kmem_cache_alloc_trace+0xf3/0x1f0 [ 63.049323] ? kthread+0x59/0x1d0 [ 63.054594] ? ret_from_fork+0x35/0x40 [ 63.060257] ? __sched_text_start+0x8/0x8 [ 63.066212] ? schedule+0xcf/0x250 [ 63.071529] ? __wake_up_common+0x110/0x350 [ 63.077794] ? __schedule+0xdc0/0xdc0 [ 63.083348] ? wait_woken+0x130/0x130 [ 63.088963] ? finish_task_switch+0x1f1/0x520 [ 63.095258] ? kasan_unpoison_shadow+0x30/0x40 [ 63.101792] ? __init_waitqueue_head+0xa0/0xd0 [ 63.108183] ? replenish_dl_entity.cold.60+0x18/0x18 [ 63.115151] ? _raw_spin_lock_irqsave+0x25/0x50 [ 63.121754] ? max_active_store+0xf0/0xf0 [ 63.127753] kthread+0x1ae/0x1d0 [ 63.132894] ? kthread_bind+0x30/0x30 [ 63.138422] ret_from_fork+0x35/0x40 [ 63.146973] Allocated by task 14: [ 63.152077] kasan_kmalloc+0xbf/0xe0 [ 63.157471] __kmalloc+0x110/0x240 [ 63.162804] init_cntrs+0x34d/0xdf0 [hfi1] [ 63.168883] hfi1_init_dd+0x29a3/0x2f90 [hfi1] [ 63.175244] init_one+0x551/0xae0 [hfi1] [ 63.181065] local_pci_probe+0x70/0xd0 [ 63.186759] work_for_cpu_fn+0x29/0x40 [ 63.192310] process_one_work+0x584/0x960 [ 63.198163] worker_thread+0x62e/0x9d0 [ 63.203843] kthread+0x1ae/0x1d0 [ 63.208874] ret_from_fork+0x35/0x40 [ 63.217203] Freed by task 1: [ 63.221844] __kasan_slab_free+0x12e/0x180 [ 63.227844] kfree+0x92/0x1a0 [ 63.232570] single_release+0x3a/0x60 [ 63.238024] __fput+0x1d9/0x480 [ 63.242911] task_work_run+0x139/0x190 [ 63.248440] exit_to_usermode_loop+0x191/0x1a0 [ 63.254814] do_syscall_64+0x301/0x330 [ 63.260283] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 63.270199] The buggy address belongs to the object at ffff88080e8d5500 which belongs to the cache kmalloc-4096 of size 4096 [ 63.287247] The buggy address is located 3632 bytes inside of 4096-byte region [ffff88080e8d5500, ffff88080e8d6500) [ 63.303564] The buggy address belongs to the page: [ 63.310447] page:ffffea00203a3400 count:1 mapcount:0 mapping:ffff88081380e840 index:0x0 compound_mapcount: 0 [ 63.323102] flags: 0x2fffff80008100(slab|head) [ 63.329775] raw: 002fffff80008100 0000000000000000 0000000100000001 ffff88081380e840 [ 63.340175] raw: 0000000000000000 0000000000070007 00000001ffffffff 0000000000000000 [ 63.350564] page dumped because: kasan: bad access detected [ 63.361974] Memory state around the buggy address: [ 63.369137] ffff88080e8d6200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.379082] ffff88080e8d6280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.389032] >ffff88080e8d6300: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 63.398944] ^ [ 63.406141] ffff88080e8d6380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 63.416109] ffff88080e8d6400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 63.426099] ================================================================== The trace happens because get_hw_stats() assumes there is room in the memory allocated in init_cntrs() to accommodate the driver counters. Unfortunately, that routine only allocated space for the device counters. Fix by insuring the allocation has room for the additional driver counters. Cc: # v4.14+ Fixes: b7481944b06e9 ("IB/hfi1: Show statistics counters under IB stats interface") Reviewed-by: Mike Marciniczyn Reviewed-by: Mike Ruhl Signed-off-by: Piotr Stankiewicz Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford commit 90b2620e6a8aa08c40cc78d61603e0acd853c33a Author: Michael J. Ruhl Date: Wed Nov 28 06:44:36 2018 -0800 IB/hfi1: Fix a latency issue for small messages A recent performance enhancement introduced a latency issue in the HFI message path. The new algorithm removed a forced call send for PIO messages and added a forced schedule event for messages larger than the MTU. For PIO, the schedule path can introduce thrashing that can significantly impact the throughput for small messages. If a message size is within the PIO threshold, always take the send path. Fixes: 0b79b27748cb ("IB/{hfi1, qib, rdmavt}: Schedule multi RC/UC packets instead of posting") Reviewed-by: Mike Marciniszyn Signed-off-by: Michael J. Ruhl Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford commit f3b2f758ec1e6cdb13c925647cbd8ad4938b78fb Author: Rob Herring Date: Mon Dec 3 13:12:48 2018 -0600 ARM: dts: realview: Fix some more duplicate regulator nodes There's a bug in dtc in checking for duplicate node names when there's another section (e.g. "/ { };"). In this case, skeleton.dtsi provides another section. Upon removal of skeleton.dtsi, the dtb fails to build due to a duplicate node 'fixedregulator@0'. As both nodes were pretty much the same 3.3V fixed regulator, it hasn't really mattered. Fix this by renaming the nodes to something unique. In the process, drop the unit-address which shouldn't be present wtihout reg property. Signed-off-by: Rob Herring Reviewed-by: Linus Walleij Signed-off-by: Olof Johansson commit f6936d029c4a14ce873bbb423bbc518aa1b4def2 Author: Lubomir Rintel Date: Sun Dec 2 12:14:28 2018 +0100 MAINTAINERS: update entry for MMP platform Move Eric Miao and Haojian Zhuang over to CREDITS, since they're AWOL for some time already. The git trees have gone away too. I'm adding myself as a reviewer. I'd like to be Cc'd on patches and will be able to test them, but I don't possess a data sheet thus there might be things I'll be unable to review. Hence the Odd-Fixes status. Signed-off-by: Lubomir Rintel Signed-off-by: Olof Johansson commit 76f4e2c3b6a560cdd7a75b87df543e04d05a9e5f Author: Lubomir Rintel Date: Sun Dec 2 12:12:24 2018 +0100 ARM: mmp/mmp2: fix cpu_is_mmp2() on mmp2-dt cpu_is_mmp2() was equivalent to cpu_is_pj4(), wouldn't be correct for multiplatform kernels. Fix it by also considering mmp_chip_id, as is done for cpu_is_pxa168() and cpu_is_pxa910() above. Moreover, it is only available with CONFIG_CPU_MMP2 and thus doesn't work on DT-based MMP2 machines. Enable it on CONFIG_MACH_MMP2_DT too. Note: CONFIG_CPU_MMP2 is only used for machines that use board files instead of DT. It should perhaps be renamed. I'm not doing it now, because I don't have a better idea. Signed-off-by: Lubomir Rintel Acked-by: Arnd Bergmann Cc: stable@vger.kernel.org Signed-off-by: Olof Johansson commit 358b5f73ce60fb1369be557c38a52e886834f44d Merge: 7bb64d55fd0e ce68cc6fad89 Author: Olof Johansson Date: Mon Dec 3 12:37:41 2018 -0800 Merge tag 'v4.19-next-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/matthias.bgg/linux into fixes DT mt7622: - Kernelci awaits a working stdout-path. Fix the path for reference board and bananapi-r64 - General propouse timer has issues with clocks that didn't get probed early. Delete the DT node as the timer isn't need, a ARM arch timer exists on the system. * tag 'v4.19-next-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/matthias.bgg/linux: arm64: dts: mt7622: Drop the general purpose timer node arm64: dts: mt7622: fix no more console output on BPI-R64 board arm64: dts: mt7622: fix no more console output on rfb1 Signed-off-by: Olof Johansson commit 7bb64d55fd0e4bb09863ae1519ec8024e1279b2b Author: Matthias Brugger Date: Tue Oct 16 16:57:58 2018 +0200 MAINTAINERS: mediatek: Update SoC entry Add IRC channel and URL of the wiki. Also add soc drivers folder and regex to catch more mediatek components. Signed-off-by: Matthias Brugger Signed-off-by: Olof Johansson commit daa3fc4454b21ac883152d07b4778bc4f83ec716 Author: Hans Verkuil Date: Wed Nov 28 15:52:42 2018 -0500 media: vicodec: set state resolution from raw format The state structure contains the resolution expected by the decoder and encoder. For an encoder that resolution should be taken from the OUTPUT format, and for a decoder from the CAPTURE format. If the wrong format is picked, a buffer overrun can occur if there is a mismatch between the CAPTURE and OUTPUT formats. The real fix would be to correctly implement the stateful codec specification, but that will take more time. For now just prevent the buffer overrun. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit e714c92f42aeed6052a287b8ccf5a519e42bab15 Author: Hans Verkuil Date: Wed Nov 28 03:37:47 2018 -0500 media: vivid: drop v4l2_ctrl_request_complete() from start_streaming If start_streaming() fails and all queued buffers are returned to vb2, then do not call v4l2_ctrl_request_complete(). Nothing happened to the request and the state should remain as it was before start_streaming was called. Signed-off-by: Hans Verkuil Acked-by: Sakari Ailus Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit dde6bdcc975983c219ffe9b8f3a2942df0b7937d Author: Hans Verkuil Date: Wed Nov 28 03:37:46 2018 -0500 media: vb2: don't unbind/put the object when going to state QUEUED When a buffer is returned to state QUEUED (that happens when start_streaming fails), then do not unbind and put the object from the request. Nothing has changed yet, so just keep it as is. Signed-off-by: Hans Verkuil Acked-by: Sakari Ailus Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 6093d3002eabd7c2913d97f1d1f4ce34b072acf9 Author: Hans Verkuil Date: Wed Nov 28 03:37:45 2018 -0500 media: vb2: keep a reference to the request until dqbuf When vb2_buffer_done is called the buffer is unbound from the request and put. The media_request_object_put also 'put's the request reference. If the application has already closed the request fd, then that means that the request reference at that point goes to 0 and the whole request is released. This means that the control handler associated with the request is also freed and that causes this kernel oops: [174705.995401] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:908 [174705.995411] in_atomic(): 1, irqs_disabled(): 1, pid: 28071, name: vivid-000-vid-o [174705.995416] 2 locks held by vivid-000-vid-o/28071: [174705.995420] #0: 000000001ea3a232 (&dev->mutex#3){....}, at: vivid_thread_vid_out+0x3f5/0x550 [vivid] [174705.995447] #1: 00000000e30a0d1e (&(&q->done_lock)->rlock){....}, at: vb2_buffer_done+0x92/0x1d0 [videobuf2_common] [174705.995460] Preemption disabled at: [174705.995461] [<0000000000000000>] (null) [174705.995472] CPU: 11 PID: 28071 Comm: vivid-000-vid-o Tainted: G W 4.20.0-rc1-test-no #88 [174705.995476] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/19/2017 [174705.995481] Call Trace: [174705.995500] dump_stack+0x46/0x60 [174705.995512] ___might_sleep.cold.79+0xe1/0xf1 [174705.995523] __mutex_lock+0x50/0x8f0 [174705.995531] ? find_held_lock+0x2d/0x90 [174705.995536] ? find_held_lock+0x2d/0x90 [174705.995542] ? find_held_lock+0x2d/0x90 [174705.995564] ? v4l2_ctrl_handler_free.part.13+0x44/0x1d0 [videodev] [174705.995576] v4l2_ctrl_handler_free.part.13+0x44/0x1d0 [videodev] [174705.995590] v4l2_ctrl_request_release+0x1c/0x30 [videodev] [174705.995600] media_request_clean+0x64/0xe0 [media] [174705.995609] media_request_release+0x19/0x40 [media] [174705.995617] vb2_buffer_done+0xef/0x1d0 [videobuf2_common] [174705.995630] vivid_thread_vid_out+0x2c1/0x550 [vivid] [174705.995645] ? vivid_stop_generating_vid_cap+0x1c0/0x1c0 [vivid] [174705.995653] kthread+0x113/0x130 [174705.995659] ? kthread_park+0x80/0x80 [174705.995667] ret_from_fork+0x35/0x40 The vb2_buffer_done function can be called from interrupt context, so anything that sleeps is not allowed. The solution is to increment the request refcount when the buffer is queued and decrement it when the buffer is dequeued. Releasing the request is fine if that happens from VIDIOC_DQBUF. Signed-off-by: Hans Verkuil Acked-by: Sakari Ailus Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit b7ff0b099089f3d4bfd4e30f581ee9d9dc4f8840 Author: Hans Verkuil Date: Wed Nov 28 03:37:44 2018 -0500 media: vb2: skip request checks for VIDIOC_PREPARE_BUF VIDIOC_PREPARE_BUF should ignore V4L2_BUF_FLAG_REQUEST_FD since it isn't doing anything with requests. So inform vb2_queue_or_prepare_buf whether it is called from vb2_prepare_buf or vb2_qbuf and just return 0 in the first case. This was found when adding new v4l2-compliance checks. Signed-off-by: Hans Verkuil Acked-by: Sakari Ailus Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 04990215dec43c424daff00d1f622167b8aafd1f Author: Hans Verkuil Date: Wed Nov 28 03:37:43 2018 -0500 media: vb2: don't call __vb2_queue_cancel if vb2_start_streaming failed vb2_start_streaming() already rolls back the buffers, so there is no need to call __vb2_queue_cancel(). Especially since __vb2_queue_cancel() does too much, such as zeroing the q->queued_count value, causing vb2 to think that no buffers have been queued. It appears that this call to __vb2_queue_cancel() is a left-over from before commit b3379c6201bb3. Fixes: b3379c6201bb3 ('vb2: only call start_streaming if sufficient buffers are queued') Signed-off-by: Hans Verkuil Cc: # for v4.16 and up Acked-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 53e9d838275d9a2a5736d788f84814c64cbf94b0 Author: Dan Carpenter Date: Mon Nov 26 03:10:44 2018 -0500 media: cedrus: Fix a NULL vs IS_ERR() check The devm_ioremap_resource() function doesn't return NULL pointers, it returns error pointers. Fixes: 50e761516f2b ("media: platform: Add Cedrus VPU decoder driver") Signed-off-by: Dan Carpenter Acked-by: Paul Kocialkowski Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 230bce5511cc001cc5b27ffc83b2da188ea43606 Author: Laurent Pinchart Date: Wed Nov 21 22:38:07 2018 -0500 media: vsp1: Fix LIF buffer thresholds Commit de2bc45c84f7 ("media: vsp1: Update LIF buffer thresholds") updated the LIF buffer thresholds based on the VSP version, but used the wrong model mask. This resulted in all VSP instances to be treated as a Gen3 VSPD, breaking operation on all Gen2 platforms as well as on H3 ES2.0, M3-N, V3M and V3H. Fix it. Fixes: de2bc45c84f7 ("media: vsp1: Update LIF buffer thresholds") Reported-by: Colin Ian King Signed-off-by: Laurent Pinchart Reviewed-by: Kieran Bingham Signed-off-by: Mauro Carvalho Chehab commit fd6f32f78645db32b6b95a42e45da2ddd6de0e67 Author: Juha-Matti Tilli Date: Sun Dec 2 12:47:08 2018 +0200 libata: whitelist all SAMSUNG MZ7KM* solid-state disks These devices support read zero after trim (RZAT), as they advertise to the OS. However, the OS doesn't believe the SSDs unless they are explicitly whitelisted. Acked-by: Martin K. Petersen Signed-off-by: Juha-Matti Tilli Signed-off-by: Jens Axboe commit e25b6783c7b1bb79103d4617336879423f86b05e Author: Stefan Wahren Date: Mon Dec 3 19:37:08 2018 +0100 ARM: dts: bcm2837: Fix polarity of wifi reset GPIOs The commit b1b8f45b3130 ("ARM: dts: bcm2837: Add missing GPIOs of Expander") introduced a wifi power sequence. Unfortunately the polarity of the reset GPIOs were wrong and broke the wifi support on Raspberry Pi 3 B and later in 3 B+. This wasn't discovered before since the power sequence takes only effect in case the relevant MMC driver is compiled as a module. Fixes: b1b8f45b3130 ("ARM: dts: bcm2837: Add missing GPIOs of Expander") Cc: stable@vger.kernel.org Reported-by: Matthias Lueschner Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=911443 Signed-off-by: Stefan Wahren Reviewed-by: Eric Anholt Signed-off-by: Florian Fainelli commit 6c3516fed7b61a3527459ccfa67fab130d910610 Author: Tony Lindgren Date: Mon Dec 3 11:24:30 2018 -0800 Input: omap-keypad - fix keyboard debounce configuration I noticed that the Android v3.0.8 kernel on droid4 is using different keypad values from the mainline kernel and does not have issues with keys occasionally being stuck until pressed again. Turns out there was an earlier patch posted to fix this as "Input: omap-keypad: errata i689: Correct debounce time", but it was never reposted to fix use macros for timing calculations. This updated version is using macros, and also fixes the use of the input clock rate to use 32768KiHz instead of 32000KiHz. And we want to use the known good Android kernel values of 3 and 6 instead of 2 and 6 in the earlier patch. Reported-by: Pavel Machek Signed-off-by: Tony Lindgren Signed-off-by: Dmitry Torokhov commit a6754fae1e66e9a40fed406290d7ca3f2b4d227c Author: Cameron Gutman Date: Thu Nov 29 10:09:33 2018 -0800 Input: xpad - quirk all PDP Xbox One gamepads Since we continue to find tons of new variants [0,1,2,3,4,5,6] that need the PDP quirk, let's just quirk all devices from PDP. [0]: https://github.com/paroj/xpad/pull/104 [1]: https://github.com/paroj/xpad/pull/105 [2]: https://github.com/paroj/xpad/pull/108 [3]: https://github.com/paroj/xpad/pull/109 [4]: https://github.com/paroj/xpad/pull/112 [5]: https://github.com/paroj/xpad/pull/115 [6]: https://github.com/paroj/xpad/pull/116 Fixes: e5c9c6a885fa ("Input: xpad - add support for PDP Xbox One controllers") Cc: stable@vger.kernel.org Signed-off-by: Cameron Gutman Signed-off-by: Dmitry Torokhov commit 5a6dab15f7a79817cab4af612ddd99eda793fce6 Author: Teika Kazura Date: Mon Dec 3 11:26:03 2018 -0800 Input: synaptics - enable SMBus for HP 15-ay000 SMBus works fine for the touchpad with id SYN3221, used in the HP 15-ay000 series, This device has been reported in these messages in the "linux-input" mailing list: * https://marc.info/?l=linux-input&m=152016683003369&w=2 * https://www.spinics.net/lists/linux-input/msg52525.html Reported-by: Nitesh Debnath Reported-by: Teika Kazura Signed-off-by: Teika Kazura Reviewed-by: Benjamin Tissoires Signed-off-by: Dmitry Torokhov commit 9df39bedbf292680655c6a947c77d6562c693d4a Author: Lyude Paul Date: Sat Nov 24 23:28:10 2018 -0800 Input: synaptics - add PNP ID for ThinkPad P50 to SMBus Noticed the other day the trackpoint felt different on my P50, then realized it was because rmi4 wasn't loading for this machine automatically. Suspend/resume, hibernate, and everything else seem to work perfectly fine on here. Signed-off-by: Lyude Paul Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit ad33429cd02565c28404bb16ae7a4c2bdfda6626 Author: Noah Westervelt Date: Thu Nov 29 10:10:35 2018 -0800 Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15ARR Add ELAN061E to the ACPI table to support Elan touchpad found in Lenovo IdeaPad 330-15ARR. Signed-off-by: Noah Westervelt Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit bf87ade0dd7f8cf19dac4d3161d5e86abe0c062b Author: Adam Wong Date: Thu Nov 29 10:04:35 2018 -0800 Input: elan_i2c - add support for ELAN0621 touchpad Added the ability to detect the ELAN0621 touchpad found in some Lenovo laptops. Signed-off-by: Adam Wong Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 0072a0c14d5b7cb72c611d396f143f5dcd73ebe2 Merge: f3f950dba37b a7c3a0d5f8d8 Author: Linus Torvalds Date: Mon Dec 3 11:29:20 2018 -0800 Merge tag 'media/v4.20-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - Revert a dt-bindings patch whose driver didn't make for 4.20 - fix a kernel oops at vicodec driver - fix a frame overflow at gspca with was causing regressions on some cameras, making them to not work - use the proper type for wait_queue head - make media request API compatible with 32-bit userspace on 64-bit kernel - fix a regression on Kernel 4.19 at dvb-pll - don't use SPDX headers yet for GFDL * tag 'media/v4.20-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: mediactl docs: Fix licensing message media: dvb-pll: don't re-validate tuner frequencies media: dvb-pll: fix tuner frequency ranges media: Revert "media: dt-bindings: Document the Rockchip VPU bindings" media: gspca: fix frame overflow error media: vicodec: fix memchr() kernel oops media: cedrus: add action item to the TODO media: media-request: Add compat ioctl media: Use wait_queue_head_t for media_request commit 9a43be9cedd516f188e6333d3b43402386723eff Author: Dan Carpenter Date: Mon Dec 3 17:52:01 2018 +0300 clk: zynqmp: Off by one in zynqmp_is_valid_clock() The > comparison should be >= to prevent reading beyond the end of the clock[] array. (The clock[] array is allocated in zynqmp_clk_setup() and has clock_max_idx elements.) Fixes: 3fde0e16d016 ("drivers: clk: Add ZynqMP clock driver") Signed-off-by: Dan Carpenter Signed-off-by: Stephen Boyd commit 2e85c57493e391b93445c1e0d530b36b95becc64 Author: Dan Carpenter Date: Mon Dec 3 17:51:43 2018 +0300 clk: mmp: Off by one in mmp_clk_add() The > comparison should be >= or we write one element beyond the end of the unit->clk_table[] array. (The unit->clk_table[] array is allocated in the mmp_clk_init() function and it has unit->nr_clks elements). Fixes: 4661fda10f8b ("clk: mmp: add basic support functions for DT support") Signed-off-by: Dan Carpenter Signed-off-by: Stephen Boyd commit d9f5b7f5dd0fa74a89de5a7ac1e26366f211ccee Author: Dan Carpenter Date: Mon Dec 3 17:50:55 2018 +0300 clk: mvebu: Off by one bugs in cp110_of_clk_get() These > comparisons should be >= to prevent reading beyond the end of of the clk_data->hws[] buffer. The clk_data->hws[] array is allocated in cp110_syscon_common_probe() when we do: cp110_clk_data = devm_kzalloc(dev, sizeof(*cp110_clk_data) + sizeof(struct clk_hw *) * CP110_CLK_NUM, GFP_KERNEL); As you can see, it has CP110_CLK_NUM elements which is equivalent to CP110_MAX_CORE_CLOCKS + CP110_MAX_GATABLE_CLOCKS. Fixes: d3da3eaef7f4 ("clk: mvebu: new driver for Armada CP110 system controller") Signed-off-by: Dan Carpenter Signed-off-by: Stephen Boyd commit f3f950dba37b5bec870147aeb9878a157a6eb875 Merge: 9099ff769faf 94d0fb159da9 Author: Linus Torvalds Date: Mon Dec 3 09:43:24 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide Pull IDE fixes from David Miller: "A missing of_node_put() and a small cleanup" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide: ide: Change to use DEFINE_SHOW_ATTRIBUTE macro ide: pmac: add of_node_put() commit 9099ff769faf879b5cb6e24e04c7904a8352aef0 Merge: 2595646791c3 dac097c4546e Author: Linus Torvalds Date: Mon Dec 3 09:35:27 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc Pull sparc fixes from David Miller: 1) Some implicit switch fallthrough fixes from Stephen Rothwell. 2) Missing of_node_put() in various sparc drivers from Yangtao Li. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: drivers/tty: add missing of_node_put() drivers/sbus/char: add of_node_put() sbus: char: add of_node_put() sparc32: supress another implicit-fallthrough warning sparc32: suppress an implicit-fallthrough warning sparc: suppress the implicit-fallthrough warning arch/sparc: Use kzalloc_node commit 106ea7feb98f1183e0cb5fe23da14fde662a8b15 Author: Evan Quan Date: Wed Nov 28 16:41:02 2018 +0800 drm/amd/powerplay: support SoftMin/Max setting for some specific DPM For some case, no need to force SoftMin/Max settings for all DPMs. It's OK to force on some specific DPM only. Signed-off-by: Evan Quan Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 10cb3e6b63bf4266a5198813526fdd7259ffb8be Author: Evan Quan Date: Wed Nov 28 16:36:12 2018 +0800 drm/amd/powerplay: issue pre-display settings for display change event For display config change event only, pre-display config settings are needed. Signed-off-by: Evan Quan Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit f02be8279a15c28302d72efa9ff21bdc586d5357 Author: Evan Quan Date: Wed Nov 28 16:33:30 2018 +0800 drm/amd/powerplay: support new pptable upload on Vega20 New pptable upload through sysfs interface is supported. Signed-off-by: Evan Quan Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit b52b6738cc2d50d2a8f4d0095bcb5a86716008a5 Author: Alex Deucher Date: Wed Nov 28 23:28:17 2018 -0500 drm/amdgpu/gmc8: always load MC firmware in the driver Some power features rely on the driver loaded version so always load the MC firmware from the driver even if the vbios loaded a version already. Acked-by: Christian König Reviewed-by: Junwei Zhang Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit a81a7c9c9ea3042ab02d66ac35def74abf091c15 Author: Alex Deucher Date: Wed Nov 28 23:25:41 2018 -0500 drm/amdgpu/gmc8: update MC firmware for polaris Some variants require different MC firmware images. Acked-by: Christian König Reviewed-by: Junwei Zhang Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 5f8cf712582617d523120df67d392059eaf2fc4b Author: Hui Peng Date: Mon Dec 3 16:09:34 2018 +0100 ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c If a USB sound card reports 0 interfaces, an error condition is triggered and the function usb_audio_probe errors out. In the error path, there was a use-after-free vulnerability where the memory object of the card was first freed, followed by a decrement of the number of active chips. Moving the decrement above the atomic_dec fixes the UAF. [ The original problem was introduced in 3.1 kernel, while it was developed in a different form. The Fixes tag below indicates the original commit but it doesn't mean that the patch is applicable cleanly. -- tiwai ] Fixes: 362e4e49abe5 ("ALSA: usb-audio - clear chip->probing on error exit") Reported-by: Hui Peng Reported-by: Mathias Payer Signed-off-by: Hui Peng Signed-off-by: Mathias Payer Cc: Signed-off-by: Takashi Iwai commit d7fd67653f847327e545bdb198b901ee124afd7c Author: Junwei Zhang Date: Thu Nov 22 17:53:00 2018 +0800 drm/amdgpu: update mc firmware image for polaris12 variants Some new variants require updated firmware. Signed-off-by: Junwei Zhang Reviewed-by: Evan Quan Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 098336deb946f37a70afc0979af388b615c378bf Author: Wen Yang Date: Thu Nov 29 14:01:50 2018 +0800 drm/msm: Fix error return checking The error checks on ret for a negative error return always fails because the return value of iommu_map_sg() is unsigned and can never be negative. Detected with Coccinelle: drivers/gpu/drm/msm/msm_iommu.c:69:9-12: WARNING: Unsigned expression compared with zero: ret < 0 Signed-off-by: Wen Yang CC: Rob Clark CC: David Airlie CC: Julia Lawall CC: linux-arm-msm@vger.kernel.org CC: dri-devel@lists.freedesktop.org CC: freedreno@lists.freedesktop.org CC: linux-kernel@vger.kernel.org Signed-off-by: Sean Paul commit d9a75a6201d9367a452de59d7759b708633f1a1f Author: Jayant Shekhar Date: Fri Nov 30 17:22:50 2018 +0530 drm/msm/dpu: Ignore alpha for XBGR8888 format Alpha enable in the pixel format will help in selecting the blend rule. By keeping alpha enable to true we are allowing foreground alpha to blend with the layer. If alpha is don't care, then we should not allow pixel alpha to be part of blend equation. Signed-off-by: Jayant Shekhar Signed-off-by: Sean Paul commit ce25aa3ee6939d83979cccf7adc5737cba9a0cb7 Author: YueHaibing Date: Fri Nov 16 19:25:26 2018 +0800 drm/msm: dpu: Fix "WARNING: invalid free of devm_ allocated data" 'dpu_enc' is a member of 'drm_enc' And 'drm_enc' got allocated with devm_kzalloc in dpu_encoder_init. This gives this error message: ./drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c:459:1-6: WARNING: invalid free of devm_ allocated data Signed-off-by: YueHaibing Signed-off-by: Rob Clark Signed-off-by: Sean Paul commit 671465198e39706a125d832857e987ec47ce3ae8 Author: YueHaibing Date: Wed Nov 14 09:55:34 2018 +0000 drm/msm/hdmi: Drop pointless static qualifier in msm_hdmi_bind() There is no need to have the 'struct hdmi_platform_config *hdmi_cfg' variable static since new value always be assigned before use it. Signed-off-by: YueHaibing Signed-off-by: Rob Clark Signed-off-by: Sean Paul commit 2189463dba3eac10d7264a40ede12fc1a3c06fb1 Author: Robert Foss Date: Mon Nov 5 11:13:12 2018 +0100 drm/msm: Move fence put to where failure occurs If dma_fence_wait fails to wait for a supplied in-fence in msm_ioctl_gem_submit, make sure we release that in-fence. Also remove this dma_fence_put() from the 'out' label. Signed-off-by: Robert Foss Reviewed-by: Chris Wilson Cc: stable@vger.kernel.org Signed-off-by: Rob Clark Signed-off-by: Sean Paul commit 081679c51ef2fd7b23cf9ddb7d775b17f75de18c Author: Sean Paul Date: Tue Oct 16 11:52:45 2018 -0400 drm/msm: dpu: Don't set legacy plane->crtc pointer It causes a WARN in drm_atomic_get_plane_state(), and is not used by atomic (or dpu). Signed-off-by: Sean Paul Reviewed-by: Daniel Vetter Signed-off-by: Rob Clark commit d52900437e95e2799953af21971a54fe5f8e33ff Author: Jordan Crouse Date: Mon Oct 15 15:31:54 2018 -0600 drm/msm/gpu: Don't map command buffers with nr_relocs equal to 0 If a command buffer doesn't have any relocs assigned to it there then is no need to map it in the kernel address space. Signed-off-by: Jordan Crouse Signed-off-by: Rob Clark Signed-off-by: Sean Paul commit ee4456359640defe3f51cc6b728bfce4bc444c9e Author: Todor Tomov Date: Fri Oct 19 17:07:22 2018 +0300 drm/msm/hdmi: Enable HPD after HDMI IRQ is set up SoCs that contain MDP5 have a top level wrapper called MDSS that manages locks, power and irq for the sub-blocks within it. Irq for HDMI is also routed through the MDSS. Shortly after the Hot Plug Detection (HPD) is enabled in HDMI, HDMI interrupts are recieved by the MDSS interrupt handler. However at this moment the HDMI irq is still not mapped to the MDSS irq domain so the HDMI irq handler cannot be called to process the interrupts. This leads to a flood of HDMI interrupts on CPU 0. If we are lucky to have the HDMI initialization running on a different CPU, it will eventually map the HDMI irq to MDSS irq domain, the next HDMI interrupt will be handled by the HDMI irq handler, the interrupt flood will stop and we will recover. If the HDMI initialization is running on CPU 0, then it cannot complete and there is nothing to stop the interrupt flood on CPU 0. The system is stuck. Fix this by moving the HPD enablement after the HDMI irq is mapped to the MDSS irq domain. Signed-off-by: Todor Tomov Signed-off-by: Rob Clark Signed-off-by: Sean Paul commit 7f9743abaa79d3491fee7a0446461b0fdd2aeaa5 Author: Jeykumar Sankaran Date: Wed Oct 10 14:11:16 2018 -0700 drm/msm: validate display and event threads While creating display and event threads per crtc, validate them before setting their priorities. changes in v2: - use dev_warn (Abhinav Kumar) changes in v3: - fix compilation error changes in v4: - Remove Change-Id (Sean Paul) - Keep logging within 80 char limit (Sean Paul) Reviewed-by: Sean Paul Signed-off-by: Jeykumar Sankaran Signed-off-by: Rob Clark Signed-off-by: Sean Paul commit 3c613a3bddd322c87677604d81e267fee22c6f14 Author: Sebastian Reichel Date: Wed Nov 21 17:09:14 2018 +0100 drm/omap: fix incorrect union usage The DSI encoder sets dssdev->ops->dsi.set_config, which is stored at the same offset as dssdev->ops->hdmi.set_hdmi_mode. The code in omap_encoder only checks if dssdev->ops->hdmi.set_hdmi_mode is NULL. Due to the way union works, it won't be NULL if dsi.set_config is set. This means dsi_set_config will be called with config=hdmi_mode=false=NULL parameter resulting in a NULL dereference. Also the dereference happens while console is locked, so kernel hangs without any debug output without "fb.lockless_register_fb=1" parameter. This restructures the code, so that the HDMI mode is only configured for HDMI output types. Fixes: 83910ad3f51fb ("drm/omap: Move most omap_dss_driver operations to omap_dss_device_ops") Signed-off-by: Sebastian Reichel Tested-by: Tony Lindgren [tomi.valkeinen@ti.com: dropped the safeguard] Signed-off-by: Tomi Valkeinen Link: https://patchwork.freedesktop.org/patch/msgid/20181121160916.22017-5-sebastian.reichel@collabora.com commit 0a02d495531e0bbe32c3f7361232ba61b981199a Author: Sebastian Reichel Date: Wed Nov 21 17:09:12 2018 +0100 drm/omap: populate DSI platform bus earlier After the changes from 4.20 the DSI encoder tries to find the attached panel before populating the DSI bus. If the panel is not found -EPROBE_DEFER is returned, so the DSI bus is never populated and the panel never added. Fix this by populating the DSI bus before searching for the video sink in dsi_init_output(). Fixes: 27d624527d992 ("drm/omap: dss: Acquire next dssdev at probe time") Acked-by: Pavel Machek Tested-by: Tony Lindgren Tested-by: Pavel Machek Signed-off-by: Sebastian Reichel Signed-off-by: Tomi Valkeinen Link: https://patchwork.freedesktop.org/patch/msgid/20181121160916.22017-3-sebastian.reichel@collabora.com commit 0a7f54ea0e1ed5a8f666e2adee7943b3991b4987 Author: Tomi Valkeinen Date: Mon Nov 26 11:24:47 2018 +0200 drm/omap: fix bus_flags for panel-dpi panel-dpi used to convey the bus-flags via the videomode, but recent changes changed the use of videomode to DRM's drm_display_mode which does not contain bus-flags. This broke panel-dpi, which didn't explicitly store the bus-flags into dssdev->bus_flags. Fix this by setting dssdev->bus_flags. Also change the bus_flags type to u32, as that is the type used in the DRM framework, and we would get a warning with drm_bus_flags_from_videomode() otherwise. Fixes: 3fbda31e814868d8477ddf52d74b7b8f596578e8 ("drm/omap: Split mode fixup and mode set from encoder enable") Signed-off-by: Tomi Valkeinen Reported-by: H. Nikolaus Schaller Link: https://patchwork.freedesktop.org/patch/msgid/20181126092447.11864-1-tomi.valkeinen@ti.com Reviewed-by: Laurent Pinchart commit 182ddd16194cd082f25fa1b063dae3c7c5cce384 Author: Juergen Gross Date: Mon Dec 3 11:38:11 2018 +0100 x86/boot: Clear RSDP address in boot_params for broken loaders Gunnar Krueger reported a systemd-boot failure and bisected it down to: e6e094e053af75 ("x86/acpi, x86/boot: Take RSDP address from boot params if available") In case a broken boot loader doesn't clear its 'struct boot_params', clear rsdp_addr in sanitize_boot_params(). Reported-by: Gunnar Krueger Tested-by: Gunnar Krueger Signed-off-by: Juergen Gross Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: bp@alien8.de Cc: sstabellini@kernel.org Fixes: e6e094e053af75 ("x86/acpi, x86/boot: Take RSDP address from boot params if available") Link: http://lkml.kernel.org/r/20181203103811.17056-1-jgross@suse.com Signed-off-by: Ingo Molnar commit 54947cd64c1b8290f64bb2958e343c07270e3a58 Author: Takashi Iwai Date: Mon Dec 3 10:44:15 2018 +0100 ALSA: hda/realtek - Fix speaker output regression on Thinkpad T570 We've got a regression report for some Thinkpad models (at least T570s) which shows the too low speaker output volume. The bisection leaded to the commit 61fcf8ece9b6 ("ALSA: hda/realtek - Enable Thinkpad Dock device for ALC298 platform"), and it's basically adding the two pin configurations for the dock, and looks harmless. The real culprit seems, though, that the DAC assignment for the speaker pin is implicitly assumed on these devices, i.e. pin NID 0x14 to be coupled with DAC NID 0x03. When more pins are configured by the commit above, the auto-parser changes the DAC assignment, and this resulted in the regression. As a workaround, just provide the fixed pin / DAC mapping table for this Thinkpad fixup function. It's no generic solution, but the problem itself is pretty much device-specific, so must be good enough. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1554304 Fixes: 61fcf8ece9b6 ("ALSA: hda/realtek - Enable Thinkpad Dock device for ALC298 platform") Cc: Reported-and-tested-by: Jeremy Cline Signed-off-by: Takashi Iwai commit d233c7dd1682437ba4b430b04766aa6eef9aef67 Author: Miklos Szeredi Date: Mon Dec 3 10:14:43 2018 +0100 fuse: fix revalidation of attributes for permission check fuse_invalidate_attr() now sets fi->inval_mask instead of fi->i_time, hence we need to check the inval mask in fuse_permission() as well. Signed-off-by: Miklos Szeredi Fixes: 2f1e81965fd0 ("fuse: allow fine grained attr cache invaldation") commit a9c2d1e82fc2937baf43c0d400f0c9e87dcf035d Author: Miklos Szeredi Date: Mon Dec 3 10:14:43 2018 +0100 fuse: fix fsync on directory Commit ab2257e9941b ("fuse: reduce size of struct fuse_inode") moved parts of fields related to writeback on regular file and to directory caching into a union. However fuse_fsync_common() called from fuse_dir_fsync() touches some writeback related fields, resulting in a crash. Move writeback related parts from fuse_fsync_common() to fuse_fysnc(). Reported-by: Brett Girton Tested-by: Brett Girton Fixes: ab2257e9941b ("fuse: reduce size of struct fuse_inode") Signed-off-by: Miklos Szeredi commit a40fa231bb64b33e2cd54cf8ef44a9f89875fa11 Author: Tina Zhang Date: Mon Dec 3 16:29:23 2018 +0800 drm/i915/gvt: Fix tiled memory decoding bug on BDW Commit b244ffa15c8b ("drm/i915/gvt: Fix drm_format_mod value for vGPU plane") introduced a regression issue to the tiled memory decoding on BDW. This patch can fix this issue. Here is the issue detail: https://github.com/intel/gvt-linux/issues/61 v1->v2: - Refine the commit message. (Zhenyu) Fixes: b244ffa15c8b("drm/i915/gvt: Fix drm_format_mod value for vGPU plane") Signed-off-by: Tina Zhang Cc: stable@vger.kernel.org # v4.19+ Cc: Zhenyu Wang Signed-off-by: Zhenyu Wang commit 37c2578c0c40e286bc0d30bdc05290b2058cf66e Author: Dexuan Cui Date: Mon Dec 3 00:54:35 2018 +0000 Drivers: hv: vmbus: Offload the handling of channels to two workqueues vmbus_process_offer() mustn't call channel->sc_creation_callback() directly for sub-channels, because sc_creation_callback() -> vmbus_open() may never get the host's response to the OPEN_CHANNEL message (the host may rescind a channel at any time, e.g. in the case of hot removing a NIC), and vmbus_onoffer_rescind() may not wake up the vmbus_open() as it's blocked due to a non-zero vmbus_connection.offer_in_progress, and finally we have a deadlock. The above is also true for primary channels, if the related device drivers use sync probing mode by default. And, usually the handling of primary channels and sub-channels can depend on each other, so we should offload them to different workqueues to avoid possible deadlock, e.g. in sync-probing mode, NIC1's netvsc_subchan_work() can race with NIC2's netvsc_probe() -> rtnl_lock(), and causes deadlock: the former gets the rtnl_lock and waits for all the sub-channels to appear, but the latter can't get the rtnl_lock and this blocks the handling of sub-channels. The patch can fix the multiple-NIC deadlock described above for v3.x kernels (e.g. RHEL 7.x) which don't support async-probing of devices, and v4.4, v4.9, v4.14 and v4.18 which support async-probing but don't enable async-probing for Hyper-V drivers (yet). The patch can also fix the hang issue in sub-channel's handling described above for all versions of kernels, including v4.19 and v4.20-rc4. So actually the patch should be applied to all the existing kernels, not only the kernels that have 8195b1396ec8. Fixes: 8195b1396ec8 ("hv_netvsc: fix deadlock on hotplug") Cc: stable@vger.kernel.org Cc: Stephen Hemminger Cc: K. Y. Srinivasan Cc: Haiyang Zhang Signed-off-by: Dexuan Cui Signed-off-by: K. Y. Srinivasan Signed-off-by: Greg Kroah-Hartman commit 94d0fb159da94cb4522e14d6004bb7acf2ff0387 Author: Yangtao Li Date: Fri Nov 30 21:20:48 2018 -0500 ide: Change to use DEFINE_SHOW_ATTRIBUTE macro Use DEFINE_SHOW_ATTRIBUTE macro to simplify the code. Signed-off-by: Yangtao Li Signed-off-by: David S. Miller commit a51921c0db3fd26c4ed83dc0ec5d32988fa02aa5 Author: Yangtao Li Date: Tue Nov 20 08:02:49 2018 -0500 ide: pmac: add of_node_put() use of_node_put() to release the refcount. Signed-off-by: Yangtao Li Signed-off-by: David S. Miller commit dac097c4546e4c5b16dd303a1e97c1d319c8ab3e Author: Yangtao Li Date: Wed Nov 21 10:22:54 2018 -0500 drivers/tty: add missing of_node_put() of_find_node_by_path() acquires a reference to the node returned by it and that reference needs to be dropped by its caller. This place is not doing this, so fix it. Signed-off-by: Yangtao Li Signed-off-by: David S. Miller commit 6bd520ab7cf69486ea81fd3cdfd2d5a390ad1100 Author: Yangtao Li Date: Tue Nov 20 08:38:26 2018 -0500 drivers/sbus/char: add of_node_put() use of_node_put() to release the refcount. Signed-off-by: Yangtao Li Signed-off-by: David S. Miller commit 87d81a23e24f24ebe014891e8bdf3ff8785031e8 Author: Yangtao Li Date: Tue Nov 20 08:30:40 2018 -0500 sbus: char: add of_node_put() use of_node_put() to release the refcount. Signed-off-by: Yangtao Li Signed-off-by: David S. Miller commit a0071bc455da7b830b9517058933a83eb6cc902a Author: Nicolas Boichat Date: Mon Nov 26 12:07:37 2018 +0800 drm/mediatek: Only try to attach bridge if there is one Even if dsi->bridge is NULL, we still try to call drm_bridge_attach, and print out an error message, before creating the connector. When no bridge is provided, let's skip these 2 steps and directly create the connector. Signed-off-by: Nicolas Boichat Signed-off-by: CK Hu Reviewed-by: Andrzej Hajda commit 63e19c8216bb03a1b4d10f6637d1324ae7a2b612 Author: Guo Ren Date: Tue Nov 20 16:06:57 2018 +0800 csky: bugfix tlb_get_pgd error. It's wrong to mask/unmask highest bit in addr to translate the vaddr to paddr. We should use PAGE_OFFSET and PHYS_OFFSET. Wrong implement: return ((get_pgd()|(1<<31)) - PHYS_OFFSET) & ~1; When PHYS_OFFSET=0xc0000000 and get_pgd() return 0xe0000000, it'll return 0x60000000. It's wrong and should be 0xa0000000. Now correct it to: return ((get_pgd() - PHYS_OFFSET) & ~1) + PAGE_OFFSET; Signed-off-by: Guo Ren commit b4b84da36403bf1142d17fe7b06c2d639c9c9b8b Author: Guo Ren Date: Tue Nov 6 15:21:14 2018 +0800 MAINTAINERS: add maintainer for C-SKY drivers There are two intc drivers and two clocksource drivers, also include related dt-bindings' documentations. Change ren_guo@c-sky.com to guoren@kernel.org Signed-off-by: Guo Ren Acked-by: Daniel Lezcano commit 2595646791c319cadfdbf271563aac97d0843dc7 Author: Linus Torvalds Date: Sun Dec 2 15:07:55 2018 -0800 Linux 4.20-rc5 commit 6a512726090a5cfd8d5cd41652d2b98a222854b8 Merge: 292974c5acae bfed4d730823 Author: Linus Torvalds Date: Sun Dec 2 12:19:44 2018 -0800 Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Olof Johansson: "Volume is a little higher than usual due to a set of gpio fixes for Davinci platforms that's been around a while, still seemed appropriate to not hold off until next merge window. Besides that it's the usual mix of minor fixes, mostly corrections of small stuff in device trees. Major stability-related one is the removal of a regulator from DT on Rock960, since DVFS caused undervoltage. I expect it'll be restored once they figure out the underlying issue" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (28 commits) MAINTAINERS: Remove unused Qualcomm SoC mailing list ARM: davinci: dm644x: set the GPIO base to 0 ARM: davinci: da830: set the GPIO base to 0 ARM: davinci: dm355: set the GPIO base to 0 ARM: davinci: dm646x: set the GPIO base to 0 ARM: davinci: dm365: set the GPIO base to 0 ARM: davinci: da850: set the GPIO base to 0 gpio: davinci: restore a way to manually specify the GPIO base ARM: davinci: dm644x: define gpio interrupts as separate resources ARM: davinci: dm355: define gpio interrupts as separate resources ARM: davinci: dm646x: define gpio interrupts as separate resources ARM: davinci: dm365: define gpio interrupts as separate resources ARM: davinci: da8xx: define gpio interrupts as separate resources ARM: dts: at91: sama5d2: use the divided clock for SMC ARM: dts: imx51-zii-rdu1: Remove EEPROM node ARM: dts: rockchip: Remove @0 from the veyron memory node arm64: dts: rockchip: Fix PCIe reset polarity for rk3399-puma-haikou. arm64: dts: qcom: msm8998: Reserve gpio ranges on MTP arm64: dts: sdm845-mtp: Reserve reserved gpios arm64: dts: ti: k3-am654: Fix wakeup_uart reg address ... commit 292974c5acae330186cbf5a833385f666aeb12c0 Merge: a234c7371fd8 975ef94a0284 Author: Linus Torvalds Date: Sun Dec 2 12:15:55 2018 -0800 Merge tag 'for-linus-4.20a-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: - A revert of a previous commit as it is no longer necessary and has shown to cause problems in some memory hotplug cases. - Some small fixes and a minor cleanup. - A patch for adding better diagnostic data in a very rare failure case. * tag 'for-linus-4.20a-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: pvcalls-front: fixes incorrect error handling Revert "xen/balloon: Mark unallocated host memory as UNUSABLE" xen: xlate_mmu: add missing header to fix 'W=1' warning xen/x86: add diagnostic printout to xen_mc_flush() in case of error x86/xen: cleanup includes in arch/x86/xen/spinlock.c commit a234c7371fd8a71faa000745ce6ffee05e1dc07a Merge: 4b78317679c4 77e75fda94d2 Author: Linus Torvalds Date: Sun Dec 2 12:07:27 2018 -0800 Merge tag 'dmaengine-fix-4.20-rc5' of git://git.infradead.org/users/vkoul/slave-dma Pull dmaengine fixes from Vinod Koul: "This contains two fixes to at_hdmac which fixes long standing bus reported recently on serial transfers causing memory leak. These fixes were done by Richard Genoud" * tag 'dmaengine-fix-4.20-rc5' of git://git.infradead.org/users/vkoul/slave-dma: dmaengine: at_hdmac: fix module unloading dmaengine: at_hdmac: fix memory leak in at_dma_xlate() commit 1e8249b8a4e960018e4baca6b523b8a4500af600 Author: Helge Deller Date: Thu Nov 29 17:05:47 2018 +0100 parisc: Enable -ffunction-sections for modules on 32-bit kernel Frank Schreiner reported, that since kernel 4.18 he faces sysfs-warnings when loading modules on a 32-bit kernel. Here is one such example: sysfs: cannot create duplicate filename '/module/nfs/sections/.text' CPU: 0 PID: 98 Comm: modprobe Not tainted 4.18.0-2-parisc #1 Debian 4.18.10-2 Backtrace: [<1017ce2c>] show_stack+0x3c/0x50 [<107a7210>] dump_stack+0x28/0x38 [<103f900c>] sysfs_warn_dup+0x88/0xac [<103f8b1c>] sysfs_add_file_mode_ns+0x164/0x1d0 [<103f9e70>] internal_create_group+0x11c/0x304 [<103fa0a0>] sysfs_create_group+0x48/0x60 [<1022abe8>] load_module.constprop.35+0x1f9c/0x23b8 [<1022b278>] sys_finit_module+0xd0/0x11c [<101831dc>] syscall_exit+0x0/0x14 This warning gets triggered by the fact, that due to commit 24b6c22504a2 ("parisc: Build kernel without -ffunction-sections") we now get multiple .text sections in the kernel modules for which sysfs_create_group() can't create multiple virtual files. This patch works around the problem by re-enabling the -ffunction-sections compiler option for modules, while keeping it disabled for the non-module kernel code. Reported-by: Frank Scheiner Fixes: 24b6c22504a2 ("parisc: Build kernel without -ffunction-sections") Cc: # v4.18+ Signed-off-by: Helge Deller commit 0a9a4304f3614e25d9de9b63502ca633c01c0d70 Author: Trond Myklebust Date: Sat Dec 1 23:18:00 2018 -0500 SUNRPC: Fix a potential race in xprt_connect() If an asynchronous connection attempt completes while another task is in xprt_connect(), then the call to rpc_sleep_on() could end up racing with the call to xprt_wake_pending_tasks(). So add a second test of the connection state after we've put the task to sleep and set the XPRT_CONNECTING flag, when we know that there can be no asynchronous connection attempts still in progress. Fixes: 0b9e79431377d ("SUNRPC: Move the test for XPRT_CONNECTING into...") Signed-off-by: Trond Myklebust commit 71700bb96047f68a0aae3932466fc7c9ad5ce6c0 Author: Trond Myklebust Date: Fri Nov 30 16:11:15 2018 -0500 SUNRPC: Fix a memory leak in call_encode() If we retransmit an RPC request, we currently end up clobbering the value of req->rq_rcv_buf.bvec that was allocated by the initial call to xprt_request_prepare(req). Signed-off-by: Trond Myklebust commit 8dae5398ab1ac107b1517e8195ed043d5f422bd0 Author: Chuck Lever Date: Fri Nov 30 15:39:57 2018 -0500 SUNRPC: Fix leak of krb5p encode pages call_encode can be invoked more than once per RPC call. Ensure that each call to gss_wrap_req_priv does not overwrite pointers to previously allocated memory. Signed-off-by: Chuck Lever Cc: stable@kernel.org Signed-off-by: Trond Myklebust commit 9bd11523dc1b9293d1eee2c0b8cfc986a312bbce Author: Trond Myklebust Date: Fri Nov 30 12:48:47 2018 -0500 SUNRPC: call_connect_status() must handle tasks that got transmitted If a task failed to get the write lock in the call to xprt_connect(), then it will be queued on xprt->sending. In that case, it is possible for it to get transmitted before the call to call_connect_status(), in which case it needs to be handled by call_transmit_status() instead. Signed-off-by: Trond Myklebust commit ad3cba223ac02dc769c3bbe88efe277bbb457566 Author: Dave Kleikamp Date: Tue Nov 27 19:31:30 2018 +0000 nfs: don't dirty kernel pages read by direct-io When we use direct_IO with an NFS backing store, we can trigger a WARNING in __set_page_dirty(), as below, since we're dirtying the page unnecessarily in nfs_direct_read_completion(). To fix, replicate the logic in commit 53cbf3b157a0 ("fs: direct-io: don't dirtying pages for ITER_BVEC/ITER_KVEC direct read"). Other filesystems that implement direct_IO handle this; most use blockdev_direct_IO(). ceph and cifs have similar logic. mount 127.0.0.1:/export /nfs dd if=/dev/zero of=/nfs/image bs=1M count=200 losetup --direct-io=on -f /nfs/image mkfs.btrfs /dev/loop0 mount -t btrfs /dev/loop0 /mnt/ kernel: WARNING: CPU: 0 PID: 8067 at fs/buffer.c:580 __set_page_dirty+0xaf/0xd0 kernel: Modules linked in: loop(E) nfsv3(E) rpcsec_gss_krb5(E) nfsv4(E) dns_resolver(E) nfs(E) fscache(E) nfsd(E) auth_rpcgss(E) nfs_acl(E) lockd(E) grace(E) fuse(E) tun(E) ip6t_rpfilter(E) ipt_REJECT(E) nf_ kernel: snd_seq(E) snd_seq_device(E) snd_pcm(E) video(E) snd_timer(E) snd(E) soundcore(E) ip_tables(E) xfs(E) libcrc32c(E) sd_mod(E) sr_mod(E) cdrom(E) ata_generic(E) pata_acpi(E) crc32c_intel(E) ahci(E) li kernel: CPU: 0 PID: 8067 Comm: kworker/0:2 Tainted: G E 4.20.0-rc1.master.20181111.ol7.x86_64 #1 kernel: Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 kernel: Workqueue: nfsiod rpc_async_release [sunrpc] kernel: RIP: 0010:__set_page_dirty+0xaf/0xd0 kernel: Code: c3 48 8b 02 f6 c4 04 74 d4 48 89 df e8 ba 05 f7 ff 48 89 c6 eb cb 48 8b 43 08 a8 01 75 1f 48 89 d8 48 8b 00 a8 04 74 02 eb 87 <0f> 0b eb 83 48 83 e8 01 eb 9f 48 83 ea 01 0f 1f 00 eb 8b 48 83 e8 kernel: RSP: 0000:ffffc1c8825b7d78 EFLAGS: 00013046 kernel: RAX: 000fffffc0020089 RBX: fffff2b603308b80 RCX: 0000000000000001 kernel: RDX: 0000000000000001 RSI: ffff9d11478115c8 RDI: ffff9d11478115d0 kernel: RBP: ffffc1c8825b7da0 R08: 0000646f6973666e R09: 8080808080808080 kernel: R10: 0000000000000001 R11: 0000000000000000 R12: ffff9d11478115d0 kernel: R13: ffff9d11478115c8 R14: 0000000000003246 R15: 0000000000000001 kernel: FS: 0000000000000000(0000) GS:ffff9d115ba00000(0000) knlGS:0000000000000000 kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 kernel: CR2: 00007f408686f640 CR3: 0000000104d8e004 CR4: 00000000000606f0 kernel: DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 kernel: DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 kernel: Call Trace: kernel: __set_page_dirty_buffers+0xb6/0x110 kernel: set_page_dirty+0x52/0xb0 kernel: nfs_direct_read_completion+0xc4/0x120 [nfs] kernel: nfs_pgio_release+0x10/0x20 [nfs] kernel: rpc_free_task+0x30/0x70 [sunrpc] kernel: rpc_async_release+0x12/0x20 [sunrpc] kernel: process_one_work+0x174/0x390 kernel: worker_thread+0x4f/0x3e0 kernel: kthread+0x102/0x140 kernel: ? drain_workqueue+0x130/0x130 kernel: ? kthread_stop+0x110/0x110 kernel: ret_from_fork+0x35/0x40 kernel: ---[ end trace 01341980905412c9 ]--- Signed-off-by: Dave Kleikamp Signed-off-by: Santosh Shilimkar [forward-ported to v4.20] Signed-off-by: Calum Mackay Reviewed-by: Dave Kleikamp Reviewed-by: Chuck Lever Signed-off-by: Trond Myklebust commit 320f35b7bf8cccf1997ca3126843535e1b95e9c4 Author: Tigran Mkrtchyan Date: Mon Nov 26 18:35:14 2018 +0100 flexfiles: enforce per-mirror stateid only for v4 DSes Since commit bb21ce0ad227 we always enforce per-mirror stateid. However, this makes sense only for v4+ servers. Signed-off-by: Tigran Mkrtchyan Signed-off-by: Trond Myklebust commit a73d4e1490913b76b292f91553b7ba08a65caa3f Author: Alexander Aring Date: Thu Nov 29 17:41:54 2018 -0500 ieee802154: hwsim: fix off-by-one in parse nested This patch fixes a off-by-one mistake in nla_parse_nested() functions of mac802154_hwsim driver. I had to enabled stack protector so I was able to reproduce it. Reference: https://github.com/linux-wpan/wpan-tools/issues/17 Signed-off-by: Alexander Aring Signed-off-by: Stefan Schmidt commit 4b78317679c4f3782a3cff0ddb269c1fcfde7621 Merge: 880584176ed7 55a974021ec9 Author: Linus Torvalds Date: Sat Dec 1 12:35:48 2018 -0800 Merge branch 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull STIBP fallout fixes from Thomas Gleixner: "The performance destruction department finally got it's act together and came up with a cure for the STIPB regression: - Provide a command line option to control the spectre v2 user space mitigations. Default is either seccomp or prctl (if seccomp is disabled in Kconfig). prctl allows mitigation opt-in, seccomp enables the migitation for sandboxed processes. - Rework the code to handle the conditional STIBP/IBPB control and remove the now unused ptrace_may_access_sched() optimization attempt - Disable STIBP automatically when SMT is disabled - Optimize the switch_to() logic to avoid MSR writes and invocations of __switch_to_xtra(). - Make the asynchronous speculation TIF updates synchronous to prevent stale mitigation state. As a general cleanup this also makes retpoline directly depend on compiler support and removes the 'minimal retpoline' option which just pretended to provide some form of security while providing none" * 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (31 commits) x86/speculation: Provide IBPB always command line options x86/speculation: Add seccomp Spectre v2 user space protection mode x86/speculation: Enable prctl mode for spectre_v2_user x86/speculation: Add prctl() control for indirect branch speculation x86/speculation: Prepare arch_smt_update() for PRCTL mode x86/speculation: Prevent stale SPEC_CTRL msr content x86/speculation: Split out TIF update ptrace: Remove unused ptrace_may_access_sched() and MODE_IBRS x86/speculation: Prepare for conditional IBPB in switch_mm() x86/speculation: Avoid __switch_to_xtra() calls x86/process: Consolidate and simplify switch_to_xtra() code x86/speculation: Prepare for per task indirect branch speculation control x86/speculation: Add command line control for indirect branch speculation x86/speculation: Unify conditional spectre v2 print functions x86/speculataion: Mark command line parser data __initdata x86/speculation: Mark string arrays const correctly x86/speculation: Reorder the spec_v2 code x86/l1tf: Show actual SMT state x86/speculation: Rework SMT state change sched/smt: Expose sched_smt_present static key ... commit dcb40590e69e306030e944a39d0e4bf54247fb68 Author: Roman Gushchin Date: Sat Dec 1 10:39:44 2018 -0800 bpf: refactor bpf_test_run() to separate own failures and test program result After commit f42ee093be29 ("bpf/test_run: support cgroup local storage") the bpf_test_run() function may fail with -ENOMEM, if it's not possible to allocate memory for a cgroup local storage. This error shouldn't be mixed with the return value of the testing program. Let's add an additional argument with a pointer where to store the testing program's result; and make bpf_test_run() return either 0 or -ENOMEM. Fixes: f42ee093be29 ("bpf/test_run: support cgroup local storage") Reported-by: Dan Carpenter Suggested-by: Alexei Starovoitov Signed-off-by: Roman Gushchin Cc: Daniel Borkmann Cc: Alexei Starovoitov Signed-off-by: Alexei Starovoitov commit 880584176ed7875117a5ba76cf316cb60f7ad30b Merge: c734b42583bc 1c9b357ced0b Author: Linus Torvalds Date: Sat Dec 1 11:36:32 2018 -0800 Merge tag 'for-linus-20181201' of git://git.kernel.dk/linux-block Pull block layer fixes from Jens Axboe: - Single range elevator discard merge fix, that caused crashes (Ming) - Fix for a regression in O_DIRECT, where we could potentially lose the error value (Maximilian Heyne) - NVMe pull request from Christoph, with little fixes all over the map for NVMe. * tag 'for-linus-20181201' of git://git.kernel.dk/linux-block: block: fix single range discard merge nvme-rdma: fix double freeing of async event data nvme: flush namespace scanning work just before removing namespaces nvme: warn when finding multi-port subsystems without multipathing enabled fs: fix lost error code in dio_complete nvme-pci: fix surprise removal nvme-fc: initialize nvme_req(rq)->ctrl after calling __nvme_fc_init_request() nvme: Free ctrl device name on init failure commit c734b42583bc391d86ed64e3be25fd5f2c464124 Merge: d8f190ee836a c74eadf881ad Author: Linus Torvalds Date: Sat Dec 1 11:32:49 2018 -0800 Merge tag 'pci-v4.20-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fixes from Bjorn Helgaas: - Fix a link speed checking interface that broke PCIe gen3 cards in gen1 slots (Mikulas Patocka) - Fix an imx6 link training error (Trent Piepho) - Fix a layerscape outbound window accessor calling error (Hou Zhiqiang) - Fix a DesignWare endpoint MSI-X address calculation error (Gustavo Pimentel) * tag 'pci-v4.20-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI: Fix incorrect value returned from pcie_get_speed_cap() PCI: dwc: Fix MSI-X EP framework address calculation bug PCI: layerscape: Fix wrong invocation of outbound window disable accessor PCI: imx6: Fix link training status detection in link up check commit c74eadf881ad634c68880e2c1b504989d95993ee Merge: f1f90e254e46 15cb127e3c8f Author: Bjorn Helgaas Date: Fri Nov 30 23:42:08 2018 -0600 Merge remote-tracking branch 'lorenzo/pci/controller-fixes' into for-linus - Fix DesignWare endpoint MSI-X address calculation bug (Gustavo Pimentel) - Fix Layerscape outbound window disable usage (Hou Zhiqiang) - Fix imx6 link up detection (Trent Piepho) * lorenzo/pci/controller-fixes: PCI: dwc: Fix MSI-X EP framework address calculation bug PCI: layerscape: Fix wrong invocation of outbound window disable accessor PCI: imx6: Fix link training status detection in link up check commit f1f90e254e46e0a14220e4090041f68256fbe297 Author: Mikulas Patocka Date: Mon Nov 26 10:37:13 2018 -0600 PCI: Fix incorrect value returned from pcie_get_speed_cap() The macros PCI_EXP_LNKCAP_SLS_*GB are values, not bit masks. We must mask the register and compare it against them. This fixes errors like this: amdgpu: [powerplay] failed to send message 261 ret is 0 when a PCIe-v3 card is plugged into a PCIe-v1 slot, because the slot is being incorrectly reported as PCIe-v3 capable. 6cf57be0f78e, which appeared in v4.17, added pcie_get_speed_cap() with the incorrect test of PCI_EXP_LNKCAP_SLS as a bitmask. 5d9a63304032, which appeared in v4.19, changed amdgpu to use pcie_get_speed_cap(), so the amdgpu bug reports below are regressions in v4.19. Fixes: 6cf57be0f78e ("PCI: Add pcie_get_speed_cap() to find max supported link speed") Fixes: 5d9a63304032 ("drm/amdgpu: use pcie functions for link width and speed") Link: https://bugs.freedesktop.org/show_bug.cgi?id=108704 Link: https://bugs.freedesktop.org/show_bug.cgi?id=108778 Signed-off-by: Mikulas Patocka [bhelgaas: update comment, remove use of PCI_EXP_LNKCAP_SLS_8_0GB and PCI_EXP_LNKCAP_SLS_16_0GB since those should be covered by PCI_EXP_LNKCAP2, remove test of PCI_EXP_LNKCAP for zero, since that register is required] Signed-off-by: Bjorn Helgaas Acked-by: Alex Deucher Cc: stable@vger.kernel.org # v4.17+ commit bf3d6afbb234156749b640b6c50f714967a85964 Author: Benjamin Herrenschmidt Date: Fri Nov 30 14:54:09 2018 +1100 powerpc: Look for "stdout-path" when setting up legacy consoles Commit 78e5dfea84dc ("powerpc: dts: replace 'linux,stdout-path' with 'stdout-path'") broke the default console on a number of embedded PowerPC systems, because it failed to also update the code in arch/powerpc/kernel/legacy_serial.c to look for that property in addition to the old one. This fixes it. Fixes: 78e5dfea84dc ("powerpc: dts: replace 'linux,stdout-path' with 'stdout-path'") Cc: stable@vger.kernel.org # v4.17+ Signed-off-by: Benjamin Herrenschmidt Reviewed-by: Rob Herring Signed-off-by: Michael Ellerman commit d8f190ee836a4581ba906731835d735cb97948f5 Merge: 6c7954b7eb76 164f7e586739 Author: Linus Torvalds Date: Fri Nov 30 18:45:49 2018 -0800 Merge branch 'akpm' (patches from Andrew) Merge misc fixes from Andrew Morton: "31 fixes" * emailed patches from Andrew Morton : (31 commits) ocfs2: fix potential use after free mm/khugepaged: fix the xas_create_range() error path mm/khugepaged: collapse_shmem() do not crash on Compound mm/khugepaged: collapse_shmem() without freezing new_page mm/khugepaged: minor reorderings in collapse_shmem() mm/khugepaged: collapse_shmem() remember to clear holes mm/khugepaged: fix crashes due to misaccounted holes mm/khugepaged: collapse_shmem() stop if punched or truncated mm/huge_memory: fix lockdep complaint on 32-bit i_size_read() mm/huge_memory: splitting set mapping+index before unfreeze mm/huge_memory: rename freeze_page() to unmap_page() initramfs: clean old path before creating a hardlink kernel/kcov.c: mark funcs in __sanitizer_cov_trace_pc() as notrace psi: make disabling/enabling easier for vendor kernels proc: fixup map_files test on arm debugobjects: avoid recursive calls with kmemleak userfaultfd: shmem: UFFDIO_COPY: set the page dirty if VM_WRITE is not set userfaultfd: shmem: add i_size checks userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas userfaultfd: shmem: allocate anonymous memory for MAP_PRIVATE shmem ... commit 6c7954b7eb76578866eba179709c5883f29f747f Merge: 868dda00b98c 6584297b78b6 Author: Linus Torvalds Date: Fri Nov 30 18:41:06 2018 -0800 Merge tag 'mips_fixes_4.20_4' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull few more MIPS fixes from Paul Burton: - Fix mips_get_syscall_arg() to operate on the task specified when detecting o32 tasks running on MIPS64 kernels. - Fix some incorrect GPIO pin muxing for the MT7620 SoC. - Update the linux-mips mailing list address. * tag 'mips_fixes_4.20_4' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MAINTAINERS: Update linux-mips mailing list address MIPS: ralink: Fix mt7620 nd_sd pinmux mips: fix mips_get_syscall_arg o32 check commit 868dda00b98ccc701a70b8c1b0168fc3bbfd595d Merge: 1f817429b2dd ea2412dc21cc Author: Linus Torvalds Date: Fri Nov 30 18:39:07 2018 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Cortex-A76 erratum workaround - ftrace fix to enable syscall events on arm64 - Fix uninitialised pointer in iort_get_platform_device_domain() * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: ACPI/IORT: Fix iort_get_platform_device_domain() uninitialized pointer value arm64: ftrace: Fix to enable syscall events on arm64 arm64: Add workaround for Cortex-A76 erratum 1286807 commit 1f817429b2ddc08f5c92a5b83d0f303f1e0d1bd4 Merge: fd3b3e0ec59d ef1a84093489 Author: Linus Torvalds Date: Fri Nov 30 18:36:30 2018 -0800 Merge tag 'gcc-plugins-v4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull stackleak plugin fix from Kees Cook: "Fix crash by not allowing kprobing of stackleak_erase() (Alexander Popov)" * tag 'gcc-plugins-v4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: stackleak: Disable function tracing and kprobes for stackleak_erase() commit fd3b3e0ec59db813d3ff665e158b1390ecdcfd14 Merge: 38c7b224ce22 31ffa5638335 Author: Linus Torvalds Date: Fri Nov 30 18:32:33 2018 -0800 Merge tag 'fscache-fixes-20181130' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull fscache and cachefiles fixes from David Howells: "Misc fixes: - Fix an assertion failure at fs/cachefiles/xattr.c:138 caused by a race between a cache object lookup failing and someone attempting to reenable that object, thereby triggering an update of the object's attributes. - Fix an assertion failure at fs/fscache/operation.c:449 caused by a split atomic subtract and atomic read that allows a race to happen. - Fix a leak of backing pages when simultaneously reading the same page from the same object from two or more threads. - Fix a hang due to a race between a cache object being discarded and the corresponding cookie being reenabled. There are also some minor cleanups: - Cast an enum value to a different enum type to prevent clang from generating a warning. This shouldn't cause any sort of change in the emitted code. - Use ktime_get_real_seconds() instead of get_seconds(). This is just used to uniquify a filename for an object to be placed in the graveyard. Objects placed there are deleted by cachfilesd in userspace immediately thereafter. - Remove an initialised, but otherwise unused variable. This should have been entirely optimised away anyway" * tag 'fscache-fixes-20181130' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: fscache, cachefiles: remove redundant variable 'cache' cachefiles: avoid deprecated get_seconds() cachefiles: Explicitly cast enumerated type in put_object fscache: fix race between enablement and dropping of object cachefiles: Fix page leak in cachefiles_read_backing_file while vmscan is active fscache: Fix race in fscache_op_complete() due to split atomic_sub & read cachefiles: Fix an assertion failure when trying to update a failed object commit 35b827b6d06199841a83839e8bb69c0cd13a28be Author: Nicolas Dichtel Date: Thu Nov 29 14:45:39 2018 +0100 tun: forbid iface creation with rtnl ops It's not supported right now (the goal of the initial patch was to support 'ip link del' only). Before the patch: $ ip link add foo type tun [ 239.632660] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 [snip] [ 239.636410] RIP: 0010:register_netdevice+0x8e/0x3a0 This panic occurs because dev->netdev_ops is not set by tun_setup(). But to have something usable, it will require more than just setting netdev_ops. Fixes: f019a7a594d9 ("tun: Implement ip link del tunXXX") CC: Eric W. Biederman Signed-off-by: Nicolas Dichtel Signed-off-by: David S. Miller commit 436c9453a1ac0944b82870ef2e0d9be956b396d9 Author: Jason Wang Date: Thu Nov 29 13:53:16 2018 +0800 virtio-net: keep vnet header zeroed after processing XDP We copy vnet header unconditionally in page_to_skb() this is wrong since XDP may modify the packet data. So let's keep a zeroed vnet header for not confusing the conversion between vnet header and skb metadata. In the future, we should able to detect whether or not the packet was modified and keep using the vnet header when packet was not touched. Fixes: f600b6905015 ("virtio_net: Add XDP support") Reported-by: Pavel Popa Signed-off-by: Jason Wang Signed-off-by: David S. Miller commit 9b2156fab0b0df7c38847148b1d42a57e7985ed1 Merge: c0f53771ba45 e1561fe2dd69 Author: David S. Miller Date: Fri Nov 30 17:22:42 2018 -0800 Merge branch 'tcp-fixes-in-timeout-and-retransmission-accounting' Yuchung Cheng says: ==================== tcp: fixes in timeout and retransmission accounting This patch set has assorted fixes of minor accounting issues in timeout, window probe, and retransmission stats. ==================== Signed-off-by: David S. Miller commit e1561fe2dd69dc5dddd69bd73aa65355bdfb048b Author: Yuchung Cheng Date: Wed Nov 28 16:06:45 2018 -0800 tcp: fix SNMP TCP timeout under-estimation Previously the SNMP TCPTIMEOUTS counter has inconsistent accounting: 1. It counts all SYN and SYN-ACK timeouts 2. It counts timeouts in other states except recurring timeouts and timeouts after fast recovery or disorder state. Such selective accounting makes analysis difficult and complicated. For example the monitoring system needs to collect many other SNMP counters to infer the total amount of timeout events. This patch makes TCPTIMEOUTS counter simply counts all the retransmit timeout (SYN or data or FIN). Signed-off-by: Yuchung Cheng Signed-off-by: Eric Dumazet Signed-off-by: Neal Cardwell Signed-off-by: David S. Miller commit ec641b39457e17774313b66697a8a1dc070257bd Author: Yuchung Cheng Date: Wed Nov 28 16:06:44 2018 -0800 tcp: fix SNMP under-estimation on failed retransmission Previously the SNMP counter LINUX_MIB_TCPRETRANSFAIL is not counting the TSO/GSO properly on failed retransmission. This patch fixes that. Signed-off-by: Yuchung Cheng Signed-off-by: Eric Dumazet Signed-off-by: Neal Cardwell Signed-off-by: David S. Miller commit 3976535af0cb9fe34a55f2ffb8d7e6b39a2f8188 Author: Yuchung Cheng Date: Wed Nov 28 16:06:43 2018 -0800 tcp: fix off-by-one bug on aborting window-probing socket Previously there is an off-by-one bug on determining when to abort a stalled window-probing socket. This patch fixes that so it is consistent with tcp_write_timeout(). Signed-off-by: Yuchung Cheng Signed-off-by: Eric Dumazet Signed-off-by: Neal Cardwell Signed-off-by: David S. Miller commit c0f53771ba45745e5870daf880127925c93f232f Author: Pan Bian Date: Thu Nov 29 07:54:22 2018 +0800 liquidio: read sc->iq_no before release sc The function lio_vf_rep_packet_sent_callback releases the occupation of sc via octeon_free_soft_command. sc should not be used after that. Unfortunately, sc->iq_no is read. To fix this, the patch stores sc->iq_no into a local variable before releasing sc and then uses the local variable instead of sc->iq_no. Signed-off-by: Pan Bian Signed-off-by: David S. Miller commit ef6fcd455278c2be3032a346cc66d9dd9866b787 Author: Cong Wang Date: Wed Nov 28 15:04:05 2018 -0800 mlx5: fix get_ip_proto() IP header is not necessarily located right after struct ethhdr, there could be multiple 802.1Q headers in between, this is why we call __vlan_get_protocol(). Fixes: fe1dc069990c ("net/mlx5e: don't set CHECKSUM_COMPLETE on SCTP packets") Cc: Alaa Hleihel Cc: Or Gerlitz Cc: Saeed Mahameed Signed-off-by: Cong Wang Reviewed-by: Tariq Toukan Acked-by: Saeed Mahameed Signed-off-by: David S. Miller commit a3d7e01da06013dc580641a1da57c3b482d58157 Author: Florian Fainelli Date: Wed Nov 28 13:40:04 2018 -0800 net: dsa: Fix tagging attribute location While introducing the DSA tagging protocol attribute, it was added to the DSA slave network devices, but those actually see untagged traffic (that is their whole purpose). Correct this mistake by putting the tagging sysfs attribute under the DSA master network device where this is the information that we need. While at it, also correct the sysfs documentation mistake that missed the "dsa/" directory component of the attribute. Fixes: 98cdb4807123 ("net: dsa: Expose tagging protocol to user-space") Signed-off-by: Florian Fainelli Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit d74286d2c25ad29dbf9e342955dd8dc31f21653b Author: Joe Stringer Date: Fri Nov 30 15:32:21 2018 -0800 bpf: Improve socket lookup reuseport documentation Improve the wording around socket lookup for reuseport sockets, and ensure that both bpf.h headers are in sync. Signed-off-by: Joe Stringer Signed-off-by: Alexei Starovoitov commit f71c6143c2038df1cb43a4b9c90740d14f77467c Author: Joe Stringer Date: Fri Nov 30 15:32:20 2018 -0800 bpf: Support sk lookup in netns with id 0 David Ahern and Nicolas Dichtel report that the handling of the netns id 0 is incorrect for the BPF socket lookup helpers: rather than finding the netns with id 0, it is resolving to the current netns. This renders the netns_id 0 inaccessible. To fix this, adjust the API for the netns to treat all negative s32 values as a lookup in the current netns (including u64 values which when truncated to s32 become negative), while any values with a positive value in the signed 32-bit integer space would result in a lookup for a socket in the netns corresponding to that id. As before, if the netns with that ID does not exist, no socket will be found. Any netns outside of these ranges will fail to find a corresponding socket, as those values are reserved for future usage. Signed-off-by: Joe Stringer Acked-by: Nicolas Dichtel Acked-by: Joey Pabalinas Signed-off-by: Alexei Starovoitov commit fd6d433865a2ad1f7e018ef80408cb3dc3be1ab3 Author: Davide Caratti Date: Wed Nov 28 18:43:42 2018 +0100 net/sched: act_police: fix memory leak in case of invalid control action when users set an invalid control action, kmemleak complains as follows: # echo clear >/sys/kernel/debug/kmemleak # ./tdc.py -e b48b Test b48b: Add police action with exceed goto chain control action All test results: 1..1 ok 1 - b48b # Add police action with exceed goto chain control action about to flush the tap output if tests need to be skipped done flushing skipped test tap output # echo scan >/sys/kernel/debug/kmemleak # cat /sys/kernel/debug/kmemleak unreferenced object 0xffffa0fafbc3dde0 (size 96): comm "tc", pid 2358, jiffies 4294922738 (age 17.022s) hex dump (first 32 bytes): 2a 00 00 20 00 00 00 00 00 00 7d 00 00 00 00 00 *.. ......}..... f8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000648803d2>] tcf_action_init_1+0x384/0x4c0 [<00000000cb69382e>] tcf_action_init+0x12b/0x1a0 [<00000000847ef0d4>] tcf_action_add+0x73/0x170 [<0000000093656e14>] tc_ctl_action+0x122/0x160 [<0000000023c98e32>] rtnetlink_rcv_msg+0x263/0x2d0 [<000000003493ae9c>] netlink_rcv_skb+0x4d/0x130 [<00000000de63f8ba>] netlink_unicast+0x209/0x2d0 [<00000000c3da0ebe>] netlink_sendmsg+0x2c1/0x3c0 [<000000007a9e0753>] sock_sendmsg+0x33/0x40 [<00000000457c6d2e>] ___sys_sendmsg+0x2a0/0x2f0 [<00000000c5c6a086>] __sys_sendmsg+0x5e/0xa0 [<00000000446eafce>] do_syscall_64+0x5b/0x180 [<000000004aa871f2>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [<00000000450c38ef>] 0xffffffffffffffff change tcf_police_init() to avoid leaking 'new' in case TCA_POLICE_RESULT contains TC_ACT_GOTO_CHAIN extended action. Fixes: c08f5ed5d625 ("net/sched: act_police: disallow 'goto chain' on fallback control action") Reported-by: Dan Carpenter Signed-off-by: Davide Caratti Acked-by: Cong Wang Signed-off-by: David S. Miller commit b7df9ada9a7700dbcca1ba53d217c01e3d48179c Author: Daniel Borkmann Date: Sat Dec 1 01:18:53 2018 +0100 bpf: fix pointer offsets in context for 32 bit Currently, pointer offsets in three BPF context structures are broken in two scenarios: i) 32 bit compiled applications running on 64 bit kernels, and ii) LLVM compiled BPF programs running on 32 bit kernels. The latter is due to BPF target machine being strictly 64 bit. So in each of the cases the offsets will mismatch in verifier when checking / rewriting context access. Fix this by providing a helper macro __bpf_md_ptr() that will enforce padding up to 64 bit and proper alignment, and for context access a macro bpf_ctx_range_ptr() which will cover full 64 bit member range on 32 bit archs. For flow_keys, we additionally need to force the size check to sizeof(__u64) as with other pointer types. Fixes: d58e468b1112 ("flow_dissector: implements flow dissector BPF hook") Fixes: 4f738adba30a ("bpf: create tcp_bpf_ulp allowing BPF to monitor socket TX/RX data") Fixes: 2dbb9b9e6df6 ("bpf: Introduce BPF_PROG_TYPE_SK_REUSEPORT") Reported-by: David S. Miller Signed-off-by: Daniel Borkmann Acked-by: David S. Miller Tested-by: David S. Miller Signed-off-by: Alexei Starovoitov commit 6584297b78b66acb80917b664084f303317fcff1 Author: Paul Burton Date: Fri Nov 30 11:57:22 2018 -0800 MAINTAINERS: Update linux-mips mailing list address The linux-mips.org infrastructure has been unreliable recently & nobody with sufficient access to fix it is around to do so. As a result we're moving away from it, and part of this is migrating our mailing list to kernel.org. Replace all instances of linux-mips@linux-mips.org in MAINTAINERS with the shiny new linux-mips@vger.kernel.org address. The new list is now being archived on kernel.org at https://lore.kernel.org/linux-mips/ which also holds the history of the old linux-mips.org list. Signed-off-by: Paul Burton Cc: linux-mips@vger.kernel.org Cc: linux-mips@linux-mips.org commit 164f7e586739d07eb56af6f6d66acebb11f315c8 Author: Pan Bian Date: Fri Nov 30 14:10:54 2018 -0800 ocfs2: fix potential use after free ocfs2_get_dentry() calls iput(inode) to drop the reference count of inode, and if the reference count hits 0, inode is freed. However, in this function, it then reads inode->i_generation, which may result in a use after free bug. Move the put operation later. Link: http://lkml.kernel.org/r/1543109237-110227-1-git-send-email-bianpan2016@163.com Fixes: 781f200cb7a("ocfs2: Remove masklog ML_EXPORT.") Signed-off-by: Pan Bian Reviewed-by: Andrew Morton Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Cc: Changwei Ge Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 95feeabb77149f7d48f05bde61d75621c57db67e Author: Hugh Dickins Date: Fri Nov 30 14:10:50 2018 -0800 mm/khugepaged: fix the xas_create_range() error path collapse_shmem()'s xas_nomem() is very unlikely to fail, but it is rightly given a failure path, so move the whole xas_create_range() block up before __SetPageLocked(new_page): so that it does not need to remember to unlock_page(new_page). Add the missing mem_cgroup_cancel_charge(), and set (currently unused) result to SCAN_FAIL rather than SCAN_SUCCEED. Link: http://lkml.kernel.org/r/alpine.LSU.2.11.1811261531200.2275@eggly.anvils Fixes: 77da9389b9d5 ("mm: Convert collapse_shmem to XArray") Signed-off-by: Hugh Dickins Cc: Matthew Wilcox Cc: Kirill A. Shutemov Cc: Jerome Glisse Cc: Konstantin Khlebnikov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 06a5e1268a5fb9c2b346a3da6b97e85f2eba0f07 Author: Hugh Dickins Date: Fri Nov 30 14:10:47 2018 -0800 mm/khugepaged: collapse_shmem() do not crash on Compound collapse_shmem()'s VM_BUG_ON_PAGE(PageTransCompound) was unsafe: before it holds page lock of the first page, racing truncation then extension might conceivably have inserted a hugepage there already. Fail with the SCAN_PAGE_COMPOUND result, instead of crashing (CONFIG_DEBUG_VM=y) or otherwise mishandling the unexpected hugepage - though later we might code up a more constructive way of handling it, with SCAN_SUCCESS. Link: http://lkml.kernel.org/r/alpine.LSU.2.11.1811261529310.2275@eggly.anvils Fixes: f3f0e1d2150b2 ("khugepaged: add support of collapse for tmpfs/shmem pages") Signed-off-by: Hugh Dickins Cc: Kirill A. Shutemov Cc: Jerome Glisse Cc: Konstantin Khlebnikov Cc: Matthew Wilcox Cc: [4.8+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 87c460a0bded56195b5eb497d44709777ef7b415 Author: Hugh Dickins Date: Fri Nov 30 14:10:43 2018 -0800 mm/khugepaged: collapse_shmem() without freezing new_page khugepaged's collapse_shmem() does almost all of its work, to assemble the huge new_page from 512 scattered old pages, with the new_page's refcount frozen to 0 (and refcounts of all old pages so far also frozen to 0). Including shmem_getpage() to read in any which were out on swap, memory reclaim if necessary to allocate their intermediate pages, and copying over all the data from old to new. Imagine the frozen refcount as a spinlock held, but without any lock debugging to highlight the abuse: it's not good, and under serious load heads into lockups - speculative getters of the page are not expecting to spin while khugepaged is rescheduled. One can get a little further under load by hacking around elsewhere; but fortunately, freezing the new_page turns out to have been entirely unnecessary, with no hacks needed elsewhere. The huge new_page lock is already held throughout, and guards all its subpages as they are brought one by one into the page cache tree; and anything reading the data in that page, without the lock, before it has been marked PageUptodate, would already be in the wrong. So simply eliminate the freezing of the new_page. Each of the old pages remains frozen with refcount 0 after it has been replaced by a new_page subpage in the page cache tree, until they are all unfrozen on success or failure: just as before. They could be unfrozen sooner, but cause no problem once no longer visible to find_get_entry(), filemap_map_pages() and other speculative lookups. Link: http://lkml.kernel.org/r/alpine.LSU.2.11.1811261527570.2275@eggly.anvils Fixes: f3f0e1d2150b2 ("khugepaged: add support of collapse for tmpfs/shmem pages") Signed-off-by: Hugh Dickins Acked-by: Kirill A. Shutemov Cc: Jerome Glisse Cc: Konstantin Khlebnikov Cc: Matthew Wilcox Cc: [4.8+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 042a30824871fa3149b0127009074b75cc25863c Author: Hugh Dickins Date: Fri Nov 30 14:10:39 2018 -0800 mm/khugepaged: minor reorderings in collapse_shmem() Several cleanups in collapse_shmem(): most of which probably do not really matter, beyond doing things in a more familiar and reassuring order. Simplify the failure gotos in the main loop, and on success update stats while interrupts still disabled from the last iteration. Link: http://lkml.kernel.org/r/alpine.LSU.2.11.1811261526400.2275@eggly.anvils Fixes: f3f0e1d2150b2 ("khugepaged: add support of collapse for tmpfs/shmem pages") Signed-off-by: Hugh Dickins Acked-by: Kirill A. Shutemov Cc: Jerome Glisse Cc: Konstantin Khlebnikov Cc: Matthew Wilcox Cc: [4.8+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2af8ff291848cc4b1cce24b6c943394eb2c761e8 Author: Hugh Dickins Date: Fri Nov 30 14:10:35 2018 -0800 mm/khugepaged: collapse_shmem() remember to clear holes Huge tmpfs testing reminds us that there is no __GFP_ZERO in the gfp flags khugepaged uses to allocate a huge page - in all common cases it would just be a waste of effort - so collapse_shmem() must remember to clear out any holes that it instantiates. The obvious place to do so, where they are put into the page cache tree, is not a good choice: because interrupts are disabled there. Leave it until further down, once success is assured, where the other pages are copied (before setting PageUptodate). Link: http://lkml.kernel.org/r/alpine.LSU.2.11.1811261525080.2275@eggly.anvils Fixes: f3f0e1d2150b2 ("khugepaged: add support of collapse for tmpfs/shmem pages") Signed-off-by: Hugh Dickins Acked-by: Kirill A. Shutemov Cc: Jerome Glisse Cc: Konstantin Khlebnikov Cc: Matthew Wilcox Cc: [4.8+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aaa52e340073b7f4593b3c4ddafcafa70cf838b5 Author: Hugh Dickins Date: Fri Nov 30 14:10:29 2018 -0800 mm/khugepaged: fix crashes due to misaccounted holes Huge tmpfs testing on a shortish file mapped into a pmd-rounded extent hit shmem_evict_inode()'s WARN_ON(inode->i_blocks) followed by clear_inode()'s BUG_ON(inode->i_data.nrpages) when the file was later closed and unlinked. khugepaged's collapse_shmem() was forgetting to update mapping->nrpages on the rollback path, after it had added but then needs to undo some holes. There is indeed an irritating asymmetry between shmem_charge(), whose callers want it to increment nrpages after successfully accounting blocks, and shmem_uncharge(), when __delete_from_page_cache() already decremented nrpages itself: oh well, just add a comment on that to them both. And shmem_recalc_inode() is supposed to be called when the accounting is expected to be in balance (so it can deduce from imbalance that reclaim discarded some pages): so change shmem_charge() to update nrpages earlier (though it's rare for the difference to matter at all). Link: http://lkml.kernel.org/r/alpine.LSU.2.11.1811261523450.2275@eggly.anvils Fixes: 800d8c63b2e98 ("shmem: add huge pages support") Fixes: f3f0e1d2150b2 ("khugepaged: add support of collapse for tmpfs/shmem pages") Signed-off-by: Hugh Dickins Acked-by: Kirill A. Shutemov Cc: Jerome Glisse Cc: Konstantin Khlebnikov Cc: Matthew Wilcox Cc: [4.8+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 701270fa193aadf00bdcf607738f64997275d4c7 Author: Hugh Dickins Date: Fri Nov 30 14:10:25 2018 -0800 mm/khugepaged: collapse_shmem() stop if punched or truncated Huge tmpfs testing showed that although collapse_shmem() recognizes a concurrently truncated or hole-punched page correctly, its handling of holes was liable to refill an emptied extent. Add check to stop that. Link: http://lkml.kernel.org/r/alpine.LSU.2.11.1811261522040.2275@eggly.anvils Fixes: f3f0e1d2150b2 ("khugepaged: add support of collapse for tmpfs/shmem pages") Signed-off-by: Hugh Dickins Reviewed-by: Matthew Wilcox Cc: Kirill A. Shutemov Cc: Jerome Glisse Cc: Konstantin Khlebnikov Cc: [4.8+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 006d3ff27e884f80bd7d306b041afc415f63598f Author: Hugh Dickins Date: Fri Nov 30 14:10:21 2018 -0800 mm/huge_memory: fix lockdep complaint on 32-bit i_size_read() Huge tmpfs testing, on 32-bit kernel with lockdep enabled, showed that __split_huge_page() was using i_size_read() while holding the irq-safe lru_lock and page tree lock, but the 32-bit i_size_read() uses an irq-unsafe seqlock which should not be nested inside them. Instead, read the i_size earlier in split_huge_page_to_list(), and pass the end offset down to __split_huge_page(): all while holding head page lock, which is enough to prevent truncation of that extent before the page tree lock has been taken. Link: http://lkml.kernel.org/r/alpine.LSU.2.11.1811261520070.2275@eggly.anvils Fixes: baa355fd33142 ("thp: file pages support for split_huge_page()") Signed-off-by: Hugh Dickins Acked-by: Kirill A. Shutemov Cc: Jerome Glisse Cc: Konstantin Khlebnikov Cc: Matthew Wilcox Cc: [4.8+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 173d9d9fd3ddae84c110fea8aedf1f26af6be9ec Author: Hugh Dickins Date: Fri Nov 30 14:10:16 2018 -0800 mm/huge_memory: splitting set mapping+index before unfreeze Huge tmpfs stress testing has occasionally hit shmem_undo_range()'s VM_BUG_ON_PAGE(page_to_pgoff(page) != index, page). Move the setting of mapping and index up before the page_ref_unfreeze() in __split_huge_page_tail() to fix this: so that a page cache lookup cannot get a reference while the tail's mapping and index are unstable. In fact, might as well move them up before the smp_wmb(): I don't see an actual need for that, but if I'm missing something, this way round is safer than the other, and no less efficient. You might argue that VM_BUG_ON_PAGE(page_to_pgoff(page) != index, page) is misplaced, and should be left until after the trylock_page(); but left as is has not crashed since, and gives more stringent assurance. Link: http://lkml.kernel.org/r/alpine.LSU.2.11.1811261516380.2275@eggly.anvils Fixes: e9b61f19858a5 ("thp: reintroduce split_huge_page()") Requires: 605ca5ede764 ("mm/huge_memory.c: reorder operations in __split_huge_page_tail()") Signed-off-by: Hugh Dickins Acked-by: Kirill A. Shutemov Cc: Konstantin Khlebnikov Cc: Jerome Glisse Cc: Matthew Wilcox Cc: [4.8+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 906f9cdfc2a0800f13683f9e4ebdfd08c12ee81b Author: Hugh Dickins Date: Fri Nov 30 14:10:13 2018 -0800 mm/huge_memory: rename freeze_page() to unmap_page() The term "freeze" is used in several ways in the kernel, and in mm it has the particular meaning of forcing page refcount temporarily to 0. freeze_page() is just too confusing a name for a function that unmaps a page: rename it unmap_page(), and rename unfreeze_page() remap_page(). Went to change the mention of freeze_page() added later in mm/rmap.c, but found it to be incorrect: ordinary page reclaim reaches there too; but the substance of the comment still seems correct, so edit it down. Link: http://lkml.kernel.org/r/alpine.LSU.2.11.1811261514080.2275@eggly.anvils Fixes: e9b61f19858a5 ("thp: reintroduce split_huge_page()") Signed-off-by: Hugh Dickins Acked-by: Kirill A. Shutemov Cc: Jerome Glisse Cc: Konstantin Khlebnikov Cc: Matthew Wilcox Cc: [4.8+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7c0950d455d6ab610d2990a13120f935b75abf2c Author: Li Zhijian Date: Fri Nov 30 14:10:09 2018 -0800 initramfs: clean old path before creating a hardlink sys_link() can fail due to the new path already existing. This case ofen occurs when we use a concated initrd, for example: 1) prepare a basic rootfs, it contains a regular files rc.local lizhijian@:~/yocto-tiny-i386-2016-04-22$ cat etc/rc.local #!/bin/sh echo "Running /etc/rc.local..." yocto-tiny-i386-2016-04-22$ find . | sed 's,^\./,,' | cpio -o -H newc | gzip -n -9 >../rootfs.cgz 2) create a extra initrd which also includes a etc/rc.local lizhijian@:~/lkp-x86_64/etc$ echo "append initrd" >rc.local lizhijian@:~/lkp/lkp-x86_64/etc$ cat rc.local append initrd lizhijian@:~/lkp/lkp-x86_64/etc$ ln rc.local rc.local.hardlink append initrd lizhijian@:~/lkp/lkp-x86_64/etc$ stat rc.local rc.local.hardlink File: 'rc.local' Size: 14 Blocks: 8 IO Block: 4096 regular file Device: 801h/2049d Inode: 11296086 Links: 2 Access: (0664/-rw-rw-r--) Uid: ( 1002/lizhijian) Gid: ( 1002/lizhijian) Access: 2018-11-15 16:08:28.654464815 +0800 Modify: 2018-11-15 16:07:57.514903210 +0800 Change: 2018-11-15 16:08:24.180228872 +0800 Birth: - File: 'rc.local.hardlink' Size: 14 Blocks: 8 IO Block: 4096 regular file Device: 801h/2049d Inode: 11296086 Links: 2 Access: (0664/-rw-rw-r--) Uid: ( 1002/lizhijian) Gid: ( 1002/lizhijian) Access: 2018-11-15 16:08:28.654464815 +0800 Modify: 2018-11-15 16:07:57.514903210 +0800 Change: 2018-11-15 16:08:24.180228872 +0800 Birth: - lizhijian@:~/lkp/lkp-x86_64$ find . | sed 's,^\./,,' | cpio -o -H newc | gzip -n -9 >../rc-local.cgz lizhijian@:~/lkp/lkp-x86_64$ gzip -dc ../rc-local.cgz | cpio -t . etc etc/rc.local.hardlink <<< it will be extracted first at this initrd etc/rc.local 3) concate 2 initrds and boot lizhijian@:~/lkp$ cat rootfs.cgz rc-local.cgz >concate-initrd.cgz lizhijian@:~/lkp$ qemu-system-x86_64 -nographic -enable-kvm -cpu host -smp 1 -m 1024 -kernel ~/lkp/linux/arch/x86/boot/bzImage -append "console=ttyS0 earlyprint=ttyS0 ignore_loglevel" -initrd ./concate-initr.cgz -serial stdio -nodefaults In this case, sys_link(2) will fail and return -EEXIST, so we can only get the rc.local at rootfs.cgz instead of rc-local.cgz [akpm@linux-foundation.org: move code to avoid forward declaration] Link: http://lkml.kernel.org/r/1542352368-13299-1-git-send-email-lizhijian@cn.fujitsu.com Signed-off-by: Li Zhijian Cc: Philip Li Cc: Dominik Brodowski Cc: Li Zhijian Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 903e8ff86753e6f327bb92166a0665e4ecb8e2e7 Author: Anders Roxell Date: Fri Nov 30 14:10:05 2018 -0800 kernel/kcov.c: mark funcs in __sanitizer_cov_trace_pc() as notrace Since __sanitizer_cov_trace_pc() is marked as notrace, function calls in __sanitizer_cov_trace_pc() shouldn't be traced either. ftrace_graph_caller() gets called for each function that isn't marked 'notrace', like canonicalize_ip(). This is the call trace from a run: [ 139.644550] ftrace_graph_caller+0x1c/0x24 [ 139.648352] canonicalize_ip+0x18/0x28 [ 139.652313] __sanitizer_cov_trace_pc+0x14/0x58 [ 139.656184] sched_clock+0x34/0x1e8 [ 139.659759] trace_clock_local+0x40/0x88 [ 139.663722] ftrace_push_return_trace+0x8c/0x1f0 [ 139.667767] prepare_ftrace_return+0xa8/0x100 [ 139.671709] ftrace_graph_caller+0x1c/0x24 Rework so that check_kcov_mode() and canonicalize_ip() that are called from __sanitizer_cov_trace_pc() are also marked as notrace. Link: http://lkml.kernel.org/r/20181128081239.18317-1-anders.roxell@linaro.org Signed-off-by: Arnd Bergmann Signen-off-by: Anders Roxell Co-developed-by: Arnd Bergmann Acked-by: Steven Rostedt (VMware) Cc: Dmitry Vyukov Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e0c274472d5d27f277af722e017525e0b33784cd Author: Johannes Weiner Date: Fri Nov 30 14:09:58 2018 -0800 psi: make disabling/enabling easier for vendor kernels Mel Gorman reports a hackbench regression with psi that would prohibit shipping the suse kernel with it default-enabled, but he'd still like users to be able to opt in at little to no cost to others. With the current combination of CONFIG_PSI and the psi_disabled bool set from the commandline, this is a challenge. Do the following things to make it easier: 1. Add a config option CONFIG_PSI_DEFAULT_DISABLED that allows distros to enable CONFIG_PSI in their kernel but leave the feature disabled unless a user requests it at boot-time. To avoid double negatives, rename psi_disabled= to psi=. 2. Make psi_disabled a static branch to eliminate any branch costs when the feature is disabled. In terms of numbers before and after this patch, Mel says: : The following is a comparision using CONFIG_PSI=n as a baseline against : your patch and a vanilla kernel : : 4.20.0-rc4 4.20.0-rc4 4.20.0-rc4 : kconfigdisable-v1r1 vanilla psidisable-v1r1 : Amean 1 1.3100 ( 0.00%) 1.3923 ( -6.28%) 1.3427 ( -2.49%) : Amean 3 3.8860 ( 0.00%) 4.1230 * -6.10%* 3.8860 ( -0.00%) : Amean 5 6.8847 ( 0.00%) 8.0390 * -16.77%* 6.7727 ( 1.63%) : Amean 7 9.9310 ( 0.00%) 10.8367 * -9.12%* 9.9910 ( -0.60%) : Amean 12 16.6577 ( 0.00%) 18.2363 * -9.48%* 17.1083 ( -2.71%) : Amean 18 26.5133 ( 0.00%) 27.8833 * -5.17%* 25.7663 ( 2.82%) : Amean 24 34.3003 ( 0.00%) 34.6830 ( -1.12%) 32.0450 ( 6.58%) : Amean 30 40.0063 ( 0.00%) 40.5800 ( -1.43%) 41.5087 ( -3.76%) : Amean 32 40.1407 ( 0.00%) 41.2273 ( -2.71%) 39.9417 ( 0.50%) : : It's showing that the vanilla kernel takes a hit (as the bisection : indicated it would) and that disabling PSI by default is reasonably : close in terms of performance for this particular workload on this : particular machine so; Link: http://lkml.kernel.org/r/20181127165329.GA29728@cmpxchg.org Signed-off-by: Johannes Weiner Tested-by: Mel Gorman Reported-by: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dbd4af54745fc0c805217693c807a3928b2d408b Author: Alexey Dobriyan Date: Fri Nov 30 14:09:53 2018 -0800 proc: fixup map_files test on arm https://bugs.linaro.org/show_bug.cgi?id=3782 Turns out arm doesn't permit mapping address 0, so try minimum virtual address instead. Link: http://lkml.kernel.org/r/20181113165446.GA28157@avx2 Signed-off-by: Alexey Dobriyan Reported-by: Rafael David Tinoco Tested-by: Rafael David Tinoco Acked-by: Cyrill Gorcunov Cc: Shuah Khan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8de456cf87ba863e028c4dd01bae44255ce3d835 Author: Qian Cai Date: Fri Nov 30 14:09:48 2018 -0800 debugobjects: avoid recursive calls with kmemleak CONFIG_DEBUG_OBJECTS_RCU_HEAD does not play well with kmemleak due to recursive calls. fill_pool kmemleak_ignore make_black_object put_object __call_rcu (kernel/rcu/tree.c) debug_rcu_head_queue debug_object_activate debug_object_init fill_pool kmemleak_ignore make_black_object ... So add SLAB_NOLEAKTRACE to kmem_cache_create() to not register newly allocated debug objects at all. Link: http://lkml.kernel.org/r/20181126165343.2339-1-cai@gmx.us Signed-off-by: Qian Cai Suggested-by: Catalin Marinas Acked-by: Waiman Long Acked-by: Catalin Marinas Cc: Thomas Gleixner Cc: Yang Shi Cc: Arnd Bergmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dcf7fe9d89763a28e0f43975b422ff141fe79e43 Author: Andrea Arcangeli Date: Fri Nov 30 14:09:43 2018 -0800 userfaultfd: shmem: UFFDIO_COPY: set the page dirty if VM_WRITE is not set Set the page dirty if VM_WRITE is not set because in such case the pte won't be marked dirty and the page would be reclaimed without writepage (i.e. swapout in the shmem case). This was found by source review. Most apps (certainly including QEMU) only use UFFDIO_COPY on PROT_READ|PROT_WRITE mappings or the app can't modify the memory in the first place. This is for correctness and it could help the non cooperative use case to avoid unexpected data loss. Link: http://lkml.kernel.org/r/20181126173452.26955-6-aarcange@redhat.com Reviewed-by: Hugh Dickins Cc: stable@vger.kernel.org Fixes: 4c27fe4c4c84 ("userfaultfd: shmem: add shmem_mcopy_atomic_pte for userfaultfd support") Reported-by: Hugh Dickins Signed-off-by: Andrea Arcangeli Cc: "Dr. David Alan Gilbert" Cc: Jann Horn Cc: Mike Kravetz Cc: Mike Rapoport Cc: Peter Xu Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e2a50c1f64145a04959df2442305d57307e5395a Author: Andrea Arcangeli Date: Fri Nov 30 14:09:37 2018 -0800 userfaultfd: shmem: add i_size checks With MAP_SHARED: recheck the i_size after taking the PT lock, to serialize against truncate with the PT lock. Delete the page from the pagecache if the i_size_read check fails. With MAP_PRIVATE: check the i_size after the PT lock before mapping anonymous memory or zeropages into the MAP_PRIVATE shmem mapping. A mostly irrelevant cleanup: like we do the delete_from_page_cache() pagecache removal after dropping the PT lock, the PT lock is a spinlock so drop it before the sleepable page lock. Link: http://lkml.kernel.org/r/20181126173452.26955-5-aarcange@redhat.com Fixes: 4c27fe4c4c84 ("userfaultfd: shmem: add shmem_mcopy_atomic_pte for userfaultfd support") Signed-off-by: Andrea Arcangeli Reviewed-by: Mike Rapoport Reviewed-by: Hugh Dickins Reported-by: Jann Horn Cc: Cc: "Dr. David Alan Gilbert" Cc: Mike Kravetz Cc: Peter Xu Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 29ec90660d68bbdd69507c1c8b4e33aa299278b1 Author: Andrea Arcangeli Date: Fri Nov 30 14:09:32 2018 -0800 userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas After the VMA to register the uffd onto is found, check that it has VM_MAYWRITE set before allowing registration. This way we inherit all common code checks before allowing to fill file holes in shmem and hugetlbfs with UFFDIO_COPY. The userfaultfd memory model is not applicable for readonly files unless it's a MAP_PRIVATE. Link: http://lkml.kernel.org/r/20181126173452.26955-4-aarcange@redhat.com Fixes: ff62a3421044 ("hugetlb: implement memfd sealing") Signed-off-by: Andrea Arcangeli Reviewed-by: Mike Rapoport Reviewed-by: Hugh Dickins Reported-by: Jann Horn Fixes: 4c27fe4c4c84 ("userfaultfd: shmem: add shmem_mcopy_atomic_pte for userfaultfd support") Cc: Cc: "Dr. David Alan Gilbert" Cc: Mike Kravetz Cc: Peter Xu Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5b51072e97d587186c2f5390c8c9c1fb7e179505 Author: Andrea Arcangeli Date: Fri Nov 30 14:09:28 2018 -0800 userfaultfd: shmem: allocate anonymous memory for MAP_PRIVATE shmem Userfaultfd did not create private memory when UFFDIO_COPY was invoked on a MAP_PRIVATE shmem mapping. Instead it wrote to the shmem file, even when that had not been opened for writing. Though, fortunately, that could only happen where there was a hole in the file. Fix the shmem-backed implementation of UFFDIO_COPY to create private memory for MAP_PRIVATE mappings. The hugetlbfs-backed implementation was already correct. This change is visible to userland, if userfaultfd has been used in unintended ways: so it introduces a small risk of incompatibility, but is necessary in order to respect file permissions. An app that uses UFFDIO_COPY for anything like postcopy live migration won't notice the difference, and in fact it'll run faster because there will be no copy-on-write and memory waste in the tmpfs pagecache anymore. Userfaults on MAP_PRIVATE shmem keep triggering only on file holes like before. The real zeropage can also be built on a MAP_PRIVATE shmem mapping through UFFDIO_ZEROPAGE and that's safe because the zeropage pte is never dirty, in turn even an mprotect upgrading the vma permission from PROT_READ to PROT_READ|PROT_WRITE won't make the zeropage pte writable. Link: http://lkml.kernel.org/r/20181126173452.26955-3-aarcange@redhat.com Fixes: 4c27fe4c4c84 ("userfaultfd: shmem: add shmem_mcopy_atomic_pte for userfaultfd support") Signed-off-by: Andrea Arcangeli Reported-by: Mike Rapoport Reviewed-by: Hugh Dickins Cc: Cc: "Dr. David Alan Gilbert" Cc: Jann Horn Cc: Mike Kravetz Cc: Peter Xu Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9e368259ad988356c4c95150fafd1a06af095d98 Author: Andrea Arcangeli Date: Fri Nov 30 14:09:25 2018 -0800 userfaultfd: use ENOENT instead of EFAULT if the atomic copy user fails Patch series "userfaultfd shmem updates". Jann found two bugs in the userfaultfd shmem MAP_SHARED backend: the lack of the VM_MAYWRITE check and the lack of i_size checks. Then looking into the above we also fixed the MAP_PRIVATE case. Hugh by source review also found a data loss source if UFFDIO_COPY is used on shmem MAP_SHARED PROT_READ mappings (the production usages incidentally run with PROT_READ|PROT_WRITE, so the data loss couldn't happen in those production usages like with QEMU). The whole patchset is marked for stable. We verified QEMU postcopy live migration with guest running on shmem MAP_PRIVATE run as well as before after the fix of shmem MAP_PRIVATE. Regardless if it's shmem or hugetlbfs or MAP_PRIVATE or MAP_SHARED, QEMU unconditionally invokes a punch hole if the guest mapping is filebacked and a MADV_DONTNEED too (needed to get rid of the MAP_PRIVATE COWs and for the anon backend). This patch (of 5): We internally used EFAULT to communicate with the caller, switch to ENOENT, so EFAULT can be used as a non internal retval. Link: http://lkml.kernel.org/r/20181126173452.26955-2-aarcange@redhat.com Fixes: 4c27fe4c4c84 ("userfaultfd: shmem: add shmem_mcopy_atomic_pte for userfaultfd support") Signed-off-by: Andrea Arcangeli Reviewed-by: Mike Rapoport Reviewed-by: Hugh Dickins Cc: Mike Kravetz Cc: Jann Horn Cc: Peter Xu Cc: "Dr. David Alan Gilbert" Cc: Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5618cf031fecda63847cafd1091e7b8bd626cdb1 Author: Luis Chamberlain Date: Fri Nov 30 14:09:21 2018 -0800 lib/test_kmod.c: fix rmmod double free We free the misc device string twice on rmmod; fix this. Without this we cannot remove the module without crashing. Link: http://lkml.kernel.org/r/20181124050500.5257-1-mcgrof@kernel.org Signed-off-by: Luis Chamberlain Reported-by: Randy Dunlap Reviewed-by: Andrew Morton Cc: [4.12+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c7d7d620dcbd2a1c595092280ca943f2fced7bbd Author: Pan Bian Date: Fri Nov 30 14:09:18 2018 -0800 hfsplus: do not free node before using hfs_bmap_free() frees node via hfs_bnode_put(node). However it then reads node->this when dumping error message on an error path, which may result in a use-after-free bug. This patch frees node only when it is never used. Link: http://lkml.kernel.org/r/1543053441-66942-1-git-send-email-bianpan2016@163.com Signed-off-by: Pan Bian Reviewed-by: Andrew Morton Cc: Ernesto A. Fernandez Cc: Joe Perches Cc: Viacheslav Dubeyko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ce96a407adef126870b3f4a1b73529dd8aa80f49 Author: Pan Bian Date: Fri Nov 30 14:09:14 2018 -0800 hfs: do not free node before using hfs_bmap_free() frees the node via hfs_bnode_put(node). However, it then reads node->this when dumping error message on an error path, which may result in a use-after-free bug. This patch frees the node only when it is never again used. Link: http://lkml.kernel.org/r/1542963889-128825-1-git-send-email-bianpan2016@163.com Fixes: a1185ffa2fc ("HFS rewrite") Signed-off-by: Pan Bian Reviewed-by: Andrew Morton Cc: Joe Perches Cc: Ernesto A. Fernandez Cc: Viacheslav Dubeyko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 94570a413f01dda8938d980d36814eee295d2a58 Author: Alexey Dobriyan Date: Fri Nov 30 14:09:10 2018 -0800 proc: update MAINTAINERS with proc.txt Turns out that /proc has official documentation and people even trying to keep it uptodate. Link: http://lkml.kernel.org/r/20181116134630.GA8004@avx2 Signed-off-by: Alexey Dobriyan Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8f416836c0d50b198cad1225132e5abebf8980dc Author: Wei Yang Date: Fri Nov 30 14:09:07 2018 -0800 mm/page_alloc.c: fix calculation of pgdat->nr_zones init_currently_empty_zone() will adjust pgdat->nr_zones and set it to 'zone_idx(zone) + 1' unconditionally. This is correct in the normal case, while not exact in hot-plug situation. This function is used in two places: * free_area_init_core() * move_pfn_range_to_zone() In the first case, we are sure zone index increase monotonically. While in the second one, this is under users control. One way to reproduce this is: ---------------------------- 1. create a virtual machine with empty node1 -m 4G,slots=32,maxmem=32G \ -smp 4,maxcpus=8 \ -numa node,nodeid=0,mem=4G,cpus=0-3 \ -numa node,nodeid=1,mem=0G,cpus=4-7 2. hot-add cpu 3-7 cpu-add [3-7] 2. hot-add memory to nod1 object_add memory-backend-ram,id=ram0,size=1G device_add pc-dimm,id=dimm0,memdev=ram0,node=1 3. online memory with following order echo online_movable > memory47/state echo online > memory40/state After this, node1 will have its nr_zones equals to (ZONE_NORMAL + 1) instead of (ZONE_MOVABLE + 1). Michal said: "Having an incorrect nr_zones might result in all sorts of problems which would be quite hard to debug (e.g. reclaim not considering the movable zone). I do not expect many users would suffer from this it but still this is trivial and obviously right thing to do so backporting to the stable tree shouldn't be harmful (last famous words)" Link: http://lkml.kernel.org/r/20181117022022.9956-1-richard.weiyang@gmail.com Fixes: f1dd2cd13c4b ("mm, memory_hotplug: do not associate hotadded memory to zones until online") Signed-off-by: Wei Yang Acked-by: Michal Hocko Reviewed-by: Oscar Salvador Cc: Anshuman Khandual Cc: Dave Hansen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c1cb20d43728aa9b5393bd8d489bc85c142949b2 Author: Yu Zhao Date: Fri Nov 30 14:09:03 2018 -0800 mm: use swp_offset as key in shmem_replace_page() We changed the key of swap cache tree from swp_entry_t.val to swp_offset. We need to do so in shmem_replace_page() as well. Hugh said: "shmem_replace_page() has been wrong since the day I wrote it: good enough to work on swap "type" 0, which is all most people ever use (especially those few who need shmem_replace_page() at all), but broken once there are any non-0 swp_type bits set in the higher order bits" Link: http://lkml.kernel.org/r/20181121215442.138545-1-yuzhao@google.com Fixes: f6ab1f7f6b2d ("mm, swap: use offset of swap entry as key of swap cache") Signed-off-by: Yu Zhao Reviewed-by: Matthew Wilcox Acked-by: Hugh Dickins Cc: [4.9+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6ff38bd40230af35e446239396e5fc8ebd6a5248 Author: Pavel Tikhomirov Date: Fri Nov 30 14:09:00 2018 -0800 mm: cleancache: fix corruption on missed inode invalidation If all pages are deleted from the mapping by memory reclaim and also moved to the cleancache: __delete_from_page_cache (no shadow case) unaccount_page_cache_page cleancache_put_page page_cache_delete mapping->nrpages -= nr (nrpages becomes 0) We don't clean the cleancache for an inode after final file truncation (removal). truncate_inode_pages_final check (nrpages || nrexceptional) is false no truncate_inode_pages no cleancache_invalidate_inode(mapping) These way when reading the new file created with same inode we may get these trash leftover pages from cleancache and see wrong data instead of the contents of the new file. Fix it by always doing truncate_inode_pages which is already ready for nrpages == 0 && nrexceptional == 0 case and just invalidates inode. [akpm@linux-foundation.org: add comment, per Jan] Link: http://lkml.kernel.org/r/20181112095734.17979-1-ptikhomirov@virtuozzo.com Fixes: commit 91b0abe36a7b ("mm + fs: store shadow entries in page cache") Signed-off-by: Pavel Tikhomirov Reviewed-by: Vasily Averin Reviewed-by: Andrey Ryabinin Reviewed-by: Jan Kara Cc: Johannes Weiner Cc: Mel Gorman Cc: Matthew Wilcox Cc: Andi Kleen Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e21e57445a64598b29a6f629688f9b9a39e7242a Author: Larry Chen Date: Fri Nov 30 14:08:56 2018 -0800 ocfs2: fix deadlock caused by ocfs2_defrag_extent() ocfs2_defrag_extent may fall into deadlock. ocfs2_ioctl_move_extents ocfs2_ioctl_move_extents ocfs2_move_extents ocfs2_defrag_extent ocfs2_lock_allocators_move_extents ocfs2_reserve_clusters inode_lock GLOBAL_BITMAP_SYSTEM_INODE __ocfs2_flush_truncate_log inode_lock GLOBAL_BITMAP_SYSTEM_INODE As backtrace shows above, ocfs2_reserve_clusters() will call inode_lock against the global bitmap if local allocator has not sufficient cluters. Once global bitmap could meet the demand, ocfs2_reserve_cluster will return success with global bitmap locked. After ocfs2_reserve_cluster(), if truncate log is full, __ocfs2_flush_truncate_log() will definitely fall into deadlock because it needs to inode_lock global bitmap, which has already been locked. To fix this bug, we could remove from ocfs2_lock_allocators_move_extents() the code which intends to lock global allocator, and put the removed code after __ocfs2_flush_truncate_log(). ocfs2_lock_allocators_move_extents() is referred by 2 places, one is here, the other does not need the data allocator context, which means this patch does not affect the caller so far. Link: http://lkml.kernel.org/r/20181101071422.14470-1-lchen@suse.com Signed-off-by: Larry Chen Reviewed-by: Changwei Ge Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 08be37b798921af207e78082fe261a6ca8be5024 Author: John Hubbard Date: Fri Nov 30 14:08:53 2018 -0800 mm/gup: finish consolidating error handling Commit df06b37ffe5a ("mm/gup: cache dev_pagemap while pinning pages") attempted to operate on each page that get_user_pages had retrieved. In order to do that, it created a common exit point from the routine. However, one case was missed, which this patch fixes up. Also, there was still an unnecessary shadow declaration (with a different type) of the "ret" variable, which this patch removes. Keith's description of the situation is: This also fixes a potentially leaked dev_pagemap reference count if a failure occurs when an iteration crosses a vma boundary. I don't think it's normal to have different vma's on a users mapped zone device memory, but good to fix anyway. I actually thought that this code: /* first iteration or cross vma bound */ if (!vma || start >= vma->vm_end) { vma = find_extend_vma(mm, start); if (!vma && in_gate_area(mm, start)) { ret = get_gate_page(mm, start & PAGE_MASK, gup_flags, &vma, pages ? &pages[i] : NULL); if (ret) goto out; dealt with the "you're trying to pin the gate page, as part of this call", rather than the generic case of crossing a vma boundary. (I think there's a fine point that I must be overlooking.) But it's still a valid case, either way. Link: http://lkml.kernel.org/r/20181121081402.29641-2-jhubbard@nvidia.com Fixes: df06b37ffe5a4 ("mm/gup: cache dev_pagemap while pinning pages") Signed-off-by: John Hubbard Reviewed-by: Keith Busch Cc: Dan Williams Cc: Kirill A. Shutemov Cc: Dave Hansen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 12457e6391e000820bb0b2b775125a569c3e80ed Author: Luis Chamberlain Date: Fri Nov 30 14:08:49 2018 -0800 MAINTAINERS: name change for Luis My name has changed, works better than Global Entry I tell ya. Link: http://lkml.kernel.org/r/20181122003138.7752-1-mcgrof@kernel.org Signed-off-by: Luis Chamberlain Cc: Kees Cook Cc: Greg Kroah-Hartman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 38c7b224ce22c25fed04007839edf974bd13439d Author: Linus Torvalds Date: Fri Nov 30 14:45:01 2018 -0800 unifdef: use memcpy instead of strncpy New versions of gcc reasonably warn about the odd pattern of strncpy(p, q, strlen(q)); which really doesn't make sense: the strncpy() ends up being just a slow and odd way to write memcpy() in this case. There was a comment about _why_ the code used strncpy - to avoid the terminating NUL byte, but memcpy does the same and avoids the warning. Signed-off-by: Linus Torvalds commit c01ac66b38660f2b507ccd0b75d28e3002d56fbb Author: David Miller Date: Wed Nov 28 22:33:53 2018 -0800 bpf: Fix verifier log string check for bad alignment. The message got changed a lot time ago. This was responsible for 36 test case failures on sparc64. Fixes: f1174f77b50c ("bpf/verifier: rework value tracking") Signed-off-by: David S. Miller Signed-off-by: Alexei Starovoitov commit b5f0cf08340090d1503dbdbfd797e32264974100 Author: John Hurley Date: Tue Nov 27 14:04:12 2018 -0800 nfp: flower: prevent offload if rhashtable insert fails For flow offload adds, if the rhash insert code fails, the flow will still have been offloaded but the reference to it in the driver freed. Re-order the offload setup calls to ensure that a flow will only be written to FW if a kernel reference is held and stored in the rhashtable. Remove this hashtable entry if the offload fails. Fixes: c01d0efa5136 ("nfp: flower: use rhashtable for flow caching") Signed-off-by: John Hurley Reviewed-by: Pieter Jansen van Vuuren Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller commit 1166494891da88af25c444e65cd4f32c3e026b46 Author: John Hurley Date: Tue Nov 27 14:04:11 2018 -0800 nfp: flower: release metadata on offload failure Calling nfp_compile_flow_metadata both assigns a stats context and increments a ref counter on (or allocates) a mask id table entry. These are released by the nfp_modify_flow_metadata call on flow deletion, however, if a flow add fails after metadata is set then the flow entry will be deleted but the metadata assignments leaked. Add an error path to the flow add offload function to ensure allocated metadata is released in the event of an offload fail. Fixes: 81f3ddf2547d ("nfp: add control message passing capabilities to flower offloads") Signed-off-by: John Hurley Reviewed-by: Pieter Jansen van Vuuren Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller commit 3b5b3a3331d141e8f2a7aaae3a94dfa1e61ecbe4 Author: Toni Peltonen Date: Tue Nov 27 16:56:57 2018 +0200 bonding: fix 802.3ad state sent to partner when unbinding slave Previously when unbinding a slave the 802.3ad implementation only told partner that the port is not suitable for aggregation by setting the port aggregation state from aggregatable to individual. This is not enough. If the physical layer still stays up and we only unbinded this port from the bond there is nothing in the aggregation status alone to prevent the partner from sending traffic towards us. To ensure that the partner doesn't consider this port at all anymore we should also disable collecting and distributing to signal that this actor is going away. Also clear AD_STATE_SYNCHRONIZATION to ensure partner exits collecting + distributing state. I have tested this behaviour againts Arista EOS switches with mlx5 cards (physical link stays up even when interface is down) and simulated the same situation virtually Linux <-> Linux with two network namespaces running two veth device pairs. In both cases setting aggregation to individual doesn't alone prevent traffic from being to sent towards this port given that the link stays up in partners end. Partner still keeps it's end in collecting + distributing state and continues until timeout is reached. In most cases this means we are losing the traffic partner sends towards our port while we wait for timeout. This is most visible with slow periodic time (LACP rate slow). Other open source implementations like Open VSwitch and libreswitch, and vendor implementations like Arista EOS, seem to disable collecting + distributing to when doing similar port disabling/detaching/removing change. With this patch kernel implementation would behave the same way and ensure partner doesn't consider our actor viable anymore. Signed-off-by: Toni Peltonen Signed-off-by: Jay Vosburgh Acked-by: Jonathan Toppins Signed-off-by: David S. Miller commit 37c4b91f955fdd5f4ad771956b97d35f1321098e Author: Dmitry Bogdanov Date: Tue Nov 27 14:51:17 2018 +0000 net: aquantia: fix rx checksum offload bits The last set of csum offload fixes had a leak: Checksum enabled status bits from rx descriptor were incorrectly interpreted. Consequently all the other valid logic worked on zero bits. That caused rx checksum offloads never to trigger. Tested by dumping rx descriptors and validating resulting csum_level. Reported-by: Igor Russkikh Signed-off-by: Dmitry Bogdanov Signed-off-by: Igor Russkikh Fixes: ad703c2b9127f ("net: aquantia: invalid checksumm offload implementation") Signed-off-by: David S. Miller commit 43d0e96022ae3c66743c01bba6c18a3afec7b578 Author: Colin Ian King Date: Tue Nov 27 14:37:17 2018 +0000 openvswitch: fix spelling mistake "execeeds" -> "exceeds" There is a spelling mistake in a net_warn_ratelimited message, fix this. Signed-off-by: Colin Ian King Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 56e0e295091dde5d0346fad08d3d8b6c07084c9d Author: Colin Ian King Date: Tue Nov 27 14:00:15 2018 +0000 liquidio: fix spelling mistake "deferal" -> "deferral" There is a spelling mistake in the oct_stats_strings array, fix it. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit 5f2b8b62786853341a20d4cd4948f9cbca3db002 Author: Thierry Reding Date: Tue Nov 27 14:21:43 2018 +0100 net: stmmac: Move debugfs init/exit to ->probe()/->remove() Setting up and tearing down debugfs is current unbalanced, as seen by this error during resume from suspend: [ 752.134067] dwc-eth-dwmac 2490000.ethernet eth0: ERROR failed to create debugfs directory [ 752.134347] dwc-eth-dwmac 2490000.ethernet eth0: stmmac_hw_setup: failed debugFS registration The imbalance happens because the driver creates the debugfs hierarchy when the device is opened and tears it down when the device is closed. There's little gain in that, and it could be argued that it is even surprising because it's not usually done for other devices. Fix the imbalance by moving the debugfs creation and teardown to the driver's ->probe() and ->remove() implementations instead. Note that the ring descriptors cannot be read while the interface is down, so make sure to return an empty file when the descriptors_status debugfs file is read. Signed-off-by: Thierry Reding Acked-by: Jose Abreu Signed-off-by: David S. Miller commit 4135cce7fd0a0d755665c02728578c7c5afe4726 Author: Xin Long Date: Tue Nov 27 19:11:50 2018 +0800 sctp: update frag_point when stream_interleave is set sctp_assoc_update_frag_point() should be called whenever asoc->pathmtu changes, but we missed one place in sctp_association_init(). It would cause frag_point is zero when sending data. As says in Jakub's reproducer, if sp->pathmtu is set by socketopt, the new asoc->pathmtu inherits it in sctp_association_init(). Later when transports are added and their pmtu >= asoc->pathmtu, it will never call sctp_assoc_update_frag_point() to set frag_point. This patch is to fix it by updating frag_point after asoc->pathmtu is set as sp->pathmtu in sctp_association_init(). Note that it moved them after sctp_stream_init(), as stream->si needs to be set first. Frag_point's calculation is also related with datachunk's type, so it needs to update frag_point when stream->si may be changed in sctp_process_init(). v1->v2: - call sctp_assoc_update_frag_point() separately in sctp_process_init and sctp_association_init, per Marcelo's suggestion. Fixes: 2f5e3c9df693 ("sctp: introduce sctp_assoc_update_frag_point") Reported-by: Jakub Audykowicz Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Acked-by: Neil Horman Signed-off-by: David S. Miller commit b6839ef26e549de68c10359d45163b0cfb031183 Merge: d7aca8a78c8b 6484a677294a Author: Linus Torvalds Date: Fri Nov 30 12:43:17 2018 -0800 Merge tag 'char-misc-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc fixes from Greg KH: "Here are a few small char/misc driver fixes for 4.20-rc5 that resolve a number of reported issues. The "largest" here is the thunderbolt patch, which resolves an issue with NVM upgrade, the smallest being some fsi driver fixes. There's also a hyperv bugfix, and the usual binder bugfixes. All of these have been in linux-next with no reported issues" * tag 'char-misc-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: misc: mic/scif: fix copy-paste error in scif_create_remote_lookup thunderbolt: Prevent root port runtime suspend during NVM upgrade Drivers: hv: vmbus: check the creation_status in vmbus_establish_gpadl() binder: fix race that allows malicious free of live buffer fsi: fsi-scom.c: Remove duplicate header fsi: master-ast-cf: select GENERIC_ALLOCATOR commit d7aca8a78c8bc5d3707691aab13cb4f7f6de696f Merge: cd9a0433238d a66d972465d1 Author: Linus Torvalds Date: Fri Nov 30 12:26:06 2018 -0800 Merge tag 'driver-core-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core fix from Greg KH: "Here is a single driver core fix for 4.20-rc5 It resolves an issue with the data alignment in 'struct devres' for the ARC platform. The full details are in the commit changelog, but the short summary is the change is a single line: - unsigned long long data[]; /* guarantee ull alignment */ + u8 __aligned(ARCH_KMALLOC_MINALIGN) data[]; This has been in linux-next for a while with no reported issues" * tag 'driver-core-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: devres: Align data[] to ARCH_KMALLOC_MINALIGN commit cd9a0433238da43611179e44b1d71ad24998b107 Merge: 40ebba2ad7e1 c648284f6c96 Author: Linus Torvalds Date: Fri Nov 30 12:23:44 2018 -0800 Merge tag 'staging-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging and IIO driver fixes from Greg KH: "Here are some small IIO and staging driver fixes for 4.20-rc5. Nothing major, the IIO fix ended up touching the HID drivers at the same time, but the HID maintainer acked it. The staging fixes are all minor patches for reported issues and regressions, full details are in the shortlog. All of these have been in linux-next for a while with no reported issues" * tag 'staging-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: iio/hid-sensors: Fix IIO_CHAN_INFO_RAW returning wrong values for signed numbers staging: vchiq_arm: fix compat VCHIQ_IOC_AWAIT_COMPLETION staging: mt7621-pinctrl: fix uninitialized variable ngroups staging: rtl8723bs: Add missing return for cfg80211_rtw_get_station staging: most: use format specifier "%s" in snprintf staging: rtl8723bs: Fix incorrect sense of ether_addr_equal staging: mt7621-dma: fix potentially dereferencing uninitialized 'tx_desc' staging: comedi: clarify/unify macros for NI macro-defined terminals drivers: staging: cedrus: find ctx before dereferencing it ctx staging: rtl8723bs: Fix the return value in case of error in 'rtw_wx_read32()' staging: comedi: ni_mio_common: scale ao INSN_CONFIG_GET_CMD_TIMING_CONSTRAINTS iio:st_magn: Fix enable device after trigger commit 40ebba2ad7e1a3f024479e633da5ca5694524767 Merge: da59f180d529 96ae93b46dbb Author: Linus Torvalds Date: Fri Nov 30 12:20:48 2018 -0800 Merge tag 'usb-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB/PHY driver fixes from Greg KH: "Here are some small USB and PHY driver fixes for 4.20-rc5 Nothing big at all, just the usual handful of USB fixes for reported issues, along with some gadget and PHY driver bug fixes. All of these have been in linux-next with no reported issues. Note, the USB gadget fixes were in linux-next on its own branch, not in mine, it just got merged into here yesterday and missed linux-next of today" * tag 'usb-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: gadget: u_ether: fix unsafe list iteration USB: omap_udc: fix rejection of out transfers when DMA is used USB: omap_udc: fix USB gadget functionality on Palm Tungsten E USB: omap_udc: fix omap_udc_start() on 15xx machines USB: omap_udc: fix crashes on probe error and module removal USB: omap_udc: use devm_request_irq() usb: core: quirks: add RESET_RESUME quirk for Cherry G230 Stream series USB: usb-storage: Add new IDs to ums-realtek Revert "usb: dwc3: gadget: skip Set/Clear Halt when invalid" phy: qcom-qusb2: Fix HSTX_TRIM tuning with fused value for SDM845 phy: qcom-qusb2: Use HSTX_TRIM fused value as is dt-bindings: phy-qcom-qmp: Fix several mistakes from prior commits phy: uniphier-pcie: Depend on HAS_IOMEM commit da59f180d529fc78591e71acf2c67114b8eff10d Merge: b1286ed7158e 40b412897ccb Author: Linus Torvalds Date: Fri Nov 30 12:18:00 2018 -0800 Merge tag 'mtd/fixes-for-4.20-rc5' of git://git.infradead.org/linux-mtd Pull mtd fixes from Boris Brezillon: "NAND fix: - Fix BBT cache allocation done in nanddev_bbt_init() SPI NOR fixes: - Fix the erase type selection logic" * tag 'mtd/fixes-for-4.20-rc5' of git://git.infradead.org/linux-mtd: mtd: nand: Fix memory allocation in nanddev_bbt_init() mtd: spi-nor: fix erase_type array to indicate current map conf commit b1286ed7158e9b62787508066283ab0b8850b518 Author: Linus Torvalds Date: Fri Nov 30 12:13:15 2018 -0800 test_hexdump: use memcpy instead of strncpy New versions of gcc reasonably warn about the odd pattern of strncpy(p, q, strlen(q)); which really doesn't make sense: the strncpy() ends up being just a slow and odd way to write memcpy() in this case. Apparently there was a patch for this floating around earlier, but it got lost. Acked-again-by: Andy Shevchenko Signed-off-by: Linus Torvalds commit bfed4d730823440d0da0cd21554efc2de831627d Merge: 7e76e65ce7e9 512cab3e7e0b Author: Olof Johansson Date: Fri Nov 30 11:57:53 2018 -0800 Merge tag 'imx-fixes-4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into fixes i.MX fixes for 4.20, round 2: - Reomve non-existing EEPROM device from imx51-zii-rdu1 board. It was added by mistake. * tag 'imx-fixes-4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: ARM: dts: imx51-zii-rdu1: Remove EEPROM node Signed-off-by: Olof Johansson commit 7e76e65ce7e9405a9608e1b806be58a6cbf4a737 Author: Andy Gross Date: Thu Nov 29 16:31:06 2018 -0600 MAINTAINERS: Remove unused Qualcomm SoC mailing list This patch removes the linux-soc mailing list from the Qualcomm SoC entry. We use the linux-msm and there is no need to have the second one and this clears the list for use by others. Signed-off-by: Andy Gross Signed-off-by: Olof Johansson commit f6149484f050940c6ca9a6ca44aa3b2693e2931e Merge: 89acb56db497 91e43395820b Author: Olof Johansson Date: Fri Nov 30 11:56:50 2018 -0800 Merge tag 'omap-for-v4.20/fixes-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes Few minor fixes for omaps for v4.20-rc cycle This set of fixes contains minor regression fixes for LogicPD dts files for MMC pinctrl and interrupts. There is also one section annotation fix that shows up with Clang, and a fix for an unitialized field for omap1. * tag 'omap-for-v4.20/fixes-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: OMAP1: ams-delta: Fix possible use of uninitialized field ARM: dts: am3517-som: Fix WL127x Wifi interrupt ARM: dts: logicpd-somlv: Fix interrupt on mmc3_dat1 ARM: dts: LogicPD Torpedo: Fix mmc3_dat1 interrupt ARM: dts: am3517: Fix pinmuxing for CD on MMC1 ARM: OMAP2+: prm44xx: Fix section annotation on omap44xx_prm_enable_io_wakeup Signed-off-by: Olof Johansson commit 89acb56db4979e55380839c815566ddb9a01949b Merge: adb97bcdbdb2 27df7977099c Author: Olof Johansson Date: Fri Nov 30 11:54:31 2018 -0800 Merge tag 'davinci-fixes-for-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci into fixes DaVinci: fix GPIO breakage after v4.19 This set of changes is needed to fix the broken GPIO support for DaVinci boards in legacy mode after certain changes made to the GPIO driver in 4.19, namely: commits 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") and eb3744a2dd01 ("gpio: davinci: Do not assume continuous IRQ numbering"). * tag 'davinci-fixes-for-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci: ARM: davinci: dm644x: set the GPIO base to 0 ARM: davinci: da830: set the GPIO base to 0 ARM: davinci: dm355: set the GPIO base to 0 ARM: davinci: dm646x: set the GPIO base to 0 ARM: davinci: dm365: set the GPIO base to 0 ARM: davinci: da850: set the GPIO base to 0 gpio: davinci: restore a way to manually specify the GPIO base ARM: davinci: dm644x: define gpio interrupts as separate resources ARM: davinci: dm355: define gpio interrupts as separate resources ARM: davinci: dm646x: define gpio interrupts as separate resources ARM: davinci: dm365: define gpio interrupts as separate resources ARM: davinci: da8xx: define gpio interrupts as separate resources Signed-off-by: Olof Johansson commit adb97bcdbdb2d42c90b5f11e08a9b5fbc017e5d7 Merge: a8505b4e02b4 c1d91f86a1b4 Author: Olof Johansson Date: Fri Nov 30 11:50:14 2018 -0800 Merge tag 'v4.20-rockchip-dts64fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into fixes Removal of vdd_log regulator on rk960 to fix a stability issue and fixup of the pcie reset polarity on puma-haikou. * tag 'v4.20-rockchip-dts64fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: Fix PCIe reset polarity for rk3399-puma-haikou. arm64: dts: rockchip: remove vdd_log from rock960 to fix a stability issues Signed-off-by: Olof Johansson commit a8505b4e02b49368878ccb14fb295b25c1859665 Merge: 9f60337147f0 672e60b72bbe Author: Olof Johansson Date: Fri Nov 30 11:49:48 2018 -0800 Merge tag 'v4.20-rockchip-dts32fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into fixes Moving the veyron memory node from memory@0 back to memory, as the firmware on these devices as issues identifying the formally correct node. * tag 'v4.20-rockchip-dts32fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: ARM: dts: rockchip: Remove @0 from the veyron memory node Signed-off-by: Olof Johansson commit 9f60337147f02793f4ce009a99bbd4387b7de794 Merge: 63415a3c38dd 4ab7ca092c3c Author: Olof Johansson Date: Fri Nov 30 11:49:03 2018 -0800 Merge tag 'at91-4.20-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into fixes AT91 fixes for 4.20 - Fix the SMC parent clock * tag 'at91-4.20-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: dts: at91: sama5d2: use the divided clock for SMC Signed-off-by: Olof Johansson commit 1ec63573b2db363848abb313cc75eb29e9abc1b3 Merge: a1b3cf6d9438 60c8144afc28 Author: Linus Torvalds Date: Fri Nov 30 11:34:25 2018 -0800 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "Misc fixes: - MCE related boot crash fix on certain AMD systems - FPU exception handling fix - FPU handling race fix - revert+rewrite of the RSDP boot protocol extension, use boot_params instead - documentation fix" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/MCE/AMD: Fix the thresholding machinery initialization order x86/fpu: Use the correct exception table macro in the XSTATE_OP wrapper x86/fpu: Disable bottom halves while loading FPU registers x86/acpi, x86/boot: Take RSDP address from boot params if available x86/boot: Mostly revert commit ae7e1238e68f2a ("Add ACPI RSDP address to setup_header") x86/ptrace: Fix documentation for tracehook_report_syscall_entry() commit a1b3cf6d943800059adc262c4d839524c529db2d Merge: 8d9f412d51b8 09d3f015d1e1 Author: Linus Torvalds Date: Fri Nov 30 11:31:48 2018 -0800 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "Misc fixes: - counter freezing related regression fix - uprobes race fix - Intel PMU unusual event combination fix - .. and diverse tooling fixes" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: uprobes: Fix handle_swbp() vs. unregister() + register() race once more perf/x86/intel: Disallow precise_ip on BTS events perf/x86/intel: Add generic branch tracing check to intel_pmu_has_bts() perf/x86/intel: Move branch tracing setup to the Intel-specific source file perf/x86/intel: Fix regression by default disabling perfmon v4 interrupt handling perf tools beauty ioctl: Support new ISO7816 commands tools uapi asm-generic: Synchronize ioctls.h tools arch x86: Update tools's copy of cpufeatures.h tools headers uapi: Synchronize i915_drm.h perf tools: Restore proper cwd on return from mnt namespace tools build feature: Check if get_current_dir_name() is available perf tools: Fix crash on synthesizing the unit commit 8d9f412d51b84eafd2253a82120e218ddc53e721 Merge: 575d7d0d6f5c 976b489120cd Author: Linus Torvalds Date: Fri Nov 30 11:29:02 2018 -0800 Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI fix from Ingo Molnar: "An arm64 warning fix" * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: efi: Prevent GICv3 WARN() by mapping the memreserve table before first use commit 10d443431dc2bb733cf7add99b453e3fb9047a2e Author: Jose Abreu Date: Fri Nov 30 09:47:31 2018 +0000 ARC: io.h: Implement reads{x}()/writes{x}() Some ARC CPU's do not support unaligned loads/stores. Currently, generic implementation of reads{b/w/l}()/writes{b/w/l}() is being used with ARC. This can lead to misfunction of some drivers as generic functions do a plain dereference of a pointer that can be unaligned. Let's use {get/put}_unaligned() helpers instead of plain dereference of pointer in order to fix. The helpers allow to get and store data from an unaligned address whilst preserving the CPU internal alignment. According to [1], the use of these helpers are costly in terms of performance so we added an initial check for a buffer already aligned so that the usage of the helpers can be avoided, when possible. [1] Documentation/unaligned-memory-access.txt Cc: Alexey Brodkin Cc: Joao Pinto Cc: David Laight Tested-by: Vitor Soares Signed-off-by: Jose Abreu Signed-off-by: Vineet Gupta commit 575d7d0d6f5c6feb896fae2e70578a1ab6d474b5 Merge: 5f1ca5c619c2 22566c160303 Author: Linus Torvalds Date: Fri Nov 30 10:57:06 2018 -0800 Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fixes from Ingo Molnar: "Two fixes for boundary conditions" * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool: Fix segfault in .cold detection with -ffunction-sections objtool: Fix double-free in .cold detection error path commit b7cc40c32a8bfa6f2581a71747f6a7d491fe43ba Author: Kevin Hilman Date: Fri Nov 30 15:51:56 2018 +0300 ARC: change defconfig defaults to ARCv2 Change the default defconfig (used with 'make defconfig') to the ARCv2 nsim_hs_defconfig, and also switch the default Kconfig ISA selection to ARCv2. This allows several default defconfigs (e.g. make defconfig, make allnoconfig, make tinyconfig) to all work with ARCv2 by default. Note since we change default architecture from ARCompact to ARCv2 it's required to explicitly mention architecture type in ARCompact defconfigs otherwise ARCv2 will be implied and binaries will be generated for ARCv2. Cc: # 4.4.x Signed-off-by: Kevin Hilman Signed-off-by: Alexey Brodkin Signed-off-by: Vineet Gupta commit 5f1ca5c619c2af5e03114b0276642cdc15d11a94 Merge: 49afe6614321 73116df7bb90 Author: Linus Torvalds Date: Fri Nov 30 10:47:50 2018 -0800 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs fixes from Al Viro: "Assorted fixes all over the place. The iov_iter one is this cycle regression (splice from UDP triggering WARN_ON()), the rest is older" * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: afs: Use d_instantiate() rather than d_add() and don't d_drop() afs: Fix missing net error handling afs: Fix validation/callback interaction iov_iter: teach csum_and_copy_to_iter() to handle pipe-backed ones exportfs: do not read dentry after free exportfs: fix 'passing zero to ERR_PTR()' warning aio: fix failure to put the file pointer sysv: return 'err' instead of 0 in __sysv_write_inode commit 49afe6614321e78727729680b97e96998695249a Merge: 0f1f69237545 5cf99a0f3161 Author: Linus Torvalds Date: Fri Nov 30 10:40:11 2018 -0800 Merge tag 'trace-v4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull more tracing fixes from Steven Rostedt: "Two more fixes: - Change idx variable in DO_TRACE macro to __idx to avoid name conflicts. A kvm event had "idx" as a parameter and it confused the macro. - Fix a race where interrupts would be traced when set_graph_function was set. The previous patch set increased a race window that tricked the function graph tracer to think it should trace interrupts when it really should not have. The bug has been there before, but was seldom hit. Only the last patch series made it more common" * tag 'trace-v4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing/fgraph: Fix set_graph_function from showing interrupts tracepoint: Use __idx instead of idx in DO_TRACE macro to make it unique commit 0f1f692375450338a36af308cbb538ffabd130f9 Merge: 570a37437cf2 3054426dc68e Author: Linus Torvalds Date: Fri Nov 30 09:32:34 2018 -0800 Merge tag 'trace-v4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: "While rewriting the function graph tracer, I discovered a design flaw that was introduced by a patch that tried to fix one bug, but by doing so created another bug. As both bugs corrupt the output (but they do not crash the kernel), I decided to fix the design such that it could have both bugs fixed. The original fix, fixed time reporting of the function graph tracer when doing a max_depth of one. This was code that can test how much the kernel interferes with userspace. But in doing so, it could corrupt the time keeping of the function profiler. The issue is that the curr_ret_stack variable was being used for two different meanings. One was to keep track of the stack pointer on the ret_stack (shadow stack used by the function graph tracer), and the other use case was the graph call depth. Although, the two may be closely related, where they got updated was the issue that lead to the two different bugs that required the two use cases to be updated differently. The big issue with this fix is that it requires changing each architecture. The good news is, I was able to remove a lot of code that was duplicated within the architectures and place it into a single location. Then I could make the fix in one place. I pushed this code into linux-next to let it settle over a week, and before doing so, I cross compiled all the affected architectures to make sure that they built fine. In the mean time, I also pulled in a patch that fixes the sched_switch previous tasks state output, that was not actually correct" * tag 'trace-v4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: sched, trace: Fix prev_state output in sched_switch tracepoint function_graph: Have profiler use curr_ret_stack and not depth function_graph: Reverse the order of pushing the ret_stack and the callback function_graph: Move return callback before update of curr_ret_stack function_graph: Use new curr_ret_depth to manage depth instead of curr_ret_stack function_graph: Make ftrace_push_return_trace() static sparc/function_graph: Simplify with function_graph_enter() sh/function_graph: Simplify with function_graph_enter() s390/function_graph: Simplify with function_graph_enter() riscv/function_graph: Simplify with function_graph_enter() powerpc/function_graph: Simplify with function_graph_enter() parisc: function_graph: Simplify with function_graph_enter() nds32: function_graph: Simplify with function_graph_enter() MIPS: function_graph: Simplify with function_graph_enter() microblaze: function_graph: Simplify with function_graph_enter() arm64: function_graph: Simplify with function_graph_enter() ARM: function_graph: Simplify with function_graph_enter() x86/function_graph: Simplify with function_graph_enter() function_graph: Create function_graph_enter() to consolidate architecture code commit ea2412dc21cc790335d319181dddc43682aef164 Author: Lorenzo Pieralisi Date: Thu Nov 29 09:55:59 2018 +0000 ACPI/IORT: Fix iort_get_platform_device_domain() uninitialized pointer value Running the Clang static analyzer on IORT code detected the following error: Logic error: Branch condition evaluates to a garbage value in iort_get_platform_device_domain() If the named component associated with a given device has no IORT mappings, iort_get_platform_device_domain() exits its MSI mapping loop with msi_parent pointer containing garbage, which can lead to erroneous code path execution. Initialize the msi_parent pointer, fixing the bug. Fixes: d4f54a186667 ("ACPI: platform: setup MSI domain for ACPI based platform device") Reported-by: Patrick Bellasi Reviewed-by: Hanjun Guo Acked-by: Will Deacon Cc: Sudeep Holla Cc: "Rafael J. Wysocki" Signed-off-by: Lorenzo Pieralisi Signed-off-by: Catalin Marinas commit 3bfa8897e4d08f822d1d58cf6cbbffbccef82e08 Author: Christian König Date: Fri Oct 26 15:59:05 2018 +0200 drm/amdgpu: wait for IB test on first device open Instead of delaying that to the first query. Otherwise we could try to use the SDMA for VM updates before the IB tests are done. Signed-off-by: Christian König Reviewed-by: Chunming Zhou Reviewed-by: Junwei Zhang Signed-off-by: Alex Deucher commit f10d9102de2816050af650da2c8f8b62535bbb72 Author: Alex Deucher Date: Tue Nov 27 11:41:27 2018 -0500 drm/amdgpu: add VCN JPEG support amdgpu_ctx_num_entities Looks like it was missed when setting support was added. Reviewed-by: Christian König Signed-off-by: Alex Deucher commit d6e820fcd4cf08b11d291a1dd7bbd0636914647c Author: Christian König Date: Thu Nov 29 16:25:10 2018 +0100 drm/ttm: fix LRU handling in ttm_buffer_object_transfer We need to set the NO_EVICT flag on the ghost object or otherwise we are adding it to the LRU. When it is added to the LRU we can run into a race between destroying and evicting it again. Signed-off-by: Christian König Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 570a37437cf24790d77fed6a59fdc9ac749e6b19 Merge: e9eaf72e73d6 ebcdcef30333 Author: Linus Torvalds Date: Fri Nov 30 09:10:29 2018 -0800 Merge tag 'drm-fixes-2018-11-30' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "This weeks instalment of fixes. Looks fairly like business as usual and everything seems to rolling along. There was one MST fix applied and reverted in the misc tree, but otherwise nothing too strange in here. core: - incorrect master setting on error fix i915: - only GVT fixes this week: * one MOCS register load * rpm lock fix * use after free rcar-du: - regression fix for group start amdgpu: - DP MST fix - GPUVM fix for huge pages - RLC fix for vega20 ast: - fix EDID reading stability - ioreg free fix meson: - sleep in irq fix - vblank fixes - array boundary fix" * tag 'drm-fixes-2018-11-30' of git://anongit.freedesktop.org/drm/drm: drm/ast: fixed reading monitor EDID not stable issue drm/ast: Fix incorrect free on ioregs Revert "drm/dp_mst: Skip validating ports during destruction, just ref" drm/amdgpu: Add delay after enable RLC ucode drm/amdgpu: Avoid endless loop in GPUVM fragment processing drm/amdgpu: Cast to uint64_t before left shift drm/meson: add support for 1080p25 mode drm/meson: Fix OOB memory accesses in meson_viu_set_osd_lut() drm/meson: Enable fast_io in meson_dw_hdmi_regmap_config drm/meson: Fixes for drm_crtc_vblank_on/off support drm: set is_master to 0 upon drm_new_set_master() failure drm/dp_mst: Skip validating ports during destruction, just ref drm: rcar-du: Fix DU3 start/stop on M3-N drm/amd/dm: Understand why attaching path/tile properties are needed drm/amd/dm: Don't forget to attach MST encoders drm/i915/gvt: Avoid use-after-free iterating the gtt list drm/i915/gvt: ensure gpu is powered before do i915_gem_gtt_insert drm/i915/gvt: not to touch undefined MOCS registers commit 1c9b357ced0b2fd2c173c058c2de88af513bc064 Merge: 2a5cf35cd6c5 6344d02dc8f8 Author: Jens Axboe Date: Fri Nov 30 10:08:39 2018 -0700 Merge branch 'nvme-4.20' of git://git.infradead.org/nvme into for-linus Pull NVMe fixes from Christoph: "Various fixlets all over." * 'nvme-4.20' of git://git.infradead.org/nvme: nvme-rdma: fix double freeing of async event data nvme: flush namespace scanning work just before removing namespaces nvme: warn when finding multi-port subsystems without multipathing enabled nvme-pci: fix surprise removal nvme-fc: initialize nvme_req(rq)->ctrl after calling __nvme_fc_init_request() nvme: Free ctrl device name on init failure commit 2a5cf35cd6c56b2924bce103413ad3381bdc31fa Author: Ming Lei Date: Sat Dec 1 00:38:18 2018 +0800 block: fix single range discard merge There are actually two kinds of discard merge: - one is the normal discard merge, just like normal read/write request, and call it single-range discard - another is the multi-range discard, queue_max_discard_segments(rq->q) > 1 For the former case, queue_max_discard_segments(rq->q) is 1, and we should handle this kind of discard merge like the normal read/write request. This patch fixes the following kernel panic issue[1], which is caused by not removing the single-range discard request from elevator queue. Guangwu has one raid discard test case, in which this issue is a bit easier to trigger, and I verified that this patch can fix the kernel panic issue in Guangwu's test case. [1] kernel panic log from Jens's report BUG: unable to handle kernel NULL pointer dereference at 0000000000000148 PGD 0 P4D 0. Oops: 0000 [#1] SMP PTI CPU: 37 PID: 763 Comm: kworker/37:1H Not tainted \ 4.20.0-rc3-00649-ge64d9a554a91-dirty #14 Hardware name: Wiwynn \ Leopard-Orv2/Leopard-DDR BW, BIOS LBM08 03/03/2017 Workqueue: kblockd \ blk_mq_run_work_fn RIP: \ 0010:blk_mq_get_driver_tag+0x81/0x120 Code: 24 \ 10 48 89 7c 24 20 74 21 83 fa ff 0f 95 c0 48 8b 4c 24 28 65 48 33 0c 25 28 00 00 00 \ 0f 85 96 00 00 00 48 83 c4 30 5b 5d c3 <48> 8b 87 48 01 00 00 8b 40 04 39 43 20 72 37 \ f6 87 b0 00 00 00 02 RSP: 0018:ffffc90004aabd30 EFLAGS: 00010246 \ RAX: 0000000000000003 RBX: ffff888465ea1300 RCX: ffffc90004aabde8 RDX: 00000000ffffffff RSI: ffffc90004aabde8 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffff888465ea1348 R09: 0000000000000000 R10: 0000000000001000 R11: 00000000ffffffff R12: ffff888465ea1300 R13: 0000000000000000 R14: ffff888465ea1348 R15: ffff888465d10000 FS: 0000000000000000(0000) GS:ffff88846f9c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000148 CR3: 000000000220a003 CR4: 00000000003606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: blk_mq_dispatch_rq_list+0xec/0x480 ? elv_rb_del+0x11/0x30 blk_mq_do_dispatch_sched+0x6e/0xf0 blk_mq_sched_dispatch_requests+0xfa/0x170 __blk_mq_run_hw_queue+0x5f/0xe0 process_one_work+0x154/0x350 worker_thread+0x46/0x3c0 kthread+0xf5/0x130 ? process_one_work+0x350/0x350 ? kthread_destroy_worker+0x50/0x50 ret_from_fork+0x1f/0x30 Modules linked in: sb_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel \ kvm switchtec irqbypass iTCO_wdt iTCO_vendor_support efivars cdc_ether usbnet mii \ cdc_acm i2c_i801 lpc_ich mfd_core ipmi_si ipmi_devintf ipmi_msghandler acpi_cpufreq \ button sch_fq_codel nfsd nfs_acl lockd grace auth_rpcgss oid_registry sunrpc nvme \ nvme_core fuse sg loop efivarfs autofs4 CR2: 0000000000000148 \ ---[ end trace 340a1fb996df1b9b ]--- RIP: 0010:blk_mq_get_driver_tag+0x81/0x120 Code: 24 10 48 89 7c 24 20 74 21 83 fa ff 0f 95 c0 48 8b 4c 24 28 65 48 33 0c 25 28 \ 00 00 00 0f 85 96 00 00 00 48 83 c4 30 5b 5d c3 <48> 8b 87 48 01 00 00 8b 40 04 39 43 \ 20 72 37 f6 87 b0 00 00 00 02 Fixes: 445251d0f4d329a ("blk-mq: fix discard merge with scheduler attached") Reported-by: Jens Axboe Cc: Guangwu Zhang Cc: Christoph Hellwig Cc: Jianchao Wang Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit ef1a8409348966f0b25ff97a170d6d0367710ea9 Author: Alexander Popov Date: Tue Nov 13 00:08:48 2018 +0300 stackleak: Disable function tracing and kprobes for stackleak_erase() The stackleak_erase() function is called on the trampoline stack at the end of syscall. This stack is not big enough for ftrace and kprobes operations, e.g. it can be exhausted if we use kprobe_events for stackleak_erase(). So let's disable function tracing and kprobes of stackleak_erase(). Reported-by: kernel test robot Fixes: 10e9ae9fabaf ("gcc-plugins: Add STACKLEAK plugin for tracking the kernel stack") Signed-off-by: Alexander Popov Reviewed-by: Steven Rostedt (VMware) Reviewed-by: Masami Hiramatsu Signed-off-by: Kees Cook commit e9eaf72e73d6159afbf90a9a02c24f2099067992 Merge: 2b17992f6f7f 89d328f637b9 Author: Linus Torvalds Date: Fri Nov 30 09:03:15 2018 -0800 Merge tag 'pstore-v4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore fix from Kees Cook: "Fix corrupted compression due to unlucky size choice with ECC" * tag 'pstore-v4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: pstore/ram: Correctly calculate usable PRZ bytes commit 3b712e43e3876b42b38321ecf790a1f5fe59c834 Author: Sean Paul Date: Wed Oct 3 16:22:31 2018 -0400 drm/msm: Grab a vblank reference when waiting for commit_done Similar to the atomic helpers, we should enable vblank while we're waiting for the commit to finish. DPU needs this, MDP5 seems to work fine without it. Reviewed-by: Abhinav Kumar Signed-off-by: Sean Paul Signed-off-by: Rob Clark commit 8531f0587f5c9e1a74cd9543a97617349f5e0706 Author: Abhinav Kumar Date: Thu Jun 14 21:01:10 2018 -0700 drm/msm/dsi: configure VCO rate for 10nm PLL driver Currenty the VCO rate in the 10nm PLL driver relies on the parent rate which is not configured. Configure the VCO rate to 19.2 Mhz as required by the 10nm PLL driver. Signed-off-by: Abhinav Kumar Signed-off-by: Sean Paul Signed-off-by: Rob Clark commit 2b17992f6f7ff4f4b72d7d3ee3e93d228682508f Merge: 94f371cb7394 7bca603a69c0 Author: Linus Torvalds Date: Fri Nov 30 08:57:31 2018 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "This is a bit later than usual for our first -rc but I'm not seeing anything worry-some in the RDMA tree right now. Quiet so far this -rc cycle, only a few internal driver related bugs and a small series fixing ODP bugs found by more advanced testing. A set of small driver and core code fixes: - Small series fixing longtime user triggerable bugs in the ODP processing inside mlx5 and core code - Various small driver malfunctions and crashes (use after, free, error unwind, implementation bugs) - A misfunction of the RDMA GID cache that can be triggered by the administrator" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/mlx5: Initialize return variable in case pagefault was skipped IB/mlx5: Fix page fault handling for MW IB/umem: Set correct address to the invalidation function IB/mlx5: Skip non-ODP MR when handling a page fault RDMA/hns: Bugfix pbl configuration for rereg mr iser: set sector for ambiguous mr status errors RDMA/rdmavt: Fix rvt_create_ah function signature IB/mlx5: Avoid load failure due to unknown link width IB/mlx5: Fix XRC QP support after introducing extended atomic RDMA/bnxt_re: Avoid accessing the device structure after it is freed RDMA/bnxt_re: Fix system hang when registration with L2 driver fails RDMA/core: Add GIDs while changing MAC addr only for registered ndev RDMA/mlx5: Fix fence type for IB_WR_LOCAL_INV WR net/mlx5: Fix XRC SRQ umem valid bits commit 47e7f506ee6590ceb2efa1f08aca7f9f2ee5c1d3 Author: Rob Clark Date: Mon Oct 15 11:22:57 2018 -0400 drm/msm: fix handling of cmdstream offset Userspace hasn't used submit cmds with submit_offset != 0 for a while, but this starts cropping up again with cmdstream sub-buffer-allocation in libdrm_freedreno. Doesn't do much good to increment the buf ptr before assigning it. Fixes: 78b8e5b847b4 drm/msm: dump a rd GPUADDR header for all buffers in the command Reviewed-by: Kristian H. Kristensen Signed-off-by: Rob Clark Signed-off-by: Sean Paul commit 51270de91412b819f654b849db3bf92dac0a0855 Author: Dan Carpenter Date: Sat Oct 13 13:28:06 2018 +0300 drm/msm/gpu: Fix a couple memory leaks in debugfs The msm_gpu_open() function should free "show_priv" on error or it causes static checker warnings. Fixes: 4f776f4511c7 ("drm/msm/gpu: Convert the GPU show function to use the GPU state") Signed-off-by: Dan Carpenter Signed-off-by: Rob Clark Signed-off-by: Sean Paul commit 482f96324a4e08818db7d75bb12beaaea6c9561d Author: Sharat Masetty Date: Fri Oct 12 14:26:56 2018 +0530 drm/msm: Fix task dump in gpu recovery The current recovery code gets a pointer to the task struct and does a few things all within the rcu_read_lock. This puts constraints on the types of gfp flags that can be used within the rcu lock. This patch instead gets a reference to the task within the rcu lock and releases the lock immediately, this way the task stays afloat until we need it and we also get to use the desired gfp flags. Signed-off-by: Sharat Masetty Signed-off-by: Rob Clark Signed-off-by: Sean Paul commit 4f3a31a8e8bff5fc363ec9f4755e58a15f7f36c7 Author: Sharat Masetty Date: Fri Oct 12 14:26:55 2018 +0530 drm/msm: Check if target supports crash dump capture This patch simply checks first to see if the target can support crash dump capture before proceeding. Signed-off-by: Sharat Masetty Signed-off-by: Rob Clark Signed-off-by: Sean Paul commit 6344d02dc8f886b6bbcd922ae1a17e4a41500f2d Author: Prabhath Sajeepa Date: Wed Nov 28 11:11:29 2018 -0700 nvme-rdma: fix double freeing of async event data Some error paths in configuration of admin queue free data buffer associated with async request SQE without resetting the data buffer pointer to NULL, This buffer is also freed up again if the controller is shutdown or reset. Signed-off-by: Prabhath Sajeepa Reviewed-by: Roland Dreier Signed-off-by: Christoph Hellwig commit f6c8e432cb0479255322c5d0335b9f1699a0270c Author: Sagi Grimberg Date: Wed Nov 21 15:17:37 2018 -0800 nvme: flush namespace scanning work just before removing namespaces nvme_stop_ctrl can be called also for reset flow and there is no need to flush the scan_work as namespaces are not being removed. This can cause deadlock in rdma, fc and loop drivers since nvme_stop_ctrl barriers before controller teardown (and specifically I/O cancellation of the scan_work itself) takes place, but the scan_work will be blocked anyways so there is no need to flush it. Instead, move scan_work flush to nvme_remove_namespaces() where it really needs to flush. Reported-by: Ming Lei Signed-off-by: Sagi Grimberg Reviewed-by: Keith Busch Reviewed by: James Smart Tested-by: Ewan D. Milne Signed-off-by: Christoph Hellwig commit 14a1336e6fff47dd1028b484d6c802105c58e2ee Author: Christoph Hellwig Date: Tue Nov 20 16:57:54 2018 +0100 nvme: warn when finding multi-port subsystems without multipathing enabled Without CONFIG_NVME_MULTIPATH enabled a multi-port subsystem might show up as invididual devices and cause problems, warn about it. Signed-off-by: Christoph Hellwig Reviewed-by: Sagi Grimberg commit 31ffa563833576bd49a8bf53120568312755e6e2 Author: Colin Ian King Date: Tue Jul 17 09:53:42 2018 +0100 fscache, cachefiles: remove redundant variable 'cache' Variable 'cache' is being assigned but is never used hence it is redundant and can be removed. Cleans up clang warning: warning: variable 'cache' set but not used [-Wunused-but-set-variable] Signed-off-by: Colin Ian King Signed-off-by: David Howells commit 34e06fe4d05bd120556a95d5ebf1bcc97b0a1ca0 Author: Arnd Bergmann Date: Fri Jul 13 16:27:44 2018 +0200 cachefiles: avoid deprecated get_seconds() get_seconds() returns an unsigned long can overflow on some architectures and is deprecated because of that. In cachefs, we cast that number to a a 32-bit integer, which will overflow in year 2106 on all architectures. As confirmed by David Howells, the overflow probably isn't harmful in the end, since the timestamps are only used to make the file names unique, but they don't strictly have to be in monotonically increasing order since the files only exist in order to be deleted as quickly as possible. Moving to ktime_get_real_seconds() avoids the deprecated interface. Signed-off-by: Arnd Bergmann Signed-off-by: David Howells commit b7e768b7e3522695ed36dcb48ecdcd344bd30a9b Author: Nathan Chancellor Date: Mon Sep 24 10:33:44 2018 -0700 cachefiles: Explicitly cast enumerated type in put_object Clang warns when one enumerated type is implicitly converted to another. fs/cachefiles/namei.c:247:50: warning: implicit conversion from enumeration type 'enum cachefiles_obj_ref_trace' to different enumeration type 'enum fscache_obj_ref_trace' [-Wenum-conversion] cache->cache.ops->put_object(&xobject->fscache, cachefiles_obj_put_wait_retry); Silence this warning by explicitly casting to fscache_obj_ref_trace, which is also done in put_object. Reported-by: Nick Desaulniers Signed-off-by: Nathan Chancellor Signed-off-by: David Howells commit c5a94f434c82529afda290df3235e4d85873c5b4 Author: NeilBrown Date: Fri Oct 26 17:16:29 2018 +1100 fscache: fix race between enablement and dropping of object It was observed that a process blocked indefintely in __fscache_read_or_alloc_page(), waiting for FSCACHE_COOKIE_LOOKING_UP to be cleared via fscache_wait_for_deferred_lookup(). At this time, ->backing_objects was empty, which would normaly prevent __fscache_read_or_alloc_page() from getting to the point of waiting. This implies that ->backing_objects was cleared *after* __fscache_read_or_alloc_page was was entered. When an object is "killed" and then "dropped", FSCACHE_COOKIE_LOOKING_UP is cleared in fscache_lookup_failure(), then KILL_OBJECT and DROP_OBJECT are "called" and only in DROP_OBJECT is ->backing_objects cleared. This leaves a window where something else can set FSCACHE_COOKIE_LOOKING_UP and __fscache_read_or_alloc_page() can start waiting, before ->backing_objects is cleared There is some uncertainty in this analysis, but it seems to be fit the observations. Adding the wake in this patch will be handled correctly by __fscache_read_or_alloc_page(), as it checks if ->backing_objects is empty again, after waiting. Customer which reported the hang, also report that the hang cannot be reproduced with this fix. The backtrace for the blocked process looked like: PID: 29360 TASK: ffff881ff2ac0f80 CPU: 3 COMMAND: "zsh" #0 [ffff881ff43efbf8] schedule at ffffffff815e56f1 #1 [ffff881ff43efc58] bit_wait at ffffffff815e64ed #2 [ffff881ff43efc68] __wait_on_bit at ffffffff815e61b8 #3 [ffff881ff43efca0] out_of_line_wait_on_bit at ffffffff815e625e #4 [ffff881ff43efd08] fscache_wait_for_deferred_lookup at ffffffffa04f2e8f [fscache] #5 [ffff881ff43efd18] __fscache_read_or_alloc_page at ffffffffa04f2ffe [fscache] #6 [ffff881ff43efd58] __nfs_readpage_from_fscache at ffffffffa0679668 [nfs] #7 [ffff881ff43efd78] nfs_readpage at ffffffffa067092b [nfs] #8 [ffff881ff43efda0] generic_file_read_iter at ffffffff81187a73 #9 [ffff881ff43efe50] nfs_file_read at ffffffffa066544b [nfs] #10 [ffff881ff43efe70] __vfs_read at ffffffff811fc756 #11 [ffff881ff43efee8] vfs_read at ffffffff811fccfa #12 [ffff881ff43eff18] sys_read at ffffffff811fda62 #13 [ffff881ff43eff50] entry_SYSCALL_64_fastpath at ffffffff815e986e Signed-off-by: NeilBrown Signed-off-by: David Howells commit 4265b0fe453240b5fa6d0986d1f23688497f4078 Author: Sandeep Panda Date: Fri Nov 30 14:57:45 2018 +0530 drm/bridge: fix AUX_CMD_SEND bit value for ti, sn65dsi86 bridge Fix the AUX_CMD_SEND bit for ti,sn65dsi86 bridge chip. With wrong value the dpcd aux transactions with eDP panel are failing. Signed-off-by: Sandeep Panda Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20181130092745.4219-1-spanda@codeaurora.org commit 41e817bca3acd3980efe5dd7d28af0e6f4ab9247 Author: Maximilian Heyne Date: Fri Nov 30 08:35:14 2018 -0700 fs: fix lost error code in dio_complete commit e259221763a40403d5bb232209998e8c45804ab8 ("fs: simplify the generic_write_sync prototype") reworked callers of generic_write_sync(), and ended up dropping the error return for the directio path. Prior to that commit, in dio_complete(), an error would be bubbled up the stack, but after that commit, errors passed on to dio_complete were eaten up. This was reported on the list earlier, and a fix was proposed in https://lore.kernel.org/lkml/20160921141539.GA17898@infradead.org/, but never followed up with. We recently hit this bug in our testing where fencing io errors, which were previously erroring out with EIO, were being returned as success operations after this commit. The fix proposed on the list earlier was a little short -- it would have still called generic_write_sync() in case `ret` already contained an error. This fix ensures generic_write_sync() is only called when there's no pending error in the write. Additionally, transferred is replaced with ret to bring this code in line with other callers. Fixes: e259221763a4 ("fs: simplify the generic_write_sync prototype") Reported-by: Ravi Nankani Signed-off-by: Maximilian Heyne Reviewed-by: Christoph Hellwig CC: Torsten Mehlan CC: Uwe Dannowski CC: Amit Shah CC: David Woodhouse CC: stable@vger.kernel.org Signed-off-by: Jens Axboe commit 4050207485e47e00353e87f2fe2166083e282688 Author: Hans de Goede Date: Mon Nov 26 11:52:18 2018 +0100 HID: ite: Add USB id match for another ITE based keyboard rfkill key quirk The 258a:6a88 keyboard-dock shipped with the Prowise PT301 tablet is likely another ITE based design. The controller die is directly bonded to the PCB with a blob of black glue on top so there are no markings and the 258a vendor-id used is unknown anywhere. But the keyboard has the exact same hotkeys mapped to Fn+F1 - F10 as the other ITE8595 keyboard I have *and* it has the same quirky behavior wrt the rfkill hotkey. Either way as said this keyboard has the same quirk for its rfkill / airplane mode hotkey as the ITE 8595 chip, it only sends a single release event when pressed and released, it never sends a press event. This commit adds the 258a:6a88 USB id to the hid-ite id-table, fixing the rfkill key not working on this keyboard. Signed-off-by: Hans de Goede Signed-off-by: Benjamin Tissoires commit ce85882860f0e756f7066cbda1c43e8b50b73ab6 Author: Daniel Vetter Date: Thu Nov 29 10:42:26 2018 +0100 drm/lease: Send a distinct uevent Sending the exact same hotplug event is not great uapi. Luckily the only already merged implementation of leases (in the -modesetting driver) doesn't care about what kind of uevent it gets, and unconditionally processes both hotplug and lease changes. So we can still adjust the uapi here. But e.g. weston tries to filter stuff, and I guess others might want to do that too. Try to make that possible. Cc: stable since it's uapi adjustement that we want to roll out everywhere. Michel Dänzer mentioned on irc that -amdgpu also has lease support. It has the same code flow as -modesetting though, so we can still go ahead. v2: Mention -amdgpu (Michel) Cc: Keith Packard Cc: Dave Airlie Cc: stable@vger.kernel.org Reviewed-by: Keith Packard Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20181129094226.30591-1-daniel.vetter@ffwll.ch commit 79c2206d369b87b19ac29cb47601059b6bf5c291 Author: YiFei Zhu Date: Thu Nov 29 18:12:30 2018 +0100 x86/earlyprintk/efi: Fix infinite loop on some screen widths An affected screen resolution is 1366 x 768, which width is not divisible by 8, the default font width. On such screens, when longer lines are earlyprintk'ed, overflow-to-next-line can never trigger, due to the left-most x-coordinate of the next character always less than the screen width. Earlyprintk will infinite loop in trying to print the rest of the string but unable to, due to the line being full. This patch makes the trigger consider the right-most x-coordinate, instead of left-most, as the value to compare against the screen width threshold. Signed-off-by: YiFei Zhu Signed-off-by: Ard Biesheuvel Cc: Andy Lutomirski Cc: Arend van Spriel Cc: Bhupesh Sharma Cc: Borislav Petkov Cc: Dave Hansen Cc: Eric Snowberg Cc: Hans de Goede Cc: Joe Perches Cc: Jon Hunter Cc: Julien Thierry Cc: Linus Torvalds Cc: Marc Zyngier Cc: Matt Fleming Cc: Nathan Chancellor Cc: Peter Zijlstra Cc: Sai Praneeth Prakhya Cc: Sedat Dilek Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/20181129171230.18699-12-ard.biesheuvel@linaro.org Signed-off-by: Ingo Molnar commit b84a64fad40637b1c9fa4f4dbf847a23e29e672b Author: Eric Snowberg Date: Thu Nov 29 18:12:20 2018 +0100 x86/efi: Allocate e820 buffer before calling efi_exit_boot_service The following commit: d64934019f6c ("x86/efi: Use efi_exit_boot_services()") introduced a regression on systems with large memory maps causing them to hang on boot. The first "goto get_map" that was removed from exit_boot() ensured there was enough room for the memory map when efi_call_early(exit_boot_services) was called. This happens when (nr_desc > ARRAY_SIZE(params->e820_table). Chain of events: exit_boot() efi_exit_boot_services() efi_get_memory_map <- at this point the mm can't grow over 8 desc priv_func() exit_boot_func() allocate_e820ext() <- new mm grows over 8 desc from e820 alloc efi_call_early(exit_boot_services) <- mm key doesn't match so retry efi_call_early(get_memory_map) <- not enough room for new mm system hangs This patch allocates the e820 buffer before calling efi_exit_boot_services() and fixes the regression. [ mingo: minor cleanliness edits. ] Signed-off-by: Eric Snowberg Signed-off-by: Ard Biesheuvel Cc: Cc: Andy Lutomirski Cc: Arend van Spriel Cc: Bhupesh Sharma Cc: Borislav Petkov Cc: Dave Hansen Cc: Hans de Goede Cc: Joe Perches Cc: Jon Hunter Cc: Julien Thierry Cc: Linus Torvalds Cc: Marc Zyngier Cc: Matt Fleming Cc: Nathan Chancellor Cc: Peter Zijlstra Cc: Sai Praneeth Prakhya Cc: Sedat Dilek Cc: Thomas Gleixner Cc: YiFei Zhu Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/20181129171230.18699-2-ard.biesheuvel@linaro.org Signed-off-by: Ingo Molnar commit 5cf99a0f3161bc3ae2391269d134d6bf7e26f00e Author: Steven Rostedt (VMware) Date: Thu Nov 29 08:50:27 2018 -0500 tracing/fgraph: Fix set_graph_function from showing interrupts The tracefs file set_graph_function is used to only function graph functions that are listed in that file (or all functions if the file is empty). The way this is implemented is that the function graph tracer looks at every function, and if the current depth is zero and the function matches something in the file then it will trace that function. When other functions are called, the depth will be greater than zero (because the original function will be at depth zero), and all functions will be traced where the depth is greater than zero. The issue is that when a function is first entered, and the handler that checks this logic is called, the depth is set to zero. If an interrupt comes in and a function in the interrupt handler is traced, its depth will be greater than zero and it will automatically be traced, even if the original function was not. But because the logic only looks at depth it may trace interrupts when it should not be. The recent design change of the function graph tracer to fix other bugs caused the depth to be zero while the function graph callback handler is being called for a longer time, widening the race of this happening. This bug was actually there for a longer time, but because the race window was so small it seldom happened. The Fixes tag below is for the commit that widen the race window, because that commit belongs to a series that will also help fix the original bug. Cc: stable@kernel.org Fixes: 39eb456dacb5 ("function_graph: Use new curr_ret_depth to manage depth instead of curr_ret_stack") Reported-by: Joe Lawrence Tested-by: Joe Lawrence Signed-off-by: Steven Rostedt (VMware) commit 0c7a52e4d4b5c4d35b31f3c3ad32af814f1bf491 Author: Zenghui Yu Date: Wed Nov 28 03:35:23 2018 +0000 tracepoint: Use __idx instead of idx in DO_TRACE macro to make it unique After enabling KVM event tracing, almost all of trace_kvm_exit()'s printk shows "kvm_exit: IRQ: ..." even if the actual exception_type is NOT IRQ. More specifically, trace_kvm_exit() is defined in virt/kvm/arm/trace.h by TRACE_EVENT. This slight problem may have existed after commit e6753f23d961 ("tracepoint: Make rcuidle tracepoint callers use SRCU"). There are two variables in trace_kvm_exit() and __DO_TRACE() which have the same name, *idx*. Thus the actual value of *idx* will be overwritten when tracing. Fix it by adding a simple prefix. Cc: Joel Fernandes Cc: Wang Haibin Cc: linux-trace-devel@vger.kernel.org Cc: stable@vger.kernel.org Fixes: e6753f23d961 ("tracepoint: Make rcuidle tracepoint callers use SRCU") Reviewed-by: Joel Fernandes (Google) Signed-off-by: Zenghui Yu Signed-off-by: Steven Rostedt (VMware) commit 73116df7bb90435ccb2817f44113295240d15034 Author: David Howells Date: Tue Nov 13 23:20:35 2018 +0000 afs: Use d_instantiate() rather than d_add() and don't d_drop() Use d_instantiate() rather than d_add() and don't d_drop() in afs_vnode_new_inode(). The dentry shouldn't be removed as it's not changing its name. Reported-by: Al Viro Signed-off-by: David Howells Signed-off-by: Al Viro commit 4584ae96ae307613625e80cb9c7d9a981bed47a7 Author: David Howells Date: Tue Nov 13 23:20:28 2018 +0000 afs: Fix missing net error handling kAFS can be given certain network errors (EADDRNOTAVAIL, EHOSTDOWN and ERFKILL) that it doesn't handle in its server/address rotation algorithms. They cause the probing and rotation to abort immediately rather than rotating. Fix this by: (1) Abstracting out the error prioritisation from the VL and FS rotation algorithms into a common function and expand usage into the server probing code. When multiple errors are available, this code selects the one we'd prefer to return. (2) Add handling for EADDRNOTAVAIL, EHOSTDOWN and ERFKILL. Fixes: 0fafdc9f888b ("afs: Fix file locking") Fixes: 0338747d8454 ("afs: Probe multiple fileservers simultaneously") Signed-off-by: David Howells Signed-off-by: Al Viro commit ae3b7361dc0ee9a425bf7d77ce211f533500b39b Author: David Howells Date: Tue Nov 13 23:20:21 2018 +0000 afs: Fix validation/callback interaction When afs_validate() is called to validate a vnode (inode), there are two unhandled cases in the fastpath at the top of the function: (1) If the vnode is promised (AFS_VNODE_CB_PROMISED is set), the break counters match and the data has expired, then there's an implicit case in which the vnode needs revalidating. This has no consequences since the default "valid = false" set at the top of the function happens to do the right thing. (2) If the vnode is not promised and it hasn't been deleted (AFS_VNODE_DELETED is not set) then there's a default case we're not handling in which the vnode is invalid. If the vnode is invalid, we need to bring cb_s_break and cb_v_break up to date before we refetch the status. As a consequence, once the server loses track of the client (ie. sufficient time has passed since we last sent it an operation), it will send us a CB.InitCallBackState* operation when we next try to talk to it. This calls afs_init_callback_state() which increments afs_server::cb_s_break, but this then doesn't propagate to the afs_vnode record. The result being that every afs_validate() call thereafter sends a status fetch operation to the server. Clarify and fix this by: (A) Setting valid in all the branches rather than initialising it at the top so that the compiler catches where we've missed. (B) Restructuring the logic in the 'promised' branch so that we set valid to false if the callback is due to expire (or has expired) and so that the final case is that the vnode is still valid. (C) Adding an else-statement that ups cb_s_break and cb_v_break if the promised and deleted cases don't match. Fixes: c435ee34551e ("afs: Overhaul the callback handling") Signed-off-by: David Howells Signed-off-by: Al Viro commit 9410d386d0a829ace9558336263086c2fbbe8aed Author: Christoph Paasch Date: Thu Nov 29 16:01:04 2018 -0800 net: Prevent invalid access to skb->prev in __qdisc_drop_all __qdisc_drop_all() accesses skb->prev to get to the tail of the segment-list. With commit 68d2f84a1368 ("net: gro: properly remove skb from list") the skb-list handling has been changed to set skb->next to NULL and set the list-poison on skb->prev. With that change, __qdisc_drop_all() will panic when it tries to dereference skb->prev. Since commit 992cba7e276d ("net: Add and use skb_list_del_init().") __list_del_entry is used, leaving skb->prev unchanged (thus, pointing to the list-head if it's the first skb of the list). This will make __qdisc_drop_all modify the next-pointer of the list-head and result in a panic later on: [ 34.501053] general protection fault: 0000 [#1] SMP KASAN PTI [ 34.501968] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.20.0-rc2.mptcp #108 [ 34.502887] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.5.1 01/01/2011 [ 34.504074] RIP: 0010:dev_gro_receive+0x343/0x1f90 [ 34.504751] Code: e0 48 c1 e8 03 42 80 3c 30 00 0f 85 4a 1c 00 00 4d 8b 24 24 4c 39 65 d0 0f 84 0a 04 00 00 49 8d 7c 24 38 48 89 f8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 74 08 3c 04 [ 34.507060] RSP: 0018:ffff8883af507930 EFLAGS: 00010202 [ 34.507761] RAX: 0000000000000007 RBX: ffff8883970b2c80 RCX: 1ffff11072e165a6 [ 34.508640] RDX: 1ffff11075867008 RSI: ffff8883ac338040 RDI: 0000000000000038 [ 34.509493] RBP: ffff8883af5079d0 R08: ffff8883970b2d40 R09: 0000000000000062 [ 34.510346] R10: 0000000000000034 R11: 0000000000000000 R12: 0000000000000000 [ 34.511215] R13: 0000000000000000 R14: dffffc0000000000 R15: ffff8883ac338008 [ 34.512082] FS: 0000000000000000(0000) GS:ffff8883af500000(0000) knlGS:0000000000000000 [ 34.513036] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 34.513741] CR2: 000055ccc3e9d020 CR3: 00000003abf32000 CR4: 00000000000006e0 [ 34.514593] Call Trace: [ 34.514893] [ 34.515157] napi_gro_receive+0x93/0x150 [ 34.515632] receive_buf+0x893/0x3700 [ 34.516094] ? __netif_receive_skb+0x1f/0x1a0 [ 34.516629] ? virtnet_probe+0x1b40/0x1b40 [ 34.517153] ? __stable_node_chain+0x4d0/0x850 [ 34.517684] ? kfree+0x9a/0x180 [ 34.518067] ? __kasan_slab_free+0x171/0x190 [ 34.518582] ? detach_buf+0x1df/0x650 [ 34.519061] ? lapic_next_event+0x5a/0x90 [ 34.519539] ? virtqueue_get_buf_ctx+0x280/0x7f0 [ 34.520093] virtnet_poll+0x2df/0xd60 [ 34.520533] ? receive_buf+0x3700/0x3700 [ 34.521027] ? qdisc_watchdog_schedule_ns+0xd5/0x140 [ 34.521631] ? htb_dequeue+0x1817/0x25f0 [ 34.522107] ? sch_direct_xmit+0x142/0xf30 [ 34.522595] ? virtqueue_napi_schedule+0x26/0x30 [ 34.523155] net_rx_action+0x2f6/0xc50 [ 34.523601] ? napi_complete_done+0x2f0/0x2f0 [ 34.524126] ? kasan_check_read+0x11/0x20 [ 34.524608] ? _raw_spin_lock+0x7d/0xd0 [ 34.525070] ? _raw_spin_lock_bh+0xd0/0xd0 [ 34.525563] ? kvm_guest_apic_eoi_write+0x6b/0x80 [ 34.526130] ? apic_ack_irq+0x9e/0xe0 [ 34.526567] __do_softirq+0x188/0x4b5 [ 34.527015] irq_exit+0x151/0x180 [ 34.527417] do_IRQ+0xdb/0x150 [ 34.527783] common_interrupt+0xf/0xf [ 34.528223] This patch makes sure that skb->prev is set to NULL when entering netem_enqueue. Cc: Prashant Bhole Cc: Tyler Hicks Cc: Eric Dumazet Fixes: 68d2f84a1368 ("net: gro: properly remove skb from list") Suggested-by: Eric Dumazet Signed-off-by: Christoph Paasch Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit 94f371cb73944b410a269d570d6946c042f2ddd0 Merge: 2f8406891fed c4f784268210 Author: Linus Torvalds Date: Thu Nov 29 15:54:12 2018 -0800 Merge tag 'acpi-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Fix a recent regression in ACPICA releted to the Generic Serial Bus protocol handling and causing it to read or write too little or too much data in some cases, so incorrect data may be written to hardware as a result (Hans de Goede)" * tag 'acpi-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPICA: Fix handling of buffer-size in acpi_ex_write_data_to_field() commit 2f8406891fed8be5aa5f535b7b5c37bba3272b1a Merge: f92a2ebb3d55 36c3aeb4b48d Author: Linus Torvalds Date: Thu Nov 29 15:07:30 2018 -0800 Merge tag 'pm-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix two issues in the operating performance points (OPP) framework. Specifics: - Fix the handling of the "operating-points-v2" property to avoid failures if multiple phandles are present in it which is legitimate (Viresh Kumar). - Drop the unnecessary static initialization of the .owner field in the ti_opp_supply_driver structure (YueHaibing)" * tag 'pm-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: OPP: Fix parsing of multiple phandles in "operating-points-v2" property opp: ti-opp-supply: Fix platform_no_drv_owner.cocci warnings commit b020fcf6bb4b2d980298c416b3f407075aa2b3b6 Author: Martin Schiller Date: Tue Nov 27 09:50:29 2018 +0100 net/x25: handle call collisions If a session in X25_STATE_1 (Awaiting Call Accept) receives a call request, the session will be closed (x25_disconnect), cause=0x01 (Number Busy) and diag=0x48 (Call Collision) will be set and a clear request will be send. Signed-off-by: Martin Schiller Signed-off-by: David S. Miller commit 06137619f061f498c2924f6543fa45b7d39f0501 Author: Martin Schiller Date: Tue Nov 27 09:50:28 2018 +0100 net/x25: fix null_x25_address handling o x25_find_listener(): the compare for the null_x25_address was wrong. We have to check the x25_addr of the listener socket instead of the x25_addr of the incomming call. o x25_bind(): it was not possible to bind a socket to null_x25_address Signed-off-by: Martin Schiller Signed-off-by: David S. Miller commit d449ba3d581ed29f751a59792fdc775572c66904 Author: Martin Schiller Date: Tue Nov 27 09:50:27 2018 +0100 net/x25: fix called/calling length calculation in x25_parse_address_block The length of the called and calling address was not calculated correctly (BCD encoding). Signed-off-by: Martin Schiller Signed-off-by: David S. Miller commit 7bca603a69c0c239654a8f0bcb99e1a60b30040c Author: Leon Romanovsky Date: Thu Nov 29 12:25:29 2018 +0200 RDMA/mlx5: Initialize return variable in case pagefault was skipped Pagefaults occurred in non-ODP MR are completely valid events, so initialize return variable to 0. Fixes: 4d5422a309de ("IB/mlx5: Skip non-ODP MR when handling a page fault") Reported-by: Dan Carpenter Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 89d328f637b9904b6d4c9af73c8a608b8dd4d6f8 Author: Kees Cook Date: Thu Nov 1 16:17:22 2018 -0700 pstore/ram: Correctly calculate usable PRZ bytes The actual number of bytes stored in a PRZ is smaller than the bytes requested by platform data, since there is a header on each PRZ. Additionally, if ECC is enabled, there are trailing bytes used as well. Normally this mismatch doesn't matter since PRZs are circular buffers and the leading "overflow" bytes are just thrown away. However, in the case of a compressed record, this rather badly corrupts the results. This corruption was visible with "ramoops.mem_size=204800 ramoops.ecc=1". Any stored crashes would not be uncompressable (producing a pstorefs "dmesg-*.enc.z" file), and triggering errors at boot: [ 2.790759] pstore: crypto_comp_decompress failed, ret = -22! Backporting this depends on commit 70ad35db3321 ("pstore: Convert console write to use ->write_buf") Reported-by: Joel Fernandes Fixes: b0aad7a99c1d ("pstore: Add compression support to pstore") Signed-off-by: Kees Cook Reviewed-by: Joel Fernandes (Google) commit c4f784268210ae5e6749d4ba30d117bd301a70a6 Merge: 2bbb5fa37475 ae6b3e54aa52 Author: Rafael J. Wysocki Date: Thu Nov 29 21:21:39 2018 +0100 Merge branch 'acpica-fixes' * acpica-fixes: ACPICA: Fix handling of buffer-size in acpi_ex_write_data_to_field() commit 90230968f102acbe103fbf7c03d41addfef5f153 Author: Baruch Siach Date: Thu Nov 29 12:00:05 2018 +0200 net: phy: sfp: correct location of SFP standards SFP standards are now available from the SNIA (Storage Networking Industry Association) website. Cc: Andrew Lunn Cc: Florian Fainelli Signed-off-by: Baruch Siach Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit c6888879fd55b1ba903c2a770127edbf6aef6f27 Author: Roman Li Date: Tue Nov 27 17:16:37 2018 -0500 drm/amd/display: Fix 6x4K displays light-up on Vega20 (v2) [Why] More than 4x4K didn't lightup on Vega20 due to low dcfclk value. Powerplay expects valid min requirement for dcfclk from DC. [How] Update min_dcfclock_khz based on min_engine_clock value. v2: backport to 4.20 (Alex) Reviewed-by: Hersen Wu Reviewed-by: Feifei Xu Reviewed-by: Evan Quan Acked-by: Alex Deucher Signed-off-by: Roman Li Signed-off-by: Alex Deucher commit 49f1c44b581b08e3289127ffe58bd208c3166701 Author: Nicholas Kazlauskas Date: Wed Nov 28 16:17:50 2018 -0500 drm/amd/display: Fix unintialized max_bpc state values [Why] If the "max bpc" isn't explicitly set in the atomic state then it have a value of 0. This has the correct behavior of limiting a panel to 8bpc in the case where the panel supports 8bpc. In the case of eDP panels this isn't a true assumption - there are panels that can only do 6bpc. Banding occurs for these displays. [How] Initialize the max_bpc when the connector resets to 8bpc. Also carry over the value when the state is duplicated. Bugzilla: https://bugs.freedesktop.org/108825 Fixes: 307638884f72 ("drm/amd/display: Support amdgpu "max bpc" connector property") Signed-off-by: Nicholas Kazlauskas Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit e869e7b59906a28232a71594599e07888033fc75 Merge: d7f7e0018b96 867d0ad476db Author: David S. Miller Date: Thu Nov 29 11:06:09 2018 -0800 Merge branch 'xps-fixes' Sabrina Dubroca says: ==================== fixes for XPS configuration after Symmetric queue selection This fixes some bugs introduced by the "Symmetric queue selection using XPS for Rx queues". First, the refactoring of the cleanup function skipped resetting the queue's NUMA node under some conditions. Second, the accounting on static keys for XPS and RXQS-XPS is unbalanced, so the static key for XPS won't actually disable itself, once enabled. The RXQS-XPS static key can actually be disabled by reconfiguring a device that didn't have RXQS-XPS configured at all. ==================== Signed-off-by: David S. Miller commit 867d0ad476db89a1e8af3f297af402399a54eea5 Author: Sabrina Dubroca Date: Thu Nov 29 14:14:49 2018 +0100 net: fix XPS static_key accounting Commit 04157469b7b8 ("net: Use static_key for XPS maps") introduced a static key for XPS, but the increments/decrements don't match. First, the static key's counter is incremented once for each queue, but only decremented once for a whole batch of queues, leading to large unbalances. Second, the xps_rxqs_needed key is decremented whenever we reset a batch of queues, whether they had any rxqs mapping or not, so that if we setup cpu-XPS on em1 and RXQS-XPS on em2, resetting the queues on em1 would decrement the xps_rxqs_needed key. This reworks the accounting scheme so that the xps_needed key is incremented only once for each type of XPS for all the queues on a device, and the xps_rxqs_needed key is incremented only once for all queues. This is sufficient to let us retrieve queues via get_xps_queue(). This patch introduces a new reset_xps_maps(), which reinitializes and frees the appropriate map (xps_rxqs_map or xps_cpus_map), and drops a reference to the needed keys: - both xps_needed and xps_rxqs_needed, in case of rxqs maps, - only xps_needed, in case of CPU maps. Now, we also need to call reset_xps_maps() at the end of __netif_set_xps_queue() when there's no active map left, for example when writing '00000000,00000000' to all queues' xps_rxqs setting. Fixes: 04157469b7b8 ("net: Use static_key for XPS maps") Signed-off-by: Sabrina Dubroca Signed-off-by: David S. Miller commit f28c020fb488e1a8b87469812017044bef88aa2b Author: Sabrina Dubroca Date: Thu Nov 29 14:14:48 2018 +0100 net: restore call to netdev_queue_numa_node_write when resetting XPS Before commit 80d19669ecd3 ("net: Refactor XPS for CPUs and Rx queues"), netif_reset_xps_queues() did netdev_queue_numa_node_write() for all the queues being reset. Now, this is only done when the "active" variable in clean_xps_maps() is false, ie when on all the CPUs, there's no active XPS mapping left. Fixes: 80d19669ecd3 ("net: Refactor XPS for CPUs and Rx queues") Signed-off-by: Sabrina Dubroca Signed-off-by: David S. Miller commit d7f7e0018b96fd1a30a968faa9464eb57372c1ec Author: Baruch Siach Date: Thu Nov 29 12:40:11 2018 +0200 net: phy: sfp: correct store of detected link modes The link modes that sfp_parse_support() detects are stored in the 'modes' bitmap. There is no reason to make an exception for 1000Base-PX or 1000Base-BX10. Fixes: 03145864bd0f ("sfp: support 1G BiDi (eg, FiberStore SFP-GE-BX) modules") Signed-off-by: Baruch Siach Acked-by: Russell King Signed-off-by: David S. Miller commit f1c0f59199419bfa955f84996122f5a81a24cb0f Merge: 60b548237fed d75d0e874ffe Author: David S. Miller Date: Thu Nov 29 10:38:39 2018 -0800 Merge branch 'ave-fixes' Kunihiko Hayashi says: ==================== fixup AVE ethernet driver This series adds fixup for AVE ethernet driver that includes increse of descriptors, replacing macro for linux-next, and adding missing author information. ==================== Signed-off-by: David S. Miller commit d75d0e874ffe929dec143d331b53e4bfceb10af2 Author: Kunihiko Hayashi Date: Thu Nov 29 17:08:38 2018 +0900 net: ethernet: ave: Add MODULE_AUTHOR and MAINTAINERS entry Add missing MODULE_AUTHOR of ave driver and an entry to MAINTAINERS. Signed-off-by: Kunihiko Hayashi Signed-off-by: David S. Miller commit 88113957ddb7b7d5451e28cd708c82ea7e63b097 Author: Kunihiko Hayashi Date: Thu Nov 29 17:08:37 2018 +0900 net: ethernet: ave: Replace NET_IP_ALIGN with AVE_FRAME_HEADROOM In commit 26a4676faa1a ("arm64: mm: define NET_IP_ALIGN to 0"), AVE controller affects this modification because the controller forces to ignore lower 2bits of buffer start address, and make 2-byte headroom, that is, data reception starts from (buffer + 2). This patch defines AVE_FRAME_HEADROOM macro as hardware-specific value, and replaces NET_IP_ALIGN with it. Signed-off-by: Kunihiko Hayashi Signed-off-by: David S. Miller commit 09ee3b4a249dd5c64da7d25a52a4ce42a49d647a Author: Kunihiko Hayashi Date: Thu Nov 29 17:08:36 2018 +0900 net: ethernet: ave: Increase descriptors to improve performance To improve performance, this increases Rx descriptor to 256, Tx descriptor to 64, and adjusts NAPI weight to NAPI_POLL_WEIGHT. Signed-off-by: Kunihiko Hayashi Signed-off-by: David S. Miller commit f92a2ebb3d5588720a33d4f22d55b4ba24f94da6 Merge: 3578f19143b0 598e1a42e962 Author: Linus Torvalds Date: Thu Nov 29 10:15:06 2018 -0800 Merge tag 'selinux-pr-20181129' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull SELinux fix from Paul Moore: "One more SELinux fix for v4.20: add some missing netlink message to SELinux permission mappings. The netlink messages were added in v4.19, but unfortunately we didn't catch it then because the mechanism to catch these things was bypassed. In addition to adding the mappings, we're adding some comments to the code to hopefully prevent bypasses in the future" * tag 'selinux-pr-20181129' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: add support for RTM_NEWCHAIN, RTM_DELCHAIN, and RTM_GETCHAIN commit 3578f19143b0a792bcd0ecb19f9295e2da563b54 Merge: b905e2db5cc4 814cedbc0b78 Author: Linus Torvalds Date: Thu Nov 29 10:10:42 2018 -0800 Merge tag 's390-4.20-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Martin Schwidefsky: - Add two missing kfree calls on error paths in the vfio-ccw code - Make sure that all data structures of a mediated vfio-ccw device are initialized before registering it - Fix a sparse warning in vfio-ccw - A followup patch for the pgtable_bytes accounting, the page table downgrade for compat processes missed a mm_dec_nr_pmds() - Reject sampling requests in the PMU init function of the CPU measurement counter facility - With the vfio AP driver an AP queue needs to be reset on every device probe as the alternative driver could have modified the device state * tag 's390-4.20-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/mm: correct pgtable_bytes on page table downgrade s390/zcrypt: reinit ap queue state machine during device probe s390/cpum_cf: Reject request for sampling in event initialization s390/cio: Fix cleanup when unsupported IDA format is used s390/cio: Fix cleanup of pfn_array alloc failure vfio: ccw: Register mediated device once all structures are initialized s390/cio: make vfio_ccw_io_region static commit b905e2db5cc42e64f8169474448f16083c535abe Merge: 9af33b574517 8159a6a4a7d2 Author: Linus Torvalds Date: Thu Nov 29 10:03:42 2018 -0800 Merge tag 'sound-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "As a usual pattern, we've got relatively large updates at rc5: - A fix for races in ALSA control user elements - ASoC DAPM regression due to component refactoring - A fix in error handling of ASoC iteration macro - ASoC Intel SST Skylake kconfig fix; a new Kconfig will appear as a consequence, but in the end it's a good cleanup - HD-audio and USB-audio quirks as always - Assort of ASoC driver fixes (pcm186x, Intel cht, rockchip, pcm3060, rsnd, omap, wm_adsp, qcom, sunxi, stm32)" * tag 'sound-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (34 commits) ALSA: usb-audio: Add vendor and product name for Dell WD19 Dock ALSA: hda/realtek - Support ALC300 ALSA: hda/realtek - Add auto-mute quirk for HP Spectre x360 laptop ALSA: hda/realtek - fix the pop noise on headphone for lenovo laptops ALSA: control: Fix race between adding and removing a user element ALSA: sparc: Fix invalid snd_free_pages() at error path ALSA: wss: Fix invalid snd_free_pages() at error path ALSA: hda/realtek - fix headset mic detection for MSI MS-B171 ALSA: hda: Add ASRock N68C-S UCC the power_save blacklist ALSA: ac97: Fix incorrect bit shift at AC97-SPSA control write ASoC: omap-dmic: Add pm_qos handling to avoid overruns with CPU_IDLE ASoC: omap-mcpdm: Add pm_qos handling to avoid under/overruns with CPU_IDLE ASoC: omap-mcbsp: Fix latency value calculation for pm_qos ASoC: acpi: fix: continue searching when machine is ignored ASoC: Intel: Skylake: fix Kconfigs, make HDaudio codec optional MAINTAINERS: add ASoC maintainers for sound dt-bindings ASoC: pcm186x: Fix device reset-registers trigger value ASoC: dapm: Recalculate audio map forcely when card instantiated ASoC: omap-abe-twl6040: Fix missing audio card caused by deferred probing ASoC: pcm3060: Rename output widgets ... commit 9af33b574517609763ff32dbca8857686c4bf296 Merge: 60b548237fed ecebf55d27a1 Author: Linus Torvalds Date: Thu Nov 29 09:56:00 2018 -0800 Merge tag 'fixes_for_v4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull ext2 and udf fixes from Jan Kara: "Three small ext2 and udf fixes" * tag 'fixes_for_v4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: ext2: fix potential use after free ext2: initialize opts.s_mount_opt as zero before using it udf: Allow mounting volumes with incorrect identification strings commit 975ef94a0284648fb0137bd5e949b18cef604e33 Author: Pan Bian Date: Thu Nov 22 10:07:12 2018 +0800 pvcalls-front: fixes incorrect error handling kfree() is incorrectly used to release the pages allocated by __get_free_page() and __get_free_pages(). Use the matching deallocators i.e., free_page() and free_pages(), respectively. Signed-off-by: Pan Bian Reviewed-by: Stefano Stabellini Signed-off-by: Juergen Gross commit 123664101aa2156d05251704fc63f9bcbf77741a Author: Igor Druzhinin Date: Tue Nov 27 20:58:21 2018 +0000 Revert "xen/balloon: Mark unallocated host memory as UNUSABLE" This reverts commit b3cf8528bb21febb650a7ecbf080d0647be40b9f. That commit unintentionally broke Xen balloon memory hotplug with "hotplug_unpopulated" set to 1. As long as "System RAM" resource got assigned under a new "Unusable memory" resource in IO/Mem tree any attempt to online this memory would fail due to general kernel restrictions on having "System RAM" resources as 1st level only. The original issue that commit has tried to workaround fa564ad96366 ("x86/PCI: Enable a 64bit BAR on AMD Family 15h (Models 00-1f, 30-3f, 60-7f)") also got amended by the following 03a551734 ("x86/PCI: Move and shrink AMD 64-bit window to avoid conflict") which made the original fix to Xen ballooning unnecessary. Signed-off-by: Igor Druzhinin Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit 72791ac854fea36034fa7976b748fde585008e78 Author: Srikanth Boddepalli Date: Tue Nov 27 19:53:27 2018 +0530 xen: xlate_mmu: add missing header to fix 'W=1' warning Add a missing header otherwise compiler warns about missed prototype: drivers/xen/xlate_mmu.c:183:5: warning: no previous prototype for 'xen_xlate_unmap_gfn_range?' [-Wmissing-prototypes] int xen_xlate_unmap_gfn_range(struct vm_area_struct *vma, ^~~~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Srikanth Boddepalli Reviewed-by: Boris Ostrovsky Reviewed-by: Joey Pabalinas Signed-off-by: Juergen Gross commit a7b403104e17209ea71eea59d4a71bf9e0d8cb83 Author: Juergen Gross Date: Fri Nov 23 17:24:51 2018 +0100 xen/x86: add diagnostic printout to xen_mc_flush() in case of error Failure of an element of a Xen multicall is signalled via a WARN() only if the kernel is compiled with MC_DEBUG. It is impossible to know which element failed and why it did so. Change that by printing the related information even without MC_DEBUG, even if maybe in some limited form (e.g. without information which caller produced the failing element). Move the printing out of the switch statement in order to have the same information for a single call. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit 874bfc6e5422d2421f7e4d5ea318d30e91679dfe Author: Masami Hiramatsu Date: Thu Nov 29 14:39:33 2018 +0900 arm64: ftrace: Fix to enable syscall events on arm64 Since commit 4378a7d4be30 ("arm64: implement syscall wrappers") introduced "__arm64_" prefix to all syscall wrapper symbols in sys_call_table, syscall tracer can not find corresponding metadata from syscall name. In the result, we have no syscall ftrace events on arm64 kernel, and some bpf testcases are failed on arm64. To fix this issue, this introduces custom arch_syscall_match_sym_name() which skips first 8 bytes when comparing the syscall and symbol names. Fixes: 4378a7d4be30 ("arm64: implement syscall wrappers") Reported-by: Naresh Kamboju Signed-off-by: Masami Hiramatsu Acked-by: Will Deacon Tested-by: Naresh Kamboju Cc: stable@vger.kernel.org Signed-off-by: Catalin Marinas commit ce8c80c536dac9f325a051b30bf7730ee505eddc Author: Catalin Marinas Date: Mon Nov 19 11:27:28 2018 +0000 arm64: Add workaround for Cortex-A76 erratum 1286807 On the affected Cortex-A76 cores (r0p0 to r3p0), if a virtual address for a cacheable mapping of a location is being accessed by a core while another core is remapping the virtual address to a new physical page using the recommended break-before-make sequence, then under very rare circumstances TLBI+DSB completes before a read using the translation being invalidated has been observed by other observers. The workaround repeats the TLBI+DSB operation and is shared with the Qualcomm Falkor erratum 1009 Reviewed-by: Suzuki K Poulose Signed-off-by: Catalin Marinas commit 598e1a42e9626213565d3b22ea948ce78556512a Author: Paul Moore Date: Wed Nov 28 12:57:33 2018 -0500 selinux: add support for RTM_NEWCHAIN, RTM_DELCHAIN, and RTM_GETCHAIN Commit 32a4f5ecd738 ("net: sched: introduce chain object to uapi") added new RTM_* definitions without properly updating SELinux, this patch adds the necessary SELinux support. While there was a BUILD_BUG_ON() in the SELinux code to protect from exactly this case, it was bypassed in the broken commit. In order to hopefully prevent this from happening in the future, add additional comments which provide some instructions on how to resolve the BUILD_BUG_ON() failures. Fixes: 32a4f5ecd738 ("net: sched: introduce chain object to uapi") Cc: # 4.19 Acked-by: David S. Miller Signed-off-by: Paul Moore commit 77e75fda94d2ebb86aa9d35fb1860f6395bf95de Author: Richard Genoud Date: Tue Nov 27 17:06:35 2018 +0100 dmaengine: at_hdmac: fix module unloading of_dma_controller_free() was not called on module onloading. This lead to a soft lockup: watchdog: BUG: soft lockup - CPU#0 stuck for 23s! Modules linked in: at_hdmac [last unloaded: at_hdmac] when of_dma_request_slave_channel() tried to call ofdma->of_dma_xlate(). Cc: stable@vger.kernel.org Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding") Acked-by: Ludovic Desroches Signed-off-by: Richard Genoud Signed-off-by: Vinod Koul commit 98f5f932254b88ce828bc8e4d1642d14e5854caa Author: Richard Genoud Date: Tue Nov 27 17:06:34 2018 +0100 dmaengine: at_hdmac: fix memory leak in at_dma_xlate() The leak was found when opening/closing a serial port a great number of time, increasing kmalloc-32 in slabinfo. Each time the port was opened, dma_request_slave_channel() was called. Then, in at_dma_xlate(), atslave was allocated with devm_kzalloc() and never freed. (Well, it was free at module unload, but that's not what we want). So, here, kzalloc is more suited for the job since it has to be freed in atc_free_chan_resources(). Cc: stable@vger.kernel.org Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding") Reported-by: Mario Forner Suggested-by: Alexandre Belloni Acked-by: Alexandre Belloni Acked-by: Ludovic Desroches Signed-off-by: Richard Genoud Signed-off-by: Vinod Koul commit 78e7b15e17ac175e7eed9e21c6f92d03d3b0a6fa Author: Radu Rendec Date: Tue Nov 27 22:20:48 2018 -0500 powerpc/msi: Fix NULL pointer access in teardown code The arch_teardown_msi_irqs() function assumes that controller ops pointers were already checked in arch_setup_msi_irqs(), but this assumption is wrong: arch_teardown_msi_irqs() can be called even when arch_setup_msi_irqs() returns an error (-ENOSYS). This can happen in the following scenario: - msi_capability_init() calls pci_msi_setup_msi_irqs() - pci_msi_setup_msi_irqs() returns -ENOSYS - msi_capability_init() notices the error and calls free_msi_irqs() - free_msi_irqs() calls pci_msi_teardown_msi_irqs() This is easier to see when CONFIG_PCI_MSI_IRQ_DOMAIN is not set and pci_msi_setup_msi_irqs() and pci_msi_teardown_msi_irqs() are just aliases to arch_setup_msi_irqs() and arch_teardown_msi_irqs(). The call to free_msi_irqs() upon pci_msi_setup_msi_irqs() failure seems legit, as it does additional cleanup; e.g. list_del(&entry->list) and kfree(entry) inside free_msi_irqs() do happen (MSI descriptors are allocated before pci_msi_setup_msi_irqs() is called and need to be cleaned up if that fails). Fixes: 6b2fd7efeb88 ("PCI/MSI/PPC: Remove arch_msi_check_device()") Cc: stable@vger.kernel.org # v3.18+ Signed-off-by: Radu Rendec Signed-off-by: Michael Ellerman commit 5363857b916c1f48027e9b96ee8be8376bf20811 Author: Takashi Iwai Date: Thu Nov 29 12:05:19 2018 +0100 ALSA: pcm: Fix interval evaluation with openmin/max As addressed in alsa-lib (commit b420056604f0), we need to fix the case where the evaluation of PCM interval "(x x+1]" leading to -EINVAL. After applying rules, such an interval may be translated as "(x x+1)". Fixes: ff2d6acdf6f1 ("ALSA: pcm: Fix snd_interval_refine first/last with open min/max") Cc: Signed-off-by: Takashi Iwai commit 96ae93b46dbb37a4a7a1e807d1b089f6b438840f Merge: effd14f66cc1 c9287fa657b3 Author: Greg Kroah-Hartman Date: Thu Nov 29 11:39:35 2018 +0100 Merge tag 'fixes-for-v4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus Felipe writes: USB: fixes for v4.20-rc4 In this second set of fixes for the current -rc cycle, we have some regressions fixes for the old omap_udc driver done by Aaro Koskinen. We're also reverting an old patch on dwc3 which is, now, known to break USB certification in some cases. We have a fix on u_ether for an unsafe list iteration. * tag 'fixes-for-v4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb: usb: gadget: u_ether: fix unsafe list iteration USB: omap_udc: fix rejection of out transfers when DMA is used USB: omap_udc: fix USB gadget functionality on Palm Tungsten E USB: omap_udc: fix omap_udc_start() on 15xx machines USB: omap_udc: fix crashes on probe error and module removal USB: omap_udc: use devm_request_irq() Revert "usb: dwc3: gadget: skip Set/Clear Halt when invalid" commit 3deef52ce10514ccdebba8e8ab85f9cebd0eb3f7 Author: Kai-Heng Feng Date: Thu Nov 29 08:57:37 2018 +0000 ALSA: hda: Add support for AMD Stoney Ridge It's similar to other AMD audio devices, it also supports D3, which can save some power drain. Signed-off-by: Kai-Heng Feng Cc: Signed-off-by: Takashi Iwai commit 44ff57e685f96d0cb9540004cc9d1d880e7a4315 Author: Tony Das Date: Wed Nov 28 20:16:37 2018 +0000 ALSA: usb-audio: Add SMSL D1 to quirks for native DSD support This patch adds quirk VID/PID IDs for the SMSL D1 in order to enable Native DSD support. [ Moved the added entry in numerical order -- tiwai ] Signed-off-by: Tony Das Cc: Signed-off-by: Takashi Iwai commit b888a5f713e4d17faaaff24316585a4eb07f35b7 Author: Chanho Min Date: Mon Nov 26 14:36:37 2018 +0900 ALSA: pcm: Fix starvation on down_write_nonblock() Commit 67ec1072b053 ("ALSA: pcm: Fix rwsem deadlock for non-atomic PCM stream") fixes deadlock for non-atomic PCM stream. But, This patch causes antother stuck. If writer is RT thread and reader is a normal thread, the reader thread will be difficult to get scheduled. It may not give chance to release readlocks and writer gets stuck for a long time if they are pinned to single cpu. The deadlock described in the previous commit is because the linux rwsem queues like a FIFO. So, we might need non-FIFO writelock, not non-block one. My suggestion is that the writer gives reader a chance to be scheduled by using the minimum msleep() instaed of spinning without blocking by writer. Also, The *_nonblock may be changed to *_nonfifo appropriately to this concept. In terms of performance, when trylock is failed, this minimum periodic msleep will have the same performance as the tick-based schedule()/wake_up_q(). [ Although this has a fairly high performance penalty, the relevant code path became already rare due to the previous commit ("ALSA: pcm: Call snd_pcm_unlink() conditionally at closing"). That is, now this unconditional msleep appears only when using linked streams, and this must be a rare case. So we accept this as a quick workaround until finding a more suitable one -- tiwai ] Fixes: 67ec1072b053 ("ALSA: pcm: Fix rwsem deadlock for non-atomic PCM stream") Suggested-by: Wonmin Jung Signed-off-by: Chanho Min Cc: Signed-off-by: Takashi Iwai commit b51abed8355e5556886623b2772fa6b7598d2282 Author: Takashi Iwai Date: Thu Nov 29 08:02:49 2018 +0100 ALSA: pcm: Call snd_pcm_unlink() conditionally at closing Currently the PCM core calls snd_pcm_unlink() always unconditionally at closing a stream. However, since snd_pcm_unlink() invokes the global rwsem down, the lock can be easily contended. More badly, when a thread runs in a high priority RT-FIFO, it may stall at spinning. Basically the call of snd_pcm_unlink() is required only for the linked streams that are already rare occasion. For normal use cases, this code path is fairly superfluous. As an optimization (and also as a workaround for the RT problem above in normal situations without linked streams), this patch adds a check before calling snd_pcm_unlink() and calls it only when needed. Reported-by: Chanho Min Cc: Signed-off-by: Takashi Iwai commit e5bde04ccce64d808f8b00a489a1fe5825d285cb Author: Pan Bian Date: Thu Nov 22 18:00:16 2018 +0800 crypto: do not free algorithm before using In multiple functions, the algorithm fields are read after its reference is dropped through crypto_mod_put. In this case, the algorithm memory may be freed, resulting in use-after-free bugs. This patch delays the put operation until the algorithm is never used. Fixes: 79c65d179a40 ("crypto: cbc - Convert to skcipher") Fixes: a7d85e06ed80 ("crypto: cfb - add support for Cipher FeedBack mode") Fixes: 043a44001b9e ("crypto: pcbc - Convert to skcipher") Cc: Signed-off-by: Pan Bian Signed-off-by: Herbert Xu commit c967590457cae5ba4f018704c341641bdcecfdcf Author: Dexuan Cui Date: Mon Nov 26 00:26:17 2018 +0000 scsi: storvsc: Fix a race in sub-channel creation that can cause panic We can concurrently try to open the same sub-channel from 2 paths: path #1: vmbus_onoffer() -> vmbus_process_offer() -> handle_sc_creation(). path #2: storvsc_probe() -> storvsc_connect_to_vsp() -> -> storvsc_channel_init() -> handle_multichannel_storage() -> -> vmbus_are_subchannels_present() -> handle_sc_creation(). They conflict with each other, but it was not an issue before the recent commit ae6935ed7d42 ("vmbus: split ring buffer allocation from open"), because at the beginning of vmbus_open() we checked newchannel->state so only one path could succeed, and the other would return with -EINVAL. After ae6935ed7d42, the failing path frees the channel's ringbuffer by vmbus_free_ring(), and this causes a panic later. Commit ae6935ed7d42 itself is good, and it just reveals the longstanding race. We can resolve the issue by removing path #2, i.e. removing the second vmbus_are_subchannels_present() in handle_multichannel_storage(). BTW, the comment "Check to see if sub-channels have already been created" in handle_multichannel_storage() is incorrect: when we unload the driver, we first close the sub-channel(s) and then close the primary channel, next the host sends rescind-offer message(s) so primary->sc_list will become empty. This means the first vmbus_are_subchannels_present() in handle_multichannel_storage() is never useful. Fixes: ae6935ed7d42 ("vmbus: split ring buffer allocation from open") Cc: stable@vger.kernel.org Cc: Long Li Cc: Stephen Hemminger Cc: K. Y. Srinivasan Cc: Haiyang Zhang Signed-off-by: Dexuan Cui Signed-off-by: K. Y. Srinivasan Signed-off-by: Martin K. Petersen commit 528bff0cdb6649f97f2c4802e4ac7a4b50645f2f Author: Yonghong Song Date: Wed Nov 28 09:38:23 2018 -0800 tools: bpftool: fix a bitfield pretty print issue Commit b12d6ec09730 ("bpf: btf: add btf print functionality") added btf pretty print functionality to bpftool. There is a problem though in printing a bitfield whose type has modifiers. For example, for a type like typedef int ___int; struct tmp_t { int a:3; ___int b:3; }; Suppose we have a map struct bpf_map_def SEC("maps") tmpmap = { .type = BPF_MAP_TYPE_HASH, .key_size = sizeof(__u32), .value_size = sizeof(struct tmp_t), .max_entries = 1, }; and the hash table is populated with one element with key 0 and value (.a = 1 and .b = 2). In BTF, the struct member "b" will have a type "typedef" which points to an int type. The current implementation does not pass the bit offset during transition from typedef to int type, hence incorrectly print the value as $ bpftool m d id 79 [{ "key": 0, "value": { "a": 0x1, "b": 0x1 } } ] This patch fixed the issue by carrying bit_offset along the type chain during bit_field print. The correct result can be printed as $ bpftool m d id 76 [{ "key": 0, "value": { "a": 0x1, "b": 0x2 } } ] The kernel pretty print is implemented correctly and does not have this issue. Fixes: b12d6ec09730 ("bpf: btf: add btf print functionality") Signed-off-by: Yonghong Song Acked-by: Song Liu Signed-off-by: Alexei Starovoitov commit ebcdcef30333660d3314158bac362425ade3d28c Merge: 50c187712701 9765635b3075 Author: Dave Airlie Date: Thu Nov 29 10:11:02 2018 +1000 Merge tag 'drm-misc-fixes-2018-11-28-1' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes - mst: Don't try to validate ports while destroying them (Lyude) - Revert: Don't try to validate ports while destroying them (Lyude) - core: Don't set device to master unless set_master succeeds (Sergio) - meson: Do vblank_on/off on enable/disable (Neil) - meson: Use fast_io regmap option to avoid sleeping in irq ctx (Lyude) - meson: Don't walk off the end of the OSD EOTF LUTs (Lyude) Cc: Lyude Paul Cc: Sergio Correia Cc: Neil Armstrong Signed-off-by: Dave Airlie From: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20181128212936.GA21379@art_vandelay commit 50c1877127012b6e8ccc0d8a1a3ad0e1b09e26dd Merge: 5c1c86031ead ad97d9de4583 Author: Dave Airlie Date: Thu Nov 29 10:07:33 2018 +1000 Merge branch 'drm-fixes-4.20' of git://people.freedesktop.org/~agd5f/linux into drm-fixes Fixes for 4.20. Nothing major. - DC DP MST fix - GPUVM fix for huge page mapping - RLC fix for vega20 Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20181128195905.2897-1-alexander.deucher@amd.com commit c2209c6d18d60298303af8353ae1e3f225df996a Merge: d78a5ebd8b18 d08489125e04 Author: Alexei Starovoitov Date: Wed Nov 28 16:03:05 2018 -0800 Merge branch 'btf-check-name' Yonghong Song says: ==================== This patch set added name checking for PTR, ARRAY, VOLATILE, TYPEDEF, CONST, RESTRICT, STRUCT, UNION, ENUM and FWD types. Such a strict name checking makes BTF more sound in the kernel and future BTF-to-header-file converesion ([1]) less fragile. Patch #1 implemented btf_name_valid_identifier() for name checking which will be used in Patch #2. Patch #2 checked name validity for the above mentioned types. Patch #3 fixed two existing test_btf unit tests exposed by the strict name checking. Patch #4 added additional test cases. This patch set is against bpf tree. Patch #1 has been implemented in bpf-next commit Commit 2667a2626f4d ("bpf: btf: Add BTF_KIND_FUNC and BTF_KIND_FUNC_PROTO"), so there is no need to apply this patch to bpf-next. In case this patch is applied to bpf-next, there will be a minor conflict like diff --cc kernel/bpf/btf.c index a09b2f94ab25,93c233ab2db6..000000000000 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@@ -474,7 -451,7 +474,11 @@@ static bool btf_name_valid_identifier(c return !*src; } ++<<<<<<< HEAD +const char *btf_name_by_offset(const struct btf *btf, u32 offset) ++======= + static const char *btf_name_by_offset(const struct btf *btf, u32 offset) ++>>>>>>> fa9566b0847d... bpf: btf: implement btf_name_valid_identifier() { if (!offset) return "(anon)"; Just resolve the conflict by taking the "const char ..." line. Patches #2, #3 and #4 can be applied to bpf-next without conflict. [1]: http://vger.kernel.org/lpc-bpf2018.html#session-2 ==================== Signed-off-by: Alexei Starovoitov commit d08489125e04a9f73d9323caea43270fd22d395f Author: Yonghong Song Date: Tue Nov 27 13:23:30 2018 -0800 tools/bpf: add addition type tests to test_btf The following additional unit testcases are added to test_btf: ... BTF raw test[42] (typedef (invalid name, name_off = 0)): OK BTF raw test[43] (typedef (invalid name, invalid identifier)): OK BTF raw test[44] (ptr type (invalid name, name_off <> 0)): OK BTF raw test[45] (volatile type (invalid name, name_off <> 0)): OK BTF raw test[46] (const type (invalid name, name_off <> 0)): OK BTF raw test[47] (restrict type (invalid name, name_off <> 0)): OK BTF raw test[48] (fwd type (invalid name, name_off = 0)): OK BTF raw test[49] (fwd type (invalid name, invalid identifier)): OK BTF raw test[50] (array type (invalid name, name_off <> 0)): OK BTF raw test[51] (struct type (name_off = 0)): OK BTF raw test[52] (struct type (invalid name, invalid identifier)): OK BTF raw test[53] (struct member (name_off = 0)): OK BTF raw test[54] (struct member (invalid name, invalid identifier)): OK BTF raw test[55] (enum type (name_off = 0)): OK BTF raw test[56] (enum type (invalid name, invalid identifier)): OK BTF raw test[57] (enum member (invalid name, name_off = 0)): OK BTF raw test[58] (enum member (invalid name, invalid identifier)): OK ... Fixes: c0fa1b6c3efc ("bpf: btf: Add BTF tests") Acked-by: Martin KaFai Lau Signed-off-by: Yonghong Song Signed-off-by: Alexei Starovoitov commit 8800cd031af085807028656c6ba7eb7908d78262 Author: Martin KaFai Lau Date: Tue Nov 27 13:23:29 2018 -0800 tools/bpf: fix two test_btf unit test cases There are two unit test cases, which should encode TYPEDEF type, but instead encode PTR type. The error is flagged out after enforcing name checking in the previous patch. Fixes: c0fa1b6c3efc ("bpf: btf: Add BTF tests") Signed-off-by: Martin KaFai Lau Signed-off-by: Yonghong Song Signed-off-by: Alexei Starovoitov commit eb04bbb608e683f8fd3ef7f716e2fa32dd90861f Author: Yonghong Song Date: Tue Nov 27 13:23:28 2018 -0800 bpf: btf: check name validity for various types This patch added name checking for the following types: . BTF_KIND_PTR, BTF_KIND_ARRAY, BTF_KIND_VOLATILE, BTF_KIND_CONST, BTF_KIND_RESTRICT: the name must be null . BTF_KIND_STRUCT, BTF_KIND_UNION: the struct/member name is either null or a valid identifier . BTF_KIND_ENUM: the enum type name is either null or a valid identifier; the enumerator name must be a valid identifier. . BTF_KIND_FWD: the name must be a valid identifier . BTF_KIND_TYPEDEF: the name must be a valid identifier For those places a valid name is required, the name must be a valid C identifier. This can be relaxed later if we found use cases for a different (non-C) frontend. Fixes: 69b693f0aefa ("bpf: btf: Introduce BPF Type Format (BTF)") Acked-by: Martin KaFai Lau Signed-off-by: Yonghong Song Signed-off-by: Alexei Starovoitov commit cdbb096adddb3f42584cecb5ec2e07c26815b71f Author: Yonghong Song Date: Tue Nov 27 13:23:27 2018 -0800 bpf: btf: implement btf_name_valid_identifier() Function btf_name_valid_identifier() have been implemented in bpf-next commit 2667a2626f4d ("bpf: btf: Add BTF_KIND_FUNC and BTF_KIND_FUNC_PROTO"). Backport this function so later patch can use it. Fixes: 69b693f0aefa ("bpf: btf: Introduce BPF Type Format (BTF)") Signed-off-by: Yonghong Song Signed-off-by: Alexei Starovoitov commit 5c1c86031ead5f13674fff31de9c2bf503c1c11a Merge: c5fbf9ebe0aa 2455facbb700 Author: Dave Airlie Date: Thu Nov 29 09:59:12 2018 +1000 Merge tag 'drm-intel-fixes-2018-11-28' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes Just gvt-fixes-2018-11-26 ""One to correct MOCS registers load on engine list, one for rpm lock warning fix, and another for use-after-free fix for partial ggtt list destroy. " Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20181128180648.GA17585@jlahtine-desk.ger.corp.intel.com commit c5fbf9ebe0aa33ec3cda8461f63ccd90a8f4086a Merge: 300625620314 0bc3544a010c Author: Dave Airlie Date: Thu Nov 29 09:56:29 2018 +1000 Merge tag 'du-fixes-20181126' of git://linuxtv.org/pinchartl/media into drm-fixes R-Car DU v4.20 regression fix Signed-off-by: Dave Airlie From: Laurent Pinchart Link: https://patchwork.freedesktop.org/patch/msgid/8134504.ZSXK7gKU4H@avalon commit 02f425f811cefcc4d325d7a72272651e622dc97e Author: Cathy Avery Date: Tue Nov 27 14:28:53 2018 -0500 scsi: vmw_pscsi: Rearrange code to avoid multiple calls to free_irq during unload Currently pvscsi_remove calls free_irq more than once as pvscsi_release_resources and __pvscsi_shutdown both call pvscsi_shutdown_intr. This results in a 'Trying to free already-free IRQ' warning and stack trace. To solve the problem pvscsi_shutdown_intr has been moved out of pvscsi_release_resources. Signed-off-by: Cathy Avery Reviewed-by: Ewan D. Milne Reviewed-by: Dan Carpenter Signed-off-by: Martin K. Petersen commit 300625620314194d9e6d4f6dda71f2dc9cf62d9f Author: Y.C. Chen Date: Thu Nov 22 11:56:28 2018 +0800 drm/ast: fixed reading monitor EDID not stable issue v1: over-sample data to increase the stability with some specific monitors v2: refine to avoid infinite loop v3: remove un-necessary "volatile" declaration [airlied: fix two checkpatch warnings] Signed-off-by: Y.C. Chen Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/1542858988-1127-1-git-send-email-yc_chen@aspeedtech.com commit dc25ab067645eabd037f1a23d49a666f9e0b8c68 Author: Sam Bobroff Date: Mon Nov 5 16:57:47 2018 +1100 drm/ast: Fix incorrect free on ioregs If the platform has no IO space, ioregs is placed next to the already allocated regs. In this case, it should not be separately freed. This prevents a kernel warning from __vunmap "Trying to vfree() nonexistent vm area" when unloading the driver. Fixes: 0dd68309b9c5 ("drm/ast: Try to use MMIO registers when PIO isn't supported") Signed-off-by: Sam Bobroff Cc: Signed-off-by: Dave Airlie commit 5db6dd14b31397e8cccaaddab2ff44ebec1acf25 Author: Fred Herard Date: Tue Nov 20 20:22:45 2018 -0500 scsi: libiscsi: Fix NULL pointer dereference in iscsi_eh_session_reset This commit addresses NULL pointer dereference in iscsi_eh_session_reset. Reference should not be made to session->leadconn when session->state is set to ISCSI_STATE_TERMINATE. Signed-off-by: Fred Herard Reviewed-by: Konrad Rzeszutek Wilk Reviewed-by: Lee Duncan Signed-off-by: Martin K. Petersen commit 9765635b30756eb74e05e260ac812659c296cd28 Author: Lyude Paul Date: Wed Nov 28 16:00:05 2018 -0500 Revert "drm/dp_mst: Skip validating ports during destruction, just ref" This reverts commit: c54c7374ff44 ("drm/dp_mst: Skip validating ports during destruction, just ref") ugh. In drm_dp_destroy_connector_work(), we have a pretty good chance of freeing the actual struct drm_dp_mst_port. However, after destroying things we send a hotplug through (*mgr->cbs->hotplug)(mgr) which is where the problems start. For i915, this calls all the way down to the fbcon probing helpers, which start trying to access the port in a modeset. [ 45.062001] ================================================================== [ 45.062112] BUG: KASAN: use-after-free in ex_handler_refcount+0x146/0x180 [ 45.062196] Write of size 4 at addr ffff8882b4b70968 by task kworker/3:1/53 [ 45.062325] CPU: 3 PID: 53 Comm: kworker/3:1 Kdump: loaded Tainted: G O 4.20.0-rc4Lyude-Test+ #3 [ 45.062442] Hardware name: LENOVO 20BWS1KY00/20BWS1KY00, BIOS JBET71WW (1.35 ) 09/14/2018 [ 45.062554] Workqueue: events drm_dp_destroy_connector_work [drm_kms_helper] [ 45.062641] Call Trace: [ 45.062685] dump_stack+0xbd/0x15a [ 45.062735] ? dump_stack_print_info.cold.0+0x1b/0x1b [ 45.062801] ? printk+0x9f/0xc5 [ 45.062847] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 45.062909] ? ex_handler_refcount+0x146/0x180 [ 45.062970] print_address_description+0x71/0x239 [ 45.063036] ? ex_handler_refcount+0x146/0x180 [ 45.063095] kasan_report.cold.5+0x242/0x30b [ 45.063155] __asan_report_store4_noabort+0x1c/0x20 [ 45.063313] ex_handler_refcount+0x146/0x180 [ 45.063371] ? ex_handler_clear_fs+0xb0/0xb0 [ 45.063428] fixup_exception+0x98/0xd7 [ 45.063484] ? raw_notifier_call_chain+0x20/0x20 [ 45.063548] do_trap+0x6d/0x210 [ 45.063605] ? _GLOBAL__sub_I_65535_1_drm_dp_aux_unregister_devnode+0x2f/0x1c6 [drm_kms_helper] [ 45.063732] do_error_trap+0xc0/0x170 [ 45.063802] ? _GLOBAL__sub_I_65535_1_drm_dp_aux_unregister_devnode+0x2f/0x1c6 [drm_kms_helper] [ 45.063929] do_invalid_op+0x3b/0x50 [ 45.063997] ? _GLOBAL__sub_I_65535_1_drm_dp_aux_unregister_devnode+0x2f/0x1c6 [drm_kms_helper] [ 45.064103] invalid_op+0x14/0x20 [ 45.064162] RIP: 0010:_GLOBAL__sub_I_65535_1_drm_dp_aux_unregister_devnode+0x2f/0x1c6 [drm_kms_helper] [ 45.064274] Code: 00 48 c7 c7 80 fe 53 a0 48 89 e5 e8 5b 6f 26 e1 5d c3 48 8d 0e 0f 0b 48 8d 0b 0f 0b 48 8d 0f 0f 0b 48 8d 0f 0f 0b 49 8d 4d 00 <0f> 0b 49 8d 0e 0f 0b 48 8d 08 0f 0b 49 8d 4d 00 0f 0b 48 8d 0b 0f [ 45.064569] RSP: 0018:ffff8882b789ee10 EFLAGS: 00010282 [ 45.064637] RAX: ffff8882af47ae70 RBX: ffff8882af47aa60 RCX: ffff8882b4b70968 [ 45.064723] RDX: ffff8882af47ae70 RSI: 0000000000000008 RDI: ffff8882b788bdb8 [ 45.064808] RBP: ffff8882b789ee28 R08: ffffed1056f13db4 R09: ffffed1056f13db3 [ 45.064894] R10: ffffed1056f13db3 R11: ffff8882b789ed9f R12: ffff8882af47ad28 [ 45.064980] R13: ffff8882b4b70968 R14: ffff8882acd86728 R15: ffff8882b4b75dc8 [ 45.065084] drm_dp_mst_reset_vcpi_slots+0x12/0x80 [drm_kms_helper] [ 45.065225] intel_mst_disable_dp+0xda/0x180 [i915] [ 45.065361] intel_encoders_disable.isra.107+0x197/0x310 [i915] [ 45.065498] haswell_crtc_disable+0xbe/0x400 [i915] [ 45.065622] ? i9xx_disable_plane+0x1c0/0x3e0 [i915] [ 45.065750] intel_atomic_commit_tail+0x74e/0x3e60 [i915] [ 45.065884] ? intel_pre_plane_update+0xbc0/0xbc0 [i915] [ 45.065968] ? drm_atomic_helper_swap_state+0x88b/0x1d90 [drm_kms_helper] [ 45.066054] ? kasan_check_write+0x14/0x20 [ 45.066165] ? i915_gem_track_fb+0x13a/0x330 [i915] [ 45.066277] ? i915_sw_fence_complete+0xe9/0x140 [i915] [ 45.066406] ? __i915_sw_fence_complete+0xc50/0xc50 [i915] [ 45.066540] intel_atomic_commit+0x72e/0xef0 [i915] [ 45.066635] ? drm_dev_dbg+0x200/0x200 [drm] [ 45.066764] ? intel_atomic_commit_tail+0x3e60/0x3e60 [i915] [ 45.066898] ? intel_atomic_commit_tail+0x3e60/0x3e60 [i915] [ 45.067001] drm_atomic_commit+0xc4/0xf0 [drm] [ 45.067074] restore_fbdev_mode_atomic+0x562/0x780 [drm_kms_helper] [ 45.067166] ? drm_fb_helper_debug_leave+0x690/0x690 [drm_kms_helper] [ 45.067249] ? kasan_check_read+0x11/0x20 [ 45.067324] restore_fbdev_mode+0x127/0x4b0 [drm_kms_helper] [ 45.067364] ? kasan_check_read+0x11/0x20 [ 45.067406] drm_fb_helper_restore_fbdev_mode_unlocked+0x164/0x200 [drm_kms_helper] [ 45.067462] ? drm_fb_helper_hotplug_event+0x30/0x30 [drm_kms_helper] [ 45.067508] ? kasan_check_write+0x14/0x20 [ 45.070360] ? mutex_unlock+0x22/0x40 [ 45.073748] drm_fb_helper_set_par+0xb2/0xf0 [drm_kms_helper] [ 45.075846] drm_fb_helper_hotplug_event.part.33+0x1cd/0x290 [drm_kms_helper] [ 45.078088] drm_fb_helper_hotplug_event+0x1c/0x30 [drm_kms_helper] [ 45.082614] intel_fbdev_output_poll_changed+0x9f/0x140 [i915] [ 45.087069] drm_kms_helper_hotplug_event+0x67/0x90 [drm_kms_helper] [ 45.089319] intel_dp_mst_hotplug+0x37/0x50 [i915] [ 45.091496] drm_dp_destroy_connector_work+0x510/0x6f0 [drm_kms_helper] [ 45.093675] ? drm_dp_update_payload_part1+0x1220/0x1220 [drm_kms_helper] [ 45.095851] ? kasan_check_write+0x14/0x20 [ 45.098473] ? kasan_check_read+0x11/0x20 [ 45.101155] ? strscpy+0x17c/0x530 [ 45.103808] ? __switch_to_asm+0x34/0x70 [ 45.106456] ? syscall_return_via_sysret+0xf/0x7f [ 45.109711] ? read_word_at_a_time+0x20/0x20 [ 45.113138] ? __switch_to_asm+0x40/0x70 [ 45.116529] ? __switch_to_asm+0x34/0x70 [ 45.119891] ? __switch_to_asm+0x40/0x70 [ 45.123224] ? __switch_to_asm+0x34/0x70 [ 45.126540] ? __switch_to_asm+0x34/0x70 [ 45.129824] process_one_work+0x88d/0x15d0 [ 45.133172] ? pool_mayday_timeout+0x850/0x850 [ 45.136459] ? pci_mmcfg_check_reserved+0x110/0x128 [ 45.139739] ? wake_q_add+0xb0/0xb0 [ 45.143010] ? check_preempt_wakeup+0x652/0x1050 [ 45.146304] ? worker_enter_idle+0x29e/0x740 [ 45.149589] ? __schedule+0x1ec0/0x1ec0 [ 45.152937] ? kasan_check_read+0x11/0x20 [ 45.156179] ? _raw_spin_lock_irq+0xa3/0x130 [ 45.159382] ? _raw_read_unlock_irqrestore+0x30/0x30 [ 45.162542] ? kasan_check_write+0x14/0x20 [ 45.165657] worker_thread+0x1a5/0x1470 [ 45.168725] ? set_load_weight+0x2e0/0x2e0 [ 45.171755] ? process_one_work+0x15d0/0x15d0 [ 45.174806] ? __switch_to_asm+0x34/0x70 [ 45.177645] ? __switch_to_asm+0x40/0x70 [ 45.180323] ? __switch_to_asm+0x34/0x70 [ 45.182936] ? __switch_to_asm+0x40/0x70 [ 45.185539] ? __switch_to_asm+0x34/0x70 [ 45.188100] ? __switch_to_asm+0x40/0x70 [ 45.190628] ? __schedule+0x7d4/0x1ec0 [ 45.193143] ? save_stack+0xa9/0xd0 [ 45.195632] ? kasan_check_write+0x10/0x20 [ 45.198162] ? kasan_kmalloc+0xc4/0xe0 [ 45.200609] ? kmem_cache_alloc_trace+0xdd/0x190 [ 45.203046] ? kthread+0x9f/0x3b0 [ 45.205470] ? ret_from_fork+0x35/0x40 [ 45.207876] ? unwind_next_frame+0x43/0x50 [ 45.210273] ? __save_stack_trace+0x82/0x100 [ 45.212658] ? deactivate_slab.isra.67+0x3d4/0x580 [ 45.215026] ? default_wake_function+0x35/0x50 [ 45.217399] ? kasan_check_read+0x11/0x20 [ 45.219825] ? _raw_spin_lock_irqsave+0xae/0x140 [ 45.222174] ? __lock_text_start+0x8/0x8 [ 45.224521] ? replenish_dl_entity.cold.62+0x4f/0x4f [ 45.226868] ? __kthread_parkme+0x87/0xf0 [ 45.229200] kthread+0x2f7/0x3b0 [ 45.231557] ? process_one_work+0x15d0/0x15d0 [ 45.233923] ? kthread_park+0x120/0x120 [ 45.236249] ret_from_fork+0x35/0x40 [ 45.240875] Allocated by task 242: [ 45.243136] save_stack+0x43/0xd0 [ 45.245385] kasan_kmalloc+0xc4/0xe0 [ 45.247597] kmem_cache_alloc_trace+0xdd/0x190 [ 45.249793] drm_dp_add_port+0x1e0/0x2170 [drm_kms_helper] [ 45.252000] drm_dp_send_link_address+0x4a7/0x740 [drm_kms_helper] [ 45.254389] drm_dp_check_and_send_link_address+0x1a7/0x210 [drm_kms_helper] [ 45.256803] drm_dp_mst_link_probe_work+0x6f/0xb0 [drm_kms_helper] [ 45.259200] process_one_work+0x88d/0x15d0 [ 45.261597] worker_thread+0x1a5/0x1470 [ 45.264038] kthread+0x2f7/0x3b0 [ 45.266371] ret_from_fork+0x35/0x40 [ 45.270937] Freed by task 53: [ 45.273170] save_stack+0x43/0xd0 [ 45.275382] __kasan_slab_free+0x139/0x190 [ 45.277604] kasan_slab_free+0xe/0x10 [ 45.279826] kfree+0x99/0x1b0 [ 45.282044] drm_dp_free_mst_port+0x4a/0x60 [drm_kms_helper] [ 45.284330] drm_dp_destroy_connector_work+0x43e/0x6f0 [drm_kms_helper] [ 45.286660] process_one_work+0x88d/0x15d0 [ 45.288934] worker_thread+0x1a5/0x1470 [ 45.291231] kthread+0x2f7/0x3b0 [ 45.293547] ret_from_fork+0x35/0x40 [ 45.298206] The buggy address belongs to the object at ffff8882b4b70968 which belongs to the cache kmalloc-2k of size 2048 [ 45.303047] The buggy address is located 0 bytes inside of 2048-byte region [ffff8882b4b70968, ffff8882b4b71168) [ 45.308010] The buggy address belongs to the page: [ 45.310477] page:ffffea000ad2dc00 count:1 mapcount:0 mapping:ffff8882c080cf40 index:0x0 compound_mapcount: 0 [ 45.313051] flags: 0x8000000000010200(slab|head) [ 45.315635] raw: 8000000000010200 ffffea000aac2808 ffffea000abe8608 ffff8882c080cf40 [ 45.318300] raw: 0000000000000000 00000000000d000d 00000001ffffffff 0000000000000000 [ 45.320966] page dumped because: kasan: bad access detected [ 45.326312] Memory state around the buggy address: [ 45.329085] ffff8882b4b70800: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 45.331845] ffff8882b4b70880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 45.334584] >ffff8882b4b70900: fc fc fc fc fc fc fc fc fc fc fc fc fc fb fb fb [ 45.337302] ^ [ 45.340061] ffff8882b4b70980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 45.342910] ffff8882b4b70a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 45.345748] ================================================================== So, this definitely isn't a fix that we want. This being said; there's no real easy fix for this problem because of some of the catch-22's of the MST helpers current design. For starters; we always need to validate a port with drm_dp_get_validated_port_ref(), but validation relies on the lifetime of the port in the actual topology. So once the port is gone, it can't be validated again. If we were to try to make the payload helpers not use port validation, then we'd cause another problem: if the port isn't validated, it could be freed and we'd just start causing more KASAN issues. There are already hacks that attempt to workaround this in drm_dp_mst_destroy_connector_work() by re-initializing the kref so that it can be used again and it's memory can be freed once the VCPI helpers finish removing the port's respective payloads. But none of these really do anything helpful since the port still can't be validated since it's gone from the topology. Also, that workaround is immensely confusing to read through. What really needs to be done in order to fix this is to teach DRM how to track the lifetime of the structs for MST ports and branch devices separately from their lifetime in the actual topology. Simply put; this means having two different krefs-one that removes the port/branch device from the topology, and one that finally calls kfree(). This would let us simplify things, since we'd now be able to keep ports around without having to keep them in the topology at the same time, which is exactly what we need in order to teach our VCPI helpers to only validate ports when it's actually necessary without running the risk of trying to use unallocated memory. Such a fix is on it's way, but for now let's play it safe and just revert this. If this bug has been around for well over a year, we can wait a little while to get an actual proper fix here. Signed-off-by: Lyude Paul Fixes: c54c7374ff44 ("drm/dp_mst: Skip validating ports during destruction, just ref") Cc: Daniel Vetter Cc: Sean Paul Cc: Jerry Zuo Cc: Harry Wentland Cc: stable@vger.kernel.org # v4.6+ Acked-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20181128210005.24434-1-lyude@redhat.com commit 60b548237fed4b4164bab13c994dd9615f6c4323 Merge: b26b2b24b1d8 d78a5ebd8b18 Author: Linus Torvalds Date: Wed Nov 28 12:53:48 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) ARM64 JIT fixes for subprog handling from Daniel Borkmann. 2) Various sparc64 JIT bug fixes (fused branch convergance, frame pointer usage detection logic, PSEODU call argument handling). 3) Fix to use BH locking in nf_conncount, from Taehee Yoo. 4) Fix race of TX skb freeing in ipheth driver, from Bernd Eckstein. 5) Handle return value of TX NAPI completion properly in lan743x driver, from Bryan Whitehead. 6) MAC filter deletion in i40e driver clears wrong state bit, from Lihong Yang. 7) Fix use after free in rionet driver, from Pan Bian. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (53 commits) s390/qeth: fix length check in SNMP processing net: hisilicon: remove unexpected free_netdev rapidio/rionet: do not free skb before reading its length i40e: fix kerneldoc for xsk methods ixgbe: recognize 1000BaseLX SFP modules as 1Gbps i40e: Fix deletion of MAC filters igb: fix uninitialized variables netfilter: nf_tables: deactivate expressions in rule replecement routine lan743x: Enable driver to work with LAN7431 tipc: fix lockdep warning during node delete lan743x: fix return value for lan743x_tx_napi_poll net: via: via-velocity: fix spelling mistake "alignement" -> "alignment" qed: fix spelling mistake "attnetion" -> "attention" net: thunderx: fix NULL pointer dereference in nic_remove sctp: increase sk_wmem_alloc when head->truesize is increased firestream: fix spelling mistake: "Inititing" -> "Initializing" net: phy: add workaround for issue where PHY driver doesn't bind to the device usbnet: ipheth: fix potential recvmsg bug and recvmsg bug 2 sparc: Adjust bpf JIT prologue for PSEUDO calls. bpf, doc: add entries of who looks over which jits ... commit b26b2b24b1d8cc6e24d81872e6e18c0d76382a81 Merge: 121b018f8c74 38a35a78c5e2 Author: Linus Torvalds Date: Wed Nov 28 12:51:10 2018 -0800 Merge tag 'xtensa-20181128' of git://github.com/jcmvbkbc/linux-xtensa Pull Xtensa fixes from Max Filippov: - fix kernel exception on userspace access to a currently disabled coprocessor - fix coprocessor data saving/restoring in configurations with multiple coprocessors - fix ptrace access to coprocessor data on configurations with multiple coprocessors with high alignment requirements * tag 'xtensa-20181128' of git://github.com/jcmvbkbc/linux-xtensa: xtensa: fix coprocessor part of ptrace_{get,set}xregs xtensa: fix coprocessor context offset definitions xtensa: enable coprocessors that are being flushed commit ad97d9de45835b6a0f71983b0ae0cffd7306730a Author: shaoyunl Date: Thu Nov 22 11:45:24 2018 -0500 drm/amdgpu: Add delay after enable RLC ucode Driver shouldn't try to access any GFX registers until RLC is idle. During the test, it took 12 seconds for RLC to clear the BUSY bit in RLC_GPM_STAT register which is un-acceptable for driver. As per RLC engineer, it would take RLC Ucode less than 10,000 GFXCLK cycles to finish its critical section. In a lowest 300M enginer clock setting(default from vbios), 50 us delay is enough. This commit fix the hang when RLC introduce the work around for XGMI which requires more cycles to setup more registers than normal Signed-off-by: shaoyunl Acked-by: Felix Kuehling Signed-off-by: Alex Deucher commit 1954db153d181e32017804e353e09ffe669c000b Author: Felix Kuehling Date: Sat Nov 24 23:25:04 2018 -0500 drm/amdgpu: Avoid endless loop in GPUVM fragment processing Don't bounce back to the root level for fragment processing, because huge pages are not supported at that level. This is unlikely to happen with the default VM size on Vega, but can be exposed by limiting the VM size with the amdgpu.vm_size module parameter. Signed-off-by: Felix Kuehling Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 9ce2b991f7ea45b913c3c391bb652dd95dd78876 Author: Felix Kuehling Date: Sat Nov 24 22:46:23 2018 -0500 drm/amdgpu: Cast to uint64_t before left shift Avoid potential integer overflows with left shift in huge-page mapping code by casting the operand to uin64_t first. Signed-off-by: Felix Kuehling Reviewed-by: Christian König Signed-off-by: Alex Deucher commit d78a5ebd8b18d3809fd9d6bbaeb64d78a332204f Merge: 9a764c1e5968 529eb362a347 Author: David S. Miller Date: Wed Nov 28 11:33:35 2018 -0800 Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue Jeff Kirsher says: ==================== Intel Wired LAN Driver Fixes 2018-11-28 This series contains fixes to igb, ixgbe and i40e. Yunjian Wang from Huawei resolves a variable that could potentially be NULL before it is used. Lihong fixes an i40e issue which goes back to 4.17 kernels, where deleting any of the MAC filters was causing the incorrect syncing for the PF. Josh Elsasser caught that there were missing enum values in the link capabilities for x550 devices, which was preventing link for 1000BaseLX SFP modules. Jan fixes the function header comments for XSK methods. ==================== Signed-off-by: David S. Miller commit 9a764c1e59684c0358e16ccaafd870629f2cfe67 Author: Julian Wiedmann Date: Wed Nov 28 16:20:50 2018 +0100 s390/qeth: fix length check in SNMP processing The response for a SNMP request can consist of multiple parts, which the cmd callback stages into a kernel buffer until all parts have been received. If the callback detects that the staging buffer provides insufficient space, it bails out with error. This processing is buggy for the first part of the response - while it initially checks for a length of 'data_len', it later copies an additional amount of 'offsetof(struct qeth_snmp_cmd, data)' bytes. Fix the calculation of 'data_len' for the first part of the response. This also nicely cleans up the memcpy code. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Julian Wiedmann Reviewed-by: Ursula Braun Signed-off-by: David S. Miller commit 55e56f06ed71d9441f3abd5b1d3c1a870812b3fe Author: Matthew Wilcox Date: Tue Nov 27 13:16:34 2018 -0800 dax: Don't access a freed inode After we drop the i_pages lock, the inode can be freed at any time. The get_unlocked_entry() code has no choice but to reacquire the lock, so it can't be used here. Create a new wait_entry_unlocked() which takes care not to acquire the lock or dereference the address_space in any way. Fixes: c2a7d2a11552 ("filesystem-dax: Introduce dax_lock_mapping_entry()") Cc: Signed-off-by: Matthew Wilcox Reviewed-by: Jan Kara Signed-off-by: Dan Williams commit c93db7bb6ef3251e0ea48ade311d3e9942748e1c Author: Matthew Wilcox Date: Tue Nov 27 13:16:33 2018 -0800 dax: Check page->mapping isn't NULL If we race with inode destroy, it's possible for page->mapping to be NULL before we even enter this routine, as well as after having slept waiting for the dax entry to become unlocked. Fixes: c2a7d2a11552 ("filesystem-dax: Introduce dax_lock_mapping_entry()") Cc: Reported-by: Jan Kara Signed-off-by: Matthew Wilcox Reviewed-by: Johannes Thumshirn Reviewed-by: Jan Kara Signed-off-by: Dan Williams commit e9d8faf93d273374dc6ae073a35e2fbcbcd97305 Merge: c758940158bf ca08987885a1 Author: David S. Miller Date: Wed Nov 28 11:02:45 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Disable BH while holding list spinlock in nf_conncount, from Taehee Yoo. 2) List corruption in nf_conncount, also from Taehee. 3) Fix race that results in leaving around an empty list node in nf_conncount, from Taehee Yoo. 4) Proper chain handling for inactive chains from the commit path, from Florian Westphal. This includes a selftest for this. 5) Do duplicate rule handles when replacing rules, also from Florian. 6) Remove net_exit path in xt_RATEEST that results in splat, from Taehee. 7) Possible use-after-free in nft_compat when releasing extensions. From Florian. 8) Memory leak in xt_hashlimit, from Taehee. 9) Call ip_vs_dst_notifier after ipv6_dev_notf, from Xin Long. 10) Fix cttimeout with udplite and gre, from Florian. 11) Preserve oif for IPv6 link-local generated traffic from mangle table, from Alin Nastac. 12) Missing error handling in masquerade notifiers, from Taehee Yoo. 13) Use mutex to protect registration/unregistration of masquerade extensions in order to prevent a race, from Taehee. 14) Incorrect condition check in tree_nodes_free(), also from Taehee. 15) Fix chain counter leak in rule replacement path, from Taehee. ==================== Signed-off-by: David S. Miller commit c758940158bf29fe14e9d0f89d5848f227b48134 Author: Pan Bian Date: Wed Nov 28 15:30:24 2018 +0800 net: hisilicon: remove unexpected free_netdev The net device ndev is freed via free_netdev when failing to register the device. The control flow then jumps to the error handling code block. ndev is used and freed again. Resulting in a use-after-free bug. Signed-off-by: Pan Bian Signed-off-by: David S. Miller commit cfc435198f53a6fa1f656d98466b24967ff457d0 Author: Pan Bian Date: Wed Nov 28 14:53:19 2018 +0800 rapidio/rionet: do not free skb before reading its length skb is freed via dev_kfree_skb_any, however, skb->len is read then. This may result in a use-after-free bug. Fixes: e6161d64263 ("rapidio/rionet: rework driver initialization and removal") Signed-off-by: Pan Bian Signed-off-by: David S. Miller commit dfb7513374c1f8e7cd595106fbdba3fd07ebaf30 Author: Martin Wilck Date: Mon Nov 12 09:58:37 2018 +0100 scsi: lpfc: fix block guard enablement on SLI3 adapters Since f44ac12f1dcc, BG enablement is tracked with the LPFC_SLI3_BG_ENABLED bit, which is set in lpfc_get_cfgparam before lpfc_sli_config_sli_port() is called. The bit shouldn't be cleared before checking the feature. Based on problem analysis by David Bond. Fixes: f44ac12f1dcc "scsi: lpfc: Memory allocation error during driver start-up on power8" Tested-by: David Bond Signed-off-by: Martin Wilck Cc: stable@vger.kernel.org # 4.17.x Cc: stable@vger.kernel.org # 4.18.x Cc: stable@vger.kernel.org # 4.19.x Reviewed-by: Hannes Reinecke Acked-by: James Smart Signed-off-by: Martin K. Petersen commit 529eb362a3477189224e7b7d24983d49448a85db Author: Jan Sokolowski Date: Tue Nov 27 09:35:35 2018 -0800 i40e: fix kerneldoc for xsk methods One method, xsk_umem_setup, had an incorrect kernel doc description, which has been corrected. Also fixes small typos found in the comments. Signed-off-by: Jan Sokolowski Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 121b018f8c74b4e0ba81b4b8ee73a82db3f24b7b Merge: 5b26f7180cdb 42a657f57628 Author: Linus Torvalds Date: Wed Nov 28 08:38:20 2018 -0800 Merge tag 'for-4.20-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "Some of these bugs are being hit during testing so we'd like to get them merged, otherwise there are usual stability fixes for stable trees" * tag 'for-4.20-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: relocation: set trans to be NULL after ending transaction Btrfs: fix race between enabling quotas and subvolume creation Btrfs: send, fix infinite loop due to directory rename dependencies Btrfs: ensure path name is null terminated at btrfs_control_ioctl Btrfs: fix rare chances for data loss when doing a fast fsync btrfs: Always try all copies when reading extent buffers commit 5b26f7180cdb3406404e6da78741e4e57f9a999e Merge: d8242d22d501 91b9deefedf4 Author: Linus Torvalds Date: Wed Nov 28 08:33:55 2018 -0800 Merge tag 'spi-fix-v4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A few driver specific fixes here, nothing big or that stands out for anyone other than the driver users. The omap2-mcspi fix is for issues that started showing up with a change in defconfig in this release to make cpuidle get turned on by default" * tag 'spi-fix-v4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: omap2-mcspi: Add missing suspend and resume calls spi: mediatek: use correct mata->xfer_len when in fifo transfer spi: uniphier: fix incorrect property items commit a8bf879af7b1999eba36303ce9cc60e0e7dd816c Author: Josh Elsasser Date: Sat Nov 24 12:57:33 2018 -0800 ixgbe: recognize 1000BaseLX SFP modules as 1Gbps Add the two 1000BaseLX enum values to the X550's check for 1Gbps modules, allowing the core driver code to establish a link over this SFP type. This is done by the out-of-tree driver but the fix wasn't in mainline. Fixes: e23f33367882 ("ixgbe: Fix 1G and 10G link stability for X550EM_x SFP+”) Fixes: 6a14ee0cfb19 ("ixgbe: Add X550 support function pointers") Signed-off-by: Josh Elsasser Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit d8242d22d501b8403c780f306762fbdf889ec0c5 Merge: ef78e5ec9214 fd65d3142f73 Author: Linus Torvalds Date: Wed Nov 28 08:29:18 2018 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "Bugfixes, many of them reported by syzkaller and mostly predating the merge window" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: kvm: svm: Ensure an IBPB on all affected CPUs when freeing a vmcb kvm: mmu: Fix race in emulated page table writes KVM: nVMX: vmcs12 revision_id is always VMCS12_REVISION even when copied from eVMCS KVM: nVMX: Verify eVMCS revision id match supported eVMCS version on eVMCS VMPTRLD KVM: nVMX/nSVM: Fix bug which sets vcpu->arch.tsc_offset to L1 tsc_offset x86/kvm/vmx: fix old-style function declaration KVM: x86: fix empty-body warnings KVM: VMX: Update shared MSRs to be saved/restored on MSR_EFER.LMA changes KVM: x86: Fix kernel info-leak in KVM_HC_CLOCK_PAIRING hypercall KVM: nVMX: Fix kernel info-leak when enabling KVM_CAP_HYPERV_ENLIGHTENED_VMCS more than once svm: Add mutex_lock to protect apic_access_page_done on AMD systems KVM: X86: Fix scan ioapic use-before-initialization KVM: LAPIC: Fix pv ipis use-before-initialization KVM: VMX: re-add ple_gap module parameter KVM: PPC: Book3S HV: Fix handling for interrupted H_ENTER_NESTED commit eab077aa84331afbda071a213925d4cdbca58941 Author: Lihong Yang Date: Wed Nov 21 09:15:37 2018 -0800 i40e: Fix deletion of MAC filters In __i40e_del_filter function, the flag __I40E_MACVLAN_SYNC_PENDING for the PF state is wrongly set for the VSI. Deleting any of the MAC filters has caused the incorrect syncing for the PF. Fix it by setting this state flag to the intended PF. CC: stable Signed-off-by: Lihong Yang Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit e4c39f7926b4de355f7df75651d75003806aae09 Author: Yunjian Wang Date: Tue Nov 6 16:27:12 2018 +0800 igb: fix uninitialized variables This patch fixes the variable 'phy_word' may be used uninitialized. Signed-off-by: Yunjian Wang Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher commit 9a24ce5b66f9c8190d63b15f4473600db4935f1f Author: Kiran Kumar Modukuri Date: Mon Sep 24 12:02:39 2018 +1000 cachefiles: Fix page leak in cachefiles_read_backing_file while vmscan is active [Description] In a heavily loaded system where the system pagecache is nearing memory limits and fscache is enabled, pages can be leaked by fscache while trying read pages from cachefiles backend. This can happen because two applications can be reading same page from a single mount, two threads can be trying to read the backing page at same time. This results in one of the threads finding that a page for the backing file or netfs file is already in the radix tree. During the error handling cachefiles does not clean up the reference on backing page, leading to page leak. [Fix] The fix is straightforward, to decrement the reference when error is encountered. [dhowells: Note that I've removed the clearance and put of newpage as they aren't attested in the commit message and don't appear to actually achieve anything since a new page is only allocated is newpage!=NULL and any residual new page is cleared before returning.] [Testing] I have tested the fix using following method for 12+ hrs. 1) mkdir -p /mnt/nfs ; mount -o vers=3,fsc :/export /mnt/nfs 2) create 10000 files of 2.8MB in a NFS mount. 3) start a thread to simulate heavy VM presssure (while true ; do echo 3 > /proc/sys/vm/drop_caches ; sleep 1 ; done)& 4) start multiple parallel reader for data set at same time find /mnt/nfs -type f | xargs -P 80 cat > /dev/null & find /mnt/nfs -type f | xargs -P 80 cat > /dev/null & find /mnt/nfs -type f | xargs -P 80 cat > /dev/null & .. .. find /mnt/nfs -type f | xargs -P 80 cat > /dev/null & find /mnt/nfs -type f | xargs -P 80 cat > /dev/null & 5) finally check using cat /proc/fs/fscache/stats | grep -i pages ; free -h , cat /proc/meminfo and page-types -r -b lru to ensure all pages are freed. Reviewed-by: Daniel Axtens Signed-off-by: Shantanu Goel Signed-off-by: Kiran Kumar Modukuri [dja: forward ported to current upstream] Signed-off-by: Daniel Axtens Signed-off-by: David Howells commit 40b412897ccb4b98b2cfb2a0aaabed58dd9e2086 Author: Frieder Schrempf Date: Tue Nov 27 07:44:52 2018 +0000 mtd: nand: Fix memory allocation in nanddev_bbt_init() Fix the size of the buffer allocated to store the in-memory BBT. This bug was previously hidden by a different bug, that was fixed in commit d098093ba06e ("mtd: nand: Fix nanddev_neraseblocks()"). Fixes: 9c3736a3de21 ("mtd: nand: Add core infrastructure to deal with NAND devices") Cc: Signed-off-by: Frieder Schrempf Acked-by: Miquel Raynal Signed-off-by: Boris Brezillon commit 3f2b7b9035107d6096ea438ea3d97dcf0481b6d2 Author: kiran.modukuri Date: Mon Nov 26 15:41:48 2018 +0000 fscache: Fix race in fscache_op_complete() due to split atomic_sub & read The code in fscache_retrieval_complete is using atomic_sub followed by an atomic_read: atomic_sub(n_pages, &op->n_pages); if (atomic_read(&op->n_pages) <= 0) fscache_op_complete(&op->op, true); This causes two threads doing a decrement of n_pages to race with each other seeing the op->refcount 0 at same time - and they end up calling fscache_op_complete() in both the threads leading to an assertion failure. Fix this by using atomic_sub_return_relaxed() instead of two calls. Note that I'm using 'relaxed' rather than, say, 'release' as there aren't multiple variables that appear to need ordering across the release. The oops looks something like: FS-Cache: Assertion failed FS-Cache: 0 > 0 is false ... kernel BUG at /usr/src/linux-4.4.0/fs/fscache/operation.c:449! ... Workqueue: fscache_operation fscache_op_work_func [fscache] ... RIP: 0010:[] fscache_op_complete+0x10d/0x180 [fscache] ... Call Trace: [] cachefiles_read_copier+0x3a9/0x410 [cachefiles] [] fscache_op_work_func+0x22/0x50 [fscache] [] process_one_work+0x150/0x3f0 [] worker_thread+0x11a/0x470 [] ? __schedule+0x359/0x980 [] ? rescuer_thread+0x310/0x310 [] kthread+0xd6/0xf0 [] ? kthread_park+0x60/0x60 [] ret_from_fork+0x3f/0x70 [] ? kthread_park+0x60/0x60 This seen this in 4.4.x kernels and the same bug affects fscache in latest upstreams kernels. Fixes: 1bb4b7f98f36 ("FS-Cache: The retrieval remaining-pages counter needs to be atomic_t") Signed-off-by: Kiran Kumar Modukuri Signed-off-by: David Howells commit e6bc06faf64a83384cc0abc537df954c9d3ff942 Author: David Howells Date: Tue Nov 27 16:34:55 2018 +0000 cachefiles: Fix an assertion failure when trying to update a failed object If cachefiles gets an error other then ENOENT when trying to look up an object in the cache (in this case, EACCES), the object state machine will eventually transition to the DROP_OBJECT state. This state invokes fscache_drop_object() which tries to sync the auxiliary data with the cache (this is done lazily since commit 402cb8dda949d) on an incomplete cache object struct. The problem comes when cachefiles_update_object_xattr() is called to rewrite the xattr holding the data. There's an assertion there that the cache object points to a dentry as we're going to update its xattr. The assertion trips, however, as dentry didn't get set. Fix the problem by skipping the update in cachefiles if the object doesn't refer to a dentry. A better way to do it could be to skip the update from the DROP_OBJECT state handler in fscache, but that might deny the cache the opportunity to update intermediate state. If this error occurs, the kernel log includes lines that look like the following: CacheFiles: Lookup failed error -13 CacheFiles: CacheFiles: Assertion failed ------------[ cut here ]------------ kernel BUG at fs/cachefiles/xattr.c:138! ... Workqueue: fscache_object fscache_object_work_func [fscache] RIP: 0010:cachefiles_update_object_xattr.cold.4+0x18/0x1a [cachefiles] ... Call Trace: cachefiles_update_object+0xdd/0x1c0 [cachefiles] fscache_update_aux_data+0x23/0x30 [fscache] fscache_drop_object+0x18e/0x1c0 [fscache] fscache_object_work_func+0x74/0x2b0 [fscache] process_one_work+0x18d/0x340 worker_thread+0x2e/0x390 ? pwq_unbound_release_workfn+0xd0/0xd0 kthread+0x112/0x130 ? kthread_bind+0x30/0x30 ret_from_fork+0x35/0x40 Note that there are actually two issues here: (1) EACCES happened on a cache object and (2) an oops occurred. I think that the second is a consequence of the first (it certainly looks like it ought to be). This patch only deals with the second. Fixes: 402cb8dda949 ("fscache: Attach the index key and aux data to the cookie") Reported-by: Zhibin Li Signed-off-by: David Howells commit 55a974021ec952ee460dc31ca08722158639de72 Author: Thomas Gleixner Date: Sun Nov 25 19:33:56 2018 +0100 x86/speculation: Provide IBPB always command line options Provide the possibility to enable IBPB always in combination with 'prctl' and 'seccomp'. Add the extra command line options and rework the IBPB selection to evaluate the command instead of the mode selected by the STIPB switch case. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Tim Chen Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185006.144047038@linutronix.de commit 6b3e64c237c072797a9ec918654a60e3a46488e2 Author: Thomas Gleixner Date: Sun Nov 25 19:33:55 2018 +0100 x86/speculation: Add seccomp Spectre v2 user space protection mode If 'prctl' mode of user space protection from spectre v2 is selected on the kernel command-line, STIBP and IBPB are applied on tasks which restrict their indirect branch speculation via prctl. SECCOMP enables the SSBD mitigation for sandboxed tasks already, so it makes sense to prevent spectre v2 user space to user space attacks as well. The Intel mitigation guide documents how STIPB works: Setting bit 1 (STIBP) of the IA32_SPEC_CTRL MSR on a logical processor prevents the predicted targets of indirect branches on any logical processor of that core from being controlled by software that executes (or executed previously) on another logical processor of the same core. Ergo setting STIBP protects the task itself from being attacked from a task running on a different hyper-thread and protects the tasks running on different hyper-threads from being attacked. While the document suggests that the branch predictors are shielded between the logical processors, the observed performance regressions suggest that STIBP simply disables the branch predictor more or less completely. Of course the document wording is vague, but the fact that there is also no requirement for issuing IBPB when STIBP is used points clearly in that direction. The kernel still issues IBPB even when STIBP is used until Intel clarifies the whole mechanism. IBPB is issued when the task switches out, so malicious sandbox code cannot mistrain the branch predictor for the next user space task on the same logical processor. Signed-off-by: Jiri Kosina Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Tim Chen Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185006.051663132@linutronix.de commit 7cc765a67d8e04ef7d772425ca5a2a1e2b894c15 Author: Thomas Gleixner Date: Sun Nov 25 19:33:54 2018 +0100 x86/speculation: Enable prctl mode for spectre_v2_user Now that all prerequisites are in place: - Add the prctl command line option - Default the 'auto' mode to 'prctl' - When SMT state changes, update the static key which controls the conditional STIBP evaluation on context switch. - At init update the static key which controls the conditional IBPB evaluation on context switch. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Tim Chen Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185005.958421388@linutronix.de commit 9137bb27e60e554dab694eafa4cca241fa3a694f Author: Thomas Gleixner Date: Sun Nov 25 19:33:53 2018 +0100 x86/speculation: Add prctl() control for indirect branch speculation Add the PR_SPEC_INDIRECT_BRANCH option for the PR_GET_SPECULATION_CTRL and PR_SET_SPECULATION_CTRL prctls to allow fine grained per task control of indirect branch speculation via STIBP and IBPB. Invocations: Check indirect branch speculation status with - prctl(PR_GET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, 0, 0, 0); Enable indirect branch speculation with - prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_ENABLE, 0, 0); Disable indirect branch speculation with - prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_DISABLE, 0, 0); Force disable indirect branch speculation with - prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_FORCE_DISABLE, 0, 0); See Documentation/userspace-api/spec_ctrl.rst. Signed-off-by: Tim Chen Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185005.866780996@linutronix.de commit 6893a959d7fdebbab5f5aa112c277d5a44435ba1 Author: Thomas Gleixner Date: Sun Nov 25 19:33:52 2018 +0100 x86/speculation: Prepare arch_smt_update() for PRCTL mode The upcoming fine grained per task STIBP control needs to be updated on CPU hotplug as well. Split out the code which controls the strict mode so the prctl control code can be added later. Mark the SMP function call argument __unused while at it. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Tim Chen Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185005.759457117@linutronix.de commit 6d991ba509ebcfcc908e009d1db51972a4f7a064 Author: Thomas Gleixner Date: Wed Nov 28 10:56:57 2018 +0100 x86/speculation: Prevent stale SPEC_CTRL msr content The seccomp speculation control operates on all tasks of a process, but only the current task of a process can update the MSR immediately. For the other threads the update is deferred to the next context switch. This creates the following situation with Process A and B: Process A task 2 and Process B task 1 are pinned on CPU1. Process A task 2 does not have the speculation control TIF bit set. Process B task 1 has the speculation control TIF bit set. CPU0 CPU1 MSR bit is set ProcB.T1 schedules out ProcA.T2 schedules in MSR bit is cleared ProcA.T1 seccomp_update() set TIF bit on ProcA.T2 ProcB.T1 schedules in MSR is not updated <-- FAIL This happens because the context switch code tries to avoid the MSR update if the speculation control TIF bits of the incoming and the outgoing task are the same. In the worst case ProcB.T1 and ProcA.T2 are the only tasks scheduling back and forth on CPU1, which keeps the MSR stale forever. In theory this could be remedied by IPIs, but chasing the remote task which could be migrated is complex and full of races. The straight forward solution is to avoid the asychronous update of the TIF bit and defer it to the next context switch. The speculation control state is stored in task_struct::atomic_flags by the prctl and seccomp updates already. Add a new TIF_SPEC_FORCE_UPDATE bit and set this after updating the atomic_flags. Check the bit on context switch and force a synchronous update of the speculation control if set. Use the same mechanism for updating the current task. Reported-by: Tim Chen Signed-off-by: Thomas Gleixner Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Tim Chen Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1811272247140.1875@nanos.tec.linutronix.de commit e6da8bb6f9abb2628381904b24163c770e630bac Author: Thomas Gleixner Date: Sun Nov 25 19:33:51 2018 +0100 x86/speculation: Split out TIF update The update of the TIF_SSBD flag and the conditional speculation control MSR update is done in the ssb_prctl_set() function directly. The upcoming prctl support for controlling indirect branch speculation via STIBP needs the same mechanism. Split the code out and make it reusable. Reword the comment about updates for other tasks. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Tim Chen Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185005.652305076@linutronix.de commit 46f7ecb1e7359f183f5bbd1e08b90e10e52164f9 Author: Thomas Gleixner Date: Sun Nov 25 19:33:50 2018 +0100 ptrace: Remove unused ptrace_may_access_sched() and MODE_IBRS The IBPB control code in x86 removed the usage. Remove the functionality which was introduced for this. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Tim Chen Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185005.559149393@linutronix.de commit 4c71a2b6fd7e42814aa68a6dec88abf3b42ea573 Author: Thomas Gleixner Date: Sun Nov 25 19:33:49 2018 +0100 x86/speculation: Prepare for conditional IBPB in switch_mm() The IBPB speculation barrier is issued from switch_mm() when the kernel switches to a user space task with a different mm than the user space task which ran last on the same CPU. An additional optimization is to avoid IBPB when the incoming task can be ptraced by the outgoing task. This optimization only works when switching directly between two user space tasks. When switching from a kernel task to a user space task the optimization fails because the previous task cannot be accessed anymore. So for quite some scenarios the optimization is just adding overhead. The upcoming conditional IBPB support will issue IBPB only for user space tasks which have the TIF_SPEC_IB bit set. This requires to handle the following cases: 1) Switch from a user space task (potential attacker) which has TIF_SPEC_IB set to a user space task (potential victim) which has TIF_SPEC_IB not set. 2) Switch from a user space task (potential attacker) which has TIF_SPEC_IB not set to a user space task (potential victim) which has TIF_SPEC_IB set. This needs to be optimized for the case where the IBPB can be avoided when only kernel threads ran in between user space tasks which belong to the same process. The current check whether two tasks belong to the same context is using the tasks context id. While correct, it's simpler to use the mm pointer because it allows to mangle the TIF_SPEC_IB bit into it. The context id based mechanism requires extra storage, which creates worse code. When a task is scheduled out its TIF_SPEC_IB bit is mangled as bit 0 into the per CPU storage which is used to track the last user space mm which was running on a CPU. This bit can be used together with the TIF_SPEC_IB bit of the incoming task to make the decision whether IBPB needs to be issued or not to cover the two cases above. As conditional IBPB is going to be the default, remove the dubious ptrace check for the IBPB always case and simply issue IBPB always when the process changes. Move the storage to a different place in the struct as the original one created a hole. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Tim Chen Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185005.466447057@linutronix.de commit 5635d99953f04b550738f6f4c1c532667c3fd872 Author: Thomas Gleixner Date: Sun Nov 25 19:33:48 2018 +0100 x86/speculation: Avoid __switch_to_xtra() calls The TIF_SPEC_IB bit does not need to be evaluated in the decision to invoke __switch_to_xtra() when: - CONFIG_SMP is disabled - The conditional STIPB mode is disabled The TIF_SPEC_IB bit still controls IBPB in both cases so the TIF work mask checks might invoke __switch_to_xtra() for nothing if TIF_SPEC_IB is the only set bit in the work masks. Optimize it out by masking the bit at compile time for CONFIG_SMP=n and at run time when the static key controlling the conditional STIBP mode is disabled. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Tim Chen Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185005.374062201@linutronix.de commit ff16701a29cba3aafa0bd1656d766813b2d0a811 Author: Thomas Gleixner Date: Sun Nov 25 19:33:47 2018 +0100 x86/process: Consolidate and simplify switch_to_xtra() code Move the conditional invocation of __switch_to_xtra() into an inline function so the logic can be shared between 32 and 64 bit. Remove the handthrough of the TSS pointer and retrieve the pointer directly in the bitmap handling function. Use this_cpu_ptr() instead of the per_cpu() indirection. This is a preparatory change so integration of conditional indirect branch speculation optimization happens only in one place. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Tim Chen Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185005.280855518@linutronix.de commit 5bfbe3ad5840d941b89bcac54b821ba14f50a0ba Author: Tim Chen Date: Sun Nov 25 19:33:46 2018 +0100 x86/speculation: Prepare for per task indirect branch speculation control To avoid the overhead of STIBP always on, it's necessary to allow per task control of STIBP. Add a new task flag TIF_SPEC_IB and evaluate it during context switch if SMT is active and flag evaluation is enabled by the speculation control code. Add the conditional evaluation to x86_virt_spec_ctrl() as well so the guest/host switch works properly. This has no effect because TIF_SPEC_IB cannot be set yet and the static key which controls evaluation is off. Preparatory patch for adding the control code. [ tglx: Simplify the context switch logic and make the TIF evaluation depend on SMP=y and on the static key controlling the conditional update. Rename it to TIF_SPEC_IB because it controls both STIBP and IBPB ] Signed-off-by: Tim Chen Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185005.176917199@linutronix.de commit fa1202ef224391b6f5b26cdd44cc50495e8fab54 Author: Thomas Gleixner Date: Sun Nov 25 19:33:45 2018 +0100 x86/speculation: Add command line control for indirect branch speculation Add command line control for user space indirect branch speculation mitigations. The new option is: spectre_v2_user= The initial options are: - on: Unconditionally enabled - off: Unconditionally disabled -auto: Kernel selects mitigation (default off for now) When the spectre_v2= command line argument is either 'on' or 'off' this implies that the application to application control follows that state even if a contradicting spectre_v2_user= argument is supplied. Originally-by: Tim Chen Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185005.082720373@linutronix.de commit 495d470e9828500e0155027f230449ac5e29c025 Author: Thomas Gleixner Date: Sun Nov 25 19:33:44 2018 +0100 x86/speculation: Unify conditional spectre v2 print functions There is no point in having two functions and a conditional at the call site. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Tim Chen Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185004.986890749@linutronix.de commit 30ba72a990f5096ae08f284de17986461efcc408 Author: Thomas Gleixner Date: Sun Nov 25 19:33:43 2018 +0100 x86/speculataion: Mark command line parser data __initdata No point to keep that around. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Tim Chen Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185004.893886356@linutronix.de commit 8770709f411763884535662744a3786a1806afd3 Author: Thomas Gleixner Date: Sun Nov 25 19:33:42 2018 +0100 x86/speculation: Mark string arrays const correctly checkpatch.pl muttered when reshuffling the code: WARNING: static const char * array should probably be static const char * const Fix up all the string arrays. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Tim Chen Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185004.800018931@linutronix.de commit 15d6b7aab0793b2de8a05d8a828777dd24db424e Author: Thomas Gleixner Date: Sun Nov 25 19:33:41 2018 +0100 x86/speculation: Reorder the spec_v2 code Reorder the code so it is better grouped. No functional change. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Tim Chen Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185004.707122879@linutronix.de commit 130d6f946f6f2a972ee3ec8540b7243ab99abe97 Author: Thomas Gleixner Date: Sun Nov 25 19:33:40 2018 +0100 x86/l1tf: Show actual SMT state Use the now exposed real SMT state, not the SMT sysfs control knob state. This reflects the state of the system when the mitigation status is queried. This does not change the warning in the VMX launch code. There the dependency on the control knob makes sense because siblings could be brought online anytime after launching the VM. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Tim Chen Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185004.613357354@linutronix.de commit a74cfffb03b73d41e08f84c2e5c87dec0ce3db9f Author: Thomas Gleixner Date: Sun Nov 25 19:33:39 2018 +0100 x86/speculation: Rework SMT state change arch_smt_update() is only called when the sysfs SMT control knob is changed. This means that when SMT is enabled in the sysfs control knob the system is considered to have SMT active even if all siblings are offline. To allow finegrained control of the speculation mitigations, the actual SMT state is more interesting than the fact that siblings could be enabled. Rework the code, so arch_smt_update() is invoked from each individual CPU hotplug function, and simplify the update function while at it. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Tim Chen Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185004.521974984@linutronix.de commit 321a874a7ef85655e93b3206d0f36b4a6097f948 Author: Thomas Gleixner Date: Sun Nov 25 19:33:38 2018 +0100 sched/smt: Expose sched_smt_present static key Make the scheduler's 'sched_smt_present' static key globaly available, so it can be used in the x86 speculation control code. Provide a query function and a stub for the CONFIG_SMP=n case. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Tim Chen Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185004.430168326@linutronix.de commit dbe733642e01dd108f71436aaea7b328cb28fd87 Author: Thomas Gleixner Date: Sun Nov 25 19:33:37 2018 +0100 x86/Kconfig: Select SCHED_SMT if SMP enabled CONFIG_SCHED_SMT is enabled by all distros, so there is not a real point to have it configurable. The runtime overhead in the core scheduler code is minimal because the actual SMT scheduling parts are conditional on a static key. This allows to expose the scheduler's SMT state static key to the speculation control code. Alternatively the scheduler's static key could be made always available when CONFIG_SMP is enabled, but that's just adding an unused static key to every other architecture for nothing. Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Tim Chen Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185004.337452245@linutronix.de commit c5511d03ec090980732e929c318a7a6374b5550e Author: Peter Zijlstra (Intel) Date: Sun Nov 25 19:33:36 2018 +0100 sched/smt: Make sched_smt_present track topology Currently the 'sched_smt_present' static key is enabled when at CPU bringup SMT topology is observed, but it is never disabled. However there is demand to also disable the key when the topology changes such that there is no SMT present anymore. Implement this by making the key count the number of cores that have SMT enabled. In particular, the SMT topology bits are set before interrrupts are enabled and similarly, are cleared after interrupts are disabled for the last time and the CPU dies. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Tim Chen Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185004.246110444@linutronix.de commit 01daf56875ee0cd50ed496a09b20eb369b45dfa5 Author: Tim Chen Date: Sun Nov 25 19:33:35 2018 +0100 x86/speculation: Reorganize speculation control MSRs update The logic to detect whether there's a change in the previous and next task's flag relevant to update speculation control MSRs is spread out across multiple functions. Consolidate all checks needed for updating speculation control MSRs into the new __speculation_ctrl_update() helper function. This makes it easy to pick the right speculation control MSR and the bits in MSR_IA32_SPEC_CTRL that need updating based on TIF flags changes. Originally-by: Thomas Lendacky Signed-off-by: Tim Chen Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185004.151077005@linutronix.de commit 26c4d75b234040c11728a8acb796b3a85ba7507c Author: Thomas Gleixner Date: Sun Nov 25 19:33:34 2018 +0100 x86/speculation: Rename SSBD update functions During context switch, the SSBD bit in SPEC_CTRL MSR is updated according to changes of the TIF_SSBD flag in the current and next running task. Currently, only the bit controlling speculative store bypass disable in SPEC_CTRL MSR is updated and the related update functions all have "speculative_store" or "ssb" in their names. For enhanced mitigation control other bits in SPEC_CTRL MSR need to be updated as well, which makes the SSB names inadequate. Rename the "speculative_store*" functions to a more generic name. No functional change. Signed-off-by: Tim Chen Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185004.058866968@linutronix.de commit 34bce7c9690b1d897686aac89604ba7adc365556 Author: Tim Chen Date: Sun Nov 25 19:33:33 2018 +0100 x86/speculation: Disable STIBP when enhanced IBRS is in use If enhanced IBRS is active, STIBP is redundant for mitigating Spectre v2 user space exploits from hyperthread sibling. Disable STIBP when enhanced IBRS is used. Signed-off-by: Tim Chen Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185003.966801480@linutronix.de commit a8f76ae41cd633ac00be1b3019b1eb4741be3828 Author: Tim Chen Date: Sun Nov 25 19:33:32 2018 +0100 x86/speculation: Move STIPB/IBPB string conditionals out of cpu_show_common() The Spectre V2 printout in cpu_show_common() handles conditionals for the various mitigation methods directly in the sprintf() argument list. That's hard to read and will become unreadable if more complex decisions need to be made for a particular method. Move the conditionals for STIBP and IBPB string selection into helper functions, so they can be extended later on. Signed-off-by: Tim Chen Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185003.874479208@linutronix.de commit b86bda0426853bfe8a3506c7d2a5b332760ae46b Author: Tim Chen Date: Sun Nov 25 19:33:31 2018 +0100 x86/speculation: Remove unnecessary ret variable in cpu_show_common() Signed-off-by: Tim Chen Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185003.783903657@linutronix.de commit 24848509aa55eac39d524b587b051f4e86df3c12 Author: Tim Chen Date: Sun Nov 25 19:33:30 2018 +0100 x86/speculation: Clean up spectre_v2_parse_cmdline() Remove the unnecessary 'else' statement in spectre_v2_parse_cmdline() to save an indentation level. Signed-off-by: Tim Chen Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185003.688010903@linutronix.de commit 8eb729b77faf83ac4c1f363a9ad68d042415f24c Author: Tim Chen Date: Sun Nov 25 19:33:29 2018 +0100 x86/speculation: Update the TIF_SSBD comment "Reduced Data Speculation" is an obsolete term. The correct new name is "Speculative store bypass disable" - which is abbreviated into SSBD. Signed-off-by: Tim Chen Signed-off-by: Thomas Gleixner Reviewed-by: Ingo Molnar Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Jiri Kosina Cc: Tom Lendacky Cc: Josh Poimboeuf Cc: Andrea Arcangeli Cc: David Woodhouse Cc: Andi Kleen Cc: Dave Hansen Cc: Casey Schaufler Cc: Asit Mallick Cc: Arjan van de Ven Cc: Jon Masters Cc: Waiman Long Cc: Greg KH Cc: Dave Stewart Cc: Kees Cook Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181125185003.593893901@linutronix.de commit ef014aae8f1cd2793e4e014bbb102bed53f852b7 Author: Zhenzhong Duan Date: Fri Nov 2 01:45:41 2018 -0700 x86/retpoline: Remove minimal retpoline support Now that CONFIG_RETPOLINE hard depends on compiler support, there is no reason to keep the minimal retpoline support around which only provided basic protection in the assembly files. Suggested-by: Peter Zijlstra Signed-off-by: Zhenzhong Duan Signed-off-by: Thomas Gleixner Cc: David Woodhouse Cc: Borislav Petkov Cc: H. Peter Anvin Cc: Konrad Rzeszutek Wilk Cc: Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/f06f0a89-5587-45db-8ed2-0a9d6638d5c0@default commit 4cd24de3a0980bf3100c9dcb08ef65ca7c31af48 Author: Zhenzhong Duan Date: Fri Nov 2 01:45:41 2018 -0700 x86/retpoline: Make CONFIG_RETPOLINE depend on compiler support Since retpoline capable compilers are widely available, make CONFIG_RETPOLINE hard depend on the compiler capability. Break the build when CONFIG_RETPOLINE is enabled and the compiler does not support it. Emit an error message in that case: "arch/x86/Makefile:226: *** You are building kernel with non-retpoline compiler, please update your compiler.. Stop." [dwmw: Fail the build with non-retpoline compiler] Suggested-by: Peter Zijlstra Signed-off-by: Zhenzhong Duan Signed-off-by: Thomas Gleixner Cc: David Woodhouse Cc: Borislav Petkov Cc: Daniel Borkmann Cc: H. Peter Anvin Cc: Konrad Rzeszutek Wilk Cc: Andy Lutomirski Cc: Masahiro Yamada Cc: Michal Marek Cc: Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/cca0cb20-f9e2-4094-840b-fb0f8810cd34@default commit 8159a6a4a7d2a092d5375f695ecfca22b4562b5f Author: Hui Wang Date: Wed Nov 28 17:11:26 2018 +0800 ALSA: usb-audio: Add vendor and product name for Dell WD19 Dock Like the Dell WD15 Dock, the WD19 Dock (0bda:402e) doens't provide useful string for the vendor and product names too. In order to share the UCM with WD15, here we keep the profile_name same as the WD15. Signed-off-by: Hui Wang Signed-off-by: Takashi Iwai commit ca08987885a147643817d02bf260bc4756ce8cd4 Author: Taehee Yoo Date: Wed Nov 28 11:27:28 2018 +0900 netfilter: nf_tables: deactivate expressions in rule replecement routine There is no expression deactivation call from the rule replacement path, hence, chain counter is not decremented. A few steps to reproduce the problem: %nft add table ip filter %nft add chain ip filter c1 %nft add chain ip filter c1 %nft add rule ip filter c1 jump c2 %nft replace rule ip filter c1 handle 3 accept %nft flush ruleset expression means immediate NFT_JUMP to chain c2. Reference count of chain c2 is increased when the rule is added. When rule is deleted or replaced, the reference counter of c2 should be decreased via nft_rule_expr_deactivate() which calls nft_immediate_deactivate(). Splat looks like: [ 214.396453] WARNING: CPU: 1 PID: 21 at net/netfilter/nf_tables_api.c:1432 nf_tables_chain_destroy.isra.38+0x2f9/0x3a0 [nf_tables] [ 214.398983] Modules linked in: nf_tables nfnetlink [ 214.398983] CPU: 1 PID: 21 Comm: kworker/1:1 Not tainted 4.20.0-rc2+ #44 [ 214.398983] Workqueue: events nf_tables_trans_destroy_work [nf_tables] [ 214.398983] RIP: 0010:nf_tables_chain_destroy.isra.38+0x2f9/0x3a0 [nf_tables] [ 214.398983] Code: 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 8e 00 00 00 48 8b 7b 58 e8 e1 2c 4e c6 48 89 df e8 d9 2c 4e c6 eb 9a <0f> 0b eb 96 0f 0b e9 7e fe ff ff e8 a7 7e 4e c6 e9 a4 fe ff ff e8 [ 214.398983] RSP: 0018:ffff8881152874e8 EFLAGS: 00010202 [ 214.398983] RAX: 0000000000000001 RBX: ffff88810ef9fc28 RCX: ffff8881152876f0 [ 214.398983] RDX: dffffc0000000000 RSI: 1ffff11022a50ede RDI: ffff88810ef9fc78 [ 214.398983] RBP: 1ffff11022a50e9d R08: 0000000080000000 R09: 0000000000000000 [ 214.398983] R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff11022a50eba [ 214.398983] R13: ffff888114446e08 R14: ffff8881152876f0 R15: ffffed1022a50ed6 [ 214.398983] FS: 0000000000000000(0000) GS:ffff888116400000(0000) knlGS:0000000000000000 [ 214.398983] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 214.398983] CR2: 00007fab9bb5f868 CR3: 000000012aa16000 CR4: 00000000001006e0 [ 214.398983] Call Trace: [ 214.398983] ? nf_tables_table_destroy.isra.37+0x100/0x100 [nf_tables] [ 214.398983] ? __kasan_slab_free+0x145/0x180 [ 214.398983] ? nf_tables_trans_destroy_work+0x439/0x830 [nf_tables] [ 214.398983] ? kfree+0xdb/0x280 [ 214.398983] nf_tables_trans_destroy_work+0x5f5/0x830 [nf_tables] [ ... ] Fixes: bb7b40aecbf7 ("netfilter: nf_tables: bogus EBUSY in chain deletions") Reported by: Christoph Anton Mitterer Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914505 Link: https://bugzilla.kernel.org/show_bug.cgi?id=201791 Signed-off-by: Taehee Yoo Signed-off-by: Pablo Neira Ayuso commit 60c8144afc287ef09ce8c1230c6aa972659ba1bb Author: Borislav Petkov Date: Tue Nov 27 14:41:37 2018 +0100 x86/MCE/AMD: Fix the thresholding machinery initialization order Currently, the code sets up the thresholding interrupt vector and only then goes about initializing the thresholding banks. Which is wrong, because an early thresholding interrupt would cause a NULL pointer dereference when accessing those banks and prevent the machine from booting. Therefore, set the thresholding interrupt vector only *after* having initialized the banks successfully. Fixes: 18807ddb7f88 ("x86/mce/AMD: Reset Threshold Limit after logging error") Reported-by: Rafał Miłecki Reported-by: John Clemens Signed-off-by: Borislav Petkov Tested-by: Rafał Miłecki Tested-by: John Clemens Cc: Aravind Gopalakrishnan Cc: linux-edac@vger.kernel.org Cc: stable@vger.kernel.org Cc: Tony Luck Cc: x86@kernel.org Cc: Yazen Ghannam Link: https://lkml.kernel.org/r/20181127101700.2964-1-zajec5@gmail.com Link: https://bugzilla.kernel.org/show_bug.cgi?id=201291 commit dc92843159a7d01e37cf68750745333e944a9e55 Author: Tudor Ambarus Date: Mon Nov 26 12:45:44 2018 +0000 mtd: spi-nor: fix erase_type array to indicate current map conf BFPT advertises all the erase types supported by all the possible map configurations. Mask out the erase types that are not supported by the current map configuration. Backward compatibility test done on sst26vf064b. Fixes: b038e8e3be72 ("mtd: spi-nor: parse SFDP Sector Map Parameter Table") Reported-by: Alexander Sverdlin Signed-off-by: Tudor Ambarus Tested-by: Alexander Sverdlin Signed-off-by: Boris Brezillon commit c9287fa657b3328b4549c0ab39ea7f197a3d6a50 Author: Marek Szyprowski Date: Mon Nov 19 16:49:05 2018 +0100 usb: gadget: u_ether: fix unsafe list iteration list_for_each_entry_safe() is not safe for deleting entries from the list if the spin lock, which protects it, is released and reacquired during the list iteration. Fix this issue by replacing this construction with a simple check if list is empty and removing the first entry in each iteration. This is almost equivalent to a revert of the commit mentioned in the Fixes: tag. This patch fixes following issue: --->8--- Unable to handle kernel NULL pointer dereference at virtual address 00000104 pgd = (ptrval) [00000104] *pgd=00000000 Internal error: Oops: 817 [#1] PREEMPT SMP ARM Modules linked in: CPU: 1 PID: 84 Comm: kworker/1:1 Not tainted 4.20.0-rc2-next-20181114-00009-g8266b35ec404 #1061 Hardware name: SAMSUNG EXYNOS (Flattened Device Tree) Workqueue: events eth_work PC is at rx_fill+0x60/0xac LR is at _raw_spin_lock_irqsave+0x50/0x5c pc : [] lr : [] psr: 80000093 sp : ee7fbee8 ip : 00000100 fp : 00000000 r10: 006000c0 r9 : c10b0ab0 r8 : ee7eb5c0 r7 : ee7eb614 r6 : ee7eb5ec r5 : 000000dc r4 : ee12ac00 r3 : ee12ac24 r2 : 00000200 r1 : 60000013 r0 : ee7eb5ec Flags: Nzcv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: 6d5dc04a DAC: 00000051 Process kworker/1:1 (pid: 84, stack limit = 0x(ptrval)) Stack: (0xee7fbee8 to 0xee7fc000) ... [] (rx_fill) from [] (process_one_work+0x200/0x738) [] (process_one_work) from [] (worker_thread+0x2c/0x4c8) [] (worker_thread) from [] (kthread+0x128/0x164) [] (kthread) from [] (ret_from_fork+0x14/0x20) Exception stack(0xee7fbfb0 to 0xee7fbff8) ... ---[ end trace 64480bc835eba7d6 ]--- Fixes: fea14e68ff5e ("usb: gadget: u_ether: use better list accessors") Signed-off-by: Marek Szyprowski Signed-off-by: Felipe Balbi commit d206e6b7ea3fdc8ec8f6be9a2ecfe58142b49e37 Author: Bjorn Andersson Date: Mon Nov 5 21:50:13 2018 -0800 arm64: dts: qcom: sdm845-mtp: Mark protected gcc clocks As of v4.20-rc1 probing the GCC driver on a SDM845 device with the standard security implementation causes an access violation and an immediate system restart. Use the protected-clocks property to mark the offending clocks protected for the MTP, in order to allow it to boot. Cc: Stephen Boyd Signed-off-by: Bjorn Andersson Acked-by: Andy Gross Signed-off-by: Stephen Boyd commit 149964e2d618e60df5ba82a5a153cef2fbc4a31e Merge: 27c0f2b01970 b181b3b801da Author: Stephen Boyd Date: Tue Nov 27 22:33:58 2018 -0800 Merge branch 'clk-protected-binding' into clk-fixes * clk-protected-binding: clk: qcom: Support 'protected-clocks' property dt-bindings: clk: Introduce 'protected-clocks' property commit 3054426dc68e5d63aa6a6e9b91ac4ec78e3f3805 Author: Pavankumar Kondeti Date: Tue Oct 30 12:24:33 2018 +0530 sched, trace: Fix prev_state output in sched_switch tracepoint commit 3f5fe9fef5b2 ("sched/debug: Fix task state recording/printout") tried to fix the problem introduced by a previous commit efb40f588b43 ("sched/tracing: Fix trace_sched_switch task-state printing"). However the prev_state output in sched_switch is still broken. task_state_index() uses fls() which considers the LSB as 1. Left shifting 1 by this value gives an incorrect mapping to the task state. Fix this by decrementing the value returned by __get_task_state() before shifting. Link: http://lkml.kernel.org/r/1540882473-1103-1-git-send-email-pkondeti@codeaurora.org Cc: stable@vger.kernel.org Fixes: 3f5fe9fef5b2 ("sched/debug: Fix task state recording/printout") Signed-off-by: Pavankumar Kondeti Signed-off-by: Steven Rostedt (VMware) commit b1b35f2e218a5b57d03bbc3b0667d5064570dc60 Author: Steven Rostedt (VMware) Date: Tue Nov 20 12:51:07 2018 -0500 function_graph: Have profiler use curr_ret_stack and not depth The profiler uses trace->depth to find its entry on the ret_stack, but the depth may not match the actual location of where its entry is (if an interrupt were to preempt the processing of the profiler for another function, the depth and the curr_ret_stack will be different). Have it use the curr_ret_stack as the index to find its ret_stack entry instead of using the depth variable, as that is no longer guaranteed to be the same. Cc: stable@kernel.org Fixes: 03274a3ffb449 ("tracing/fgraph: Adjust fgraph depth before calling trace return callback") Reviewed-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 7c6ea35ef50810aa12ab26f21cb858d980881576 Author: Steven Rostedt (VMware) Date: Tue Nov 20 12:40:25 2018 -0500 function_graph: Reverse the order of pushing the ret_stack and the callback The function graph profiler uses the ret_stack to store the "subtime" and reuse it by nested functions and also on the return. But the current logic has the profiler callback called before the ret_stack is updated, and it is just modifying the ret_stack that will later be allocated (it's just lucky that the "subtime" is not touched when it is allocated). This could also cause a crash if we are at the end of the ret_stack when this happens. By reversing the order of the allocating the ret_stack and then calling the callbacks attached to a function being traced, the ret_stack entry is no longer used before it is allocated. Cc: stable@kernel.org Fixes: 03274a3ffb449 ("tracing/fgraph: Adjust fgraph depth before calling trace return callback") Reviewed-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 552701dd0fa7c3d448142e87210590ba424694a0 Author: Steven Rostedt (VMware) Date: Mon Nov 19 15:18:40 2018 -0500 function_graph: Move return callback before update of curr_ret_stack In the past, curr_ret_stack had two functions. One was to denote the depth of the call graph, the other is to keep track of where on the ret_stack the data is used. Although they may be slightly related, there are two cases where they need to be used differently. The one case is that it keeps the ret_stack data from being corrupted by an interrupt coming in and overwriting the data still in use. The other is just to know where the depth of the stack currently is. The function profiler uses the ret_stack to save a "subtime" variable that is part of the data on the ret_stack. If curr_ret_stack is modified too early, then this variable can be corrupted. The "max_depth" option, when set to 1, will record the first functions going into the kernel. To see all top functions (when dealing with timings), the depth variable needs to be lowered before calling the return hook. But by lowering the curr_ret_stack, it makes the data on the ret_stack still being used by the return hook susceptible to being overwritten. Now that there's two variables to handle both cases (curr_ret_depth), we can move them to the locations where they can handle both cases. Cc: stable@kernel.org Fixes: 03274a3ffb449 ("tracing/fgraph: Adjust fgraph depth before calling trace return callback") Reviewed-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 39eb456dacb543de90d3bc6a8e0ac5cf51ac475e Author: Steven Rostedt (VMware) Date: Mon Nov 19 08:07:12 2018 -0500 function_graph: Use new curr_ret_depth to manage depth instead of curr_ret_stack Currently, the depth of the ret_stack is determined by curr_ret_stack index. The issue is that there's a race between setting of the curr_ret_stack and calling of the callback attached to the return of the function. Commit 03274a3ffb44 ("tracing/fgraph: Adjust fgraph depth before calling trace return callback") moved the calling of the callback to after the setting of the curr_ret_stack, even stating that it was safe to do so, when in fact, it was the reason there was a barrier() there (yes, I should have commented that barrier()). Not only does the curr_ret_stack keep track of the current call graph depth, it also keeps the ret_stack content from being overwritten by new data. The function profiler, uses the "subtime" variable of ret_stack structure and by moving the curr_ret_stack, it allows for interrupts to use the same structure it was using, corrupting the data, and breaking the profiler. To fix this, there needs to be two variables to handle the call stack depth and the pointer to where the ret_stack is being used, as they need to change at two different locations. Cc: stable@kernel.org Fixes: 03274a3ffb449 ("tracing/fgraph: Adjust fgraph depth before calling trace return callback") Reviewed-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit d125f3f866df88da5a85df00291f88f0baa89f7c Author: Steven Rostedt (VMware) Date: Mon Nov 19 07:40:39 2018 -0500 function_graph: Make ftrace_push_return_trace() static As all architectures now call function_graph_enter() to do the entry work, no architecture should ever call ftrace_push_return_trace(). Make it static. This is needed to prepare for a fix of a design bug on how the curr_ret_stack is used. Cc: stable@kernel.org Fixes: 03274a3ffb449 ("tracing/fgraph: Adjust fgraph depth before calling trace return callback") Reviewed-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 9c4bf5e0db164f330a2d3e128e9832661f69f0e9 Author: Steven Rostedt (VMware) Date: Sun Nov 18 17:37:40 2018 -0500 sparc/function_graph: Simplify with function_graph_enter() The function_graph_enter() function does the work of calling the function graph hook function and the management of the shadow stack, simplifying the work done in the architecture dependent prepare_ftrace_return(). Have sparc use the new code, and remove the shadow stack management as well as having to set up the trace structure. This is needed to prepare for a fix of a design bug on how the curr_ret_stack is used. Cc: "David S. Miller" Cc: sparclinux@vger.kernel.org Cc: stable@kernel.org Fixes: 03274a3ffb449 ("tracing/fgraph: Adjust fgraph depth before calling trace return callback") Reviewed-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit bc715ee4dbc5db462c59b9cfba92d31b3274fe3a Author: Steven Rostedt (VMware) Date: Sun Nov 18 17:35:37 2018 -0500 sh/function_graph: Simplify with function_graph_enter() The function_graph_enter() function does the work of calling the function graph hook function and the management of the shadow stack, simplifying the work done in the architecture dependent prepare_ftrace_return(). Have superh use the new code, and remove the shadow stack management as well as having to set up the trace structure. This is needed to prepare for a fix of a design bug on how the curr_ret_stack is used. Cc: Yoshinori Sato Cc: Rich Felker Cc: linux-sh@vger.kernel.org Cc: stable@kernel.org Fixes: 03274a3ffb449 ("tracing/fgraph: Adjust fgraph depth before calling trace return callback") Reviewed-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 18588e1487b19e45bd90bd55ec8d3a1d44f3257f Author: Steven Rostedt (VMware) Date: Sun Nov 18 17:33:17 2018 -0500 s390/function_graph: Simplify with function_graph_enter() The function_graph_enter() function does the work of calling the function graph hook function and the management of the shadow stack, simplifying the work done in the architecture dependent prepare_ftrace_return(). Have s390 use the new code, and remove the shadow stack management as well as having to set up the trace structure. This is needed to prepare for a fix of a design bug on how the curr_ret_stack is used. Acked-by: Martin Schwidefsky Cc: Heiko Carstens Cc: Julian Wiedmann Cc: linux-s390@vger.kernel.org Cc: stable@kernel.org Fixes: 03274a3ffb449 ("tracing/fgraph: Adjust fgraph depth before calling trace return callback") Reviewed-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit e949b6db51dc172a35c962bc4414ca148315fe21 Author: Steven Rostedt (VMware) Date: Sun Nov 18 17:31:44 2018 -0500 riscv/function_graph: Simplify with function_graph_enter() The function_graph_enter() function does the work of calling the function graph hook function and the management of the shadow stack, simplifying the work done in the architecture dependent prepare_ftrace_return(). Have riscv use the new code, and remove the shadow stack management as well as having to set up the trace structure. This is needed to prepare for a fix of a design bug on how the curr_ret_stack is used. Cc: Greentime Hu Cc: Alan Kao Cc: stable@kernel.org Fixes: 03274a3ffb449 ("tracing/fgraph: Adjust fgraph depth before calling trace return callback") Reviewed-by: Palmer Dabbelt Reviewed-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit fe60522ec60082a1dd735691b82c64f65d4ad15e Author: Steven Rostedt (VMware) Date: Sun Nov 18 17:28:53 2018 -0500 powerpc/function_graph: Simplify with function_graph_enter() The function_graph_enter() function does the work of calling the function graph hook function and the management of the shadow stack, simplifying the work done in the architecture dependent prepare_ftrace_return(). Have powerpc use the new code, and remove the shadow stack management as well as having to set up the trace structure. This is needed to prepare for a fix of a design bug on how the curr_ret_stack is used. Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Michael Ellerman Cc: linuxppc-dev@lists.ozlabs.org Cc: stable@kernel.org Fixes: 03274a3ffb449 ("tracing/fgraph: Adjust fgraph depth before calling trace return callback") Reviewed-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit a87532c78d291265efadc4b20a8c7a70cd59ea29 Author: Steven Rostedt (VMware) Date: Sun Nov 18 17:27:43 2018 -0500 parisc: function_graph: Simplify with function_graph_enter() The function_graph_enter() function does the work of calling the function graph hook function and the management of the shadow stack, simplifying the work done in the architecture dependent prepare_ftrace_return(). Have parisc use the new code, and remove the shadow stack management as well as having to set up the trace structure. This is needed to prepare for a fix of a design bug on how the curr_ret_stack is used. Cc: "James E.J. Bottomley" Cc: Helge Deller Cc: linux-parisc@vger.kernel.org Cc: stable@kernel.org Fixes: 03274a3ffb449 ("tracing/fgraph: Adjust fgraph depth before calling trace return callback") Reviewed-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit d48ebb24866edea2c35be02a878f25bc65529370 Author: Steven Rostedt (VMware) Date: Sun Nov 18 17:26:35 2018 -0500 nds32: function_graph: Simplify with function_graph_enter() The function_graph_enter() function does the work of calling the function graph hook function and the management of the shadow stack, simplifying the work done in the architecture dependent prepare_ftrace_return(). Have nds32 use the new code, and remove the shadow stack management as well as having to set up the trace structure. This is needed to prepare for a fix of a design bug on how the curr_ret_stack is used. Cc: Greentime Hu Cc: stable@kernel.org Fixes: 03274a3ffb449 ("tracing/fgraph: Adjust fgraph depth before calling trace return callback") Reviewed-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 8712b27c5723c26400a2b350faf1d6d9fd7ffaad Author: Steven Rostedt (VMware) Date: Sun Nov 18 17:25:18 2018 -0500 MIPS: function_graph: Simplify with function_graph_enter() The function_graph_enter() function does the work of calling the function graph hook function and the management of the shadow stack, simplifying the work done in the architecture dependent prepare_ftrace_return(). Have MIPS use the new code, and remove the shadow stack management as well as having to set up the trace structure. This is needed to prepare for a fix of a design bug on how the curr_ret_stack is used. Cc: Ralf Baechle Cc: Paul Burton Cc: James Hogan Cc: linux-mips@linux-mips.org Cc: stable@kernel.org Fixes: 03274a3ffb449 ("tracing/fgraph: Adjust fgraph depth before calling trace return callback") Reviewed-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 556763e5a500d71879d632867b75826551acd49c Author: Steven Rostedt (VMware) Date: Sun Nov 18 17:23:30 2018 -0500 microblaze: function_graph: Simplify with function_graph_enter() The function_graph_enter() function does the work of calling the function graph hook function and the management of the shadow stack, simplifying the work done in the architecture dependent prepare_ftrace_return(). Have microblaze use the new code, and remove the shadow stack management as well as having to set up the trace structure. This is needed to prepare for a fix of a design bug on how the curr_ret_stack is used. Cc: Michal Simek Cc: stable@kernel.org Fixes: 03274a3ffb449 ("tracing/fgraph: Adjust fgraph depth before calling trace return callback") Reviewed-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 01e0ab2c4ff12358f15a856fd1a7bbea0670972b Author: Steven Rostedt (VMware) Date: Sun Nov 18 17:21:51 2018 -0500 arm64: function_graph: Simplify with function_graph_enter() The function_graph_enter() function does the work of calling the function graph hook function and the management of the shadow stack, simplifying the work done in the architecture dependent prepare_ftrace_return(). Have arm64 use the new code, and remove the shadow stack management as well as having to set up the trace structure. This is needed to prepare for a fix of a design bug on how the curr_ret_stack is used. Cc: Catalin Marinas Cc: linux-arm-kernel@lists.infradead.org Cc: stable@kernel.org Fixes: 03274a3ffb449 ("tracing/fgraph: Adjust fgraph depth before calling trace return callback") Acked-by: Will Deacon Reviewed-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit f1f5b14afd7cce39e6a9b25c685e1ea34c231096 Author: Steven Rostedt (VMware) Date: Sun Nov 18 17:19:26 2018 -0500 ARM: function_graph: Simplify with function_graph_enter() The function_graph_enter() function does the work of calling the function graph hook function and the management of the shadow stack, simplifying the work done in the architecture dependent prepare_ftrace_return(). Have ARM use the new code, and remove the shadow stack management as well as having to set up the trace structure. This is needed to prepare for a fix of a design bug on how the curr_ret_stack is used. Cc: Russell King Cc: linux-arm-kernel@lists.infradead.org Cc: stable@kernel.org Fixes: 03274a3ffb449 ("tracing/fgraph: Adjust fgraph depth before calling trace return callback") Reviewed-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 07f7175b43827640d1e69c9eded89aa089a234b4 Author: Steven Rostedt (VMware) Date: Sun Nov 18 17:14:10 2018 -0500 x86/function_graph: Simplify with function_graph_enter() The function_graph_enter() function does the work of calling the function graph hook function and the management of the shadow stack, simplifying the work done in the architecture dependent prepare_ftrace_return(). Have x86 use the new code, and remove the shadow stack management as well as having to set up the trace structure. This is needed to prepare for a fix of a design bug on how the curr_ret_stack is used. Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: "H. Peter Anvin" Cc: x86@kernel.org Cc: stable@kernel.org Fixes: 03274a3ffb449 ("tracing/fgraph: Adjust fgraph depth before calling trace return callback") Reviewed-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 4df5ce9bc03e47d05f400e64aa32a82ec4cef419 Author: Bryan Whitehead Date: Mon Nov 26 12:27:10 2018 -0500 lan743x: Enable driver to work with LAN7431 This driver was designed to work with both LAN7430 and LAN7431. The only difference between the two is the LAN7431 has support for external phy. This change adds LAN7431 to the list of recognized devices supported by this driver. Updates for v2: changed 'fixes' tag to match defined format fixes: 23f0703c125b ("lan743x: Add main source files for new lan743x driver") Signed-off-by: Bryan Whitehead Signed-off-by: David S. Miller commit ec835f891232d7763dea9da0358f31e24ca6dfb7 Author: Jon Maloy Date: Mon Nov 26 12:26:14 2018 -0500 tipc: fix lockdep warning during node delete We see the following lockdep warning: [ 2284.078521] ====================================================== [ 2284.078604] WARNING: possible circular locking dependency detected [ 2284.078604] 4.19.0+ #42 Tainted: G E [ 2284.078604] ------------------------------------------------------ [ 2284.078604] rmmod/254 is trying to acquire lock: [ 2284.078604] 00000000acd94e28 ((&n->timer)#2){+.-.}, at: del_timer_sync+0x5/0xa0 [ 2284.078604] [ 2284.078604] but task is already holding lock: [ 2284.078604] 00000000f997afc0 (&(&tn->node_list_lock)->rlock){+.-.}, at: tipc_node_stop+0xac/0x190 [tipc] [ 2284.078604] [ 2284.078604] which lock already depends on the new lock. [ 2284.078604] [ 2284.078604] [ 2284.078604] the existing dependency chain (in reverse order) is: [ 2284.078604] [ 2284.078604] -> #1 (&(&tn->node_list_lock)->rlock){+.-.}: [ 2284.078604] tipc_node_timeout+0x20a/0x330 [tipc] [ 2284.078604] call_timer_fn+0xa1/0x280 [ 2284.078604] run_timer_softirq+0x1f2/0x4d0 [ 2284.078604] __do_softirq+0xfc/0x413 [ 2284.078604] irq_exit+0xb5/0xc0 [ 2284.078604] smp_apic_timer_interrupt+0xac/0x210 [ 2284.078604] apic_timer_interrupt+0xf/0x20 [ 2284.078604] default_idle+0x1c/0x140 [ 2284.078604] do_idle+0x1bc/0x280 [ 2284.078604] cpu_startup_entry+0x19/0x20 [ 2284.078604] start_secondary+0x187/0x1c0 [ 2284.078604] secondary_startup_64+0xa4/0xb0 [ 2284.078604] [ 2284.078604] -> #0 ((&n->timer)#2){+.-.}: [ 2284.078604] del_timer_sync+0x34/0xa0 [ 2284.078604] tipc_node_delete+0x1a/0x40 [tipc] [ 2284.078604] tipc_node_stop+0xcb/0x190 [tipc] [ 2284.078604] tipc_net_stop+0x154/0x170 [tipc] [ 2284.078604] tipc_exit_net+0x16/0x30 [tipc] [ 2284.078604] ops_exit_list.isra.8+0x36/0x70 [ 2284.078604] unregister_pernet_operations+0x87/0xd0 [ 2284.078604] unregister_pernet_subsys+0x1d/0x30 [ 2284.078604] tipc_exit+0x11/0x6f2 [tipc] [ 2284.078604] __x64_sys_delete_module+0x1df/0x240 [ 2284.078604] do_syscall_64+0x66/0x460 [ 2284.078604] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2284.078604] [ 2284.078604] other info that might help us debug this: [ 2284.078604] [ 2284.078604] Possible unsafe locking scenario: [ 2284.078604] [ 2284.078604] CPU0 CPU1 [ 2284.078604] ---- ---- [ 2284.078604] lock(&(&tn->node_list_lock)->rlock); [ 2284.078604] lock((&n->timer)#2); [ 2284.078604] lock(&(&tn->node_list_lock)->rlock); [ 2284.078604] lock((&n->timer)#2); [ 2284.078604] [ 2284.078604] *** DEADLOCK *** [ 2284.078604] [ 2284.078604] 3 locks held by rmmod/254: [ 2284.078604] #0: 000000003368be9b (pernet_ops_rwsem){+.+.}, at: unregister_pernet_subsys+0x15/0x30 [ 2284.078604] #1: 0000000046ed9c86 (rtnl_mutex){+.+.}, at: tipc_net_stop+0x144/0x170 [tipc] [ 2284.078604] #2: 00000000f997afc0 (&(&tn->node_list_lock)->rlock){+.-.}, at: tipc_node_stop+0xac/0x19 [...} The reason is that the node timer handler sometimes needs to delete a node which has been disconnected for too long. To do this, it grabs the lock 'node_list_lock', which may at the same time be held by the generic node cleanup function, tipc_node_stop(), during module removal. Since the latter is calling del_timer_sync() inside the same lock, we have a potential deadlock. We fix this letting the timer cleanup function use spin_trylock() instead of just spin_lock(), and when it fails to grab the lock it just returns so that the timer handler can terminate its execution. This is safe to do, since tipc_node_stop() anyway is about to delete both the timer and the node instance. Fixes: 6a939f365bdb ("tipc: Auto removal of peer down node instance") Acked-by: Ying Xue Signed-off-by: Jon Maloy Signed-off-by: David S. Miller commit cc5922054131f9abefdc0622ae64fc55e6b2671d Author: Bryan Whitehead Date: Mon Nov 26 12:04:57 2018 -0500 lan743x: fix return value for lan743x_tx_napi_poll The lan743x driver, when under heavy traffic load, has been noticed to sometimes hang, or cause a kernel panic. Debugging reveals that the TX napi poll routine was returning the wrong value, 'weight'. Most other drivers return 0. And call napi_complete, instead of napi_complete_done. Additionally when creating the tx napi poll routine. Changed netif_napi_add, to netif_tx_napi_add. Updates for v3: changed 'fixes' tag to match defined format Updates for v2: use napi_complete, instead of napi_complete_done in lan743x_tx_napi_poll use netif_tx_napi_add, instead of netif_napi_add for registration of tx napi poll routine fixes: 23f0703c125b ("lan743x: Add main source files for new lan743x driver") Signed-off-by: Bryan Whitehead Signed-off-by: David S. Miller commit 4b5adba07c945e191ac2ecd83627dd520dca152f Author: Colin Ian King Date: Mon Nov 26 15:34:01 2018 +0000 net: via: via-velocity: fix spelling mistake "alignement" -> "alignment" The text in array velocity_gstrings contains a spelling mistake, rename rx_frame_alignement_errors to rx_frame_alignment_errors. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit 1d510657ac7e486dd443cabbbd0677253aeb705f Author: Colin Ian King Date: Mon Nov 26 15:53:54 2018 +0000 qed: fix spelling mistake "attnetion" -> "attention" The text in array s_igu_fifo_error_strs contains a spelling mistake, fix it. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit 24a6d2dd263bc910de018c78d1148b3e33b94512 Author: Lorenzo Bianconi Date: Mon Nov 26 15:07:16 2018 +0100 net: thunderx: fix NULL pointer dereference in nic_remove Fix a possible NULL pointer dereference in nic_remove routine removing the nicpf module if nic_probe fails. The issue can be triggered with the following reproducer: $rmmod nicvf $rmmod nicpf [ 521.412008] Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000014 [ 521.422777] Mem abort info: [ 521.425561] ESR = 0x96000004 [ 521.428624] Exception class = DABT (current EL), IL = 32 bits [ 521.434535] SET = 0, FnV = 0 [ 521.437579] EA = 0, S1PTW = 0 [ 521.440730] Data abort info: [ 521.443603] ISV = 0, ISS = 0x00000004 [ 521.447431] CM = 0, WnR = 0 [ 521.450417] user pgtable: 4k pages, 48-bit VAs, pgdp = 0000000072a3da42 [ 521.457022] [0000000000000014] pgd=0000000000000000 [ 521.461916] Internal error: Oops: 96000004 [#1] SMP [ 521.511801] Hardware name: GIGABYTE H270-T70/MT70-HD0, BIOS T49 02/02/2018 [ 521.518664] pstate: 80400005 (Nzcv daif +PAN -UAO) [ 521.523451] pc : nic_remove+0x24/0x88 [nicpf] [ 521.527808] lr : pci_device_remove+0x48/0xd8 [ 521.532066] sp : ffff000013433cc0 [ 521.535370] x29: ffff000013433cc0 x28: ffff810f6ac50000 [ 521.540672] x27: 0000000000000000 x26: 0000000000000000 [ 521.545974] x25: 0000000056000000 x24: 0000000000000015 [ 521.551274] x23: ffff8007ff89a110 x22: ffff000001667070 [ 521.556576] x21: ffff8007ffb170b0 x20: ffff8007ffb17000 [ 521.561877] x19: 0000000000000000 x18: 0000000000000025 [ 521.567178] x17: 0000000000000000 x16: 000000000000010ffc33ff98 x8 : 0000000000000000 [ 521.593683] x7 : 0000000000000000 x6 : 0000000000000001 [ 521.598983] x5 : 0000000000000002 x4 : 0000000000000003 [ 521.604284] x3 : ffff8007ffb17184 x2 : ffff8007ffb17184 [ 521.609585] x1 : ffff000001662118 x0 : ffff000008557be0 [ 521.614887] Process rmmod (pid: 1897, stack limit = 0x00000000859535c3) [ 521.621490] Call trace: [ 521.623928] nic_remove+0x24/0x88 [nicpf] [ 521.627927] pci_device_remove+0x48/0xd8 [ 521.631847] device_release_driver_internal+0x1b0/0x248 [ 521.637062] driver_detach+0x50/0xc0 [ 521.640628] bus_remove_driver+0x60/0x100 [ 521.644627] driver_unregister+0x34/0x60 [ 521.648538] pci_unregister_driver+0x24/0xd8 [ 521.652798] nic_cleanup_module+0x14/0x111c [nicpf] [ 521.657672] __arm64_sys_delete_module+0x150/0x218 [ 521.662460] el0_svc_handler+0x94/0x110 [ 521.666287] el0_svc+0x8/0xc [ 521.669160] Code: aa1e03e0 9102c295 d503201f f9404eb3 (b9401660) Fixes: 4863dea3fab0 ("net: Adding support for Cavium ThunderX network controller") Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit e399ef194171717aefa78838d02b1e92267be2b1 Author: Stephen Rothwell Date: Mon Nov 26 18:45:26 2018 +1100 sparc32: supress another implicit-fallthrough warning Signed-off-by: Stephen Rothwell Signed-off-by: David S. Miller commit e945067d95cc99a6e4601b6bda665f30c7917c3b Author: Stephen Rothwell Date: Mon Nov 26 18:11:46 2018 +1100 sparc32: suppress an implicit-fallthrough warning Signed-off-by: Stephen Rothwell Signed-off-by: David S. Miller commit f6f8c1c09c224076a6c9ca3d97c24b81698f98f8 Author: Stephen Rothwell Date: Mon Nov 26 17:59:40 2018 +1100 sparc: suppress the implicit-fallthrough warning sparc builds with -Werror Signed-off-by: Stephen Rothwell Signed-off-by: David S. Miller commit 0d32f17717e65e76cbdb248374dd162acdfe2fff Author: Xin Long Date: Mon Nov 26 14:52:44 2018 +0800 sctp: increase sk_wmem_alloc when head->truesize is increased I changed to count sk_wmem_alloc by skb truesize instead of 1 to fix the sk_wmem_alloc leak caused by later truesize's change in xfrm in Commit 02968ccf0125 ("sctp: count sk_wmem_alloc by skb truesize in sctp_packet_transmit"). But I should have also increased sk_wmem_alloc when head->truesize is increased in sctp_packet_gso_append() as xfrm does. Otherwise, sctp gso packet will cause sk_wmem_alloc underflow. Fixes: 02968ccf0125 ("sctp: count sk_wmem_alloc by skb truesize in sctp_packet_transmit") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller commit a8842e975503191e4982efb886299fc19972c97f Author: Colin Ian King Date: Sun Nov 25 23:21:08 2018 +0000 firestream: fix spelling mistake: "Inititing" -> "Initializing" There are spelling mistakes in debug messages, fix them. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit c85ddecae6e5e82ca3ae6f20c63f1d865e2ff5ea Author: Heiner Kallweit Date: Fri Nov 23 19:41:29 2018 +0100 net: phy: add workaround for issue where PHY driver doesn't bind to the device After switching the r8169 driver to use phylib some user reported that their network is broken. This was caused by the genphy PHY driver being used instead of the dedicated PHY driver for the RTL8211B. Users reported that loading the Realtek PHY driver module upfront fixes the issue. See also this mail thread: https://marc.info/?t=154279781800003&r=1&w=2 The issue is quite weird and the root cause seems to be somewhere in the base driver core. The patch works around the issue and may be removed once the actual issue is fixed. The Fixes tag refers to the first reported occurrence of the issue. The issue itself may have been existing much longer and it may affect users of other network chips as well. Users typically will recognize this issue only if their PHY stops working when being used with the genphy driver. Fixes: f1e911d5d0df ("r8169: add basic phylib support") Signed-off-by: Heiner Kallweit Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 45611c61dd503454b2edae00aabe1e429ec49ebe Author: Bernd Eckstein <3erndeckstein@gmail.com> Date: Fri Nov 23 13:51:26 2018 +0100 usbnet: ipheth: fix potential recvmsg bug and recvmsg bug 2 The bug is not easily reproducable, as it may occur very infrequently (we had machines with 20minutes heavy downloading before it occurred) However, on a virual machine (VMWare on Windows 10 host) it occurred pretty frequently (1-2 seconds after a speedtest was started) dev->tx_skb mab be freed via dev_kfree_skb_irq on a callback before it is set. This causes the following problems: - double free of the skb or potential memory leak - in dmesg: 'recvmsg bug' and 'recvmsg bug 2' and eventually general protection fault Example dmesg output: [ 134.841986] ------------[ cut here ]------------ [ 134.841987] recvmsg bug: copied 9C24A555 seq 9C24B557 rcvnxt 9C25A6B3 fl 0 [ 134.841993] WARNING: CPU: 7 PID: 2629 at /build/linux-hwe-On9fm7/linux-hwe-4.15.0/net/ipv4/tcp.c:1865 tcp_recvmsg+0x44d/0xab0 [ 134.841994] Modules linked in: ipheth(OE) kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64 crypto_simd glue_helper cryptd vmw_balloon intel_rapl_perf joydev input_leds serio_raw vmw_vsock_vmci_transport vsock shpchp i2c_piix4 mac_hid binfmt_misc vmw_vmci parport_pc ppdev lp parport autofs4 vmw_pvscsi vmxnet3 hid_generic usbhid hid vmwgfx ttm drm_kms_helper syscopyarea sysfillrect mptspi mptscsih sysimgblt ahci psmouse fb_sys_fops pata_acpi mptbase libahci e1000 drm scsi_transport_spi [ 134.842046] CPU: 7 PID: 2629 Comm: python Tainted: G W OE 4.15.0-34-generic #37~16.04.1-Ubuntu [ 134.842046] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/19/2017 [ 134.842048] RIP: 0010:tcp_recvmsg+0x44d/0xab0 [ 134.842048] RSP: 0018:ffffa6630422bcc8 EFLAGS: 00010286 [ 134.842049] RAX: 0000000000000000 RBX: ffff997616f4f200 RCX: 0000000000000006 [ 134.842049] RDX: 0000000000000007 RSI: 0000000000000082 RDI: ffff9976257d6490 [ 134.842050] RBP: ffffa6630422bd98 R08: 0000000000000001 R09: 000000000004bba4 [ 134.842050] R10: 0000000001e00c6f R11: 000000000004bba4 R12: ffff99760dee3000 [ 134.842051] R13: 0000000000000000 R14: ffff99760dee3514 R15: 0000000000000000 [ 134.842051] FS: 00007fe332347700(0000) GS:ffff9976257c0000(0000) knlGS:0000000000000000 [ 134.842052] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 134.842053] CR2: 0000000001e41000 CR3: 000000020e9b4006 CR4: 00000000003606e0 [ 134.842055] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 134.842055] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 134.842057] Call Trace: [ 134.842060] ? aa_sk_perm+0x53/0x1a0 [ 134.842064] inet_recvmsg+0x51/0xc0 [ 134.842066] sock_recvmsg+0x43/0x50 [ 134.842070] SYSC_recvfrom+0xe4/0x160 [ 134.842072] ? __schedule+0x3de/0x8b0 [ 134.842075] ? ktime_get_ts64+0x4c/0xf0 [ 134.842079] SyS_recvfrom+0xe/0x10 [ 134.842082] do_syscall_64+0x73/0x130 [ 134.842086] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 134.842086] RIP: 0033:0x7fe331f5a81d [ 134.842088] RSP: 002b:00007ffe8da98398 EFLAGS: 00000246 ORIG_RAX: 000000000000002d [ 134.842090] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 00007fe331f5a81d [ 134.842094] RDX: 00000000000003fb RSI: 0000000001e00874 RDI: 0000000000000003 [ 134.842095] RBP: 00007fe32f642c70 R08: 0000000000000000 R09: 0000000000000000 [ 134.842097] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe332347698 [ 134.842099] R13: 0000000001b7e0a0 R14: 0000000001e00874 R15: 0000000000000000 [ 134.842103] Code: 24 fd ff ff e9 cc fe ff ff 48 89 d8 41 8b 8c 24 10 05 00 00 44 8b 45 80 48 c7 c7 08 bd 59 8b 48 89 85 68 ff ff ff e8 b3 c4 7d ff <0f> 0b 48 8b 85 68 ff ff ff e9 e9 fe ff ff 41 8b 8c 24 10 05 00 [ 134.842126] ---[ end trace b7138fc08c83147f ]--- [ 134.842144] general protection fault: 0000 [#1] SMP PTI [ 134.842145] Modules linked in: ipheth(OE) kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64 crypto_simd glue_helper cryptd vmw_balloon intel_rapl_perf joydev input_leds serio_raw vmw_vsock_vmci_transport vsock shpchp i2c_piix4 mac_hid binfmt_misc vmw_vmci parport_pc ppdev lp parport autofs4 vmw_pvscsi vmxnet3 hid_generic usbhid hid vmwgfx ttm drm_kms_helper syscopyarea sysfillrect mptspi mptscsih sysimgblt ahci psmouse fb_sys_fops pata_acpi mptbase libahci e1000 drm scsi_transport_spi [ 134.842161] CPU: 7 PID: 2629 Comm: python Tainted: G W OE 4.15.0-34-generic #37~16.04.1-Ubuntu [ 134.842162] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/19/2017 [ 134.842164] RIP: 0010:tcp_close+0x2c6/0x440 [ 134.842165] RSP: 0018:ffffa6630422bde8 EFLAGS: 00010202 [ 134.842167] RAX: 0000000000000000 RBX: ffff99760dee3000 RCX: 0000000180400034 [ 134.842168] RDX: 5c4afd407207a6c4 RSI: ffffe868495bd300 RDI: ffff997616f4f200 [ 134.842169] RBP: ffffa6630422be08 R08: 0000000016f4d401 R09: 0000000180400034 [ 134.842169] R10: ffffa6630422bd98 R11: 0000000000000000 R12: 000000000000600c [ 134.842170] R13: 0000000000000000 R14: ffff99760dee30c8 R15: ffff9975bd44fe00 [ 134.842171] FS: 00007fe332347700(0000) GS:ffff9976257c0000(0000) knlGS:0000000000000000 [ 134.842173] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 134.842174] CR2: 0000000001e41000 CR3: 000000020e9b4006 CR4: 00000000003606e0 [ 134.842177] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 134.842178] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 134.842179] Call Trace: [ 134.842181] inet_release+0x42/0x70 [ 134.842183] __sock_release+0x42/0xb0 [ 134.842184] sock_close+0x15/0x20 [ 134.842187] __fput+0xea/0x220 [ 134.842189] ____fput+0xe/0x10 [ 134.842191] task_work_run+0x8a/0xb0 [ 134.842193] exit_to_usermode_loop+0xc4/0xd0 [ 134.842195] do_syscall_64+0xf4/0x130 [ 134.842197] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 134.842197] RIP: 0033:0x7fe331f5a560 [ 134.842198] RSP: 002b:00007ffe8da982e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 134.842200] RAX: 0000000000000000 RBX: 00007fe32f642c70 RCX: 00007fe331f5a560 [ 134.842201] RDX: 00000000008f5320 RSI: 0000000001cd4b50 RDI: 0000000000000003 [ 134.842202] RBP: 00007fe32f6500f8 R08: 000000000000003c R09: 00000000009343c0 [ 134.842203] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe32f6500d0 [ 134.842204] R13: 00000000008f5320 R14: 00000000008f5320 R15: 0000000001cd4770 [ 134.842205] Code: c8 00 00 00 45 31 e4 49 39 fe 75 4d eb 50 83 ab d8 00 00 00 01 48 8b 17 48 8b 47 08 48 c7 07 00 00 00 00 48 c7 47 08 00 00 00 00 <48> 89 42 08 48 89 10 0f b6 57 34 8b 47 2c 2b 47 28 83 e2 01 80 [ 134.842226] RIP: tcp_close+0x2c6/0x440 RSP: ffffa6630422bde8 [ 134.842227] ---[ end trace b7138fc08c831480 ]--- The proposed patch eliminates a potential racing condition. Before, usb_submit_urb was called and _after_ that, the skb was attached (dev->tx_skb). So, on a callback it was possible, however unlikely that the skb was freed before it was set. That way (because dev->tx_skb was not set to NULL after it was freed), it could happen that a skb from a earlier transmission was freed a second time (and the skb we should have freed did not get freed at all) Now we free the skb directly in ipheth_tx(). It is not passed to the callback anymore, eliminating the posibility of a double free of the same skb. Depending on the retval of usb_submit_urb() we use dev_kfree_skb_any() respectively dev_consume_skb_any() to free the skb. Signed-off-by: Oliver Zweigle Signed-off-by: Bernd Eckstein <3ernd.Eckstein@gmail.com> Signed-off-by: David S. Miller commit a7c3a0d5f8d8cd5cdb32c06d4d68f5b4e4d2104b Author: Mauro Carvalho Chehab Date: Fri Nov 23 07:18:12 2018 -0500 media: mediactl docs: Fix licensing message Right now, it mentions two SPDX headers that don't exist inside the Kernel: GFDL-1.1-or-later And an exception: no-invariant-sections While it would be trivial to add the first one, there's no way, currently, to distinguish, with SPDX, between a free and a non-free document under GFDL. Free documents with GFDL should not have invariant sections. There's an open issue at SPDX tree waiting for it to be solved. While we don't have this issue closed, let's just replace by a free-text license, and add a TODO note to remind us to revisit it later. Reviewed-by: Tomasz Figa Signed-off-by: Mauro Carvalho Chehab commit 3420f65cbbd0555049bd02394bed33a0ef74d860 Author: Mauro Carvalho Chehab Date: Fri Nov 23 12:10:57 2018 -0500 media: dvb-pll: don't re-validate tuner frequencies The dvb_frontend core already checks for the frequencies. No need for any additional check inside the driver. It is part of the fixes for the following bug: https://bugzilla.opensuse.org/show_bug.cgi?id=1116374 Fixes: a3f90c75b833 ("media: dvb: convert tuner_info frequencies to Hz") Reported-by: Stakanov Schufter Reported-by: Takashi Iwai Cc: stable@vger.kernel.org # For 4.19 Signed-off-by: Mauro Carvalho Chehab commit 3d8e450f517cdb33da77827ec75929354753e9c0 Author: Mauro Carvalho Chehab Date: Tue Nov 20 05:19:36 2018 -0500 media: dvb-pll: fix tuner frequency ranges Tuners should report frequencies in Hz. That works fine on most drivers, but, in the case of dvb-pll, some settings are for satellite tuners, while others are for terrestrial/cable ones. The code was trying to solve it at probing time, but that doesn't work, as, when _attach is called, the delivery system may be wrong. Fix it by ensuring that all frequencies are in Hz at the per-tuner max/min values. While here, add a debug message, as this would help to debug any issues there. It partially fixes the following bug: https://bugzilla.opensuse.org/show_bug.cgi?id=1116374 Fixes: a3f90c75b833 ("media: dvb: convert tuner_info frequencies to Hz") Reported-by: Stakanov Schufter Reported-by: Takashi Iwai Cc: stable@vger.kernel.org # For 4.19 Signed-off-by: Mauro Carvalho Chehab commit 93143f846b2728d81b000740acfdbbd52ab41e46 Merge: 69500127424c 2b9034b5eadd Author: David S. Miller Date: Tue Nov 27 09:52:05 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2018-11-27 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) Fix several bugs in BPF sparc JIT, that is, convergence for fused branches, initialization of frame pointer register, and moving all arguments into output registers from input registers in prologue to fix BPF to BPF calls, from David. 2) Fix a bug in arm64 JIT for fetching BPF to BPF call addresses where they are not guaranteed to fit into imm field and therefore must be retrieved through prog aux data, from Daniel. 3) Explicitly add all JITs to MAINTAINERS file with developers able to help out in feature development, fixes, review, etc. ==================== Signed-off-by: David S. Miller commit 751a0cc0cd3a0d51e6aaf6fd3b8bd31f4ecfaf3e Author: Igor Konopko Date: Fri Nov 23 16:58:10 2018 +0100 nvme-pci: fix surprise removal When a PCIe NVMe device is not present, nvme_dev_remove_admin() calls blk_cleanup_queue() on the admin queue, which frees the hctx for that queue. Moments later, on the same path nvme_kill_queues() calls blk_mq_unquiesce_queue() on admin queue and tries to access hctx of it, which leads to following OOPS: Oops: 0000 [#1] SMP PTI RIP: 0010:sbitmap_any_bit_set+0xb/0x40 Call Trace: blk_mq_run_hw_queue+0xd5/0x150 blk_mq_run_hw_queues+0x3a/0x50 nvme_kill_queues+0x26/0x50 nvme_remove_namespaces+0xb2/0xc0 nvme_remove+0x60/0x140 pci_device_remove+0x3b/0xb0 Fixes: cb4bfda62afa2 ("nvme-pci: fix hot removal during error handling") Signed-off-by: Igor Konopko Reviewed-by: Keith Busch Signed-off-by: Christoph Hellwig commit dfa74422d604abc2e16763db12646583219806e4 Author: Ewan D. Milne Date: Mon Nov 26 12:01:30 2018 -0500 nvme-fc: initialize nvme_req(rq)->ctrl after calling __nvme_fc_init_request() __nvme_fc_init_request() invokes memset() on the nvme_fcp_op_w_sgl structure, which NULLed-out the nvme_req(req)->ctrl field previously set by nvme_fc_init_request(). This apparently was not referenced until commit faf4a44fff ("nvme: support traffic based keep-alive") which now results in a crash in nvme_complete_rq(): [ 8386.897130] RIP: 0010:panic+0x220/0x26c [ 8386.901406] Code: 83 3d 6f ee 72 01 00 74 05 e8 e8 54 02 00 48 c7 c6 40 fd 5b b4 48 c7 c7 d8 8d c6 b3 31e [ 8386.922359] RSP: 0018:ffff99650019fc40 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 [ 8386.930804] RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000006 [ 8386.938764] RDX: 0000000000000000 RSI: 0000000000000082 RDI: ffff8e325f8168b0 [ 8386.946725] RBP: ffff99650019fcb0 R08: 0000000000000000 R09: 00000000000004f8 [ 8386.954687] R10: 0000000000000000 R11: ffff99650019f9b8 R12: ffffffffb3c55f3c [ 8386.962648] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001 [ 8386.970613] oops_end+0xd1/0xe0 [ 8386.974116] no_context+0x1b2/0x3c0 [ 8386.978006] do_page_fault+0x32/0x140 [ 8386.982090] page_fault+0x1e/0x30 [ 8386.985786] RIP: 0010:nvme_complete_rq+0x65/0x1d0 [nvme_core] [ 8386.992195] Code: 41 bc 03 00 00 00 74 16 0f 86 c3 00 00 00 66 3d 83 00 41 bc 06 00 00 00 0f 85 e7 00 000 [ 8387.013147] RSP: 0018:ffff99650019fe18 EFLAGS: 00010246 [ 8387.018973] RAX: 0000000000000000 RBX: ffff8e322ae51280 RCX: 0000000000000001 [ 8387.026935] RDX: 0000000000000400 RSI: 0000000000000001 RDI: ffff8e322ae51280 [ 8387.034897] RBP: ffff8e322ae51280 R08: 0000000000000000 R09: ffffffffb2f0b890 [ 8387.042859] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 [ 8387.050821] R13: 0000000000000100 R14: 0000000000000004 R15: ffff8e2b0446d990 [ 8387.058782] ? swiotlb_unmap_page+0x40/0x40 [ 8387.063448] nvme_fc_complete_rq+0x2d/0x70 [nvme_fc] [ 8387.068986] blk_done_softirq+0xa1/0xd0 [ 8387.073264] __do_softirq+0xd6/0x2a9 [ 8387.077251] run_ksoftirqd+0x26/0x40 [ 8387.081238] smpboot_thread_fn+0x10e/0x160 [ 8387.085807] kthread+0xf8/0x130 [ 8387.089309] ? sort_range+0x20/0x20 [ 8387.093198] ? kthread_stop+0x110/0x110 [ 8387.097475] ret_from_fork+0x35/0x40 [ 8387.101462] ---[ end trace 7106b0adf5e422f8 ]--- Fixes: faf4a44fff ("nvme: support traffic based keep-alive") Signed-off-by: Ewan D. Milne Reviewed-by: Hannes Reinecke Signed-off-by: Christoph Hellwig commit ac26d1f74cfc19c8dc9d533b5f20e99dbee3d9bd Author: Jann Horn Date: Tue Nov 27 14:32:00 2018 +0100 x86/fpu: Use the correct exception table macro in the XSTATE_OP wrapper Commit 75045f77f7a7 ("x86/extable: Introduce _ASM_EXTABLE_UA for uaccess fixups") incorrectly replaced the fixup entry for XSTATE_OP with a user-#PF-only fixup. XRSTOR can also raise #GP if the xstate content is invalid, and _ASM_EXTABLE_UA doesn't expect that. Change this fixup back to _ASM_EXTABLE so that #GP gets fixed up. Fixes: 75045f77f7a7 ("x86/extable: Introduce _ASM_EXTABLE_UA for uaccess fixups") Reported-by: Sebastian Andrzej Siewior Signed-off-by: Jann Horn Signed-off-by: Borislav Petkov Acked-by: Sebastian Andrzej Siewior Tested-by: Sebastian Andrzej Siewior Cc: "H. Peter Anvin" Cc: "Naveen N. Rao" Cc: Andy Lutomirski Cc: Ingo Molnar Cc: Thomas Gleixner Cc: kernel-hardening@lists.openwall.com Cc: x86-ml Link: https://lkml.kernel.org/r/20181126165957.xhsyu2dhyy45mrjo@linutronix.de Link: https://lkml.kernel.org/r/20181127133200.38322-1-jannh@google.com commit b8e0be79d0004eded7f93981489781a389790959 Merge: 1078bef0cd92 ffdcc3638c58 Author: Takashi Iwai Date: Tue Nov 27 16:06:42 2018 +0100 Merge tag 'asoc-v4.20-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v4.20 Lots of fixes here, the majority of which are driver specific but there's a couple of core things and one notable driver specific one: - A core fix for a DAPM regression introduced during the component refactoring, we'd lost the code that forced a reevaluation of the DAPM graph after probe (which we suppress during init to save lots of recalcuation) and have now restored it. - A core fix for error handling using the newly added for_each_rtd_codec_dai_rollback() macro. - A fix for the names of widgets in the newly introduced pcm3060 driver, merged as a fix so we don't have a release with legacy names. commit 814cedbc0b78d75e335c96da9b9391142eab5600 Author: Martin Schwidefsky Date: Tue Nov 27 14:04:04 2018 +0100 s390/mm: correct pgtable_bytes on page table downgrade The downgrade of a page table from 3 levels to 2 levels for a 31-bit compat process removes a pmd table which has to be counted against pgtable_bytes. Signed-off-by: Martin Schwidefsky commit 0b57436f15bf40e432487086c4f2d01fd3529393 Author: Wolfram Sang Date: Tue Nov 13 12:15:42 2018 +0100 i2c: rcar: check bus state before reinitializing We should check the bus state before reinitializing the IP core. Otherwise, the internal bus busy state which also tracks multi-master activity is lost. Credits go to the Renesas BSP team for suggesting this change. Reported-by: Yoshihiro Shimoda Signed-off-by: Wolfram Sang Fixes: ae481cc13965 ("i2c: rcar: fix resume by always initializing registers before transfer") Signed-off-by: Wolfram Sang commit 39129f28c9431522a6790e7b8c3283221a28447b Author: Wolfram Sang Date: Fri Nov 9 18:07:32 2018 +0100 i2c: nvidia-gpu: limit reads also for combined messages If the controller can only do 4 byte reads, this needs to be applied for the read-part of combined messages, too. Signed-off-by: Wolfram Sang Fixes: c71bcdcb42a7 ("i2c: add i2c bus driver for NVIDIA GPU") Acked-by: Ajay Gupta Tested-by: Ajay Gupta commit 98be694ba25fa0e87811e7784b782c9498741b26 Author: Wolfram Sang Date: Fri Nov 9 18:02:16 2018 +0100 i2c: nvidia-gpu: adhere to I2C fault codes As described in Documentation/i2c/fault-codes. Signed-off-by: Wolfram Sang Fixes: c71bcdcb42a7 ("i2c: add i2c bus driver for NVIDIA GPU") Acked-by: Ajay Gupta Tested-by: Ajay Gupta commit 976b489120cdab2b1b3a41ffa14661db43d58190 Author: Ard Biesheuvel Date: Fri Nov 23 22:51:32 2018 +0100 efi: Prevent GICv3 WARN() by mapping the memreserve table before first use Mapping the MEMRESERVE EFI configuration table from an early initcall is too late: the GICv3 ITS code that creates persistent reservations for the boot CPU's LPI tables is invoked from init_IRQ(), which runs much earlier than the handling of the initcalls. This results in a WARN() splat because the LPI tables cannot be reserved persistently, which will result in silent memory corruption after a kexec reboot. So instead, invoke the initialization performed by the initcall from efi_mem_reserve_persistent() itself as well, but keep the initcall so that the init is guaranteed to have been called before SMP boot. Tested-by: Marc Zyngier Tested-by: Jan Glauber Tested-by: John Garry Signed-off-by: Ard Biesheuvel Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Fixes: 63eb322d89c8 ("efi: Permit calling efi_mem_reserve_persistent() ...") Link: http://lkml.kernel.org/r/20181123215132.7951-2-ard.biesheuvel@linaro.org Signed-off-by: Ingo Molnar commit fd65d3142f734bc4376053c8d75670041903134d Author: Jim Mattson Date: Tue May 22 09:54:20 2018 -0700 kvm: svm: Ensure an IBPB on all affected CPUs when freeing a vmcb Previously, we only called indirect_branch_prediction_barrier on the logical CPU that freed a vmcb. This function should be called on all logical CPUs that last loaded the vmcb in question. Fixes: 15d45071523d ("KVM/x86: Add IBPB support") Reported-by: Neel Natu Signed-off-by: Jim Mattson Reviewed-by: Konrad Rzeszutek Wilk Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 0e0fee5c539b61fdd098332e0e2cc375d9073706 Author: Junaid Shahid Date: Wed Oct 31 14:53:57 2018 -0700 kvm: mmu: Fix race in emulated page table writes When a guest page table is updated via an emulated write, kvm_mmu_pte_write() is called to update the shadow PTE using the just written guest PTE value. But if two emulated guest PTE writes happened concurrently, it is possible that the guest PTE and the shadow PTE end up being out of sync. Emulated writes do not mark the shadow page as unsync-ed, so this inconsistency will not be resolved even by a guest TLB flush (unless the page was marked as unsync-ed at some other point). This is fixed by re-reading the current value of the guest PTE after the MMU lock has been acquired instead of just using the value that was written prior to calling kvm_mmu_pte_write(). Signed-off-by: Junaid Shahid Reviewed-by: Wanpeng Li Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 52ad7eb3d668867f9ee2e34d715cfb4860d36a93 Author: Liran Alon Date: Tue Nov 13 17:44:46 2018 +0200 KVM: nVMX: vmcs12 revision_id is always VMCS12_REVISION even when copied from eVMCS vmcs12 represents the per-CPU cache of L1 active vmcs12. This cache can be loaded by one of the following: 1) Guest making a vmcs12 active by exeucting VMPTRLD 2) Guest specifying eVMCS in VP assist page and executing VMLAUNCH/VMRESUME. Either way, vmcs12 should have revision_id of VMCS12_REVISION. Which is not equal to eVMCS revision_id which specifies used VersionNumber of eVMCS struct (e.g. KVM_EVMCS_VERSION). Specifically, this causes an issue in restoring a nested VM state because vmx_set_nested_state() verifies that vmcs12->revision_id is equal to VMCS12_REVISION which was not true in case vmcs12 was populated from an eVMCS by vmx_get_nested_state() which calls copy_enlightened_to_vmcs12(). Reviewed-by: Darren Kenny Signed-off-by: Liran Alon Reviewed-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 72aeb60c52bf74a0eeec77d6b41ce40145697d76 Author: Liran Alon Date: Thu Nov 1 10:57:39 2018 +0200 KVM: nVMX: Verify eVMCS revision id match supported eVMCS version on eVMCS VMPTRLD According to TLFS section 16.11.2 Enlightened VMCS, the first u32 field of eVMCS should specify eVMCS VersionNumber. This version should be in the range of supported eVMCS versions exposed to guest via CPUID.0x4000000A.EAX[0:15]. The range which KVM expose to guest in this CPUID field should be the same as the value returned in vmcs_version by nested_enable_evmcs(). According to the above, eVMCS VMPTRLD should verify that version specified in given eVMCS is in the supported range. However, current code mistakenly verfies this field against VMCS12_REVISION. One can also see that when KVM use eVMCS, it makes sure that alloc_vmcs_cpu() sets allocated eVMCS revision_id to KVM_EVMCS_VERSION. Obvious fix should just change eVMCS VMPTRLD to verify first u32 field of eVMCS is equal to KVM_EVMCS_VERSION. However, it turns out that Microsoft Hyper-V fails to comply to their own invented interface: When Hyper-V use eVMCS, it just sets first u32 field of eVMCS to revision_id specified in MSR_IA32_VMX_BASIC (In our case: VMCS12_REVISION). Instead of used eVMCS version number which is one of the supported versions specified in CPUID.0x4000000A.EAX[0:15]. To overcome Hyper-V bug, we accept either a supported eVMCS version or VMCS12_REVISION as valid values for first u32 field of eVMCS. Cc: Vitaly Kuznetsov Reviewed-by: Nikita Leshenko Reviewed-by: Mark Kanda Signed-off-by: Liran Alon Reviewed-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 326e742533bf0a23f0127d8ea62fb558ba665f08 Author: Leonid Shatz Date: Tue Nov 6 12:14:25 2018 +0200 KVM: nVMX/nSVM: Fix bug which sets vcpu->arch.tsc_offset to L1 tsc_offset Since commit e79f245ddec1 ("X86/KVM: Properly update 'tsc_offset' to represent the running guest"), vcpu->arch.tsc_offset meaning was changed to always reflect the tsc_offset value set on active VMCS. Regardless if vCPU is currently running L1 or L2. However, above mentioned commit failed to also change kvm_vcpu_write_tsc_offset() to set vcpu->arch.tsc_offset correctly. This is because vmx_write_tsc_offset() could set the tsc_offset value in active VMCS to given offset parameter *plus vmcs12->tsc_offset*. However, kvm_vcpu_write_tsc_offset() just sets vcpu->arch.tsc_offset to given offset parameter. Without taking into account the possible addition of vmcs12->tsc_offset. (Same is true for SVM case). Fix this issue by changing kvm_x86_ops->write_tsc_offset() to return actually set tsc_offset in active VMCS and modify kvm_vcpu_write_tsc_offset() to set returned value in vcpu->arch.tsc_offset. In addition, rename write_tsc_offset() callback to write_l1_tsc_offset() to make it clear that it is meant to set L1 TSC offset. Fixes: e79f245ddec1 ("X86/KVM: Properly update 'tsc_offset' to represent the running guest") Reviewed-by: Liran Alon Reviewed-by: Mihai Carabas Reviewed-by: Krish Sadhukhan Signed-off-by: Leonid Shatz Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 1e4329ee2c52692ea42cc677fb2133519718b34a Author: Yi Wang Date: Thu Nov 8 11:22:21 2018 +0800 x86/kvm/vmx: fix old-style function declaration The inline keyword which is not at the beginning of the function declaration may trigger the following build warnings, so let's fix it: arch/x86/kvm/vmx.c:1309:1: warning: ‘inline’ is not at beginning of declaration [-Wold-style-declaration] arch/x86/kvm/vmx.c:5947:1: warning: ‘inline’ is not at beginning of declaration [-Wold-style-declaration] arch/x86/kvm/vmx.c:5985:1: warning: ‘inline’ is not at beginning of declaration [-Wold-style-declaration] arch/x86/kvm/vmx.c:6023:1: warning: ‘inline’ is not at beginning of declaration [-Wold-style-declaration] Signed-off-by: Yi Wang Signed-off-by: Paolo Bonzini commit 354cb410d87314e2eda344feea84809e4261570a Author: Yi Wang Date: Thu Nov 8 16:48:36 2018 +0800 KVM: x86: fix empty-body warnings We get the following warnings about empty statements when building with 'W=1': arch/x86/kvm/lapic.c:632:53: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body] arch/x86/kvm/lapic.c:1907:42: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body] arch/x86/kvm/lapic.c:1936:65: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body] arch/x86/kvm/lapic.c:1975:44: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body] Rework the debug helper macro to get rid of these warnings. Signed-off-by: Yi Wang Signed-off-by: Paolo Bonzini commit f48b4711dd6e1cf282f9dfd159c14a305909c97c Author: Liran Alon Date: Tue Nov 20 18:03:25 2018 +0200 KVM: VMX: Update shared MSRs to be saved/restored on MSR_EFER.LMA changes When guest transitions from/to long-mode by modifying MSR_EFER.LMA, the list of shared MSRs to be saved/restored on guest<->host transitions is updated (See vmx_set_efer() call to setup_msrs()). On every entry to guest, vcpu_enter_guest() calls vmx_prepare_switch_to_guest(). This function should also take care of setting the shared MSRs to be saved/restored. However, the function does nothing in case we are already running with loaded guest state (vmx->loaded_cpu_state != NULL). This means that even when guest modifies MSR_EFER.LMA which results in updating the list of shared MSRs, it isn't being taken into account by vmx_prepare_switch_to_guest() because it happens while we are running with loaded guest state. To fix above mentioned issue, add a flag to mark that the list of shared MSRs has been updated and modify vmx_prepare_switch_to_guest() to set shared MSRs when running with host state *OR* list of shared MSRs has been updated. Note that this issue was mistakenly introduced by commit 678e315e78a7 ("KVM: vmx: add dedicated utility to access guest's kernel_gs_base") because previously vmx_set_efer() always called vmx_load_host_state() which resulted in vmx_prepare_switch_to_guest() to set shared MSRs. Fixes: 678e315e78a7 ("KVM: vmx: add dedicated utility to access guest's kernel_gs_base") Reported-by: Eyal Moscovici Reviewed-by: Mihai Carabas Reviewed-by: Liam Merwick Reviewed-by: Jim Mattson Signed-off-by: Liran Alon Signed-off-by: Paolo Bonzini commit bcbfbd8ec21096027f1ee13ce6c185e8175166f6 Author: Liran Alon Date: Thu Nov 8 00:43:06 2018 +0200 KVM: x86: Fix kernel info-leak in KVM_HC_CLOCK_PAIRING hypercall kvm_pv_clock_pairing() allocates local var "struct kvm_clock_pairing clock_pairing" on stack and initializes all it's fields besides padding (clock_pairing.pad[]). Because clock_pairing var is written completely (including padding) to guest memory, failure to init struct padding results in kernel info-leak. Fix the issue by making sure to also init the padding with zeroes. Fixes: 55dd00a73a51 ("KVM: x86: add KVM_HC_CLOCK_PAIRING hypercall") Reported-by: syzbot+a8ef68d71211ba264f56@syzkaller.appspotmail.com Reviewed-by: Mark Kanda Signed-off-by: Liran Alon Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 7f9ad1dfa3c768d1116c2dbacd7a09f9a871534e Author: Liran Alon Date: Sat Nov 17 14:05:06 2018 +0200 KVM: nVMX: Fix kernel info-leak when enabling KVM_CAP_HYPERV_ENLIGHTENED_VMCS more than once Consider the case that userspace enables KVM_CAP_HYPERV_ENLIGHTENED_VMCS twice: 1) kvm_vcpu_ioctl_enable_cap() is called to enable KVM_CAP_HYPERV_ENLIGHTENED_VMCS which calls nested_enable_evmcs(). 2) nested_enable_evmcs() sets enlightened_vmcs_enabled to true and fills vmcs_version which is then copied to userspace. 3) kvm_vcpu_ioctl_enable_cap() is called again to enable KVM_CAP_HYPERV_ENLIGHTENED_VMCS which calls nested_enable_evmcs(). 4) This time nested_enable_evmcs() just returns 0 as enlightened_vmcs_enabled is already true. *Without filling vmcs_version*. 5) kvm_vcpu_ioctl_enable_cap() continues as usual and copies *uninitialized* vmcs_version to userspace which leads to kernel info-leak. Fix this issue by simply changing nested_enable_evmcs() to always fill vmcs_version output argument. Even when enlightened_vmcs_enabled is already set to true. Note that SVM's nested_enable_evmcs() should not be modified because it always returns a non-zero value (-ENODEV) which results in kvm_vcpu_ioctl_enable_cap() skipping the copy of vmcs_version to userspace (as it should). Fixes: 57b119da3594 ("KVM: nVMX: add KVM_CAP_HYPERV_ENLIGHTENED_VMCS capability") Reported-by: syzbot+cfbc368e283d381f8cef@syzkaller.appspotmail.com Reviewed-by: Krish Sadhukhan Reviewed-by: Vitaly Kuznetsov Signed-off-by: Liran Alon Signed-off-by: Paolo Bonzini commit 30510387a5e45bfcf8190e03ec7aa15b295828e2 Author: Wei Wang Date: Mon Nov 12 12:23:14 2018 +0000 svm: Add mutex_lock to protect apic_access_page_done on AMD systems There is a race condition when accessing kvm->arch.apic_access_page_done. Due to it, x86_set_memory_region will fail when creating the second vcpu for a svm guest. Add a mutex_lock to serialize the accesses to apic_access_page_done. This lock is also used by vmx for the same purpose. Signed-off-by: Wei Wang Signed-off-by: Amadeusz Juskowiak Signed-off-by: Julian Stecklina Signed-off-by: Suravee Suthikulpanit Reviewed-by: Joerg Roedel Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit e97f852fd4561e77721bb9a4e0ea9d98305b1e93 Author: Wanpeng Li Date: Tue Nov 20 16:34:18 2018 +0800 KVM: X86: Fix scan ioapic use-before-initialization Reported by syzkaller: BUG: unable to handle kernel NULL pointer dereference at 00000000000001c8 PGD 80000003ec4da067 P4D 80000003ec4da067 PUD 3f7bfa067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 7 PID: 5059 Comm: debug Tainted: G OE 4.19.0-rc5 #16 RIP: 0010:__lock_acquire+0x1a6/0x1990 Call Trace: lock_acquire+0xdb/0x210 _raw_spin_lock+0x38/0x70 kvm_ioapic_scan_entry+0x3e/0x110 [kvm] vcpu_enter_guest+0x167e/0x1910 [kvm] kvm_arch_vcpu_ioctl_run+0x35c/0x610 [kvm] kvm_vcpu_ioctl+0x3e9/0x6d0 [kvm] do_vfs_ioctl+0xa5/0x690 ksys_ioctl+0x6d/0x80 __x64_sys_ioctl+0x1a/0x20 do_syscall_64+0x83/0x6e0 entry_SYSCALL_64_after_hwframe+0x49/0xbe The reason is that the testcase writes hyperv synic HV_X64_MSR_SINT6 msr and triggers scan ioapic logic to load synic vectors into EOI exit bitmap. However, irqchip is not initialized by this simple testcase, ioapic/apic objects should not be accessed. This can be triggered by the following program: #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); long res = 0; memcpy((void*)0x20000040, "/dev/kvm", 9); res = syscall(__NR_openat, 0xffffffffffffff9c, 0x20000040, 0, 0); if (res != -1) r[0] = res; res = syscall(__NR_ioctl, r[0], 0xae01, 0); if (res != -1) r[1] = res; res = syscall(__NR_ioctl, r[1], 0xae41, 0); if (res != -1) r[2] = res; memcpy( (void*)0x20000080, "\x01\x00\x00\x00\x00\x5b\x61\xbb\x96\x00\x00\x40\x00\x00\x00\x00\x01\x00" "\x08\x00\x00\x00\x00\x00\x0b\x77\xd1\x78\x4d\xd8\x3a\xed\xb1\x5c\x2e\x43" "\xaa\x43\x39\xd6\xff\xf5\xf0\xa8\x98\xf2\x3e\x37\x29\x89\xde\x88\xc6\x33" "\xfc\x2a\xdb\xb7\xe1\x4c\xac\x28\x61\x7b\x9c\xa9\xbc\x0d\xa0\x63\xfe\xfe" "\xe8\x75\xde\xdd\x19\x38\xdc\x34\xf5\xec\x05\xfd\xeb\x5d\xed\x2e\xaf\x22" "\xfa\xab\xb7\xe4\x42\x67\xd0\xaf\x06\x1c\x6a\x35\x67\x10\x55\xcb", 106); syscall(__NR_ioctl, r[2], 0x4008ae89, 0x20000080); syscall(__NR_ioctl, r[2], 0xae80, 0); return 0; } This patch fixes it by bailing out scan ioapic if ioapic is not initialized in kernel. Reported-by: Wei Wu Cc: Paolo Bonzini Cc: Radim Krčmář Cc: Wei Wu Signed-off-by: Wanpeng Li Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 38ab012f109caf10f471db1adf284e620dd8d701 Author: Wanpeng Li Date: Tue Nov 20 09:39:30 2018 +0800 KVM: LAPIC: Fix pv ipis use-before-initialization Reported by syzkaller: BUG: unable to handle kernel NULL pointer dereference at 0000000000000014 PGD 800000040410c067 P4D 800000040410c067 PUD 40410d067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 3 PID: 2567 Comm: poc Tainted: G OE 4.19.0-rc5 #16 RIP: 0010:kvm_pv_send_ipi+0x94/0x350 [kvm] Call Trace: kvm_emulate_hypercall+0x3cc/0x700 [kvm] handle_vmcall+0xe/0x10 [kvm_intel] vmx_handle_exit+0xc1/0x11b0 [kvm_intel] vcpu_enter_guest+0x9fb/0x1910 [kvm] kvm_arch_vcpu_ioctl_run+0x35c/0x610 [kvm] kvm_vcpu_ioctl+0x3e9/0x6d0 [kvm] do_vfs_ioctl+0xa5/0x690 ksys_ioctl+0x6d/0x80 __x64_sys_ioctl+0x1a/0x20 do_syscall_64+0x83/0x6e0 entry_SYSCALL_64_after_hwframe+0x49/0xbe The reason is that the apic map has not yet been initialized, the testcase triggers pv_send_ipi interface by vmcall which results in kvm->arch.apic_map is dereferenced. This patch fixes it by checking whether or not apic map is NULL and bailing out immediately if that is the case. Fixes: 4180bf1b65 (KVM: X86: Implement "send IPI" hypercall) Reported-by: Wei Wu Cc: Paolo Bonzini Cc: Radim Krčmář Cc: Wei Wu Signed-off-by: Wanpeng Li Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit a87c99e61236ba8ca962ce97a19fab5ebd588d35 Author: Luiz Capitulino Date: Fri Nov 23 12:02:14 2018 -0500 KVM: VMX: re-add ple_gap module parameter Apparently, the ple_gap parameter was accidentally removed by commit c8e88717cfc6b36bedea22368d97667446318291. Add it back. Signed-off-by: Luiz Capitulino Cc: stable@vger.kernel.org Fixes: c8e88717cfc6b36bedea22368d97667446318291 Signed-off-by: Paolo Bonzini commit 15cb127e3c8f6232096d5dba6a5b4046bc292d70 Author: Gustavo Pimentel Date: Fri Nov 23 18:00:21 2018 +0100 PCI: dwc: Fix MSI-X EP framework address calculation bug Fix an error caused by 3-bit right rotation on offset address calculation of MSI-X table in dw_pcie_ep_raise_msix_irq(). The initial testing code was setting by default the offset address of MSI-X table to zero, so that even with a 3-bit right rotation the computed result would still be zero and valid, therefore this bug went unnoticed. Fixes: beb4641a787d ("PCI: dwc: Add MSI-X callbacks handler") Signed-off-by: Gustavo Pimentel [lorenzo.pieralisi@arm.com: updated commit log] Signed-off-by: Lorenzo Pieralisi Cc: stable@vger.kernel.org commit 1078bef0cd9291355a20369b21cd823026ab8eaa Author: Kailang Yang Date: Thu Nov 8 16:36:15 2018 +0800 ALSA: hda/realtek - Support ALC300 This patch will enable ALC300. [ It's almost equivalent with other ALC269-compatible ones, and apparently has no loopback mixer -- tiwai ] Signed-off-by: Kailang Yang Cc: Signed-off-by: Takashi Iwai commit e8ed64b08eddc05043e556832616a478bbe4bb00 Author: Girija Kumar Kasinadhuni Date: Mon Nov 26 13:40:46 2018 -0500 ALSA: hda/realtek - Add auto-mute quirk for HP Spectre x360 laptop This device makes a loud buzzing sound when a headphone is inserted while playing audio at full volume through the speaker. Fixes: bbf8ff6b1d2a ("ALSA: hda/realtek - Fixup for HP x360 laptops with B&O speakers") Signed-off-by: Girija Kumar Kasinadhuni Cc: Signed-off-by: Takashi Iwai commit 104f708fd1241b22f808bdf066ab67dc5a051de5 Author: Harald Freudenberger Date: Fri Nov 9 14:59:24 2018 +0100 s390/zcrypt: reinit ap queue state machine during device probe Until the vfio-ap driver came into live there was a well known agreement about the way how ap devices are initialized and their states when the driver's probe function is called. However, the vfio device driver when receiving an ap queue device does additional resets thereby removing the registration for interrupts for the ap device done by the ap bus core code. So when later the vfio driver releases the device and one of the default zcrypt drivers takes care of the device the interrupt registration needs to get renewed. The current code does no renew and result is that requests send into such a queue will never see a reply processed - the application hangs. This patch adds a function which resets the aq queue state machine for the ap queue device and triggers the walk through the initial states (which are reset and registration for interrupts). This function is now called before the driver's probe function is invoked. When the association between driver and device is released, the driver's remove function is called. The current implementation calls a ap queue function ap_queue_remove(). This invokation has been moved to the ap bus function to make the probe / remove pair for ap bus and drivers more symmetric. Fixes: 7e0bdbe5c21c ("s390/zcrypt: AP bus support for alternate driver(s)") Cc: stable@vger.kernel.org # 4.19+ Signed-off-by: Harald Freudenberger Reviewd-by: Tony Krowiak Reviewd-by: Martin Schwidefsky Signed-off-by: Martin Schwidefsky commit ecebf55d27a11538ea84aee0be643dd953f830d5 Author: Pan Bian Date: Sun Nov 25 08:58:02 2018 +0800 ext2: fix potential use after free The function ext2_xattr_set calls brelse(bh) to drop the reference count of bh. After that, bh may be freed. However, following brelse(bh), it reads bh->b_data via macro HDR(bh). This may result in a use-after-free bug. This patch moves brelse(bh) after reading field. CC: stable@vger.kernel.org Signed-off-by: Pan Bian Signed-off-by: Jan Kara commit e5f5b717983bccfa033282e9886811635602510e Author: xingaopeng Date: Sat Nov 24 19:21:59 2018 +0800 ext2: initialize opts.s_mount_opt as zero before using it We need to initialize opts.s_mount_opt as zero before using it, else we may get some unexpected mount options. Fixes: 088519572ca8 ("ext2: Parse mount options into a dedicated structure") CC: stable@vger.kernel.org Signed-off-by: xingaopeng Signed-off-by: Jan Kara commit 2a48602615e0a2f563549c7d5c8d507f904cf96e Author: Chanho Park Date: Thu Nov 22 18:23:47 2018 +0900 tty: do not set TTY_IO_ERROR flag if console port Since Commit 761ed4a94582 ('tty: serial_core: convert uart_close to use tty_port_close') and Commit 4dda864d7307 ('tty: serial_core: Fix serial console crash on port shutdown), a serial port which is used as console can be stuck when logging out if there is a remained process. After logged out, agetty will try to grab the serial port but it will be failed because the previous process did not release the port correctly. To fix this, TTY_IO_ERROR bit should not be enabled of tty_port_close if the port is console port. Reproduce step: - Run background processes from serial console $ while true; do sleep 10; done & - Log out $ logout -> Stuck - Read journal log by journalctl | tail Jan 28 16:07:01 ubuntu systemd[1]: Stopped Serial Getty on ttyAMA0. Jan 28 16:07:01 ubuntu systemd[1]: Started Serial Getty on ttyAMA0. Jan 28 16:07:02 ubuntu agetty[1643]: /dev/ttyAMA0: not a tty Fixes: 761ed4a94582 ("tty: serial_core: convert uart_close to use tty_port_close") Cc: Geert Uytterhoeven Cc: Rob Herring Cc: Jiri Slaby Signed-off-by: Chanho Park Cc: stable Signed-off-by: Greg Kroah-Hartman commit 2b9034b5eaddc09c0e9529b93446eb975f97f814 Author: David Miller Date: Mon Nov 26 21:55:09 2018 -0800 sparc: Adjust bpf JIT prologue for PSEUDO calls. Move all arguments into output registers from input registers. This path is exercised by test_verifier.c's "calls: two calls with args" test. Adjust BPF_TAILCALL_PROLOGUE_SKIP as needed. Let's also make the prologue length a constant size regardless of the combination of ->saw_frame_pointer and ->saw_tail_call settings. Signed-off-by: David S. Miller Signed-off-by: Daniel Borkmann commit 27df7977099c2b8d32399cd1752f527c5a343dfa Author: Bartosz Golaszewski Date: Wed Nov 21 10:35:23 2018 +0100 ARM: davinci: dm644x: set the GPIO base to 0 Commit 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") broke the GPIO support on DaVinci boards in legacy mode by allowing gpiolib to set the GPIO base automatically. DaVinci board files use the legacy GPIO API with hard-coded GPIO line numbers. Use the new fields in struct davinci_gpio_platform_data to manually set the GPIO base to 0. Fixes: 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski Signed-off-by: Sekhar Nori commit 55a891d0d0bd3db9303c580857147c37e2c76a5a Author: Bartosz Golaszewski Date: Wed Nov 21 10:35:22 2018 +0100 ARM: davinci: da830: set the GPIO base to 0 Commit 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") broke the GPIO support on DaVinci boards in legacy mode by allowing gpiolib to set the GPIO base automatically. DaVinci board files use the legacy GPIO API with hard-coded GPIO line numbers. Use the new fields in struct davinci_gpio_platform_data to manually set the GPIO base to 0. Fixes: 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski Signed-off-by: Sekhar Nori commit a6ca633e13f888cbb0a92309a1e090818cffcc86 Author: Bartosz Golaszewski Date: Wed Nov 21 10:35:21 2018 +0100 ARM: davinci: dm355: set the GPIO base to 0 Commit 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") broke the GPIO support on DaVinci boards in legacy mode by allowing gpiolib to set the GPIO base automatically. DaVinci board files use the legacy GPIO API with hard-coded GPIO line numbers. Use the new fields in struct davinci_gpio_platform_data to manually set the GPIO base to 0. Fixes: 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski Signed-off-by: Sekhar Nori commit 6484a677294aa5d08c0210f2f387ebb9be646115 Author: YueHaibing Date: Wed Nov 14 01:57:03 2018 +0000 misc: mic/scif: fix copy-paste error in scif_create_remote_lookup gcc '-Wunused-but-set-variable' warning: drivers/misc/mic/scif/scif_rma.c: In function 'scif_create_remote_lookup': drivers/misc/mic/scif/scif_rma.c:373:25: warning: variable 'vmalloc_num_pages' set but not used [-Wunused-but-set-variable] 'vmalloc_num_pages' should be used to determine if the address is within the vmalloc range. Fixes: ba612aa8b487 ("misc: mic: SCIF memory registration and unregistration") Signed-off-by: YueHaibing Cc: stable Signed-off-by: Greg Kroah-Hartman commit d6a2b9535d1e52bea269c138614c4801469d10e1 Author: Keith Busch Date: Mon Nov 26 16:39:47 2018 -0700 nvme: Free ctrl device name on init failure Free the kobject name that was allocated for the controller device on failure rather than its parent. Fixes: d22524a4782a9 ("nvme: switch controller refcounting to use struct device") Signed-off-by: Keith Busch Signed-off-by: Christoph Hellwig commit 38a35a78c5e270cbe53c4fef6b0d3c2da90dd849 Author: Max Filippov Date: Mon Nov 26 18:06:01 2018 -0800 xtensa: fix coprocessor part of ptrace_{get,set}xregs Layout of coprocessor registers in the elf_xtregs_t and xtregs_coprocessor_t may be different due to alignment. Thus it is not always possible to copy data between the xtregs_coprocessor_t structure and the elf_xtregs_t and get correct values for all registers. Use a table of offsets and sizes of individual coprocessor register groups to do coprocessor context copying in the ptrace_getxregs and ptrace_setxregs. This fixes incorrect coprocessor register values reading from the user process by the native gdb on an xtensa core with multiple coprocessors and registers with high alignment requirements. Cc: stable@vger.kernel.org Signed-off-by: Max Filippov commit 03bc996af0cc71c7f30c384d8ce7260172423b34 Author: Max Filippov Date: Mon Nov 26 15:18:26 2018 -0800 xtensa: fix coprocessor context offset definitions Coprocessor context offsets are used by the assembly code that moves coprocessor context between the individual fields of the thread_info::xtregs_cp structure and coprocessor registers. This fixes coprocessor context clobbering on flushing and reloading during normal user code execution and user process debugging in the presence of more than one coprocessor in the core configuration. Cc: stable@vger.kernel.org Signed-off-by: Max Filippov commit 2958b66694e018c552be0b60521fec27e8d12988 Author: Max Filippov Date: Mon Nov 26 13:29:41 2018 -0800 xtensa: enable coprocessors that are being flushed coprocessor_flush_all may be called from a context of a thread that is different from the thread being flushed. In that case contents of the cpenable special register may not match ti->cpenable of the target thread, resulting in unhandled coprocessor exception in the kernel context. Set cpenable special register to the ti->cpenable of the target register for the duration of the flush and restore it afterwards. This fixes the following crash caused by coprocessor register inspection in native gdb: (gdb) p/x $w0 Illegal instruction in kernel: sig: 9 [#1] PREEMPT Call Trace: ___might_sleep+0x184/0x1a4 __might_sleep+0x41/0xac exit_signals+0x14/0x218 do_exit+0xc9/0x8b8 die+0x99/0xa0 do_illegal_instruction+0x18/0x6c common_exception+0x77/0x77 coprocessor_flush+0x16/0x3c arch_ptrace+0x46c/0x674 sys_ptrace+0x2ce/0x3b4 system_call+0x54/0x80 common_exception+0x77/0x77 note: gdb[100] exited with preempt_count 1 Killed Cc: stable@vger.kernel.org Signed-off-by: Max Filippov commit ef78e5ec9214376c5cb989f5da70b02d0c117b66 Author: Matias Bjørling Date: Mon Nov 26 11:27:03 2018 -0800 ia64: export node_distance function The numa_slit variable used by node_distance is available to a module as long as it is linked at compile-time. However, it is not available to loadable modules. Leading to errors such as: ERROR: "numa_slit" [drivers/nvme/host/nvme-core.ko] undefined! The error above is caused by the nvme multipath code that makes use of node_distance for its path calculation. When the patch was added, the lightnvm subsystem would select nvme and always compile it in, leading to the node_distance call to always succeed. However, when this requirement was removed, nvme could be compiled in as a module, which exposed this bug. This patch extracts node_distance to a function and exports it. Since ACPI is depending on node_distance being a simple lookup to numa_slit, the previous behavior is exposed as slit_distance and its users updated. Fixes: f333444708f82 "nvme: take node locality into account when selecting a path" Fixes: 73569e11032f "lightnvm: remove dependencies on BLK_DEV_NVME and PCI" Signed-off-by: Matias Bjøring Signed-off-by: Tony Luck Signed-off-by: Linus Torvalds commit fa1e0c9690bfa19eadd2adbaf511fb4fef9270e6 Author: Daniel Borkmann Date: Tue Nov 27 01:21:00 2018 +0100 bpf, doc: add entries of who looks over which jits Make the high-level BPF JIT entry a general 'catch-all' and add architecture specific entries to make it more clear who actively maintains which BPF JIT compiler. The list (L) address implies that this eventually lands in the bpf patchwork bucket. Goal is that this set of responsible developers listed here is always up to date and a point of contact for helping out in e.g. feature development, fixes, review or testing patches in order to help long-term in ensuring quality of the BPF JITs and therefore BPF core under a given architecture. Every new JIT in future /must/ have an entry here as well. Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Acked-by: Naveen N. Rao Acked-by: Sandipan Das Acked-by: Martin Schwidefsky Acked-by: Heiko Carstens Acked-by: David S. Miller Acked-by: Zi Shen Lim Acked-by: Paul Burton Acked-by: Jakub Kicinski Acked-by: Wang YanQing Signed-off-by: Alexei Starovoitov commit e2ac579a7a18bcd9e8cf14cf42eac0b8a2ba6c4b Author: David Miller Date: Mon Nov 26 14:52:18 2018 -0800 sparc: Correct ctx->saw_frame_pointer logic. We need to initialize the frame pointer register not just if it is seen as a source operand, but also if it is seen as the destination operand of a store or an atomic instruction (which effectively is a source operand). This is exercised by test_verifier's "non-invalid fp arithmetic" Signed-off-by: David S. Miller Signed-off-by: Alexei Starovoitov commit c44768a33da81b4a0986e79bbf0588f1a0651dec Author: David Miller Date: Mon Nov 26 13:03:46 2018 -0800 sparc: Fix JIT fused branch convergance. On T4 and later sparc64 cpus we can use the fused compare and branch instruction. However, it can only be used if the branch destination is in the range of a signed 10-bit immediate offset. This amounts to 1024 instructions forwards or backwards. After the commit referenced in the Fixes: tag, the largest possible size program seen by the JIT explodes by a significant factor. As a result of this convergance takes many more passes since the expanded "BPF_LDX | BPF_MSH | BPF_B" code sequence, for example, contains several embedded branch on condition instructions. On each pass, as suddenly new fused compare and branch instances become valid, this makes thousands more in range for the next pass. And so on and so forth. This is most greatly exemplified by "BPF_MAXINSNS: exec all MSH" which takes 35 passes to converge, and shrinks the image by about 64K. To decrease the cost of this number of convergance passes, do the convergance pass before we have the program image allocated, just like other JITs (such as x86) do. Fixes: e0cea7ce988c ("bpf: implement ld_abs/ld_ind in native bpf") Signed-off-by: David S. Miller Signed-off-by: Alexei Starovoitov commit fdac315d705a97e9edff1a40889fefd2df594422 Merge: 69500127424c 8c11ea5ce13d Author: Alexei Starovoitov Date: Mon Nov 26 17:34:25 2018 -0800 Merge branch 'arm64-jit-fixes' Daniel Borkmann says: ==================== This set contains a fix for arm64 BPF JIT. First patch generalizes ppc64 way of retrieving subprog into bpf_jit_get_func_addr() as core code and uses the same on arm64 in second patch. Tested on both arm64 and ppc64. ==================== Signed-off-by: Alexei Starovoitov commit 8c11ea5ce13da0252fc92f91e90b0cb0c8fe5619 Author: Daniel Borkmann Date: Mon Nov 26 14:05:39 2018 +0100 bpf, arm64: fix getting subprog addr from aux for calls The arm64 JIT has the same issue as ppc64 JIT in that the relative BPF to BPF call offset can be too far away from core kernel in that relative encoding into imm is not sufficient and could potentially be truncated, see also fd045f6cd98e ("arm64: add support for module PLTs") which adds spill-over space for module_alloc() and therefore bpf_jit_binary_alloc(). Therefore, use the recently added bpf_jit_get_func_addr() helper for properly fetching the address through prog->aux->func[off]->bpf_func instead. This also has the benefit to optimize normal helper calls since their address can use the optimized emission. Tested on Cavium ThunderX CN8890. Fixes: db496944fdaa ("bpf: arm64: add JIT support for multi-function programs") Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov commit e2c95a61656d29ceaac97b6a975c8a1f26e26f15 Author: Daniel Borkmann Date: Mon Nov 26 14:05:38 2018 +0100 bpf, ppc64: generalize fetching subprog into bpf_jit_get_func_addr Make fetching of the BPF call address from ppc64 JIT generic. ppc64 was using a slightly different variant rather than through the insns' imm field encoding as the target address would not fit into that space. Therefore, the target subprog number was encoded into the insns' offset and fetched through fp->aux->func[off]->bpf_func instead. Given there are other JITs with this issue and the mechanism of fetching the address is JIT-generic, move it into the core as a helper instead. On the JIT side, we get information on whether the retrieved address is a fixed one, that is, not changing through JIT passes, or a dynamic one. For the former, JITs can optimize their imm emission because this doesn't change jump offsets throughout JIT process. Signed-off-by: Daniel Borkmann Reviewed-by: Sandipan Das Tested-by: Sandipan Das Signed-off-by: Alexei Starovoitov commit 462951cd32e1496dc64b00051dfb777efc8ae5d8 Author: Michael Ellerman Date: Mon Nov 26 12:59:16 2018 +1100 powerpc/mm: Fix linux page tables build with some configs For some configs the build fails with: arch/powerpc/mm/dump_linuxpagetables.c: In function 'populate_markers': arch/powerpc/mm/dump_linuxpagetables.c:306:39: error: 'PKMAP_BASE' undeclared (first use in this function) arch/powerpc/mm/dump_linuxpagetables.c:314:50: error: 'LAST_PKMAP' undeclared (first use in this function) These come from highmem.h, including that fixes the build. Signed-off-by: Michael Ellerman commit 5564597d51c8ff5b88d95c76255e18b13b760879 Author: Paul Mackerras Date: Tue Nov 27 09:01:54 2018 +1100 powerpc: Fix COFF zImage booting on old powermacs Commit 6975a783d7b4 ("powerpc/boot: Allow building the zImage wrapper as a relocatable ET_DYN", 2011-04-12) changed the procedure descriptor at the start of crt0.S to have a hard-coded start address of 0x500000 rather than a reference to _zimage_start, presumably because having a reference to a symbol introduced a relocation which is awkward to handle in a position-independent executable. Unfortunately, what is at 0x500000 in the COFF image is not the first instruction, but the procedure descriptor itself, that is, a word containing 0x500000, which is not a valid instruction. Hence, booting a COFF zImage results in a "DEFAULT CATCH!, code=FFF00700" message from Open Firmware. This fixes the problem by (a) putting the procedure descriptor in the data section and (b) adding a branch to _zimage_start as the first instruction in the program. Fixes: 6975a783d7b4 ("powerpc/boot: Allow building the zImage wrapper as a relocatable ET_DYN") Signed-off-by: Paul Mackerras Signed-off-by: Michael Ellerman commit 53ca0f2fec39c80ccd19e6e3f30cc8daef174b70 Author: Taehee Yoo Date: Sun Nov 25 18:47:13 2018 +0900 netfilter: nf_conncount: remove wrong condition check routine All lists that reach the tree_nodes_free() function have both zero counter and true dead flag. The reason for this is that lists to be release are selected by nf_conncount_gc_list() which already decrements the list counter and sets on the dead flag. Therefore, this if statement in tree_nodes_free() is unnecessary and wrong. Fixes: 31568ec09ea0 ("netfilter: nf_conncount: fix list_del corruption in conn_free") Signed-off-by: Taehee Yoo Signed-off-by: Pablo Neira Ayuso commit 095faf45e64be00bff4da2d6182dface3d69c9b7 Author: Taehee Yoo Date: Thu Nov 22 19:59:57 2018 +0900 netfilter: nat: fix double register in masquerade modules There is a reference counter to ensure that masquerade modules register notifiers only once. However, the existing reference counter approach is not safe, test commands are: while : do modprobe ip6t_MASQUERADE & modprobe nft_masq_ipv6 & modprobe -rv ip6t_MASQUERADE & modprobe -rv nft_masq_ipv6 & done numbers below represent the reference counter. -------------------------------------------------------- CPU0 CPU1 CPU2 CPU3 CPU4 [insmod] [insmod] [rmmod] [rmmod] [insmod] -------------------------------------------------------- 0->1 register 1->2 returns 2->1 returns 1->0 0->1 register <-- unregister -------------------------------------------------------- The unregistation of CPU3 should be processed before the registration of CPU4. In order to fix this, use a mutex instead of reference counter. splat looks like: [ 323.869557] watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [modprobe:1381] [ 323.869574] Modules linked in: nf_tables(+) nf_nat_ipv6(-) nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 n] [ 323.869574] irq event stamp: 194074 [ 323.898930] hardirqs last enabled at (194073): [] trace_hardirqs_on_thunk+0x1a/0x1c [ 323.898930] hardirqs last disabled at (194074): [] trace_hardirqs_off_thunk+0x1a/0x1c [ 323.898930] softirqs last enabled at (182132): [] __do_softirq+0x6ec/0xa3b [ 323.898930] softirqs last disabled at (182109): [] irq_exit+0x1a6/0x1e0 [ 323.898930] CPU: 0 PID: 1381 Comm: modprobe Not tainted 4.20.0-rc2+ #27 [ 323.898930] RIP: 0010:raw_notifier_chain_register+0xea/0x240 [ 323.898930] Code: 3c 03 0f 8e f2 00 00 00 44 3b 6b 10 7f 4d 49 bc 00 00 00 00 00 fc ff df eb 22 48 8d 7b 10 488 [ 323.898930] RSP: 0018:ffff888101597218 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13 [ 323.898930] RAX: 0000000000000000 RBX: ffffffffc04361c0 RCX: 0000000000000000 [ 323.898930] RDX: 1ffffffff26132ae RSI: ffffffffc04aa3c0 RDI: ffffffffc04361d0 [ 323.898930] RBP: ffffffffc04361c8 R08: 0000000000000000 R09: 0000000000000001 [ 323.898930] R10: ffff8881015972b0 R11: fffffbfff26132c4 R12: dffffc0000000000 [ 323.898930] R13: 0000000000000000 R14: 1ffff110202b2e44 R15: ffffffffc04aa3c0 [ 323.898930] FS: 00007f813ed41540(0000) GS:ffff88811ae00000(0000) knlGS:0000000000000000 [ 323.898930] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 323.898930] CR2: 0000559bf2c9f120 CR3: 000000010bc80000 CR4: 00000000001006f0 [ 323.898930] Call Trace: [ 323.898930] ? atomic_notifier_chain_register+0x2d0/0x2d0 [ 323.898930] ? down_read+0x150/0x150 [ 323.898930] ? sched_clock_cpu+0x126/0x170 [ 323.898930] ? nf_tables_core_module_init+0xe4/0xe4 [nf_tables] [ 323.898930] ? nf_tables_core_module_init+0xe4/0xe4 [nf_tables] [ 323.898930] register_netdevice_notifier+0xbb/0x790 [ 323.898930] ? __dev_close_many+0x2d0/0x2d0 [ 323.898930] ? __mutex_unlock_slowpath+0x17f/0x740 [ 323.898930] ? wait_for_completion+0x710/0x710 [ 323.898930] ? nf_tables_core_module_init+0xe4/0xe4 [nf_tables] [ 323.898930] ? up_write+0x6c/0x210 [ 323.898930] ? nf_tables_core_module_init+0xe4/0xe4 [nf_tables] [ 324.127073] ? nf_tables_core_module_init+0xe4/0xe4 [nf_tables] [ 324.127073] nft_chain_filter_init+0x1e/0xe8a [nf_tables] [ 324.127073] nf_tables_module_init+0x37/0x92 [nf_tables] [ ... ] Fixes: 8dd33cc93ec9 ("netfilter: nf_nat: generalize IPv4 masquerading support for nf_tables") Fixes: be6b635cd674 ("netfilter: nf_nat: generalize IPv6 masquerading support for nf_tables") Signed-off-by: Taehee Yoo Signed-off-by: Pablo Neira Ayuso commit 584eab291c67894cb17cc87544b9d086228ea70f Author: Taehee Yoo Date: Thu Nov 22 19:59:46 2018 +0900 netfilter: add missing error handling code for register functions register_{netdevice/inetaddr/inet6addr}_notifier may return an error value, this patch adds the code to handle these error paths. Signed-off-by: Taehee Yoo Signed-off-by: Pablo Neira Ayuso commit 75b7b86bdb0df37e08e44b6c1f99010967f81944 Author: Artemy Kovalyov Date: Sun Nov 25 20:34:26 2018 +0200 IB/mlx5: Fix page fault handling for MW Memory windows are implemented with an indirect MKey, when a page fault event comes for a MW Mkey we need to find the MR at the end of the list of the indirect MKeys by iterating on all items from the first to the last. The offset calculated during this process has to be zeroed after the first iteration or the next iteration will start from a wrong address, resulting incorrect ODP faulting behavior. Fixes: db570d7deafb ("IB/mlx5: Add ODP support to MW") Signed-off-by: Artemy Kovalyov Signed-off-by: Moni Shoua Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 605728e65ad303a1b639bcae7c0abd2e24e6a930 Author: Artemy Kovalyov Date: Sun Nov 25 20:34:25 2018 +0200 IB/umem: Set correct address to the invalidation function The invalidate range was using PAGE_SIZE instead of the computed 'end', and had the wrong transformation of page_index due the weird construction. This can trigger during error unwind and would cause malfunction. Inline the code and correct the math. Fixes: 403cd12e2cf7 ("IB/umem: Add contiguous ODP support") Signed-off-by: Artemy Kovalyov Signed-off-by: Moni Shoua Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 4d5422a309deecec906c491f8aea77593a46321d Author: Artemy Kovalyov Date: Sun Nov 25 20:34:23 2018 +0200 IB/mlx5: Skip non-ODP MR when handling a page fault It is possible that we call pagefault_single_data_segment() with a MKey that belongs to a memory region which is not on demand (i.e. pinned pages). This can happen if, for instance, a WQE that points to multiple MRs where some of them are ODP MRs and some are not. In this case we don't need to handle this MR in the ODP context besides reporting success. Otherwise the code will call pagefault_mr() which will do to_ib_umem_odp() on a non-ODP MR and thus access out of bounds. Fixes: 7bdf65d411c1 ("IB/mlx5: Handle page faults") Signed-off-by: Artemy Kovalyov Signed-off-by: Moni Shoua Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 508b09046c0f21678652fb66fd1e9959d55591d2 Author: Alin Nastac Date: Wed Nov 21 14:00:30 2018 +0100 netfilter: ipv6: Preserve link scope traffic original oif When ip6_route_me_harder is invoked, it resets outgoing interface of: - link-local scoped packets sent by neighbor discovery - multicast packets sent by MLD host - multicast packets send by MLD proxy daemon that sets outgoing interface through IPV6_PKTINFO ipi6_ifindex Link-local and multicast packets must keep their original oif after ip6_route_me_harder is called. Signed-off-by: Alin Nastac Signed-off-by: Pablo Neira Ayuso commit de7243057e7cefa923fa5f467c0f1ec24eef41d2 Author: Ye Yin Date: Fri Nov 23 09:55:18 2018 -0800 fs/xfs: fix f_ffree value for statfs when project quota is set When project is set, we should use inode limit minus the used count Signed-off-by: Ye Yin Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 8114865ff82e200b383e46821c25cb0625b842b5 Author: Steven Rostedt (VMware) Date: Sun Nov 18 17:10:15 2018 -0500 function_graph: Create function_graph_enter() to consolidate architecture code Currently all the architectures do basically the same thing in preparing the function graph tracer on entry to a function. This code can be pulled into a generic location and then this will allow the function graph tracer to be fixed, as well as extended. Create a new function graph helper function_graph_enter() that will call the hook function (ftrace_graph_entry) and the shadow stack operation (ftrace_push_return_trace), and remove the need of the architecture code to manage the shadow stack. This is needed to prepare for a fix of a design bug on how the curr_ret_stack is used. Cc: stable@kernel.org Fixes: 03274a3ffb449 ("tracing/fgraph: Adjust fgraph depth before calling trace return callback") Reviewed-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 31e1ab494559fb46de304cc6c2aed1528f94b298 Author: Christian Hewitt Date: Wed Nov 21 13:39:29 2018 +0400 drm/meson: add support for 1080p25 mode This essential mode for PAL users is missing, so add it. Fixes: 335e3713afb87 ("drm/meson: Add support for HDMI venc modes and settings") Signed-off-by: Christian Hewitt Acked-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/1542793169-13008-1-git-send-email-christianshewitt@gmail.com Signed-off-by: Sean Paul commit 97b2a3180a559a33852ac0cd77904166069484fd Author: Lyude Paul Date: Sat Nov 24 20:21:17 2018 -0500 drm/meson: Fix OOB memory accesses in meson_viu_set_osd_lut() Currently on driver bringup with KASAN enabled, meson triggers an OOB memory access as shown below: [ 117.904528] ================================================================== [ 117.904560] BUG: KASAN: global-out-of-bounds in meson_viu_set_osd_lut+0x7a0/0x890 [ 117.904588] Read of size 4 at addr ffff20000a63ce24 by task systemd-udevd/498 [ 117.904601] [ 118.083372] CPU: 4 PID: 498 Comm: systemd-udevd Not tainted 4.20.0-rc3Lyude-Test+ #20 [ 118.091143] Hardware name: amlogic khadas-vim2/khadas-vim2, BIOS 2018.07-rc2-armbian 09/11/2018 [ 118.099768] Call trace: [ 118.102181] dump_backtrace+0x0/0x3e8 [ 118.105796] show_stack+0x14/0x20 [ 118.109083] dump_stack+0x130/0x1c4 [ 118.112539] print_address_description+0x60/0x25c [ 118.117214] kasan_report+0x1b4/0x368 [ 118.120851] __asan_report_load4_noabort+0x18/0x20 [ 118.125566] meson_viu_set_osd_lut+0x7a0/0x890 [ 118.129953] meson_viu_init+0x10c/0x290 [ 118.133741] meson_drv_bind_master+0x474/0x748 [ 118.138141] meson_drv_bind+0x10/0x18 [ 118.141760] try_to_bring_up_master+0x3d8/0x768 [ 118.146249] component_add+0x214/0x570 [ 118.149978] meson_dw_hdmi_probe+0x18/0x20 [meson_dw_hdmi] [ 118.155404] platform_drv_probe+0x98/0x138 [ 118.159455] really_probe+0x2a0/0xa70 [ 118.163070] driver_probe_device+0x1b4/0x2d8 [ 118.167299] __driver_attach+0x200/0x280 [ 118.171189] bus_for_each_dev+0x10c/0x1a8 [ 118.175144] driver_attach+0x38/0x50 [ 118.178681] bus_add_driver+0x330/0x608 [ 118.182471] driver_register+0x140/0x388 [ 118.186361] __platform_driver_register+0xc8/0x108 [ 118.191117] meson_dw_hdmi_platform_driver_init+0x1c/0x1000 [meson_dw_hdmi] [ 118.198022] do_one_initcall+0x12c/0x3bc [ 118.201883] do_init_module+0x1fc/0x638 [ 118.205673] load_module+0x4b4c/0x6808 [ 118.209387] __se_sys_init_module+0x2e8/0x3c0 [ 118.213699] __arm64_sys_init_module+0x68/0x98 [ 118.218100] el0_svc_common+0x104/0x210 [ 118.221893] el0_svc_handler+0x48/0xb8 [ 118.225594] el0_svc+0x8/0xc [ 118.228429] [ 118.229887] The buggy address belongs to the variable: [ 118.235007] eotf_33_linear_mapping+0x84/0xc0 [ 118.239301] [ 118.240752] Memory state around the buggy address: [ 118.245522] ffff20000a63cd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 118.252695] ffff20000a63cd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 118.259850] >ffff20000a63ce00: 00 00 00 00 04 fa fa fa fa fa fa fa 00 00 00 00 [ 118.267000] ^ [ 118.271222] ffff20000a63ce80: 00 fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 [ 118.278393] ffff20000a63cf00: 00 00 00 00 00 00 00 00 00 00 00 00 04 fa fa fa [ 118.285542] ================================================================== [ 118.292699] Disabling lock debugging due to kernel taint It seems that when looping through the OSD EOTF LUT maps, we use the same max iterator for OETF: 20. This is wrong though, since 20*2 is 40, which means that we'll stop out of bounds on the EOTF maps. But, this whole thing is already confusing enough to read through as-is, so let's just replace all of the hardcoded sizes with OSD_(OETF/EOTF)_LUT_SIZE / 2. Signed-off-by: Lyude Paul Fixes: bbbe775ec5b5 ("drm: Add support for Amlogic Meson Graphic Controller") Cc: Neil Armstrong Cc: Maxime Ripard Cc: Carlo Caione Cc: Kevin Hilman Cc: dri-devel@lists.freedesktop.org Cc: linux-amlogic@lists.infradead.org Cc: linux-arm-kernel@lists.infradead.org Cc: # v4.10+ Acked-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20181125012117.31915-1-lyude@redhat.com Signed-off-by: Sean Paul commit 995b278e4723b26f8ebf0e7c119286d16c712747 Author: Lyude Paul Date: Sat Nov 24 14:12:38 2018 -0500 drm/meson: Enable fast_io in meson_dw_hdmi_regmap_config Seeing as we use this registermap in the context of our IRQ handlers, we need to be using spinlocks for reading/writing registers so that we can still read them from IRQ handlers without having to grab any mutexes and accidentally sleep. We don't currently do this, as pointed out by lockdep: [ 18.403770] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:908 [ 18.406744] in_atomic(): 1, irqs_disabled(): 128, pid: 68, name: kworker/u17:0 [ 18.413864] INFO: lockdep is turned off. [ 18.417675] irq event stamp: 12 [ 18.420778] hardirqs last enabled at (11): [] _raw_spin_unlock_irq+0x2c/0x60 [ 18.429510] hardirqs last disabled at (12): [] __schedule+0xc4/0xa60 [ 18.437345] softirqs last enabled at (0): [] copy_process.isra.4.part.5+0x4d8/0x1c50 [ 18.446684] softirqs last disabled at (0): [<0000000000000000>] (null) [ 18.453979] CPU: 0 PID: 68 Comm: kworker/u17:0 Tainted: G W O 4.20.0-rc3Lyude-Test+ #9 [ 18.469839] Hardware name: amlogic khadas-vim2/khadas-vim2, BIOS 2018.07-rc2-armbian 09/11/2018 [ 18.480037] Workqueue: hci0 hci_power_on [bluetooth] [ 18.487138] Call trace: [ 18.494192] dump_backtrace+0x0/0x1b8 [ 18.501280] show_stack+0x14/0x20 [ 18.508361] dump_stack+0xbc/0xf4 [ 18.515427] ___might_sleep+0x140/0x1d8 [ 18.522515] __might_sleep+0x50/0x88 [ 18.529582] __mutex_lock+0x60/0x870 [ 18.536621] mutex_lock_nested+0x1c/0x28 [ 18.543660] regmap_lock_mutex+0x10/0x18 [ 18.550696] regmap_read+0x38/0x70 [ 18.557727] dw_hdmi_hardirq+0x58/0x138 [dw_hdmi] [ 18.564804] __handle_irq_event_percpu+0xac/0x410 [ 18.571891] handle_irq_event_percpu+0x34/0x88 [ 18.578982] handle_irq_event+0x48/0x78 [ 18.586051] handle_fasteoi_irq+0xac/0x160 [ 18.593061] generic_handle_irq+0x24/0x38 [ 18.599989] __handle_domain_irq+0x60/0xb8 [ 18.606857] gic_handle_irq+0x50/0xa0 [ 18.613659] el1_irq+0xb4/0x130 [ 18.620394] debug_lockdep_rcu_enabled+0x2c/0x30 [ 18.627111] schedule+0x38/0xa0 [ 18.633781] schedule_timeout+0x3a8/0x510 [ 18.640389] wait_for_common+0x15c/0x180 [ 18.646905] wait_for_completion+0x14/0x20 [ 18.653319] mmc_wait_for_req_done+0x28/0x168 [ 18.659693] mmc_wait_for_req+0xa8/0xe8 [ 18.665978] mmc_wait_for_cmd+0x64/0x98 [ 18.672180] mmc_io_rw_direct_host+0x94/0x130 [ 18.678385] mmc_io_rw_direct+0x10/0x18 [ 18.684516] sdio_enable_func+0xe8/0x1d0 [ 18.690627] btsdio_open+0x24/0xc0 [btsdio] [ 18.696821] hci_dev_do_open+0x64/0x598 [bluetooth] [ 18.703025] hci_power_on+0x50/0x270 [bluetooth] [ 18.709163] process_one_work+0x2a0/0x6e0 [ 18.715252] worker_thread+0x40/0x448 [ 18.721310] kthread+0x12c/0x130 [ 18.727326] ret_from_fork+0x10/0x1c [ 18.735555] ------------[ cut here ]------------ [ 18.741430] do not call blocking ops when !TASK_RUNNING; state=2 set at [<000000006265ec59>] wait_for_common+0x140/0x180 [ 18.752417] WARNING: CPU: 0 PID: 68 at kernel/sched/core.c:6096 __might_sleep+0x7c/0x88 [ 18.760553] Modules linked in: dm_mirror dm_region_hash dm_log dm_mod btsdio bluetooth snd_soc_hdmi_codec dw_hdmi_i2s_audio ecdh_generic brcmfmac brcmutil cfg80211 rfkill ir_nec_decoder meson_dw_hdmi(O) dw_hdmi rc_geekbox meson_rng meson_ir ao_cec rng_core rc_core cec leds_pwm efivars nfsd ip_tables x_tables crc32_generic f2fs uas meson_gxbb_wdt pwm_meson efivarfs ipv6 [ 18.799469] CPU: 0 PID: 68 Comm: kworker/u17:0 Tainted: G W O 4.20.0-rc3Lyude-Test+ #9 [ 18.808858] Hardware name: amlogic khadas-vim2/khadas-vim2, BIOS 2018.07-rc2-armbian 09/11/2018 [ 18.818045] Workqueue: hci0 hci_power_on [bluetooth] [ 18.824088] pstate: 80000085 (Nzcv daIf -PAN -UAO) [ 18.829891] pc : __might_sleep+0x7c/0x88 [ 18.835722] lr : __might_sleep+0x7c/0x88 [ 18.841256] sp : ffff000008003cb0 [ 18.846751] x29: ffff000008003cb0 x28: 0000000000000000 [ 18.852269] x27: ffff00000938e000 x26: ffff800010283000 [ 18.857726] x25: ffff800010353280 x24: ffff00000868ef50 [ 18.863166] x23: 0000000000000000 x22: 0000000000000000 [ 18.868551] x21: 0000000000000000 x20: 000000000000038c [ 18.873850] x19: ffff000008cd08c0 x18: 0000000000000010 [ 18.879081] x17: ffff000008a68cb0 x16: 0000000000000000 [ 18.884197] x15: 0000000000aaaaaa x14: 0e200e200e200e20 [ 18.889239] x13: 0000000000000001 x12: 00000000ffffffff [ 18.894261] x11: ffff000008adfa48 x10: 0000000000000001 [ 18.899517] x9 : ffff0000092a0158 x8 : 0000000000000000 [ 18.904674] x7 : ffff00000812136c x6 : 0000000000000000 [ 18.909895] x5 : 0000000000000000 x4 : 0000000000000001 [ 18.915080] x3 : 0000000000000007 x2 : 0000000000000007 [ 18.920269] x1 : 99ab8e9ebb6c8500 x0 : 0000000000000000 [ 18.925443] Call trace: [ 18.929904] __might_sleep+0x7c/0x88 [ 18.934311] __mutex_lock+0x60/0x870 [ 18.938687] mutex_lock_nested+0x1c/0x28 [ 18.943076] regmap_lock_mutex+0x10/0x18 [ 18.947453] regmap_read+0x38/0x70 [ 18.951842] dw_hdmi_hardirq+0x58/0x138 [dw_hdmi] [ 18.956269] __handle_irq_event_percpu+0xac/0x410 [ 18.960712] handle_irq_event_percpu+0x34/0x88 [ 18.965176] handle_irq_event+0x48/0x78 [ 18.969612] handle_fasteoi_irq+0xac/0x160 [ 18.974058] generic_handle_irq+0x24/0x38 [ 18.978501] __handle_domain_irq+0x60/0xb8 [ 18.982938] gic_handle_irq+0x50/0xa0 [ 18.987351] el1_irq+0xb4/0x130 [ 18.991734] debug_lockdep_rcu_enabled+0x2c/0x30 [ 18.996180] schedule+0x38/0xa0 [ 19.000609] schedule_timeout+0x3a8/0x510 [ 19.005064] wait_for_common+0x15c/0x180 [ 19.009513] wait_for_completion+0x14/0x20 [ 19.013951] mmc_wait_for_req_done+0x28/0x168 [ 19.018402] mmc_wait_for_req+0xa8/0xe8 [ 19.022809] mmc_wait_for_cmd+0x64/0x98 [ 19.027177] mmc_io_rw_direct_host+0x94/0x130 [ 19.031563] mmc_io_rw_direct+0x10/0x18 [ 19.035922] sdio_enable_func+0xe8/0x1d0 [ 19.040294] btsdio_open+0x24/0xc0 [btsdio] [ 19.044742] hci_dev_do_open+0x64/0x598 [bluetooth] [ 19.049228] hci_power_on+0x50/0x270 [bluetooth] [ 19.053687] process_one_work+0x2a0/0x6e0 [ 19.058143] worker_thread+0x40/0x448 [ 19.062608] kthread+0x12c/0x130 [ 19.067064] ret_from_fork+0x10/0x1c [ 19.071513] irq event stamp: 12 [ 19.075937] hardirqs last enabled at (11): [] _raw_spin_unlock_irq+0x2c/0x60 [ 19.083560] hardirqs last disabled at (12): [] __schedule+0xc4/0xa60 [ 19.091401] softirqs last enabled at (0): [] copy_process.isra.4.part.5+0x4d8/0x1c50 [ 19.100801] softirqs last disabled at (0): [<0000000000000000>] (null) [ 19.108135] ---[ end trace 38c4920787b88c75 ]--- So, fix this by enabling the fast_io option in our regmap config so that regmap uses spinlocks for locking instead of mutexes. Signed-off-by: Lyude Paul Fixes: 3f68be7d8e96 ("drm/meson: Add support for HDMI encoder and DW-HDMI bridge + PHY") Cc: Daniel Vetter Cc: Neil Armstrong Cc: Carlo Caione Cc: Kevin Hilman Cc: dri-devel@lists.freedesktop.org Cc: linux-amlogic@lists.infradead.org Cc: linux-arm-kernel@lists.infradead.org Cc: # v4.12+ Acked-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20181124191238.28276-1-lyude@redhat.com Signed-off-by: Sean Paul commit 2bcd3ecab773f73211c45bb1430bb52ac641f271 Author: Neil Armstrong Date: Thu Nov 22 17:01:03 2018 +0100 drm/meson: Fixes for drm_crtc_vblank_on/off support Since Linux 4.17, calls to drm_crtc_vblank_on/off are mandatory, and we get a warning when ctrc is disabled : " driver forgot to call drm_crtc_vblank_off()" But, the vsync IRQ was not totally disabled due the transient hardware state and specific interrupt line, thus adding proper IRQ masking from the HHI system control registers. The last change fixes a race condition introduced by calling the added drm_crtc_vblank_on/off when an HPD event occurs from the HDMI connector, triggering a WARN_ON() in the _atomic_begin() callback when the CRTC is disabled, thus also triggering a WARN_ON() in drm_vblank_put() : WARNING: CPU: 0 PID: 1185 at drivers/gpu/drm/meson/meson_crtc.c:157 meson_crtc_atomic_begin+0x78/0x80 [...] Call trace: meson_crtc_atomic_begin+0x78/0x80 drm_atomic_helper_commit_planes+0x140/0x218 drm_atomic_helper_commit_tail+0x38/0x80 commit_tail+0x7c/0x80 drm_atomic_helper_commit+0xdc/0x150 drm_atomic_commit+0x54/0x60 restore_fbdev_mode_atomic+0x198/0x238 restore_fbdev_mode+0x6c/0x1c0 drm_fb_helper_restore_fbdev_mode_unlocked+0x7c/0xf0 drm_fb_helper_set_par+0x34/0x60 drm_fb_helper_hotplug_event.part.28+0xb8/0xc8 drm_fbdev_client_hotplug+0xa4/0xe0 drm_client_dev_hotplug+0x90/0xe0 drm_kms_helper_hotplug_event+0x3c/0x48 drm_helper_hpd_irq_event+0x134/0x168 dw_hdmi_top_thread_irq+0x3c/0x50 [...] WARNING: CPU: 0 PID: 1185 at drivers/gpu/drm/drm_vblank.c:1026 drm_vblank_put+0xb4/0xc8 [...] Call trace: drm_vblank_put+0xb4/0xc8 drm_crtc_vblank_put+0x24/0x30 drm_atomic_helper_wait_for_vblanks.part.9+0x130/0x2b8 drm_atomic_helper_commit_tail+0x68/0x80 [...] The issue is that vblank need to be enabled in any occurrence of : - atomic_enable() - atomic_begin() and state->enable == true, which was not the case Moving the CRTC enable code to a common function and calling in one of these occurrence solves this race condition and makes sure vblank is enabled in each call to _atomic_begin() from the HPD event leading to drm_atomic_helper_commit_planes(). To Summarize : - Make sure that the CRTC code will call the drm_crtc_vblank_on()/off() - *Really* mask the Vsync IRQ - Initialize and enable vblank at the first atomic_begin()/_atomic_enable() Cc: stable@vger.kernel.org # 4.17+ Signed-off-by: Neil Armstrong Reviewed-by: Lyude Paul [fixed typos+added cc for stable] Signed-off-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/20181122160103.10993-1-narmstrong@baylibre.com Signed-off-by: Sean Paul commit 23a336b34258aba3b50ea6863cca4e81b5ef6384 Author: Sergio Correia Date: Thu Nov 22 02:33:29 2018 -0300 drm: set is_master to 0 upon drm_new_set_master() failure When drm_new_set_master() fails, set is_master to 0, to prevent a possible NULL pointer deref. Here is a problematic flow: we check is_master in drm_is_current_master(), then proceed to call drm_lease_owner() passing master. If we do not restore is_master status when drm_new_set_master() fails, we may have a situation in which is_master will be 1 and master itself, NULL, leading to the deref of a NULL pointer in drm_lease_owner(). This fixes the following OOPS, observed on an ArchLinux running a 4.19.2 kernel: [ 97.804282] BUG: unable to handle kernel NULL pointer dereference at 0000000000000080 [ 97.807224] PGD 0 P4D 0 [ 97.807224] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 97.807224] CPU: 0 PID: 1348 Comm: xfwm4 Tainted: P OE 4.19.2-arch1-1-ARCH #1 [ 97.807224] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./AB350 Pro4, BIOS P5.10 10/16/2018 [ 97.807224] RIP: 0010:drm_lease_owner+0xd/0x20 [drm] [ 97.807224] Code: 83 c4 18 5b 5d c3 b8 ea ff ff ff eb e2 b8 ed ff ff ff eb db e8 b4 ca 68 fb 0f 1f 40 00 0f 1f 44 00 00 48 89 f8 eb 03 48 89 d0 <48> 8b 90 80 00 00 00 48 85 d2 75 f1 c3 66 0f 1f 44 00 00 0f 1f 44 [ 97.807224] RSP: 0018:ffffb8cf08e07bb0 EFLAGS: 00010202 [ 97.807224] RAX: 0000000000000000 RBX: ffff9cf0f2586c00 RCX: ffff9cf0f2586c88 [ 97.807224] RDX: ffff9cf0ddbd8000 RSI: 0000000000000000 RDI: 0000000000000000 [ 97.807224] RBP: ffff9cf1040e9800 R08: 0000000000000000 R09: 0000000000000000 [ 97.807224] R10: ffffdeb30fd5d680 R11: ffffdeb30f5d6808 R12: ffff9cf1040e9888 [ 97.807224] R13: 0000000000000000 R14: dead000000000200 R15: ffff9cf0f2586cc8 [ 97.807224] FS: 00007f4145513180(0000) GS:ffff9cf10ea00000(0000) knlGS:0000000000000000 [ 97.807224] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 97.807224] CR2: 0000000000000080 CR3: 00000003d7548000 CR4: 00000000003406f0 [ 97.807224] Call Trace: [ 97.807224] drm_is_current_master+0x1a/0x30 [drm] [ 97.807224] drm_master_release+0x3e/0x130 [drm] [ 97.807224] drm_file_free.part.0+0x2be/0x2d0 [drm] [ 97.807224] drm_open+0x1ba/0x1e0 [drm] [ 97.807224] drm_stub_open+0xaf/0xe0 [drm] [ 97.807224] chrdev_open+0xa3/0x1b0 [ 97.807224] ? cdev_put.part.0+0x20/0x20 [ 97.807224] do_dentry_open+0x132/0x340 [ 97.807224] path_openat+0x2d1/0x14e0 [ 97.807224] ? mem_cgroup_commit_charge+0x7a/0x520 [ 97.807224] do_filp_open+0x93/0x100 [ 97.807224] ? __check_object_size+0x102/0x189 [ 97.807224] ? _raw_spin_unlock+0x16/0x30 [ 97.807224] do_sys_open+0x186/0x210 [ 97.807224] do_syscall_64+0x5b/0x170 [ 97.807224] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 97.807224] RIP: 0033:0x7f4147b07976 [ 97.807224] Code: 89 54 24 08 e8 7b f4 ff ff 8b 74 24 0c 48 8b 3c 24 41 89 c0 44 8b 54 24 08 b8 01 01 00 00 89 f2 48 89 fe bf 9c ff ff ff 0f 05 <48> 3d 00 f0 ff ff 77 30 44 89 c7 89 44 24 08 e8 a6 f4 ff ff 8b 44 [ 97.807224] RSP: 002b:00007ffcced96ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 97.807224] RAX: ffffffffffffffda RBX: 00005619d5037f80 RCX: 00007f4147b07976 [ 97.807224] RDX: 0000000000000002 RSI: 00005619d46b969c RDI: 00000000ffffff9c [ 98.040039] RBP: 0000000000000024 R08: 0000000000000000 R09: 0000000000000000 [ 98.040039] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000024 [ 98.040039] R13: 0000000000000012 R14: 00005619d5035950 R15: 0000000000000012 [ 98.040039] Modules linked in: nct6775 hwmon_vid algif_skcipher af_alg nls_iso8859_1 nls_cp437 vfat fat uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common arc4 videodev media snd_usb_audio snd_hda_codec_hdmi snd_usbmidi_lib snd_rawmidi snd_seq_device mousedev input_leds iwlmvm mac80211 snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec edac_mce_amd kvm_amd snd_hda_core kvm iwlwifi snd_hwdep r8169 wmi_bmof cfg80211 snd_pcm irqbypass snd_timer snd libphy soundcore pinctrl_amd rfkill pcspkr sp5100_tco evdev gpio_amdpt k10temp mac_hid i2c_piix4 wmi pcc_cpufreq acpi_cpufreq vboxnetflt(OE) vboxnetadp(OE) vboxpci(OE) vboxdrv(OE) msr sg crypto_user ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 fscrypto uas usb_storage dm_crypt hid_generic usbhid hid [ 98.040039] dm_mod raid1 md_mod sd_mod crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel pcbc ahci libahci aesni_intel aes_x86_64 libata crypto_simd cryptd glue_helper ccp xhci_pci rng_core scsi_mod xhci_hcd nvidia_drm(POE) drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm agpgart nvidia_uvm(POE) nvidia_modeset(POE) nvidia(POE) ipmi_devintf ipmi_msghandler [ 98.040039] CR2: 0000000000000080 [ 98.040039] ---[ end trace 3b65093b6fe62b2f ]--- [ 98.040039] RIP: 0010:drm_lease_owner+0xd/0x20 [drm] [ 98.040039] Code: 83 c4 18 5b 5d c3 b8 ea ff ff ff eb e2 b8 ed ff ff ff eb db e8 b4 ca 68 fb 0f 1f 40 00 0f 1f 44 00 00 48 89 f8 eb 03 48 89 d0 <48> 8b 90 80 00 00 00 48 85 d2 75 f1 c3 66 0f 1f 44 00 00 0f 1f 44 [ 98.040039] RSP: 0018:ffffb8cf08e07bb0 EFLAGS: 00010202 [ 98.040039] RAX: 0000000000000000 RBX: ffff9cf0f2586c00 RCX: ffff9cf0f2586c88 [ 98.040039] RDX: ffff9cf0ddbd8000 RSI: 0000000000000000 RDI: 0000000000000000 [ 98.040039] RBP: ffff9cf1040e9800 R08: 0000000000000000 R09: 0000000000000000 [ 98.040039] R10: ffffdeb30fd5d680 R11: ffffdeb30f5d6808 R12: ffff9cf1040e9888 [ 98.040039] R13: 0000000000000000 R14: dead000000000200 R15: ffff9cf0f2586cc8 [ 98.040039] FS: 00007f4145513180(0000) GS:ffff9cf10ea00000(0000) knlGS:0000000000000000 [ 98.040039] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 98.040039] CR2: 0000000000000080 CR3: 00000003d7548000 CR4: 00000000003406f0 Signed-off-by: Sergio Correia Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20181122053329.2692-1-sergio@correia.cc Signed-off-by: Sean Paul commit c54c7374ff44de5e609506aca7c0deae4703b6d1 Author: Lyude Paul Date: Tue Nov 13 17:46:14 2018 -0500 drm/dp_mst: Skip validating ports during destruction, just ref Jerry Zuo pointed out a rather obscure hotplugging issue that it seems I accidentally introduced into DRM two years ago. Pretend we have a topology like this: |- DP-1: mst_primary |- DP-4: active display |- DP-5: disconnected |- DP-6: active hub |- DP-7: active display |- DP-8: disconnected |- DP-9: disconnected If we unplug DP-6, the topology starting at DP-7 will be destroyed but it's payloads will live on in DP-1's VCPI allocations and thus require removal. However, this removal currently fails because drm_dp_update_payload_part1() will (rightly so) try to validate the port before accessing it, fail then abort. If we keep going, eventually we run the MST hub out of bandwidth and all new allocations will start to fail (or in my case; all new displays just start flickering a ton). We could just teach drm_dp_update_payload_part1() not to drop the port ref in this case, but then we also need to teach drm_dp_destroy_payload_step1() to do the same thing, then hope no one ever adds anything to the that requires a validated port reference in drm_dp_destroy_connector_work(). Kind of sketchy. So let's go with a more clever solution: any port that drm_dp_destroy_connector_work() interacts with is guaranteed to still exist in memory until we say so. While said port might not be valid we don't really care: that's the whole reason we're destroying it in the first place! So, teach drm_dp_get_validated_port_ref() to use the all mighty current_work() function to avoid attempting to validate ports from the context of mgr->destroy_connector_work. I can't see any situation where this wouldn't be safe, and this avoids having to play whack-a-mole in the future of trying to work around port validation. Signed-off-by: Lyude Paul Fixes: 263efde31f97 ("drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()") Reported-by: Jerry Zuo Cc: Jerry Zuo Cc: Harry Wentland Cc: # v4.6+ Reviewed-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20181113224613.28809-1-lyude@redhat.com Signed-off-by: Sean Paul commit 1830b6eeda1fed42d85f2388f79c926331a9b2d0 Author: Mika Westerberg Date: Mon Nov 26 12:47:46 2018 +0300 thunderbolt: Prevent root port runtime suspend during NVM upgrade During NVM upgrade process the host router is hot-removed for a short while. During this time it is possible that the root port is moved into D3cold which would be fine if the root port could trigger PME on itself. However, many systems actually do not implement it so what happens is that the root port goes into D3cold and never wakes up unless userspace does PCI config space access, such as running 'lscpi'. For this reason we explicitly prevent the root port from runtime suspending during NVM upgrade. Signed-off-by: Mika Westerberg Signed-off-by: Greg Kroah-Hartman commit eceb05965489784f24bbf4d61ba60e475a983016 Author: Dexuan Cui Date: Mon Nov 26 02:29:56 2018 +0000 Drivers: hv: vmbus: check the creation_status in vmbus_establish_gpadl() This is a longstanding issue: if the vmbus upper-layer drivers try to consume too many GPADLs, the host may return with an error 0xC0000044 (STATUS_QUOTA_EXCEEDED), but currently we forget to check the creation_status, and hence we can pass an invalid GPADL handle into the OPEN_CHANNEL message, and get an error code 0xc0000225 in open_info->response.open_result.status, and finally we hang in vmbus_open() -> "goto error_free_info" -> vmbus_teardown_gpadl(). With this patch, we can exit gracefully on STATUS_QUOTA_EXCEEDED. Cc: Stephen Hemminger Cc: K. Y. Srinivasan Cc: Haiyang Zhang Cc: stable@vger.kernel.org Signed-off-by: Dexuan Cui Signed-off-by: K. Y. Srinivasan Signed-off-by: Greg Kroah-Hartman commit 7bada55ab50697861eee6bb7d60b41e68a961a9c Author: Todd Kjos Date: Tue Nov 6 15:55:32 2018 -0800 binder: fix race that allows malicious free of live buffer Malicious code can attempt to free buffers using the BC_FREE_BUFFER ioctl to binder. There are protections against a user freeing a buffer while in use by the kernel, however there was a window where BC_FREE_BUFFER could be used to free a recently allocated buffer that was not completely initialized. This resulted in a use-after-free detected by KASAN with a malicious test program. This window is closed by setting the buffer's allow_user_free attribute to 0 when the buffer is allocated or when the user has previously freed it instead of waiting for the caller to set it. The problem was that when the struct buffer was recycled, allow_user_free was stale and set to 1 allowing a free to go through. Signed-off-by: Todd Kjos Acked-by: Arve Hjønnevåg Cc: stable # 4.14 Signed-off-by: Greg Kroah-Hartman commit 7d35baa4e9ec4b717bc0e58a39cdb6a1c50f5465 Author: Mathias Kresin Date: Mon Nov 26 11:25:40 2018 +0100 MIPS: ralink: Fix mt7620 nd_sd pinmux In case the nd_sd group is set to the sd-card function, Pins 45 + 46 are configured as GPIOs. If they are blocked by the sd function, they can't be used as GPIOs. Reported-by: Kristian Evensen Signed-off-by: Mathias Kresin Signed-off-by: Paul Burton Fixes: f576fb6a0700 ("MIPS: ralink: cleanup the soc specific pinmux data") Patchwork: https://patchwork.linux-mips.org/patch/21220/ Cc: John Crispin Cc: Ralf Baechle Cc: James Hogan Cc: linux-mips@linux-mips.org Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org # v3.18+ commit 6f8b52ba442ce1372a58df4e85f169686ef52a0d Merge: 2e6e902d1850 09aaf6813cfc Author: Linus Torvalds Date: Mon Nov 26 09:34:31 2018 -0800 Merge tag 'hwmon-for-v4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - fix temp4_type attribute permissions in w83795 driver - fix tacho fault detection in mlxreg-fan driver - fix current value calculations in ina2xx driver - fix initial notification/warning in raspberrypi driver - fix a NULL pointer access in ina2xx * tag 'hwmon-for-v4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (w83795) temp4_type has writable permission hwmon: (mlxreg-fan) Fix macros for tacho fault reading hwmon: (ina2xx) Fix current value calculation hwmon: (raspberrypi) Fix initial notify hwmon (ina2xx) Fix NULL id pointer in probe() commit fb9e7f0bba151281d7587c1262fae8bdf0497296 Author: Bartosz Golaszewski Date: Wed Nov 21 10:35:20 2018 +0100 ARM: davinci: dm646x: set the GPIO base to 0 Commit 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") broke the GPIO support on DaVinci boards in legacy mode by allowing gpiolib to set the GPIO base automatically. DaVinci board files use the legacy GPIO API with hard-coded GPIO line numbers. Use the new fields in struct davinci_gpio_platform_data to manually set the GPIO base to 0. Fixes: 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski Signed-off-by: Sekhar Nori commit 133cd2e48305887709675847da1f6ee2b7363929 Author: Bartosz Golaszewski Date: Wed Nov 21 10:35:19 2018 +0100 ARM: davinci: dm365: set the GPIO base to 0 Commit 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") broke the GPIO support on DaVinci boards in legacy mode by allowing gpiolib to set the GPIO base automatically. DaVinci board files use the legacy GPIO API with hard-coded GPIO line numbers. Use the new fields in struct davinci_gpio_platform_data to manually set the GPIO base to 0. Fixes: 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski Signed-off-by: Sekhar Nori commit 45ed94b9e2d2e310fa7fb884b26080dfd4f0e31d Author: Bartosz Golaszewski Date: Wed Nov 21 10:35:18 2018 +0100 ARM: davinci: da850: set the GPIO base to 0 Commit 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") broke the network support in legacy boot mode for da850-evm since we can no longer request the MDIO clock GPIO. We now have the option to specify the GPIO base manually for davinci, so add the relevant fields to platform data. Fixes: 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski Signed-off-by: Sekhar Nori commit 786a9ab1330169f2602238822b4df5d5c4c98f6c Author: Bartosz Golaszewski Date: Wed Nov 21 10:35:17 2018 +0100 gpio: davinci: restore a way to manually specify the GPIO base Commit 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") broke the network support in legacy boot mode for da850-evm since we can no longer request the MDIO clock GPIO. Other boards may be broken too, which I haven't tested. The problem is in the fact that most board files still use the legacy GPIO API where lines are requested by numbers rather than descriptors. While this should be fixed eventually, in order to unbreak the board for now - provide a way to manually specify the GPIO base in platform data. Fixes: 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski Acked-by: Linus Walleij Signed-off-by: Sekhar Nori commit adcf60ce14c8250761af9de907eb6c7d096c26d3 Author: Bartosz Golaszewski Date: Wed Nov 21 10:35:16 2018 +0100 ARM: davinci: dm644x: define gpio interrupts as separate resources Since commit eb3744a2dd01 ("gpio: davinci: Do not assume continuous IRQ numbering") the davinci GPIO driver fails to probe if we boot in legacy mode from any of the board files. Since the driver now expects every interrupt to be defined as a separate resource, split the definition of IRQ resources instead of having a single continuous interrupt range. Fixes: eb3744a2dd01 ("gpio: davinci: Do not assume continuous IRQ numbering") Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski Signed-off-by: Sekhar Nori commit 27db7baab640ea28d7994eda943fef170e347081 Author: Bartosz Golaszewski Date: Wed Nov 21 10:35:15 2018 +0100 ARM: davinci: dm355: define gpio interrupts as separate resources Since commit eb3744a2dd01 ("gpio: davinci: Do not assume continuous IRQ numbering") the davinci GPIO driver fails to probe if we boot in legacy mode from any of the board files. Since the driver now expects every interrupt to be defined as a separate resource, split the definition of IRQ resources instead of having a single continuous interrupt range. Fixes: eb3744a2dd01 ("gpio: davinci: Do not assume continuous IRQ numbering") Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski Signed-off-by: Sekhar Nori commit 2c9c83491f30afbce25796e185cd4d5e36080e31 Author: Bartosz Golaszewski Date: Wed Nov 21 10:35:14 2018 +0100 ARM: davinci: dm646x: define gpio interrupts as separate resources Since commit eb3744a2dd01 ("gpio: davinci: Do not assume continuous IRQ numbering") the davinci GPIO driver fails to probe if we boot in legacy mode from any of the board files. Since the driver now expects every interrupt to be defined as a separate resource, split the definition of IRQ resources instead of having a single continuous interrupt range. Fixes: eb3744a2dd01 ("gpio: davinci: Do not assume continuous IRQ numbering") Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski Signed-off-by: Sekhar Nori commit 193c04374e281a56c7d4f96e66d329671945bebe Author: Bartosz Golaszewski Date: Wed Nov 21 10:35:13 2018 +0100 ARM: davinci: dm365: define gpio interrupts as separate resources Since commit eb3744a2dd01 ("gpio: davinci: Do not assume continuous IRQ numbering") the davinci GPIO driver fails to probe if we boot in legacy mode from any of the board files. Since the driver now expects every interrupt to be defined as a separate resource, split the definition of IRQ resources instead of having a single continuous interrupt range. Fixes: eb3744a2dd01 ("gpio: davinci: Do not assume continuous IRQ numbering") Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski Signed-off-by: Sekhar Nori commit 58a0afbf4c99ac355df16773af835b919b9432ee Author: Bartosz Golaszewski Date: Wed Nov 21 10:35:12 2018 +0100 ARM: davinci: da8xx: define gpio interrupts as separate resources Since commit eb3744a2dd01 ("gpio: davinci: Do not assume continuous IRQ numbering") the davinci GPIO driver fails to probe if we boot in legacy mode from any of the board files. Since the driver now expects every interrupt to be defined as a separate resource, split the definition of IRQ resources instead of having a single continuous interrupt range. Fixes: eb3744a2dd01 ("gpio: davinci: Do not assume continuous IRQ numbering") Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski Signed-off-by: Sekhar Nori commit 069caf5950dfa75d0526cd89c439ff9d9d3136d8 Author: Aaro Koskinen Date: Sun Nov 25 00:17:08 2018 +0200 USB: omap_udc: fix rejection of out transfers when DMA is used Commit 387f869d2579 ("usb: gadget: u_ether: conditionally align transfer size") started aligning transfer size only if requested, breaking omap_udc DMA mode. Set quirk_ep_out_aligned_size to restore the old behaviour. Fixes: 387f869d2579 ("usb: gadget: u_ether: conditionally align transfer size") Signed-off-by: Aaro Koskinen Signed-off-by: Felipe Balbi commit 2c2322fbcab8102b8cadc09d66714700a2da42c2 Author: Aaro Koskinen Date: Sun Nov 25 00:17:07 2018 +0200 USB: omap_udc: fix USB gadget functionality on Palm Tungsten E On Palm TE nothing happens when you try to use gadget drivers and plug the USB cable. Fix by adding the board to the vbus sense quirk list. Signed-off-by: Aaro Koskinen Signed-off-by: Felipe Balbi commit 6ca6695f576b8453fe68865e84d25946d63b10ad Author: Aaro Koskinen Date: Sun Nov 25 00:17:06 2018 +0200 USB: omap_udc: fix omap_udc_start() on 15xx machines On OMAP 15xx machines there are no transceivers, and omap_udc_start() always fails as it forgot to adjust the default return value. Signed-off-by: Aaro Koskinen Signed-off-by: Felipe Balbi commit 99f700366fcea1aa2fa3c49c99f371670c3c62f8 Author: Aaro Koskinen Date: Sun Nov 25 00:17:05 2018 +0200 USB: omap_udc: fix crashes on probe error and module removal We currently crash if usb_add_gadget_udc_release() fails, since the udc->done is not initialized until in the remove function. Furthermore, on module removal the udc data is accessed although the release function is already triggered by usb_del_gadget_udc() early in the function. Fix by rewriting the release and remove functions, basically moving all the cleanup into the release function, and doing the completion only in the module removal case. The patch fixes omap_udc module probe with a failing gadged, and also allows the removal of omap_udc. Tested by running "modprobe omap_udc; modprobe -r omap_udc" in a loop. Signed-off-by: Aaro Koskinen Signed-off-by: Felipe Balbi commit 286afdde1640d8ea8916a0f05e811441fbbf4b9d Author: Aaro Koskinen Date: Sun Nov 25 00:17:04 2018 +0200 USB: omap_udc: use devm_request_irq() The current code fails to release the third irq on the error path (observed by reading the code), and we get also multiple WARNs with failing gadget drivers due to duplicate IRQ releases. Fix by using devm_request_irq(). Signed-off-by: Aaro Koskinen Signed-off-by: Felipe Balbi commit ce68cc6fad893eb33b69ef7ec186233a51696236 Author: Ryder Lee Date: Mon Nov 12 09:28:08 2018 +0800 arm64: dts: mt7622: Drop the general purpose timer node MediaTeks general purpose timer register into system in early phase during kernel boot, but the clock sources aren't probed at this point. The system has the ARM architecture timer, so we don't need the GPT timer from mediatek. Drop the DT node for it. Fixes: 9cc7f0de9e67 ("arm64: dts: mt7622: add timer, CCI-400 and PMU nodes") Signed-off-by: Ryder Lee [mb: fix commit message] Signed-off-by: Matthias Brugger commit 89259088c1b7fecb43e8e245dc931909132a4e03 Author: Florian Westphal Date: Sat Nov 17 11:32:29 2018 +0100 netfilter: nfnetlink_cttimeout: fetch timeouts for udplite and gre, too syzbot was able to trigger the WARN in cttimeout_default_get() by passing UDPLITE as l4protocol. Alias UDPLITE to UDP, both use same timeout values. Furthermore, also fetch GRE timeouts. GRE is a bit more complicated, as it still can be a module and its netns_proto_gre struct layout isn't visible outside of the gre module. Can't move timeouts around, it appears conntrack sysctl unregister assumes net_generic() returns nf_proto_net, so we get crash. Expose layout of netns_proto_gre instead. A followup nf-next patch could make gre tracker be built-in as well if needed, its not that large. Last, make the WARN() mention the missing protocol value in case anything else is missing. Reported-by: syzbot+2fae8fa157dd92618cae@syzkaller.appspotmail.com Fixes: 8866df9264a3 ("netfilter: nfnetlink_cttimeout: pass default timeout policy to obj_to_nlattr") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 2a31e4bd9ad255ee40809b5c798c4b1c2b09703b Author: Xin Long Date: Thu Nov 15 15:14:30 2018 +0800 ipvs: call ip_vs_dst_notifier earlier than ipv6_dev_notf ip_vs_dst_event is supposed to clean up all dst used in ipvs' destinations when a net dev is going down. But it works only when the dst's dev is the same as the dev from the event. Now with the same priority but late registration, ip_vs_dst_notifier is always called later than ipv6_dev_notf where the dst's dev is set to lo for NETDEV_DOWN event. As the dst's dev lo is not the same as the dev from the event in ip_vs_dst_event, ip_vs_dst_notifier doesn't actually work. Also as these dst have to wait for dest_trash_timer to clean them up. It would cause some non-permanent kernel warnings: unregister_netdevice: waiting for br0 to become free. Usage count = 3 To fix it, call ip_vs_dst_notifier earlier than ipv6_dev_notf by increasing its priority to ADDRCONF_NOTIFY_PRIORITY + 5. Note that for ipv4 route fib_netdev_notifier doesn't set dst's dev to lo in NETDEV_DOWN event, so this fix is only needed when IP_VS_IPV6 is defined. Fixes: 7a4f0761fce3 ("IPVS: init and cleanup restructuring") Reported-by: Li Shuang Signed-off-by: Xin Long Acked-by: Julian Anastasov Acked-by: Simon Horman Signed-off-by: Pablo Neira Ayuso commit 2455facbb700e3c3ca26b9255956d6ed45cb6217 Merge: 2e6e902d1850 7513edbc096a Author: Joonas Lahtinen Date: Mon Nov 26 11:19:47 2018 +0200 Merge tag 'gvt-fixes-2018-11-26' of https://github.com/intel/gvt-linux into drm-intel-fixes gvt-fixes-2018-11-26 - Fix engine check for correct MOCS regs load (Xinyun) - Fix rpm locking for vGPU ggtt init (Henry) - Fix use-after-free when destroy partial ggtt entries (Chris) Signed-off-by: Joonas Lahtinen From: Zhenyu Wang Link: https://patchwork.freedesktop.org/patch/msgid/20181126021820.GL12743@zhen-hp.sh.intel.com commit 36c3aeb4b48d5b058526d606fde14db4fd7e5e6d Merge: 2e6e902d1850 3e27c79c4b12 Author: Rafael J. Wysocki Date: Mon Nov 26 10:13:28 2018 +0100 Merge branch 'opp/fixes-for-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull operating performance points (OPP) framework fixes for 4.20-rc5 from Viresh Kumar. * 'opp/fixes-for-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: OPP: Fix parsing of multiple phandles in "operating-points-v2" property opp: ti-opp-supply: Fix platform_no_drv_owner.cocci warnings commit 0bc3544a010c1e460c99fa052991789f113d860e Author: Laurent Pinchart Date: Fri Nov 23 13:38:17 2018 +0200 drm: rcar-du: Fix DU3 start/stop on M3-N Group start/stop is controlled by the DRES and DEN bits of DSYSR0 for the first group and DSYSR2 for the second group. On most DU instances, this maps to the first CRTC of the group. On M3-N, however, DU2 doesn't exist, but DSYSR2 does. There is no CRTC object there that maps to the correct DSYSR register. Commit 9144adc5e5a9 ("drm: rcar-du: Cache DSYSR value to ensure known initial value") switched group start/stop from using group read/write access to DSYSR to a CRTC-based API to cache the DSYSR value. While doing so, it introduced a regression on M3-N by accessing DSYSR3 instead of DSYSR2 to start/stop the second group. To fix this, access the DSYSR register directly through group read/write if the SoC is missing the first DU channel of the group. Keep using the rcar_du_crtc_dsysr_clr_set() function otherwise, to retain the DSYSR caching feature. Fixes: 9144adc5e5a9 ("drm: rcar-du: Cache DSYSR value to ensure known initial value") Reported-by: Hoan Nguyen An Signed-off-by: Laurent Pinchart Acked-by: Kieran Bingham Tested-by: Simon Horman commit c4cfcf6f4297c9256b53790bacbbbd6901fef468 Author: Hui Wang Date: Mon Nov 26 14:17:16 2018 +0800 ALSA: hda/realtek - fix the pop noise on headphone for lenovo laptops We have several Lenovo laptops with the codec alc285, when playing sound via headphone, we can hear click/pop noise in the headphone, if we let the headphone share the DAC of NID 0x2 with the speaker, the noise disappears. The Lenovo laptops here include P52, P72, X1 yoda2 and X1 carbon. I have tried to set preferred_dacs and override_conn, but neither of them worked. Thanks for Kailang, he told me to invalidate the NID 0x3 through override_wcaps. BugLink: https://bugs.launchpad.net/bugs/1805079 Cc: Signed-off-by: Kailang Yang Signed-off-by: Hui Wang Signed-off-by: Takashi Iwai commit effd14f66cc1ef6701a19c5a56e39c35f4d395a5 Author: Michael Niewöhner Date: Sun Nov 25 17:57:33 2018 +0100 usb: core: quirks: add RESET_RESUME quirk for Cherry G230 Stream series Cherry G230 Stream 2.0 (G85-231) and 3.0 (G85-232) need this quirk to function correctly. This fixes a but where double pressing numlock locks up the device completely with need to replug the keyboard. Signed-off-by: Michael Niewöhner Tested-by: Michael Niewöhner Cc: stable Signed-off-by: Greg Kroah-Hartman commit a84a1bcc992f0545a51d2e120b8ca2ef20e2ea97 Author: Kai-Heng Feng Date: Fri Nov 23 08:42:19 2018 +0000 USB: usb-storage: Add new IDs to ums-realtek There are two new Realtek card readers require ums-realtek to work correctly. Add the new IDs to support them. Signed-off-by: Kai-Heng Feng Acked-by: Alan Stern Cc: stable Signed-off-by: Greg Kroah-Hartman commit 1dbcd8d42c02afe38740d26f333f76e23e830d54 Merge: 2e6e902d1850 c88520db18ba Author: Greg Kroah-Hartman Date: Mon Nov 26 08:08:01 2018 +0100 Merge tag 'phy-for-4.20-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/kishon/linux-phy into usb-linus Kishon writes: phy: for 4.20-rc *) Fix updating HSTX_TRIM tuning parameter in qcom-qusb2 PHY driver *) Fix inconsistencies between dt-bindings and the driver *) Add "Depend on HAS_IOMEM" uniphier-pcie to avoid randconfig errors Signed-off-by: Kishon Vijay Abraham I * tag 'phy-for-4.20-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/kishon/linux-phy: phy: qcom-qusb2: Fix HSTX_TRIM tuning with fused value for SDM845 phy: qcom-qusb2: Use HSTX_TRIM fused value as is dt-bindings: phy-qcom-qmp: Fix several mistakes from prior commits phy: uniphier-pcie: Depend on HAS_IOMEM commit 38317f5c0f2faae5110854f36edad810f841d62f Author: Felipe Balbi Date: Mon Nov 19 08:34:04 2018 +0200 Revert "usb: dwc3: gadget: skip Set/Clear Halt when invalid" This reverts commit ffb80fc672c3a7b6afd0cefcb1524fb99917b2f3. Turns out that commit is wrong. Host controllers are allowed to use Clear Feature HALT as means to sync data toggle between host and periperal. Cc: Signed-off-by: Felipe Balbi commit 032371a1e673275202c047537726f4216d7dbf0b Merge: 2e6e902d1850 d20810530b71 Author: Greg Kroah-Hartman Date: Mon Nov 26 08:02:51 2018 +0100 Merge tag 'fsi-updates-2018-11-26' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/linux-fsi char-misc-linus Ben writes: "Here are two very minor fixes for FSI. One from Arnd is a Kconfig fixup and has been rusting away in my tree for a while (I had forgotten about it). The other one just removes a duplicate #include, courtesy of Brajeswar Ghosh." * tag 'fsi-updates-2018-11-26' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/linux-fsi: fsi: fsi-scom.c: Remove duplicate header fsi: master-ast-cf: select GENERIC_ALLOCATOR commit 69500127424cd90ff2cf8191256b2ac3b0a4af56 Merge: aba36930a35e 1efb6ee3edea Author: David S. Miller Date: Sun Nov 25 20:04:58 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2018-11-25 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) Fix an off-by-one bug when adjusting subprog start offsets after patching, from Edward. 2) Fix several bugs such as overflow in size allocation in queue / stack map creation, from Alexei. 3) Fix wrong IPv6 destination port byte order in bpf_sk_lookup_udp helper, from Andrey. 4) Fix several bugs in bpftool such as preventing an infinite loop in get_fdinfo, error handling and man page references, from Quentin. 5) Fix a warning in bpf_trace_printk() that wasn't catching an invalid format string, from Martynas. 6) Fix a bug in BPF cgroup local storage where non-atomic allocation was used in atomic context, from Roman. 7) Fix a NULL pointer dereference bug in bpftool from reallocarray() error handling, from Jakub and Wen. 8) Add a copy of pkt_cls.h and tc_bpf.h uapi headers to the tools include infrastructure so that bpftool compiles on older RHEL7-like user space which does not ship these headers, from Yonghong. 9) Fix BPF kselftests for user space where to get ping test working with ping6 and ping -6, from Li. ==================== Signed-off-by: David S. Miller commit d20810530b7109a95abef5130e6dcec09c5180d7 Author: Brajeswar Ghosh Date: Fri Nov 16 16:17:03 2018 +0530 fsi: fsi-scom.c: Remove duplicate header Remove linux/cdev.h which is included more than once Signed-off-by: Brajeswar Ghosh Signed-off-by: Benjamin Herrenschmidt commit 64999fa7aa2c076ec6d05aee481f11f5296ceb8c Author: Arnd Bergmann Date: Tue Aug 14 00:37:18 2018 +0200 fsi: master-ast-cf: select GENERIC_ALLOCATOR In randconfig builds without CONFIG_GENERIC_ALLOCATOR, this driver fails to link: ERROR: "gen_pool_alloc_algo" [drivers/fsi/fsi-master-ast-cf.ko] undefined! ERROR: "gen_pool_fixed_alloc" [drivers/fsi/fsi-master-ast-cf.ko] undefined! ERROR: "of_gen_pool_get" [drivers/fsi/fsi-master-ast-cf.ko] undefined! ERROR: "gen_pool_free" [drivers/fsi/fsi-master-ast-cf.ko] undefined! Select the dependency as all other users do. Fixes: 6a794a27daca ("fsi: master-ast-cf: Add new FSI master using Aspeed ColdFire") Signed-off-by: Arnd Bergmann Signed-off-by: Benjamin Herrenschmidt commit 2e6e902d185027f8e3cb8b7305238f7e35d6a436 Author: Linus Torvalds Date: Sun Nov 25 14:19:31 2018 -0800 Linux 4.20-rc4 commit 78e1f386170798159a81fdbc5e131836fd808048 Author: Al Viro Date: Sun Nov 25 16:24:16 2018 -0500 iov_iter: teach csum_and_copy_to_iter() to handle pipe-backed ones Signed-off-by: Al Viro commit caf54f59e57e1652e2460d3a45dce233d44d5884 Merge: 9ff01193a20d 6c08ec1216b7 Author: Paolo Bonzini Date: Sun Nov 25 18:56:32 2018 +0100 Merge tag 'kvm-ppc-fixes-4.20-1' of https://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc into HEAD PPC KVM fixes for 4.20 This has a single 1-line patch which fixes a bug in the recently-merged nested HV KVM support. commit d6d460b89378b1bc6715574cdafd748ba59d5a27 Merge: 17c2f540863a cb216b84d6ea Author: Linus Torvalds Date: Sun Nov 25 09:24:40 2018 -0800 Merge tag 'dma-mapping-4.20-3' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping fixes from Christoph Hellwig: "Two dma-direct / swiotlb regressions fixes: - zero is a valid physical address on some arm boards, we can't use it as the error value - don't try to cache flush the error return value (no matter what it is)" * tag 'dma-mapping-4.20-3' of git://git.infradead.org/users/hch/dma-mapping: swiotlb: Skip cache maintenance on map error dma-direct: Make DIRECT_MAPPING_ERROR viable for SWIOTLB commit 17c2f540863a6c0faa3f0ede3c785d9427bcaf80 Merge: 4e962ff6e34f bb21ce0ad227 Author: Linus Torvalds Date: Sun Nov 25 09:19:58 2018 -0800 Merge tag 'nfs-for-4.20-4' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client bugfixes from Trond Myklebust: - Fix a NFSv4 state manager deadlock when returning a delegation - NFSv4.2 copy do not allocate memory under the lock - flexfiles: Use the correct stateid for IO in the tightly coupled case * tag 'nfs-for-4.20-4' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: flexfiles: use per-mirror specified stateid for IO NFSv4.2 copy do not allocate memory under the lock NFSv4: Fix a NFSv4 state manager deadlock commit 4e962ff6e34f44c400c548da0c1e2393053a691e Author: Luc Van Oostenryck Date: Sun Nov 25 17:34:05 2018 +0100 MAINTAINERS: change Sparse's maintainer I'm taking over the maintainance of Sparse so add myself as maintainer and move Christopher's info to CREDITS. Signed-off-by: Luc Van Oostenryck Signed-off-by: Linus Torvalds commit e2125dac22f2c9c66c412cd8e049a7305af59f73 Merge: e195ca6cb6f2 fffc9a260e38 Author: Linus Torvalds Date: Sat Nov 24 18:44:01 2018 -0800 Merge tag 'xarray-4.20-rc4' of git://git.infradead.org/users/willy/linux-dax Pull XArray updates from Matthew Wilcox: "We found some bugs in the DAX conversion to XArray (and one bug which predated the XArray conversion). There were a couple of bugs in some of the higher-level functions, which aren't actually being called in today's kernel, but surfaced as a result of converting existing radix tree & IDR users over to the XArray. Some of the other changes to how the higher-level APIs work were also motivated by converting various users; again, they're not in use in today's kernel, so changing them has a low probability of introducing a bug. Dan can still trigger a bug in the DAX code with hot-offline/online, and we're working on tracking that down" * tag 'xarray-4.20-rc4' of git://git.infradead.org/users/willy/linux-dax: XArray tests: Add missing locking dax: Avoid losing wakeup in dax_lock_mapping_entry dax: Fix huge page faults dax: Fix dax_unlock_mapping_entry for PMD pages dax: Reinstate RCU protection of inode dax: Make sure the unlocking entry isn't locked dax: Remove optimisation from dax_lock_mapping_entry XArray tests: Correct some 64-bit assumptions XArray: Correct xa_store_range XArray: Fix Documentation XArray: Handle NULL pointers differently for allocation XArray: Unify xa_store and __xa_store XArray: Add xa_store_bh() and xa_store_irq() XArray: Turn xa_erase into an exported function XArray: Unify xa_cmpxchg and __xa_cmpxchg XArray: Regularise xa_reserve nilfs2: Use xa_erase_irq XArray: Export __xa_foo to non-GPL modules XArray: Fix xa_for_each with a single element at 0 commit aba36930a35e7f1fe1319b203f25c05d6c119936 Author: Willem de Bruijn Date: Sat Nov 24 14:21:16 2018 -0500 net: always initialize pagedlen In ip packet generation, pagedlen is initialized for each skb at the start of the loop in __ip(6)_append_data, before label alloc_new_skb. Depending on compiler options, code can be generated that jumps to this label, triggering use of an an uninitialized variable. In practice, at -O2, the generated code moves the initialization below the label. But the code should not rely on that for correctness. Fixes: 15e36f5b8e98 ("udp: paged allocation with gso") Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller commit 9efdda4e3abed13f0903b7b6e4d4c2102019440a Author: Eric Dumazet Date: Sat Nov 24 09:12:24 2018 -0800 tcp: address problems caused by EDT misshaps When a qdisc setup including pacing FQ is dismantled and recreated, some TCP packets are sent earlier than instructed by TCP stack. TCP can be fooled when ACK comes back, because the following operation can return a negative value. tcp_time_stamp(tp) - tp->rx_opt.rcv_tsecr; Some paths in TCP stack were not dealing properly with this, this patch addresses four of them. Fixes: ab408b6dc744 ("tcp: switch tcp and sch_fq to new earliest departure time model") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit e195ca6cb6f21633e56322d5aa11ed59cdb22fb2 Merge: d146194f31c9 ffe0e7cf290f Author: Linus Torvalds Date: Sat Nov 24 12:58:47 2018 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - revert of the high-resolution scrolling feature, as it breaks certain hardware due to incompatibilities between Logitech and Microsoft worlds. Peter Hutterer is working on a fixed implementation. Until that is finished, revert by Benjamin Tissoires. - revert of incorrect strncpy->strlcpy conversion in uhid, from David Herrmann - fix for buggy sendfile() implementation on uhid device node, from Eric Biggers - a few assorted device-ID specific quirks * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: Revert "Input: Add the `REL_WHEEL_HI_RES` event code" Revert "HID: input: Create a utility class for counting scroll events" Revert "HID: logitech: Add function to enable HID++ 1.0 "scrolling acceleration"" Revert "HID: logitech: Enable high-resolution scrolling on Logitech mice" Revert "HID: logitech: Use LDJ_DEVICE macro for existing Logitech mice" Revert "HID: logitech: fix a used uninitialized GCC warning" Revert "HID: input: simplify/fix high-res scroll event handling" HID: Add quirk for Primax PIXART OEM mice HID: i2c-hid: Disable runtime PM for LG touchscreen HID: multitouch: Add pointstick support for Cirque Touchpad HID: steam: remove input device when a hid client is running. Revert "HID: uhid: use strlcpy() instead of strncpy()" HID: uhid: forbid UHID_CREATE under KERNEL_DS or elevated privileges HID: input: Ignore battery reported by Symbol DS4308 HID: Add quirk for Microsoft PIXART OEM mouse commit e1a7bfe3807974e66f971f2589d4e0197ec0fced Author: Takashi Iwai Date: Thu Nov 22 14:36:17 2018 +0100 ALSA: control: Fix race between adding and removing a user element The procedure for adding a user control element has some window opened for race against the concurrent removal of a user element. This was caught by syzkaller, hitting a KASAN use-after-free error. This patch addresses the bug by wrapping the whole procedure to add a user control element with the card->controls_rwsem, instead of only around the increment of card->user_ctl_count. This required a slight code refactoring, too. The function snd_ctl_add() is split to two parts: a core function to add the control element and a part calling it. The former is called from the function for adding a user control element inside the controls_rwsem. One change to be noted is that snd_ctl_notify() for adding a control element gets called inside the controls_rwsem as well while it was called outside the rwsem. But this should be OK, as snd_ctl_notify() takes another (finer) rwlock instead of rwsem, and the call of snd_ctl_notify() inside rwsem is already done in another code path. Reported-by: syzbot+dc09047bce3820621ba2@syzkaller.appspotmail.com Cc: Signed-off-by: Takashi Iwai commit 9a20332ab373b1f8f947e0a9c923652b32dab031 Author: Takashi Iwai Date: Fri Nov 23 18:18:30 2018 +0100 ALSA: sparc: Fix invalid snd_free_pages() at error path Some spurious calls of snd_free_pages() have been overlooked and remain in the error paths of sparc cs4231 driver code. Since runtime->dma_area is managed by the PCM core helper, we shouldn't release manually. Drop the superfluous calls. Reviewed-by: Takashi Sakamoto Cc: Signed-off-by: Takashi Iwai commit 7b69154171b407844c273ab4c10b5f0ddcd6aa29 Author: Takashi Iwai Date: Fri Nov 23 18:16:33 2018 +0100 ALSA: wss: Fix invalid snd_free_pages() at error path Some spurious calls of snd_free_pages() have been overlooked and remain in the error paths of wss driver code. Since runtime->dma_area is managed by the PCM core helper, we shouldn't release manually. Drop the superfluous calls. Reviewed-by: Takashi Sakamoto Cc: Signed-off-by: Takashi Iwai commit d146194f31c96f9b260c5a1cf1592d2e7f82a2e2 Merge: 857fa628bbe9 4f9f49646a57 Author: Linus Torvalds Date: Sat Nov 24 09:42:32 2018 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas:: - Fix wrong conflict resolution around CONFIG_ARM64_SSBD - Fix sparse warning on unsigned long constant * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: cpufeature: Fix mismerge of CONFIG_ARM64_SSBD block arm64: sysreg: fix sparse warnings commit 857fa628bbe93017c72ddd0d5304962a2608db07 Merge: abe72ff41340 07093b764769 Author: Linus Torvalds Date: Sat Nov 24 09:19:38 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Need to take mutex in ath9k_add_interface(), from Dan Carpenter. 2) Fix mt76 build without CONFIG_LEDS_CLASS, from Arnd Bergmann. 3) Fix socket wmem accounting in SCTP, from Xin Long. 4) Fix failed resume crash in ena driver, from Arthur Kiyanovski. 5) qed driver passes bytes instead of bits into second arg of bitmap_weight(). From Denis Bolotin. 6) Fix reset deadlock in ibmvnic, from Juliet Kim. 7) skb_scrube_packet() needs to scrub the fwd marks too, from Petr Machata. 8) Make sure older TCP stacks see enough dup ACKs, and avoid doing SACK compression during this period, from Eric Dumazet. 9) Add atomicity to SMC protocol cursor handling, from Ursula Braun. 10) Don't leave dangling error pointer if bpf_prog_add() fails in thunderx driver, from Lorenzo Bianconi. Also, when we unmap TSO headers, set sq->tso_hdrs to NULL. 11) Fix race condition over state variables in act_police, from Davide Caratti. 12) Disable guest csum in the presence of XDP in virtio_net, from Jason Wang. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (64 commits) net: gemini: Fix copy/paste error net: phy: mscc: fix deadlock in vsc85xx_default_config dt-bindings: dsa: Fix typo in "probed" net: thunderx: set tso_hdrs pointer to NULL in nicvf_free_snd_queue net: amd: add missing of_node_put() team: no need to do team_notify_peers or team_mcast_rejoin when disabling port virtio-net: fail XDP set if guest csum is negotiated virtio-net: disable guest csum during XDP set net/sched: act_police: add missing spinlock initialization net: don't keep lonely packets forever in the gro hash net/ipv6: re-do dad when interface has IFF_NOARP flag change packet: copy user buffers before orphan or clone ibmvnic: Update driver queues after change in ring size support ibmvnic: Fix RX queue buffer cleanup net: thunderx: set xdp_prog to NULL if bpf_prog_add fails net/dim: Update DIM start sample after each DIM iteration net: faraday: ftmac100: remove netif_running(netdev) check before disabling interrupts net/smc: use after free fix in smc_wr_tx_put_slot() net/smc: atomic SMCD cursor handling net/smc: add SMC-D shutdown signal ... commit abe72ff4134028ff2189d29629c40a40bee0a989 Merge: 7c98a4261827 8c110d43c6bc Author: Linus Torvalds Date: Sat Nov 24 09:11:52 2018 -0800 Merge tag 'xfs-4.20-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Darrick Wong: "Dave and I have continued our work fixing corruption problems that can be found when running long-term burn-in exercisers on xfs. Here are some patches fixing most of the problems, but there will likely be more. :/ - Numerous corruption fixes for copy on write - Numerous corruption fixes for blocksize < pagesize writes - Don't miscalculate AG reservations for small final AGs - Fix page cache truncation to work properly for reflink and extent shifting - Fix use-after-free when retrying failed inode/dquot buffer logging - Fix corruptions seen when using copy_file_range in directio mode" * tag 'xfs-4.20-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: iomap: readpages doesn't zero page tail beyond EOF vfs: vfs_dedupe_file_range() doesn't return EOPNOTSUPP iomap: dio data corruption and spurious errors when pipes fill iomap: sub-block dio needs to zeroout beyond EOF iomap: FUA is wrong for DIO O_DSYNC writes into unwritten extents xfs: delalloc -> unwritten COW fork allocation can go wrong xfs: flush removing page cache in xfs_reflink_remap_prep xfs: extent shifting doesn't fully invalidate page cache xfs: finobt AG reserves don't consider last AG can be a runt xfs: fix transient reference count error in xfs_buf_resubmit_failed_buffers xfs: uncached buffer tracing needs to print bno xfs: make xfs_file_remap_range() static xfs: fix shared extent data corruption due to missing cow reservation commit 07093b76476903f820d83d56c3040e656fb4d9e3 Author: Andreas Fiedler Date: Sat Nov 24 00:16:34 2018 +0100 net: gemini: Fix copy/paste error The TX stats should be started with the tx_stats_syncp, there seems to be a copy/paste error in the driver. Signed-off-by: Andreas Fiedler Signed-off-by: Linus Walleij Signed-off-by: David S. Miller commit 3fa528b7682e73e906266bcd43728b8f923bf9b2 Author: Quentin Schulz Date: Fri Nov 23 19:01:51 2018 +0100 net: phy: mscc: fix deadlock in vsc85xx_default_config The vsc85xx_default_config function called in the vsc85xx_config_init function which is used by VSC8530, VSC8531, VSC8540 and VSC8541 PHYs mistakenly calls phy_read and phy_write in-between phy_select_page and phy_restore_page. phy_select_page and phy_restore_page actually take and release the MDIO bus lock and phy_write and phy_read take and release the lock to write or read to a PHY register. Let's fix this deadlock by using phy_modify_paged which handles correctly a read followed by a write in a non-standard page. Fixes: 6a0bfbbe20b0 ("net: phy: mscc: migrate to phy_select/restore_page functions") Signed-off-by: Quentin Schulz Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit e7b9fb4f545b1f7885e7c642643828f93d3d79c9 Author: Fabio Estevam Date: Fri Nov 23 15:46:50 2018 -0200 dt-bindings: dsa: Fix typo in "probed" The correct form is "can be probed", so fix the typo. Signed-off-by: Fabio Estevam Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit ef2a7cf1d8831535b8991459567b385661eb4a36 Author: Lorenzo Bianconi Date: Fri Nov 23 18:28:01 2018 +0100 net: thunderx: set tso_hdrs pointer to NULL in nicvf_free_snd_queue Reset snd_queue tso_hdrs pointer to NULL in nicvf_free_snd_queue routine since it is used to check if tso dma descriptor queue has been previously allocated. The issue can be triggered with the following reproducer: $ip link set dev enP2p1s0v0 xdpdrv obj xdp_dummy.o $ip link set dev enP2p1s0v0 xdpdrv off [ 341.467649] WARNING: CPU: 74 PID: 2158 at mm/vmalloc.c:1511 __vunmap+0x98/0xe0 [ 341.515010] Hardware name: GIGABYTE H270-T70/MT70-HD0, BIOS T49 02/02/2018 [ 341.521874] pstate: 60400005 (nZCv daif +PAN -UAO) [ 341.526654] pc : __vunmap+0x98/0xe0 [ 341.530132] lr : __vunmap+0x98/0xe0 [ 341.533609] sp : ffff00001c5db860 [ 341.536913] x29: ffff00001c5db860 x28: 0000000000020000 [ 341.542214] x27: ffff810feb5090b0 x26: ffff000017e57000 [ 341.547515] x25: 0000000000000000 x24: 00000000fbd00000 [ 341.552816] x23: 0000000000000000 x22: ffff810feb5090b0 [ 341.558117] x21: 0000000000000000 x20: 0000000000000000 [ 341.563418] x19: ffff000017e57000 x18: 0000000000000000 [ 341.568719] x17: 0000000000000000 x16: 0000000000000000 [ 341.574020] x15: 0000000000000010 x14: ffffffffffffffff [ 341.579321] x13: ffff00008985eb27 x12: ffff00000985eb2f [ 341.584622] x11: ffff0000096b3000 x10: ffff00001c5db510 [ 341.589923] x9 : 00000000ffffffd0 x8 : ffff0000086868e8 [ 341.595224] x7 : 3430303030303030 x6 : 00000000000006ef [ 341.600525] x5 : 00000000003fffff x4 : 0000000000000000 [ 341.605825] x3 : 0000000000000000 x2 : ffffffffffffffff [ 341.611126] x1 : ffff0000096b3728 x0 : 0000000000000038 [ 341.616428] Call trace: [ 341.618866] __vunmap+0x98/0xe0 [ 341.621997] vunmap+0x3c/0x50 [ 341.624961] arch_dma_free+0x68/0xa0 [ 341.628534] dma_direct_free+0x50/0x80 [ 341.632285] nicvf_free_resources+0x160/0x2d8 [nicvf] [ 341.637327] nicvf_config_data_transfer+0x174/0x5e8 [nicvf] [ 341.642890] nicvf_stop+0x298/0x340 [nicvf] [ 341.647066] __dev_close_many+0x9c/0x108 [ 341.650977] dev_close_many+0xa4/0x158 [ 341.654720] rollback_registered_many+0x140/0x530 [ 341.659414] rollback_registered+0x54/0x80 [ 341.663499] unregister_netdevice_queue+0x9c/0xe8 [ 341.668192] unregister_netdev+0x28/0x38 [ 341.672106] nicvf_remove+0xa4/0xa8 [nicvf] [ 341.676280] nicvf_shutdown+0x20/0x30 [nicvf] [ 341.680630] pci_device_shutdown+0x44/0x88 [ 341.684720] device_shutdown+0x144/0x250 [ 341.688640] kernel_restart_prepare+0x44/0x50 [ 341.692986] kernel_restart+0x20/0x68 [ 341.696638] __se_sys_reboot+0x210/0x238 [ 341.700550] __arm64_sys_reboot+0x24/0x30 [ 341.704555] el0_svc_handler+0x94/0x110 [ 341.708382] el0_svc+0x8/0xc [ 341.711252] ---[ end trace 3f4019c8439959c9 ]--- [ 341.715874] page:ffff7e0003ef4000 count:0 mapcount:0 mapping:0000000000000000 index:0x4 [ 341.723872] flags: 0x1fffe000000000() [ 341.727527] raw: 001fffe000000000 ffff7e0003f1a008 ffff7e0003ef4048 0000000000000000 [ 341.735263] raw: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000 [ 341.742994] page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0) where xdp_dummy.c is a simple bpf program that forwards the incoming frames to the network stack (available here: https://github.com/altoor/xdp_walkthrough_examples/blob/master/sample_1/xdp_dummy.c) Fixes: 05c773f52b96 ("net: thunderx: Add basic XDP support") Fixes: 4863dea3fab0 ("net: Adding support for Cavium ThunderX network controller") Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit c44c749d3b6fdfca39002e7e48e03fe9f9fe37a3 Author: Yangtao Li Date: Thu Nov 22 07:34:41 2018 -0500 net: amd: add missing of_node_put() of_find_node_by_path() acquires a reference to the node returned by it and that reference needs to be dropped by its caller. This place doesn't do that, so fix it. Signed-off-by: Yangtao Li Signed-off-by: David S. Miller commit 5ed9dc99107144f83b6c1bb52a69b58875baf540 Author: Hangbin Liu Date: Thu Nov 22 16:15:28 2018 +0800 team: no need to do team_notify_peers or team_mcast_rejoin when disabling port team_notify_peers() will send ARP and NA to notify peers. team_mcast_rejoin() will send multicast join group message to notify peers. We should do this when enabling/changed to a new port. But it doesn't make sense to do it when a port is disabled. On the other hand, when we set mcast_rejoin_count to 2, and do a failover, team_port_disable() will increase mcast_rejoin.count_pending to 2 and then team_port_enable() will increase mcast_rejoin.count_pending to 4. We will send 4 mcast rejoin messages at latest, which will make user confused. The same with notify_peers.count. Fix it by deleting team_notify_peers() and team_mcast_rejoin() in team_port_disable(). Reported-by: Liang Li Fixes: fc423ff00df3a ("team: add peer notification") Fixes: 492b200efdd20 ("team: add support for sending multicast rejoins") Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit 1efb6ee3edea57f57f9fb05dba8dcb3f7333f61f Author: Martynas Pumputis Date: Fri Nov 23 17:43:26 2018 +0100 bpf: fix check of allowed specifiers in bpf_trace_printk A format string consisting of "%p" or "%s" followed by an invalid specifier (e.g. "%p%\n" or "%s%") could pass the check which would make format_decode (lib/vsprintf.c) to warn. Fixes: 9c959c863f82 ("tracing: Allow BPF programs to call bpf_trace_printk()") Reported-by: syzbot+1ec5c5ec949c4adaa0c4@syzkaller.appspotmail.com Signed-off-by: Martynas Pumputis Signed-off-by: Daniel Borkmann commit ca088320a02537f36c243ac21794525d8eabb3bd Author: Yixian Liu Date: Fri Nov 23 15:46:07 2018 +0800 RDMA/hns: Bugfix pbl configuration for rereg mr Current hns driver assigned the first two PBL page addresses from previous registered MR to the hardware when reregister MR changing the memory locations occurred. This will lead to PBL addressing error as the PBL has already been released. This patch fixes this wrong assignment by using the page address from new allocated PBL. Fixes: a2c80b7b4119 ("RDMA/hns: Add rereg mr support for hip08") Signed-off-by: Yixian Liu Signed-off-by: Jason Gunthorpe commit 18ba58e1c234ea1a2d9835ac8c1735d965ce4640 Author: Jason Wang Date: Thu Nov 22 14:36:31 2018 +0800 virtio-net: fail XDP set if guest csum is negotiated We don't support partial csumed packet since its metadata will be lost or incorrect during XDP processing. So fail the XDP set if guest_csum feature is negotiated. Fixes: f600b6905015 ("virtio_net: Add XDP support") Reported-by: Jesper Dangaard Brouer Cc: Jesper Dangaard Brouer Cc: Pavel Popa Cc: David Ahern Signed-off-by: Jason Wang Signed-off-by: David S. Miller commit e59ff2c49ae16e1d179de679aca81405829aee6c Author: Jason Wang Date: Thu Nov 22 14:36:30 2018 +0800 virtio-net: disable guest csum during XDP set We don't disable VIRTIO_NET_F_GUEST_CSUM if XDP was set. This means we can receive partial csumed packets with metadata kept in the vnet_hdr. This may have several side effects: - It could be overridden by header adjustment, thus is might be not correct after XDP processing. - There's no way to pass such metadata information through XDP_REDIRECT to another driver. - XDP does not support checksum offload right now. So simply disable guest csum if possible in this the case of XDP. Fixes: 3f93522ffab2d ("virtio-net: switch off offloads on demand if possible on XDP set") Reported-by: Jesper Dangaard Brouer Cc: Jesper Dangaard Brouer Cc: Pavel Popa Cc: David Ahern Signed-off-by: Jason Wang Signed-off-by: David S. Miller commit 7c98a42618271210c60b79128b220107d35938d9 Merge: 3381918fec92 7e241f647dc7 Author: Linus Torvalds Date: Fri Nov 23 11:24:55 2018 -0800 Merge tag 'ceph-for-4.20-rc4' of https://github.com/ceph/ceph-client Pullk ceph fix from Ilya Dryomov: "A messenger fix, marked for stable" * tag 'ceph-for-4.20-rc4' of https://github.com/ceph/ceph-client: libceph: fall back to sendmsg for slab pages commit 3381918fec9278d14f776d1dabd68da85fd6822e Merge: d88783b9c884 14b04063cc99 Author: Linus Torvalds Date: Fri Nov 23 11:20:14 2018 -0800 Merge tag 'for-linus-20181123' of git://git.kernel.dk/linux-block Pull block fix from Jens Axboe: "Just a single fix for this week, fixing an issue with nvme-fc" * tag 'for-linus-20181123' of git://git.kernel.dk/linux-block: nvme-fc: resolve io failures during connect commit 484afd1bd3fc6f9f5347289fc8b285aa65f67054 Author: Davide Caratti Date: Wed Nov 21 18:23:53 2018 +0100 net/sched: act_police: add missing spinlock initialization commit f2cbd4852820 ("net/sched: act_police: fix race condition on state variables") introduces a new spinlock, but forgets its initialization. Ensure that tcf_police_init() initializes 'tcfp_lock' every time a 'police' action is newly created, to avoid the following lockdep splat: INFO: trying to register non-static key. the code is fine but needs lockdep annotation. turning off the locking correctness validator. <...> Call Trace: dump_stack+0x85/0xcb register_lock_class+0x581/0x590 __lock_acquire+0xd4/0x1330 ? tcf_police_init+0x2fa/0x650 [act_police] ? lock_acquire+0x9e/0x1a0 lock_acquire+0x9e/0x1a0 ? tcf_police_init+0x2fa/0x650 [act_police] ? tcf_police_init+0x55a/0x650 [act_police] _raw_spin_lock_bh+0x34/0x40 ? tcf_police_init+0x2fa/0x650 [act_police] tcf_police_init+0x2fa/0x650 [act_police] tcf_action_init_1+0x384/0x4c0 tcf_action_init+0xf6/0x160 tcf_action_add+0x73/0x170 tc_ctl_action+0x122/0x160 rtnetlink_rcv_msg+0x2a4/0x490 ? netlink_deliver_tap+0x99/0x400 ? validate_linkmsg+0x370/0x370 netlink_rcv_skb+0x4d/0x130 netlink_unicast+0x196/0x230 netlink_sendmsg+0x2e5/0x3e0 sock_sendmsg+0x36/0x40 ___sys_sendmsg+0x280/0x2f0 ? _raw_spin_unlock+0x24/0x30 ? handle_pte_fault+0xafe/0xf30 ? find_held_lock+0x2d/0x90 ? syscall_trace_enter+0x1df/0x360 ? __sys_sendmsg+0x5e/0xa0 __sys_sendmsg+0x5e/0xa0 do_syscall_64+0x60/0x210 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f1841c7cf10 Code: c3 48 8b 05 82 6f 2c 00 f7 db 64 89 18 48 83 cb ff eb dd 0f 1f 80 00 00 00 00 83 3d 8d d0 2c 00 00 75 10 b8 2e 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 ae cc 00 00 48 89 04 24 RSP: 002b:00007ffcf9df4d68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f1841c7cf10 RDX: 0000000000000000 RSI: 00007ffcf9df4dc0 RDI: 0000000000000003 RBP: 000000005bf56105 R08: 0000000000000002 R09: 00007ffcf9df8edc R10: 00007ffcf9df47e0 R11: 0000000000000246 R12: 0000000000671be0 R13: 00007ffcf9df4e84 R14: 0000000000000008 R15: 0000000000000000 Fixes: f2cbd4852820 ("net/sched: act_police: fix race condition on state variables") Reported-by: Cong Wang Signed-off-by: Davide Caratti Acked-by: Cong Wang Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 605108acfe6233b72e2f803aa1cb59a2af3001ca Author: Paolo Abeni Date: Wed Nov 21 18:21:35 2018 +0100 net: don't keep lonely packets forever in the gro hash Eric noted that with UDP GRO and NAPI timeout, we could keep a single UDP packet inside the GRO hash forever, if the related NAPI instance calls napi_gro_complete() at an higher frequency than the NAPI timeout. Willem noted that even TCP packets could be trapped there, till the next retransmission. This patch tries to address the issue, flushing the old packets - those with a NAPI_GRO_CB age before the current jiffy - before scheduling the NAPI timeout. The rationale is that such a timeout should be well below a jiffy and we are not flushing packets eligible for sane GRO. v1 -> v2: - clarified the commit message and comment RFC -> v1: - added 'Fixes tags', cleaned-up the wording. Reported-by: Eric Dumazet Fixes: 3b47d30396ba ("net: gro: add a per device gro flush timer") Signed-off-by: Paolo Abeni Acked-by: Willem de Bruijn Acked-by: Eric Dumazet Signed-off-by: David S. Miller commit 896585d48e8e9ba44cd1754fbce8537feffcc1a5 Author: Hangbin Liu Date: Wed Nov 21 21:52:33 2018 +0800 net/ipv6: re-do dad when interface has IFF_NOARP flag change When we add a new IPv6 address, we should also join corresponding solicited-node multicast address, unless the interface has IFF_NOARP flag, as function addrconf_join_solict() did. But if we remove IFF_NOARP flag later, we do not do dad and add the mcast address. So we will drop corresponding neighbour discovery message that came from other nodes. A typical example is after creating a ipvlan with mode l3, setting up an ipv6 address and changing the mode to l2. Then we will not be able to ping this address as the interface doesn't join related solicited-node mcast address. Fix it by re-doing dad when interface changed IFF_NOARP flag. Then we will add corresponding mcast group and check if there is a duplicate address on the network. Reported-by: Jianlin Shi Reviewed-by: Stefano Brivio Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit d88783b9c8849d88c3a75b7b9071cba072b47eba Merge: a03bac580ae7 829383e18372 Author: Linus Torvalds Date: Fri Nov 23 11:15:27 2018 -0800 Merge tag 'iommu-fixes-v4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull IOMMU fixes from Joerg Roedel: - Two fixes for the Intel VT-d driver to fix a NULL-ptr dereference and an unbalance in an allocate/free path (allocated with memremap, freed with iounmap) - Fix for a crash in the Renesas IOMMU driver - Fix for the Advanced Virtual Interrupt Controler (AVIC) code in the AMD IOMMU driver * tag 'iommu-fixes-v4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/vt-d: Use memunmap to free memremap amd/iommu: Fix Guest Virtual APIC Log Tail Address Register iommu/ipmmu-vmsa: Fix crash on early domain free iommu/vt-d: Fix NULL pointer dereference in prq_event_thread() commit 5cd8d46ea1562be80063f53c7c6a5f40224de623 Author: Willem de Bruijn Date: Tue Nov 20 13:00:18 2018 -0500 packet: copy user buffers before orphan or clone tpacket_snd sends packets with user pages linked into skb frags. It notifies that pages can be reused when the skb is released by setting skb->destructor to tpacket_destruct_skb. This can cause data corruption if the skb is orphaned (e.g., on transmit through veth) or cloned (e.g., on mirror to another psock). Create a kernel-private copy of data in these cases, same as tun/tap zerocopy transmission. Reuse that infrastructure: mark the skb as SKBTX_ZEROCOPY_FRAG, which will trigger copy in skb_orphan_frags(_rx). Unlike other zerocopy packets, do not set shinfo destructor_arg to struct ubuf_info. tpacket_destruct_skb already uses that ptr to notify when the original skb is released and a timestamp is recorded. Do not change this timestamp behavior. The ubuf_info->callback is not needed anyway, as no zerocopy notification is expected. Mark destructor_arg as not-a-uarg by setting the lower bit to 1. The resulting value is not a valid ubuf_info pointer, nor a valid tpacket_snd frame address. Add skb_zcopy_.._nouarg helpers for this. The fix relies on features introduced in commit 52267790ef52 ("sock: add MSG_ZEROCOPY"), so can be backported as is only to 4.14. Tested with from `./in_netns.sh ./txring_overwrite` from http://github.com/wdebruij/kerneltools/tests Fixes: 69e3c75f4d54 ("net: TX_RING and packet mmap") Reported-by: Anand H. Krishnan Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller commit a03bac580ae743d5900af626ac63f7f8cd85def9 Merge: b88af9948724 2bbb5fa37475 Author: Linus Torvalds Date: Fri Nov 23 10:56:16 2018 -0800 Merge tag 'acpi-4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Prevent the ACPI core from registering a platform device for the SMB0001 HID to avoid IRQ allocation issues (Hans de Goede)" * tag 'acpi-4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI / platform: Add SMB0001 HID to forbidden_id_list commit b88af994872418f0a98db6f4a9bae849315a99b0 Merge: e6005d3c4233 1d50088ca395 Author: Linus Torvalds Date: Fri Nov 23 10:52:57 2018 -0800 Merge tag 'pm-4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix two issues in the Operating Performance Points (OPP) framework, one cpufreq driver issue, one problem related to the tasks freezer and a few build-related issues in the cpupower utility. Specifics: - Fix tasks freezer deadlock in de_thread() that occurs if one of its sub-threads has been frozen already (Chanho Min). - Avoid registering a platform device by the ti-cpufreq driver on platforms that cannot use it (Dave Gerlach). - Fix a mistake in the ti-opp-supply operating performance points (OPP) driver that caused an incorrect reference voltage to be used and make it adjust the minimum voltage dynamically to avoid hangs or crashes in some cases (Keerthy). - Fix issues related to compiler flags in the cpupower utility and correct a linking problem in it by renaming a file with a duplicate name (Jiri Olsa, Konstantin Khlebnikov)" * tag 'pm-4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: exec: make de_thread() freezable cpufreq: ti-cpufreq: Only register platform_device when supported opp: ti-opp-supply: Correct the supply in _get_optimal_vdd_voltage call opp: ti-opp-supply: Dynamically update u_volt_min tools cpupower: Override CFLAGS assignments tools cpupower debug: Allow to use outside build flags tools/power/cpupower: fix compilation with STATIC=true commit 4f9f49646a5733c0c2bd49940673dde89a9c5add Author: Will Deacon Date: Wed Nov 21 15:07:00 2018 +0000 arm64: cpufeature: Fix mismerge of CONFIG_ARM64_SSBD block When merging support for SSBD and the CRC32 instructions, the conflict resolution for the new capability entries in arm64_features[] inadvertedly predicated the availability of the CRC32 instructions on CONFIG_ARM64_SSBD, despite the functionality being entirely unrelated. Move the #ifdef CONFIG_ARM64_SSBD down so that it only covers the SSBD capability. Signed-off-by: Will Deacon Signed-off-by: Catalin Marinas commit e6005d3c42336074de3745718ac85807dd6e1e6a Merge: dcd3aa31dcdd 10547d956d59 Author: Linus Torvalds Date: Fri Nov 23 10:40:19 2018 -0800 Merge tag 'gpio-v4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fixes from Linus Walleij: "Minor stuff except the IDA leak which was kind of important to fix. Also new maintainers, yay. - Do not lose an IDA on the gpiochip register errorpath. - Fix the PXA non-pincontrol GPIO-using platforms. - Fix the direction on the mockup GPIO driver. - Add some MAINTAINERS stuff: Bartosz stepped up as GPIO co-maintainer, and Andy established an Intel git tree" * tag 'gpio-v4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: MAINTAINERS: Do maintain Intel GPIO drivers via separate tree gpio: mockup: fix indicated direction gpio: pxa: fix legacy non pinctrl aware builds again gpio: don't free unallocated ida on gpiochip_add_data_with_key() error path MAINTAINERS: add myself as co-maintainer of gpiolib commit dcd3aa31dcdd6d8eae8d4771c44aeb3b1fec995a Merge: 9b7c880c834c 5305ec6a27b2 Author: Linus Torvalds Date: Fri Nov 23 10:36:02 2018 -0800 Merge tag 'mmc-v4.20-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "MMC host: - sdhci-pci: Fixup card detect lookup - sdhci-pci: Workaround GLK firmware bug for tuning" * tag 'mmc-v4.20-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci-pci: Workaround GLK firmware failing to restore the tuning value mmc: sdhci-pci: Try "cd" for card-detect lookup before using NULL commit 9b7c880c834c0a1c80a1dc6b8a0b19155361321f Merge: edeca3a769ad 98c9cdfd34fb Author: Linus Torvalds Date: Fri Nov 23 10:03:08 2018 -0800 Merge tag 'drm-fixes-2018-11-23' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Regular drm fixes: amdgpu: - Vega20 fixes - firmware loading fix - panel display fix - override fix i915: - Sandybridge lockup fix - fastboot DSI panel fix - GPU hang on Broxton - GPU reloc fixes on pineview/bearlake ast: - screen blurring fix - cursor appearance fix udmabuf: - mmap fix vc4: - NULL deref fix - async cursor update fix All seems pretty normal at this stage" * tag 'drm-fixes-2018-11-23' of git://anongit.freedesktop.org/drm/drm: drm/ast: fixed cursor may disappear sometimes drm/ast: change resolution may cause screen blurred drm/i915: Add rotation readout for plane initial config drm/i915: Force a LUT update in intel_initial_commit() drm/fb-helper: Blacklist writeback when adding connectors to fbdev drm/i915: Write GPU relocs harder with gen3 drm/amdgpu: Enable HDP memory light sleep drm/i915: Prevent machine hang from Broxton's vtd w/a and error capture drm/amd/pp: handle negative values when reading OD drm/amdgpu: Add missing firmware entry for HAINAN drm/amd/powerplay: disable Vega20 DS related features drm/amdgpu: Fix oops when pp_funcs->switch_power_profile is unset drm/i915: Disable LP3 watermarks on all SNB machines drm/ast: Remove existing framebuffers before loading driver udmabuf: set read/write flag when exporting drm/amd/display: Support amdgpu "max bpc" connector property (v2) drm/amdgpu: Add amdgpu "max bpc" connector property (v2) drm/vc4: Set ->legacy_cursor_update to false when doing non-async updates drm/vc4: Fix NULL pointer dereference in the async update path commit b5d9a07ef7736b2456b9d3c90568de25e43d8ec3 Author: Sergey Matyukevich Date: Fri Nov 16 21:21:30 2018 +0300 arm64: sysreg: fix sparse warnings Specify correct type for the constants to avoid the following sparse complaints: ./arch/arm64/include/asm/sysreg.h:471:42: warning: constant 0xffffffffffffffff is so big it is unsigned long ./arch/arm64/include/asm/sysreg.h:512:42: warning: constant 0xffffffffffffffff is so big it is unsigned long Acked-by: Will Deacon Acked-by: Olof Johansson Acked-by: Luc Van Oostenryck Signed-off-by: Sergey Matyukevich Signed-off-by: Catalin Marinas commit 8cd65271f8e545ddeed10ecc2e417936bdff168e Author: Anisse Astier Date: Fri Nov 23 17:59:11 2018 +0100 ALSA: hda/realtek - fix headset mic detection for MSI MS-B171 MSI Cubi N 8GL (MS-B171) needs the same fixup as its older model, the MS-B120, in order for the headset mic to be properly detected. They both use a single 3-way jack for both mic and headset with an ALC283 codec, with the same pins used. Cc: stable@vger.kernel.org Signed-off-by: Anisse Astier Signed-off-by: Takashi Iwai commit 39070a98d668db8fbaa2a6a6752f732cbcbb14b1 Author: Hans de Goede Date: Thu Nov 22 12:38:12 2018 +0100 ALSA: hda: Add ASRock N68C-S UCC the power_save blacklist Power-saving is causing plops on audio start/stop on the built-in audio of the nForce 430 based ASRock N68C-S UCC motherboard, add this model to the power_save blacklist. BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1525104 Cc: Signed-off-by: Hans de Goede Signed-off-by: Takashi Iwai commit 7194eda1ba0872d917faf3b322540b4f57f11ba5 Author: Takashi Iwai Date: Fri Nov 23 15:44:00 2018 +0100 ALSA: ac97: Fix incorrect bit shift at AC97-SPSA control write The function snd_ac97_put_spsa() gets the bit shift value from the associated private_value, but it extracts too much; the current code extracts 8 bit values in bits 8-15, but this is a combination of two nibbles (bits 8-11 and bits 12-15) for left and right shifts. Due to the incorrect bits extraction, the actual shift may go beyond the 32bit value, as spotted recently by UBSAN check: UBSAN: Undefined behaviour in sound/pci/ac97/ac97_codec.c:836:7 shift exponent 68 is too large for 32-bit type 'int' This patch fixes the shift value extraction by masking the properly with 0x0f instead of 0xff. Reported-and-tested-by: Meelis Roos Cc: Signed-off-by: Takashi Iwai commit 2084ac6c505a58f7efdec13eba633c6aaa085ca5 Author: Pan Bian Date: Fri Nov 23 15:56:33 2018 +0800 exportfs: do not read dentry after free The function dentry_connected calls dput(dentry) to drop the previously acquired reference to dentry. In this case, dentry can be released. After that, IS_ROOT(dentry) checks the condition (dentry == dentry->d_parent), which may result in a use-after-free bug. This patch directly compares dentry with its parent obtained before dropping the reference. Fixes: a056cc8934c("exportfs: stop retrying once we race with rename/remove") Signed-off-by: Pan Bian Signed-off-by: Al Viro commit ffdcc3638c58d55a6fa68b6e5dfd4fb4109652eb Author: Peter Ujfalusi Date: Wed Nov 14 13:06:23 2018 +0200 ASoC: omap-dmic: Add pm_qos handling to avoid overruns with CPU_IDLE We need to block sleep states which would require longer time to leave than the time the DMA must react to the DMA request in order to keep the FIFO serviced without overrun. Signed-off-by: Peter Ujfalusi Acked-by: Jarkko Nikula Signed-off-by: Mark Brown commit 373a500e34aea97971c9d71e45edad458d3da98f Author: Peter Ujfalusi Date: Wed Nov 14 13:06:22 2018 +0200 ASoC: omap-mcpdm: Add pm_qos handling to avoid under/overruns with CPU_IDLE We need to block sleep states which would require longer time to leave than the time the DMA must react to the DMA request in order to keep the FIFO serviced without under of overrun. Signed-off-by: Peter Ujfalusi Acked-by: Jarkko Nikula Signed-off-by: Mark Brown commit dd2f52d8991af9fe0928d59ec502ba52be7bc38d Author: Peter Ujfalusi Date: Wed Nov 14 13:06:21 2018 +0200 ASoC: omap-mcbsp: Fix latency value calculation for pm_qos The latency number is in usec for the pm_qos. Correct the calculation to give us the time in usec Signed-off-by: Peter Ujfalusi Acked-by: Jarkko Nikula Signed-off-by: Mark Brown commit 42a657f57628402c73237547f0134e083e2f6764 Author: Pan Bian Date: Fri Nov 23 18:10:15 2018 +0800 btrfs: relocation: set trans to be NULL after ending transaction The function relocate_block_group calls btrfs_end_transaction to release trans when update_backref_cache returns 1, and then continues the loop body. If btrfs_block_rsv_refill fails this time, it will jump out the loop and the freed trans will be accessed. This may result in a use-after-free bug. The patch assigns NULL to trans after trans is released so that it will not be accessed. Fixes: 0647bf564f1 ("Btrfs: improve forever loop when doing balance relocation") CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Qu Wenruo Signed-off-by: Pan Bian Reviewed-by: David Sterba Signed-off-by: David Sterba commit 396defa8523372645d6d5a8b7f4b5403b119e360 Author: Ryder Lee Date: Mon Nov 12 09:28:07 2018 +0800 arm64: dts: mt7622: fix no more console output on BPI-R64 board Fix this by using a 'stdout-path' property that points to the device. Fixes: 0b6286dd96c0 ("arm64: dts: mt7622: add bananapi BPI-R64 board") Signed-off-by: Ryder Lee Signed-off-by: Matthias Brugger commit 6c05946e349d92f527d98644fbc9c41f06312c00 Author: Ryder Lee Date: Mon Nov 12 09:28:06 2018 +0800 arm64: dts: mt7622: fix no more console output on rfb1 No default serial console on boot. Fix this by using a 'stdout-path' property that points to the device. Fixes: c0d9f9ad4f76 ("arm64: dts: mt7622: add earlycon to mt7622-rfb1 board") Signed-off-by: Ryder Lee Tested-by: Kevin Hilman [mb: Fix commit message] Signed-off-by: Matthias Brugger commit 1d50088ca3956e5dcd2751a658e7869b9af10bb4 Merge: bec00cb5e97c d98ccfc3948a c22397888f1e Author: Rafael J. Wysocki Date: Fri Nov 23 10:32:49 2018 +0100 Merge branches 'pm-cpufreq' and 'pm-sleep' * pm-cpufreq: cpufreq: ti-cpufreq: Only register platform_device when supported * pm-sleep: exec: make de_thread() freezable commit bec00cb5e97c19d2c8bd10db15d334cb40760000 Merge: 6eb5c9b5edff 0db699f747cc Author: Rafael J. Wysocki Date: Fri Nov 23 10:32:22 2018 +0100 Merge branches 'pm-opp' and 'pm-tools' * pm-opp: opp: ti-opp-supply: Correct the supply in _get_optimal_vdd_voltage call opp: ti-opp-supply: Dynamically update u_volt_min * pm-tools: tools cpupower: Override CFLAGS assignments tools cpupower debug: Allow to use outside build flags tools/power/cpupower: fix compilation with STATIC=true commit 09d3f015d1e1b4fee7e9bbdcf54201d239393391 Author: Andrea Parri Date: Thu Nov 22 17:10:31 2018 +0100 uprobes: Fix handle_swbp() vs. unregister() + register() race once more Commit: 142b18ddc8143 ("uprobes: Fix handle_swbp() vs unregister() + register() race") added the UPROBE_COPY_INSN flag, and corresponding smp_wmb() and smp_rmb() memory barriers, to ensure that handle_swbp() uses fully-initialized uprobes only. However, the smp_rmb() is mis-placed: this barrier should be placed after handle_swbp() has tested for the flag, thus guaranteeing that (program-order) subsequent loads from the uprobe can see the initial stores performed by prepare_uprobe(). Move the smp_rmb() accordingly. Also amend the comments associated to the two memory barriers to indicate their actual locations. Signed-off-by: Andrea Parri Acked-by: Oleg Nesterov Cc: Alexander Shishkin Cc: Andrew Morton Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Namhyung Kim Cc: Paul E. McKenney Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Cc: stable@kernel.org Fixes: 142b18ddc8143 ("uprobes: Fix handle_swbp() vs unregister() + register() race") Link: http://lkml.kernel.org/r/20181122161031.15179-1-andrea.parri@amarulasolutions.com Signed-off-by: Ingo Molnar commit 4a135e538962cb00a9667c82e7d2b9e4d7cd7177 Author: Mathias Krause Date: Wed Nov 21 21:09:23 2018 +0100 xfrm_user: fix freeing of xfrm states on acquire Commit 565f0fa902b6 ("xfrm: use a dedicated slab cache for struct xfrm_state") moved xfrm state objects to use their own slab cache. However, it missed to adapt xfrm_user to use this new cache when freeing xfrm states. Fix this by introducing and make use of a new helper for freeing xfrm_state objects. Fixes: 565f0fa902b6 ("xfrm: use a dedicated slab cache for struct xfrm_state") Reported-by: Pan Bian Cc: # v4.18+ Signed-off-by: Mathias Krause Acked-by: Herbert Xu Signed-off-by: Steffen Klassert commit 3e27c79c4b121a64e85f26ab8957e5d0a09ff28e Author: Viresh Kumar Date: Fri Nov 23 10:36:07 2018 +0530 OPP: Fix parsing of multiple phandles in "operating-points-v2" property We currently return error if more than one phandle is present in the "operating-points-v2" property, which is incorrect. We only want to check the count of phandles here and set index to 0 if only one phandle is present. Fix it. Fixes: 5ed4cecd75e9 ("OPP: Pass OPP table to _of_add_opp_table_v{1|2}()") Signed-off-by: Viresh Kumar commit 98c9cdfd34fbb62886e4c5a07e33661aa3352ef5 Merge: 8cf6f361eb76 f559156c399c Author: Dave Airlie Date: Fri Nov 23 11:03:20 2018 +1000 Merge tag 'drm-intel-fixes-2018-11-22' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Fix for fastboot DSI panel boot time flicker regression, also fixes Bugzilla #108225 - Fix Bugzilla #101269 to avoid GPU hangs on Sandybridge machines - Avoid GPU hang on error capture on Broxton with Vt-d enabled - Avoid missing GPU relocations on Pineview and Bearlake (Gen3) Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20181122120555.GA18282@jlahtine-desk.ger.corp.intel.com commit 813961de3ee6474dd5703e883471fd941d6c8f69 Author: Alexei Starovoitov Date: Thu Nov 22 10:49:56 2018 -0800 bpf: fix integer overflow in queue_stack_map Fix the following issues: - allow queue_stack_map for root only - fix u32 max_entries overflow - disallow value_size == 0 Fixes: f1a2e44a3aec ("bpf: add queue and stack maps") Reported-by: Wei Wu Signed-off-by: Alexei Starovoitov Cc: Mauricio Vasquez B Signed-off-by: Daniel Borkmann commit 039e70a70c8417b5bf5878a60612ebd2c95f731e Merge: 6d0f60b0f858 5bf032ef08e6 Author: David S. Miller Date: Thu Nov 22 11:53:26 2018 -0800 Merge branch 'ibmvnic-Fix-queue-and-buffer-accounting-errors' Thomas Falcon says: ==================== ibmvnic: Fix queue and buffer accounting errors This series includes two small fixes. The first resolves a typo bug in the code to clean up unused RX buffers during device queue removal. The second ensures that device queue memory is updated to reflect new supported queue ring sizes after migration to other backing hardware. ==================== Signed-off-by: David S. Miller commit 5bf032ef08e6a110edc1e3bfb3c66a208fb55125 Author: Thomas Falcon Date: Wed Nov 21 11:17:59 2018 -0600 ibmvnic: Update driver queues after change in ring size support During device reset, queue memory is not being updated to accommodate changes in ring buffer sizes supported by backing hardware. Track any differences in ring buffer sizes following the reset and update queue memory when possible. Signed-off-by: Thomas Falcon Signed-off-by: David S. Miller commit b7cdec3d699db2e5985ad39de0f25d3b6111928e Author: Thomas Falcon Date: Wed Nov 21 11:17:58 2018 -0600 ibmvnic: Fix RX queue buffer cleanup The wrong index is used when cleaning up RX buffer objects during release of RX queues. Update to use the correct index counter. Signed-off-by: Thomas Falcon Signed-off-by: David S. Miller commit 6d0f60b0f8588fd4380ea5df9601e12fddd55ce2 Author: Lorenzo Bianconi Date: Wed Nov 21 16:32:10 2018 +0100 net: thunderx: set xdp_prog to NULL if bpf_prog_add fails Set xdp_prog pointer to NULL if bpf_prog_add fails since that routine reports the error code instead of NULL in case of failure and xdp_prog pointer value is used in the driver to verify if XDP is currently enabled. Moreover report the error code to userspace if nicvf_xdp_setup fails Fixes: 05c773f52b96 ("net: thunderx: Add basic XDP support") Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit 0211dda68a4f6531923a2f72d8e8959207f59fba Author: Tal Gilboa Date: Wed Nov 21 16:28:23 2018 +0200 net/dim: Update DIM start sample after each DIM iteration On every iteration of net_dim, the algorithm may choose to check for the system state by comparing current data sample with previous data sample. After each of these comparison, regardless of the action taken, the sample used as baseline is needed to be updated. This patch fixes a bug that causes DIM to take wrong decisions, due to never updating the baseline sample for comparison between iterations. This way, DIM always compares current sample with zeros. Although this is a functional fix, it also improves and stabilizes performance as the algorithm works properly now. Performance: Tested single UDP TX stream with pktgen: samples/pktgen/pktgen_sample03_burst_single_flow.sh -i p4p2 -d 1.1.1.1 -m 24:8a:07:88:26:8b -f 3 -b 128 ConnectX-5 100GbE packet rate improved from 15-19Mpps to 19-20Mpps. Also, toggling between profiles is less frequent with the fix. Fixes: 8115b750dbcb ("net/dim: use struct net_dim_sample as arg to net_dim") Signed-off-by: Tal Gilboa Reviewed-by: Tariq Toukan Signed-off-by: David S. Miller commit bb21ce0ad227b69ec0f83279297ee44232105d96 Author: Tigran Mkrtchyan Date: Wed Nov 21 12:25:41 2018 +0100 flexfiles: use per-mirror specified stateid for IO rfc8435 says: For tight coupling, ffds_stateid provides the stateid to be used by the client to access the file. However current implementation replaces per-mirror provided stateid with by open or lock stateid. Ensure that per-mirror stateid is used by ff_layout_write_prepare_v4 and nfs4_ff_layout_prepare_ds. Signed-off-by: Tigran Mkrtchyan Signed-off-by: Rick Macklem Signed-off-by: Trond Myklebust commit 99f2c55591fb5c1b536263970d98c2ebc2089906 Author: Olga Kornievskaia Date: Wed Nov 21 11:24:22 2018 -0500 NFSv4.2 copy do not allocate memory under the lock Bruce pointed out that we shouldn't allocate memory while holding a lock in the nfs4_callback_offload() and handle_async_copy() that deal with a racing CB_OFFLOAD and reply to COPY case. Signed-off-by: Olga Kornievskaia Signed-off-by: Trond Myklebust commit ea2fc769719f9cc8e26845e8ffa2a719e2724645 Author: Ezequiel Garcia Date: Fri Nov 9 10:16:41 2018 -0500 media: Revert "media: dt-bindings: Document the Rockchip VPU bindings" This reverts commit e4183d3256e3cd668e899d06af66da5aac3a51af. The commit was picked by mistake, as the Rockchip VPU driver is not ready for inclusion yet, and it's still under discussion. Signed-off-by: Ezequiel Garcia Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit f96d84488f7d5f9123428c700cea82a292bca53e Author: Hans Verkuil Date: Tue Nov 20 05:13:04 2018 -0500 media: gspca: fix frame overflow error When converting gspca to vb2 I missed that fact that the buffer sizes were rounded up to the next page size. As a result some gspca drivers (spca561 being one of them) reported frame overflows. Modify the code to align the buffer sizes to the next page size, just as the original code did. Fixes: 1f5965c4dfd7 ("media: gspca: convert to vb2") Tested-off-by: Hans Verkuil Signed-off-by: Hans Verkuil Reported-by: softwarebugs Cc: # for v4.18 and up Signed-off-by: Mauro Carvalho Chehab commit 552f0329c75b3e1d7f9bb8c9e421d37403f192cd Author: Filipe Manana Date: Mon Nov 19 16:20:34 2018 +0000 Btrfs: fix race between enabling quotas and subvolume creation We have a race between enabling quotas end subvolume creation that cause subvolume creation to fail with -EINVAL, and the following diagram shows how it happens: CPU 0 CPU 1 btrfs_ioctl() btrfs_ioctl_quota_ctl() btrfs_quota_enable() mutex_lock(fs_info->qgroup_ioctl_lock) btrfs_ioctl() create_subvol() btrfs_qgroup_inherit() -> save fs_info->quota_root into quota_root -> stores a NULL value -> tries to lock the mutex qgroup_ioctl_lock -> blocks waiting for the task at CPU0 -> sets BTRFS_FS_QUOTA_ENABLED in fs_info -> sets quota_root in fs_info->quota_root (non-NULL value) mutex_unlock(fs_info->qgroup_ioctl_lock) -> checks quota enabled flag is set -> returns -EINVAL because fs_info->quota_root was NULL before it acquired the mutex qgroup_ioctl_lock -> ioctl returns -EINVAL Returning -EINVAL to user space will be confusing if all the arguments passed to the subvolume creation ioctl were valid. Fix it by grabbing the value from fs_info->quota_root after acquiring the mutex. CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit edeca3a769ad28a9477798c3b1d8e0701db728e4 Merge: 52465bce85a2 a6b0961b3989 Author: Linus Torvalds Date: Thu Nov 22 08:45:44 2018 -0800 Merge tag 'sound-4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "The only significant change is for OSS PCM emulation to convert with kvcalloc() to address both performance and security issues. It's a pretty straightforward change, which should be safe. The rest are, as usual, device-specific small fixes for HD-audio" * tag 'sound-4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/ca0132 - fix AE-5 pincfg ALSA: hda/ca0132 - Add new ZxR quirk ALSA: hda/ca0132 - Call pci_iounmap() instead of iounmap() ALSA: hda/realtek - Add quirk entry for HP Pavilion 15 ALSA: oss: Use kvzalloc() for local buffer allocations commit 52465bce85a2d28bcec5cba5a645bb610367ab1b Merge: 4cd731953d62 544b03da39e2 Author: Linus Torvalds Date: Thu Nov 22 08:43:06 2018 -0800 Merge tag 'char-misc-4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small char/misc driver fixes for issues that have been reported. Nothing major, highlights include: - gnss sync write fixes - uio oops fix - nvmem fixes - other minor fixes and some documentation/maintainers updates Full details are in the shortlog. All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: Documentation/security-bugs: Postpone fix publication in exceptional cases MAINTAINERS: Add Sasha as a stable branch maintainer gnss: sirf: fix synchronous write timeout gnss: serial: fix synchronous write timeout uio: Fix an Oops on load test_firmware: fix error return getting clobbered nvmem: core: fix regression in of_nvmem_cell_get() misc: atmel-ssc: Fix section annotation on atmel_ssc_get_driver_data drivers/misc/sgi-gru: fix Spectre v1 vulnerability Drivers: hv: kvp: Fix the recent regression caused by incorrect clean-up slimbus: ngd: remove unnecessary check commit 4cd731953d620b7e4e999a90d13db58b88c5e95b Merge: ef4d6f2c0c65 63529eaa6164 Author: Linus Torvalds Date: Thu Nov 22 08:39:29 2018 -0800 Merge tag 'usb-4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are a number of small USB fixes for 4.20-rc4. There's the usual xhci and dwc2/3 fixes as well as a few minor other issues resolved for problems that have been reported. Full details are in the shortlog. All have been in linux-next for a while with no reported issues" * tag 'usb-4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: cdc-acm: add entry for Hiro (Conexant) modem usb: xhci: Prevent bus suspend if a port connect change or polling state is detected usb: core: Fix hub port connection events lost usb: dwc3: gadget: fix ISOC TRB type on unaligned transfers Revert "usb: gadget: ffs: Fix BUG when userland exits with submitted AIO transfers" usb: dwc2: pci: Fix an error code in probe usb: dwc3: Fix NULL pointer exception in dwc3_pci_remove() xhci: Add quirk to workaround the errata seen on Cavium Thunder-X2 Soc usb: xhci: fix timeout for transition from RExit to U0 usb: xhci: fix uninitialized completion when USB3 port got wrong status xhci: Add check for invalid byte size error when UAS devices are connected. xhci: handle port status events for removed USB3 hcd xhci: Fix leaking USB3 shared_hcd at xhci removal USB: misc: appledisplay: add 20" Apple Cinema Display USB: quirks: Add no-lpm quirk for Raydium touchscreens usb: quirks: Add delay-init quirk for Corsair K70 LUX RGB USB: Wait for extra delay time after USB_PORT_FEAT_RESET for quirky hub usb: dwc3: gadget: Properly check last unaligned/zero chain TRB usb: dwc3: core: Clean up ULPI device commit ef4d6f2c0c659922856bb48cbb7a83ac97941e01 Merge: b84b6345e382 e8828ec1c003 Author: Linus Torvalds Date: Thu Nov 22 08:35:30 2018 -0800 Merge tag 'mtd/fixes-for-4.20-rc4' of git://git.infradead.org/linux-mtd Pull mtd fixes from Boris Brezillon: "SPI NOR fixes: - Various fixes related to the SFDP parsing code merged in 4.20 - Fix for a page fault in the cadence-qspi NAND fixes: - Fix a macro name conflict between the QCOM NAND controller driver and the RISC-V asm headers - Fix of-node handling in the atmel driver" * tag 'mtd/fixes-for-4.20-rc4' of git://git.infradead.org/linux-mtd: mtd: spi-nor: fix selection of uniform erase type in flexible conf mtd: spi-nor: Fix Cadence QSPI page fault kernel panic mtd: rawnand: qcom: Namespace prefix some commands mtd: rawnand: atmel: fix OF child-node lookup mtd: spi_nor: pass DMA-able buffer to spi_nor_read_raw() mtd: spi-nor: don't overwrite errno in spi_nor_get_map_in_use() mtd: spi-nor: fix iteration over smpt array mtd: spi-nor: don't drop sfdp data if optional parsers fail commit b84b6345e3827ab616946b52f46e95179657b596 Merge: 92b419289cee 8e4829c6f747 Author: Linus Torvalds Date: Thu Nov 22 08:31:46 2018 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Two small fixes. The qla2xxx is a regression from 4.18 and the ufs one is a device enablement fix" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: Fix hynix ufs bug with quirk on hi36xx SoC scsi: qla2xxx: Timeouts occur on surprise removal of QLogic adapter commit 829383e183728dec7ed9150b949cd6de64127809 Author: Pan Bian Date: Wed Nov 21 17:53:47 2018 +0800 iommu/vt-d: Use memunmap to free memremap memunmap() should be used to free the return of memremap(), not iounmap(). Fixes: dfddb969edf0 ('iommu/vt-d: Switch from ioremap_cache to memremap') Signed-off-by: Pan Bian Signed-off-by: Joerg Roedel commit f2a5fef1248beccacec0deecb67c1be693d72ae6 Author: Juergen Gross Date: Mon Nov 19 14:59:45 2018 +0100 x86/xen: cleanup includes in arch/x86/xen/spinlock.c arch/x86/xen/spinlock.c includes several headers which are not needed. Remove the #includes. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit 4fc4bb796b0c75067fd65292dfd874869ff7c9dc Author: Myungho Jung Date: Wed Nov 21 15:18:30 2018 -0800 fuse: Add bad inode check in fuse_destroy_inode() make_bad_inode() sets inode->i_mode to S_IFREG if I/O error is detected in fuse_do_getattr()/fuse_do_setattr(). If the inode is not a regular file, write_files and queued_writes in fuse_inode are not initialized and have NULL or invalid pointers written by other members in a union. So, list_empty() returns false in fuse_destroy_inode(). Add is_bad_inode() to check if make_bad_inode() was called. Reported-by: syzbot+b9c89b84423073226299@syzkaller.appspotmail.com Fixes: ab2257e9941b ("fuse: reduce size of struct fuse_inode") Signed-off-by: Myungho Jung Signed-off-by: Miklos Szeredi commit 0152eee6fc3b84298bb6a79961961734e8afa5b8 Author: Steffen Klassert Date: Thu Nov 22 07:26:24 2018 +0100 xfrm: Fix NULL pointer dereference in xfrm_input when skb_dst_force clears the dst_entry. Since commit 222d7dbd258d ("net: prevent dst uses after free") skb_dst_force() might clear the dst_entry attached to the skb. The xfrm code doesn't expect this to happen, so we crash with a NULL pointer dereference in this case. Fix it by checking skb_dst(skb) for NULL after skb_dst_force() and drop the packet in case the dst_entry was cleared. We also move the skb_dst_force() to a codepath that is not used when the transformation was offloaded, because in this case we don't have a dst_entry attached to the skb. The output and forwarding path was already fixed by commit 9e1437937807 ("xfrm: Fix NULL pointer dereference when skb_dst_force clears the dst_entry.") Fixes: 222d7dbd258d ("net: prevent dst uses after free") Reported-by: Jean-Philippe Menil Signed-off-by: Steffen Klassert commit 472de49fdc53365c880ab81ae2b5cfdd83db0b06 Author: Jiri Olsa Date: Wed Nov 21 11:16:12 2018 +0100 perf/x86/intel: Disallow precise_ip on BTS events Vince reported a crash in the BTS flush code when touching the callchain data, which was supposed to be initialized as an 'early' callchain, but intel_pmu_drain_bts_buffer() does not do that: BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 ... Call Trace: intel_pmu_drain_bts_buffer+0x151/0x220 ? intel_get_event_constraints+0x219/0x360 ? perf_assign_events+0xe2/0x2a0 ? select_idle_sibling+0x22/0x3a0 ? __update_load_avg_se+0x1ec/0x270 ? enqueue_task_fair+0x377/0xdd0 ? cpumask_next_and+0x19/0x20 ? load_balance+0x134/0x950 ? check_preempt_curr+0x7a/0x90 ? ttwu_do_wakeup+0x19/0x140 x86_pmu_stop+0x3b/0x90 x86_pmu_del+0x57/0x160 event_sched_out.isra.106+0x81/0x170 group_sched_out.part.108+0x51/0xc0 __perf_event_disable+0x7f/0x160 event_function+0x8c/0xd0 remote_function+0x3c/0x50 flush_smp_call_function_queue+0x35/0xe0 smp_call_function_single_interrupt+0x3a/0xd0 call_function_single_interrupt+0xf/0x20 It was triggered by fuzzer but can be easily reproduced by: # perf record -e cpu/branch-instructions/pu -g -c 1 Peter suggested not to allow branch tracing for precise events: > Now arguably, this is really stupid behaviour. Who in his right mind > wants callchain output on BTS entries. And even if they do, BTS + > precise_ip is nonsensical. > > So in my mind disallowing precise_ip on BTS would be the simplest fix. Suggested-by: Peter Zijlstra Reported-by: Vince Weaver Signed-off-by: Jiri Olsa Acked-by: Peter Zijlstra Cc: Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Stephane Eranian Cc: Thomas Gleixner Fixes: 6cbc304f2f36 ("perf/x86/intel: Fix unwind errors from PEBS entries (mk-II)") Link: http://lkml.kernel.org/r/20181121101612.16272-3-jolsa@kernel.org Signed-off-by: Ingo Molnar commit 67266c1080ad56c31af72b9c18355fde8ccc124a Author: Jiri Olsa Date: Wed Nov 21 11:16:11 2018 +0100 perf/x86/intel: Add generic branch tracing check to intel_pmu_has_bts() Currently we check the branch tracing only by checking for the PERF_COUNT_HW_BRANCH_INSTRUCTIONS event of PERF_TYPE_HARDWARE type. But we can define the same event with the PERF_TYPE_RAW type. Changing the intel_pmu_has_bts() code to check on event's final hw config value, so both HW types are covered. Adding unlikely to intel_pmu_has_bts() condition calls, because it was used in the original code in intel_bts_constraints. Signed-off-by: Jiri Olsa Acked-by: Peter Zijlstra Cc: Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Link: http://lkml.kernel.org/r/20181121101612.16272-2-jolsa@kernel.org Signed-off-by: Ingo Molnar commit ed6101bbf6266ee83e620b19faa7c6ad56bb41ab Author: Jiri Olsa Date: Wed Nov 21 11:16:10 2018 +0100 perf/x86/intel: Move branch tracing setup to the Intel-specific source file Moving branch tracing setup to Intel core object into separate intel_pmu_bts_config function, because it's Intel specific. Suggested-by: Peter Zijlstra Signed-off-by: Jiri Olsa Acked-by: Peter Zijlstra Cc: Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Link: http://lkml.kernel.org/r/20181121101612.16272-1-jolsa@kernel.org Signed-off-by: Ingo Molnar commit c648284f6c9606f1854816086593eeae5556845a Merge: 5a96b2d38dc0 0145b50566e7 Author: Greg Kroah-Hartman Date: Thu Nov 22 09:37:36 2018 +0100 Merge tag 'iio-fixes-for-4.20a' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus Jonathan writes: First set of IIO fixes for the 4.20 cycle. * st_magn - Avoid an ordering issue that lead to large numbers of unhandled interrupts whilst enabling buffered capture. * hid-sensors - Fix a long running problem with signed values reading wrong from sysfs on these sensors. It appears people were only using the buffered interface. These typically occur in laptops so chances are everyone was using the sensor-proxy which will use the buffered interface by default. * tag 'iio-fixes-for-4.20a' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio/hid-sensors: Fix IIO_CHAN_INFO_RAW returning wrong values for signed numbers iio:st_magn: Fix enable device after trigger commit ffe0e7cf290f5c9d1392134b4ef8da2a3761a4cd Author: Benjamin Tissoires Date: Wed Nov 21 16:27:12 2018 +0100 Revert "Input: Add the `REL_WHEEL_HI_RES` event code" This reverts commit aaf9978c3c0291ef3beaa97610bc9c3084656a85. Quoting Peter: There is a HID feature report called "Resolution Multiplier" Described in the "Enhanced Wheel Support in Windows" doc and the "USB HID Usage Tables" page 30. http://download.microsoft.com/download/b/d/1/bd1f7ef4-7d72-419e-bc5c-9f79ad7bb66e/wheel.docx https://www.usb.org/sites/default/files/documents/hut1_12v2.pdf This was new for Windows Vista, so we're only a decade behind here. I only accidentally found this a few days ago while debugging a stuck button on a Microsoft mouse. The docs above describe it like this: a wheel control by default sends value 1 per notch. If the resolution multiplier is active, the wheel is expected to send a value of $multiplier per notch (e.g. MS Sculpt mouse) or just send events more often, i.e. for less physical motion (e.g. MS Comfort mouse). For the latter, you need the right HW of course. The Sculpt mouse has tactile wheel clicks, so nothing really changes. The Comfort mouse has continuous motion with no tactile clicks. Similar to the free-wheeling Logitech mice but without any inertia. Note that the doc also says that Vista and onwards *always* enable this feature where available. An example HID definition looks like this: Usage Page Generic Desktop (0x01) Usage Resolution Multiplier (0x48) Logical Minimum 0 Logical Maximum 1 Physical Minimum 1 Physical Maximum 16 Report Size 2 # in bits Report Count 1 Feature (Data, Var, Abs) So the actual bits have values 0 or 1 and that reflects real values 1 or 16. We've only seen single-bits so far, so there's low-res and hi-res, but nothing in between. The multiplier is available for HID usages "Wheel" and "AC Pan" (horiz wheel). Microsoft suggests that > Vendors should ship their devices with smooth scrolling disabled and allow > Windows to enable it. This ensures that the device works like a regular HID > device on legacy operating systems that do not support smooth scrolling. (see the wheel doc linked above) The mice that we tested so far do reset on unplug. Device Support looks to be all (?) Microsoft mice but nothing else Not supported: - Logitech G500s, G303 - Roccat Kone XTD - all the cheap Lenovo, HP, Dell, Logitech USB mice that come with a workstation that I could find don't have it. - Etekcity something something - Razer Imperator Supported: - Microsoft Comfort Optical Mouse 3000 - yes, physical: 1:4 - Microsoft Sculpt Ergonomic Mouse - yes, physical: 1:12 - Microsoft Surface mouse - yes, physical: 1:4 So again, I think this is really just available on Microsoft mice, but probably all decent MS mice released over the last decade. Looking at the hardware itself: - no noticeable notches in the weel - low-res: 18 events per 360deg rotation (click angle 20 deg) - high-res: 72 events per 360deg → matches multiplier of 4 - I can feel the notches during wheel turns - low-res: 24 events per 360 deg rotation (click angle 15 deg) - horiz wheel is tilt-based, continuous output value 1 - high-res: 24 events per 360deg with value 12 → matches multiplier of 12 - horiz wheel output rate doubles/triples?, values is 3 - It's a touch strip, not a wheel so no notches - high-res: events have value 4 instead of 1 a bit strange given that it doesn't actually have notches. Ok, why is this an issue for the current API? First, because the logitech multiplier used in Harry's patches looks suspiciously like the Resolution Multiplier so I think we should assume it's the same thing. Nestor, can you shed some light on that? - `REL_WHEEL` is defined as the number of notches, emulated where needed. - `REL_WHEEL_HI_RES` is the movement of the user's finger in microns. - `WM_MOUSEWHEEL` (Windows) is is a multiple of 120, defined as "the threshold for action to be taken and one such action" https://docs.microsoft.com/en-us/windows/desktop/inputdev/wm-mousewheel If the multiplier is set to M, this means we need an accumulated value of M until we can claim there was a wheel click. So after enabling the multiplier and setting it to the maximum (like Windows): - M units are 15deg rotation → 1 unit is 2620/M micron (see below). This is the `REL_WHEEL_HI_RES` value. - wheel diameter 20mm: 15 deg rotation is 2.62mm, 2620 micron (pi * 20mm / (360deg/15deg)) - For every M units accumulated, send one `REL_WHEEL` event The problem here is that we've now hardcoded 20mm/15 deg into the kernel and we have no way of getting the size of the wheel or the click angle into the kernel. In userspace we now have to undo the kernel's calculation. If our click angle is e.g. 20 degree we have to undo the (lossy) calculation from the kernel and calculate the correct angle instead. This also means the 15 is a hardcoded option forever and cannot be changed. In hid-logitech-hidpp.c, the microns per unit is hardcoded per device. Harry, did you measure those by hand? We'd need to update the kernel for every device and there are 10 years worth of devices from MS alone. The multiplier default is 8 which is in the right ballpark, so I'm pretty sure this is the same as the Resolution Multiplier, just in HID++ lingo. And given that the 120 magic factor is what Windows uses in the end, I can't imagine Logitech rolling their own thing here. Nestor? And we're already fairly inaccurate with the microns anyway. The MX Anywhere 2S has a click angle of 20 degrees (18 stops) and a 17mm wheel, so a wheel notch is approximately 2.67mm, one event at multiplier 8 (1/8 of a notch) would be 334 micron. That's only 80% of the fallback value of 406 in the kernel. Multiplier 6 gives us 445micron (10% off). I'm assuming multiplier 7 doesn't exist because it's not a factor of 120. Summary: Best option may be to simply do what Windows is doing, all the HW manufacturers have to use that approach after all. Switch `REL_WHEEL_HI_RES` to report in fractions of 120, with 120 being one notch and divide that by the multiplier for the actual events. So e.g. the Logitech multiplier 8 would send value 15 for each event in hi-res mode. This can be converted in userspace to whatever userspace needs (combined with a hwdb there that tells you wheel size/click angle/...). Conflicts: include/uapi/linux/input-event-codes.h -> I kept the new reserved event in the code, so I had to adapt the revert slightly Signed-off-by: Benjamin Tissoires Acked-by: Harry Cutts Acked-by: Dmitry Torokhov Acked-by: Jiri Kosina commit f1539a0c2545d7bd82e451bd1464f2a820f55de4 Author: Benjamin Tissoires Date: Wed Nov 21 16:27:11 2018 +0100 Revert "HID: input: Create a utility class for counting scroll events" This reverts commit 1ff2e1a44e02d4bdbb9be67c7d9acc240a67141f. It turns out the current API is not that compatible with some Microsoft mice, so better start again from scratch. Signed-off-by: Benjamin Tissoires Acked-by: Harry Cutts Acked-by: Dmitry Torokhov Acked-by: Jiri Kosina commit 00acc9e2c4a55045d73f2615429742369996d801 Author: Benjamin Tissoires Date: Wed Nov 21 16:27:10 2018 +0100 Revert "HID: logitech: Add function to enable HID++ 1.0 "scrolling acceleration"" This reverts commit 051dc9b0579602bd63e9df74d0879b5293e71581. It turns out the current API is not that compatible with some Microsoft mice, so better start again from scratch. Signed-off-by: Benjamin Tissoires Acked-by: Harry Cutts Acked-by: Dmitry Torokhov Acked-by: Jiri Kosina commit 5372fc3797691065b8318f0cc9ab8695cebb17e1 Author: Benjamin Tissoires Date: Wed Nov 21 16:27:09 2018 +0100 Revert "HID: logitech: Enable high-resolution scrolling on Logitech mice" This reverts commit d56ca9855bf924f3bc9807a3e42f38539df3f41f. It turns out the current API is not that compatible with some Microsoft mice, so better start again from scratch. Signed-off-by: Benjamin Tissoires Acked-by: Harry Cutts Acked-by: Dmitry Torokhov Acked-by: Jiri Kosina commit a69616d5b3e13f18cdec1c759818aec87866ac0c Author: Benjamin Tissoires Date: Wed Nov 21 16:27:08 2018 +0100 Revert "HID: logitech: Use LDJ_DEVICE macro for existing Logitech mice" This reverts commit 3fe1d6bbcd16f384d2c7dab2caf8e4b2df9ea7e6. It turns out the current API is not that compatible with some Microsoft mice, so better start again from scratch. Signed-off-by: Benjamin Tissoires Acked-by: Harry Cutts Acked-by: Dmitry Torokhov Acked-by: Jiri Kosina commit d0341efe7449860e1bbfdd282b3b7f0c34309222 Author: Benjamin Tissoires Date: Wed Nov 21 16:27:07 2018 +0100 Revert "HID: logitech: fix a used uninitialized GCC warning" This reverts commit 5fe2ccbef9d7aecf5c4402c753444f1a12096cfd. It turns out the current API is not that compatible with some Microsoft mice, so better start again from scratch. Signed-off-by: Benjamin Tissoires Acked-by: Harry Cutts Acked-by: Dmitry Torokhov Acked-by: Jiri Kosina commit e2b95b27196cc90f37016d79432fb2af3f9c9291 Author: Benjamin Tissoires Date: Wed Nov 21 16:27:06 2018 +0100 Revert "HID: input: simplify/fix high-res scroll event handling" This reverts commit 044ee890286153a1aefb40cb8b6659921aecb38b. It turns out the current API is not that compatible with some Microsoft mice, so better start again from scratch. Signed-off-by: Benjamin Tissoires Acked-by: Harry Cutts Acked-by: Dmitry Torokhov Acked-by: Jiri Kosina commit bf21c6e455539a495ce6d2877da2f9e364a89062 Author: YueHaibing Date: Thu Nov 22 03:41:07 2018 +0000 opp: ti-opp-supply: Fix platform_no_drv_owner.cocci warnings Remove .owner field if calls are used which set it automatically Generated by: scripts/coccinelle/api/platform_no_drv_owner.cocci Signed-off-by: YueHaibing Signed-off-by: Viresh Kumar commit 8cf6f361eb76bf7fca85bde15a0a9316fa124c0c Merge: 1d74f133252f a5d0f4565996 Author: Dave Airlie Date: Thu Nov 22 11:19:20 2018 +1000 Merge branch 'drm-fixes-4.20' of git://people.freedesktop.org/~agd5f/linux into drm-fixes - OD fixes for powerplay - Vega20 fixes - KFD fix for Kaveri - add missing firmware declaration for hainan (SI chip) - Fix DC user experience regressions related to panels that support >8 bpc Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20181121163647.2847-1-alexander.deucher@amd.com commit 1d74f133252fab157b9bcd4c710cee7ffcdd01c1 Merge: 7989b9ee8baf 8fd3b90300be Author: Dave Airlie Date: Thu Nov 22 11:17:46 2018 +1000 Merge tag 'drm-misc-fixes-2018-11-21' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes - vc4: Fix NULL deref in async path (Boris) - vc4: Avoid taking async path for cursor updates when impossible (Boris) - udmabuf: Fix mmap with PROT_WRITE (Gerd) - fb-helper: Don't use writeback connectors for fbdev (Paul) Cc: Boris Brezillon Cc: Gerd Hoffmann Cc: Paul Kocialkowski Signed-off-by: Dave Airlie From: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20181121155248.GA241511@art_vandelay commit 7989b9ee8bafe5cc625381dd0c3c4586de27ca26 Author: Y.C. Chen Date: Tue Oct 30 11:34:46 2018 +0800 drm/ast: fixed cursor may disappear sometimes Signed-off-by: Y.C. Chen Cc: Reviewed-by: Dave Airlie Signed-off-by: Dave Airlie commit 426a593e641ebf0d9288f0a2fcab644a86820220 Author: Vincent Chen Date: Wed Nov 21 09:38:11 2018 +0800 net: faraday: ftmac100: remove netif_running(netdev) check before disabling interrupts In the original ftmac100_interrupt(), the interrupts are only disabled when the condition "netif_running(netdev)" is true. However, this condition causes kerenl hang in the following case. When the user requests to disable the network device, kernel will clear the bit __LINK_STATE_START from the dev->state and then call the driver's ndo_stop function. Network device interrupts are not blocked during this process. If an interrupt occurs between clearing __LINK_STATE_START and stopping network device, kernel cannot disable the interrupts due to the condition "netif_running(netdev)" in the ISR. Hence, kernel will hang due to the continuous interruption of the network device. In order to solve the above problem, the interrupts of the network device should always be disabled in the ISR without being restricted by the condition "netif_running(netdev)". [V2] Remove unnecessary curly braces. Signed-off-by: Vincent Chen Signed-off-by: David S. Miller commit 1a37bd823891568f8721989aed0615835632d81a Author: Y.C. Chen Date: Wed Oct 3 14:57:47 2018 +0800 drm/ast: change resolution may cause screen blurred The value of pitches is not correct while calling mode_set. The issue we found so far on following system: - Debian8 with XFCE Desktop - Ubuntu with KDE Desktop - SUSE15 with KDE Desktop Signed-off-by: Y.C. Chen Cc: Tested-by: Jean Delvare Reviewed-by: Jean Delvare Signed-off-by: Dave Airlie commit 395048ebd4547d3cced71807b8aabfbde000fe55 Merge: 1e2b1046b53f e438bae43c1e Author: David S. Miller Date: Wed Nov 21 16:14:56 2018 -0800 Merge branch 'smc-fixes' Ursula Braun says: ==================== net/smc: fixes 2018-11-12 here is V4 of some net/smc fixes in different areas for the net tree. v1->v2: do not define 8-byte alignment for union smcd_cdc_cursor in patch 4/5 "net/smc: atomic SMCD cursor handling" v2->v3: stay with 8-byte alignment for union smcd_cdc_cursor in patch 4/5 "net/smc: atomic SMCD cursor handling", but get rid of __packed for struct smcd_cdc_msg v3->v4: get rid of another __packed for struct smc_cdc_msg in patch 4/5 "net/smc: atomic SMCD cursor handling" ==================== Signed-off-by: David S. Miller commit e438bae43c1e08e688c09c410407b59fc1c173b4 Author: Ursula Braun Date: Tue Nov 20 16:46:43 2018 +0100 net/smc: use after free fix in smc_wr_tx_put_slot() In smc_wr_tx_put_slot() field pend->idx is used after being cleared. That means always idx 0 is cleared in the wr_tx_mask. This results in a broken administration of available WR send payload buffers. Signed-off-by: Ursula Braun Signed-off-by: David S. Miller commit b9a22dd9811dbcddb5623c499e5b736400059df6 Author: Ursula Braun Date: Tue Nov 20 16:46:42 2018 +0100 net/smc: atomic SMCD cursor handling Running uperf tests with SMCD on LPARs results in corrupted cursors. SMCD cursors should be treated atomically to fix cursor corruption. Signed-off-by: Ursula Braun Signed-off-by: David S. Miller commit 0512f69e388c963dbe955d4bd9ae0f7d88d2dc54 Author: Hans Wippel Date: Tue Nov 20 16:46:41 2018 +0100 net/smc: add SMC-D shutdown signal When a SMC-D link group is freed, a shutdown signal should be sent to the peer to indicate that the link group is invalid. This patch adds the shutdown signal to the SMC code. Signed-off-by: Hans Wippel Signed-off-by: Ursula Braun Signed-off-by: David S. Miller commit ee05ff7af26509f39360534a5225ee714416cdfd Author: Karsten Graul Date: Tue Nov 20 16:46:40 2018 +0100 net/smc: use queue pair number when matching link group When searching for an existing link group the queue pair number is also to be taken into consideration. When the SMC server sends a new number in a CLC packet (keeping all other values equal) then a new link group is to be created on the SMC client side. Signed-off-by: Karsten Graul Signed-off-by: Ursula Braun Signed-off-by: David S. Miller commit f07920ad9c6f5781c90ac4915f8254d999d8c1cc Author: Hans Wippel Date: Tue Nov 20 16:46:39 2018 +0100 net/smc: abort CLC connection in smc_release In case of a non-blocking SMC socket, the initial CLC handshake is performed over a blocking TCP connection in a worker. If the SMC socket is released, smc_release has to wait for the blocking CLC socket operations (e.g., kernel_connect) inside the worker. This patch aborts a CLC connection when the respective non-blocking SMC socket is released to avoid waiting on socket operations or timeouts. Signed-off-by: Hans Wippel Signed-off-by: Ursula Braun Signed-off-by: David S. Miller commit 1e2b1046b53f356e663fd145d0c57bea04a0343a Merge: 86de5921a3d5 1770f0fa978e Author: David S. Miller Date: Wed Nov 21 15:51:16 2018 -0800 Merge tag 'wireless-drivers-for-davem-2018-11-20' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for 4.20 First set of fixes for 4.20, this time we have quite a few them but all very small. ath9k * fix a locking regression found by a static checker wlcore * fix a crash which was a regression with wakeirq handling brcm80211 * yet another fix for 160 MHz channel handling mt76 * fix a longstaning build problem when CONFIG_LEDS_CLASS is disabled * don't use uninitialised mutex iwlwifi * do note that the iwlwifi merge tag (commit 4ec321c14693) seems to contain wrong list of changes so ignore that * fix ACPI data handling, a memory leak and other smaller fixes ath10k * fix a crash during suspend which was a recent regression ==================== Signed-off-by: David S. Miller commit 86de5921a3d5dd246df661e09bdd0a6131b39ae3 Author: Eric Dumazet Date: Tue Nov 20 05:53:59 2018 -0800 tcp: defer SACK compression after DupThresh Jean-Louis reported a TCP regression and bisected to recent SACK compression. After a loss episode (receiver not able to keep up and dropping packets because its backlog is full), linux TCP stack is sending a single SACK (DUPACK). Sender waits a full RTO timer before recovering losses. While RFC 6675 says in section 5, "Algorithm Details", (2) If DupAcks < DupThresh but IsLost (HighACK + 1) returns true -- indicating at least three segments have arrived above the current cumulative acknowledgment point, which is taken to indicate loss -- go to step (4). ... (4) Invoke fast retransmit and enter loss recovery as follows: there are old TCP stacks not implementing this strategy, and still counting the dupacks before starting fast retransmit. While these stacks probably perform poorly when receivers implement LRO/GRO, we should be a little more gentle to them. This patch makes sure we do not enable SACK compression unless 3 dupacks have been sent since last rcv_nxt update. Ideally we should even rearm the timer to send one or two more DUPACK if no more packets are coming, but that will be work aiming for linux-4.21. Many thanks to Jean-Louis for bisecting the issue, providing packet captures and testing this patch. Fixes: 5d9f4262b7ea ("tcp: add SACK compression") Reported-by: Jean-Louis Dupond Tested-by: Jean-Louis Dupond Signed-off-by: Eric Dumazet Acked-by: Neal Cardwell Signed-off-by: David S. Miller commit dde7011a824cfa815b03f853ec985ff46b740939 Author: Jakub Kicinski Date: Wed Nov 21 13:53:17 2018 -0800 tools: bpftool: fix potential NULL pointer dereference in do_load This patch fixes a possible null pointer dereference in do_load, detected by the semantic patch deref_null.cocci, with the following warning: ./tools/bpf/bpftool/prog.c:1021:23-25: ERROR: map_replace is NULL but dereferenced. The following code has potential null pointer references: 881 map_replace = reallocarray(map_replace, old_map_fds + 1, 882 sizeof(*map_replace)); 883 if (!map_replace) { 884 p_err("mem alloc failed"); 885 goto err_free_reuse_maps; 886 } ... 1019 err_free_reuse_maps: 1020 for (i = 0; i < old_map_fds; i++) 1021 close(map_replace[i].fd); 1022 free(map_replace); Fixes: 3ff5a4dc5d89 ("tools: bpftool: allow reuse of maps with bpftool prog load") Co-developed-by: Wen Yang Signed-off-by: Wen Yang Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Borkmann commit b5dd186d10ba59e6b5ba60e42b3b083df56df6f3 Author: Petr Machata Date: Tue Nov 20 11:39:56 2018 +0000 net: skb_scrub_packet(): Scrub offload_fwd_mark When a packet is trapped and the corresponding SKB marked as already-forwarded, it retains this marking even after it is forwarded across veth links into another bridge. There, since it ingresses the bridge over veth, which doesn't have offload_fwd_mark, it triggers a warning in nbp_switchdev_frame_mark(). Then nbp_switchdev_allowed_egress() decides not to allow egress from this bridge through another veth, because the SKB is already marked, and the mark (of 0) of course matches. Thus the packet is incorrectly blocked. Solve by resetting offload_fwd_mark() in skb_scrub_packet(). That function is called from tunnels and also from veth, and thus catches the cases where traffic is forwarded between bridges and transformed in a way that invalidates the marking. Fixes: 6bc506b4fb06 ("bridge: switchdev: Add forward mark support for stacked devices") Fixes: abf4bb6b63d0 ("skbuff: Add the offload_mr_fwd_mark field") Signed-off-by: Petr Machata Suggested-by: Ido Schimmel Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 24c3456c8d5ee6fc1933ca40f7b4406130682668 Author: Sagi Grimberg Date: Wed Nov 14 10:17:01 2018 -0800 iser: set sector for ambiguous mr status errors If for some reason we failed to query the mr status, we need to make sure to provide sufficient information for an ambiguous error (guard error on sector 0). Fixes: 0a7a08ad6f5f ("IB/iser: Implement check_protection") Cc: Reported-by: Dan Carpenter Signed-off-by: Sagi Grimberg Signed-off-by: Jason Gunthorpe commit 4f32fb921b153ae9ea280e02a3e91509fffc03d3 Author: Kamal Heib Date: Thu Nov 15 09:49:38 2018 -0800 RDMA/rdmavt: Fix rvt_create_ah function signature rdmavt uses a crazy system that looses the type checking when assinging functions to struct ib_device function pointers. Because of this the signature to this function was not changed when the below commit revised things. Fix the signature so we are not calling a function pointer with a mismatched signature. Fixes: 477864c8fcd9 ("IB/core: Let create_ah return extended response to user") Signed-off-by: Kamal Heib Reviewed-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit db7a691a1551a748cb92d9c89c6b190ea87e28d5 Author: Michael Guralnik Date: Wed Nov 21 15:03:54 2018 +0200 IB/mlx5: Avoid load failure due to unknown link width If the firmware reports a connection width that is not 1x, 4x, 8x or 12x it causes the driver to fail during initialization. To prevent this failure every time a new width is introduced to the RDMA stack, we will set a default 4x width for these widths which ar unknown to the driver. This is needed to allow to run old kernels with new firmware. Cc: # 4.1 Fixes: 1b5daf11b015 ("IB/mlx5: Avoid using the MAD_IFC command under ISSI > 0 mode") Signed-off-by: Michael Guralnik Reviewed-by: Majd Dibbiny Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 13f8d9c16693afb908ead3d2a758adbe6a79eccd Author: Yonatan Cohen Date: Wed Nov 21 13:48:39 2018 +0200 IB/mlx5: Fix XRC QP support after introducing extended atomic Extended atomics are supported with RC and XRC QP types, but the commit citied in the Fixes line added an unneeded check to to_mlx5_access_flags. This broke XRC QPs. The following ib_atomic_bw invocation over XRC reproduces the issue: ib_atomic_bw -d mlx5_1 --connection=XRC --atomic_type=FETCH_AND_ADD It is safe to remove such checks because the QP type was already checked in ib_modify_qp_is_ok(), which was previously called from mlx5_ib_modify_qp. Fixes: a60109dc9a95 ("IB/mlx5: Add support for extended atomic operations") Signed-off-by: Yonatan Cohen Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit a6c66d6a08b88cc10aca9d3f65cfae31e7652a99 Author: Selvin Xavier Date: Wed Nov 21 00:05:01 2018 -0800 RDMA/bnxt_re: Avoid accessing the device structure after it is freed When bnxt_re_ib_reg returns failure, the device structure gets freed. Driver tries to access the device pointer after it is freed. [ 4871.034744] Failed to register with netedev: 0xffffffa1 [ 4871.034765] infiniband (null): Failed to register with IB: 0xffffffea [ 4871.046430] ================================================================== [ 4871.046437] BUG: KASAN: use-after-free in bnxt_re_task+0x63/0x180 [bnxt_re] [ 4871.046439] Write of size 4 at addr ffff880fa8406f48 by task kworker/u48:2/17813 [ 4871.046443] CPU: 20 PID: 17813 Comm: kworker/u48:2 Kdump: loaded Tainted: G B OE 4.20.0-rc1+ #42 [ 4871.046444] Hardware name: Dell Inc. PowerEdge R730/0599V5, BIOS 1.0.4 08/28/2014 [ 4871.046447] Workqueue: bnxt_re bnxt_re_task [bnxt_re] [ 4871.046449] Call Trace: [ 4871.046454] dump_stack+0x91/0xeb [ 4871.046458] print_address_description+0x6a/0x2a0 [ 4871.046461] kasan_report+0x176/0x2d0 [ 4871.046463] ? bnxt_re_task+0x63/0x180 [bnxt_re] [ 4871.046466] bnxt_re_task+0x63/0x180 [bnxt_re] [ 4871.046470] process_one_work+0x216/0x5b0 [ 4871.046471] ? process_one_work+0x189/0x5b0 [ 4871.046475] worker_thread+0x4e/0x3d0 [ 4871.046479] kthread+0x10e/0x140 [ 4871.046480] ? process_one_work+0x5b0/0x5b0 [ 4871.046482] ? kthread_stop+0x220/0x220 [ 4871.046486] ret_from_fork+0x3a/0x50 [ 4871.046492] The buggy address belongs to the page: [ 4871.046494] page:ffffea003ea10180 count:0 mapcount:0 mapping:0000000000000000 index:0x0 [ 4871.046495] flags: 0x57ffffc0000000() [ 4871.046498] raw: 0057ffffc0000000 0000000000000000 ffffea003ea10188 0000000000000000 [ 4871.046500] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 4871.046501] page dumped because: kasan: bad access detected Avoid accessing the device structure once it is freed. Fixes: 497158aa5f52 ("RDMA/bnxt_re: Fix the ib_reg failure cleanup") Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 3c4b1419c33c2417836a63f8126834ee36968321 Author: Selvin Xavier Date: Wed Nov 21 00:05:00 2018 -0800 RDMA/bnxt_re: Fix system hang when registration with L2 driver fails Driver doesn't release rtnl lock if registration with L2 driver (bnxt_re_register_netdev) fais and this causes hang while requesting for the next lock. [ 371.635416] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 371.635417] kworker/u48:1 D 0 634 2 0x80000000 [ 371.635423] Workqueue: bnxt_re bnxt_re_task [bnxt_re] [ 371.635424] Call Trace: [ 371.635426] ? __schedule+0x36b/0xbd0 [ 371.635429] schedule+0x39/0x90 [ 371.635430] schedule_preempt_disabled+0x11/0x20 [ 371.635431] __mutex_lock+0x45b/0x9c0 [ 371.635433] ? __mutex_lock+0x16d/0x9c0 [ 371.635435] ? bnxt_re_ib_reg+0x2b/0xb30 [bnxt_re] [ 371.635438] ? wake_up_klogd+0x37/0x40 [ 371.635442] bnxt_re_ib_reg+0x2b/0xb30 [bnxt_re] [ 371.635447] bnxt_re_task+0xfd/0x180 [bnxt_re] [ 371.635449] process_one_work+0x216/0x5b0 [ 371.635450] ? process_one_work+0x189/0x5b0 [ 371.635453] worker_thread+0x4e/0x3d0 [ 371.635455] kthread+0x10e/0x140 [ 371.635456] ? process_one_work+0x5b0/0x5b0 [ 371.635458] ? kthread_stop+0x220/0x220 [ 371.635460] ret_from_fork+0x3a/0x50 [ 371.635477] INFO: task NetworkManager:1228 blocked for more than 120 seconds. [ 371.635478] Tainted: G B OE 4.20.0-rc1+ #42 [ 371.635479] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. Release the rtnl_lock correctly in the failure path. Fixes: de5c95d0f518 ("RDMA/bnxt_re: Fix system crash during RDMA resource initialization") Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit d52ef88a9f4be523425730da3239cf87bee936da Author: Parav Pandit Date: Mon Nov 19 09:58:24 2018 +0200 RDMA/core: Add GIDs while changing MAC addr only for registered ndev Currently when MAC address is changed, regardless of the netdev reg_state, GID entries are removed and added to reflect the new MAC address and new default GID entries. When a bonding device is used and the underlying PCI device is removed several netdevice events are generated. Two events of the interest are CHANGEADDR and UNREGISTER event on lower(slave) netdevice of the bond netdevice. Sometimes CHANGEADDR event is generated when netdev state is UNREGISTERING (after UNREGISTER event is generated). In this scenario, GID entries for default GIDs are added and never deleted because GID entries are deleted only when netdev state is < UNREGISTERED. This leads to non zero reference count on the netdevice. Due to this, PCI device unbind operation is getting stuck. To avoid it, when changing mac address, add GID entries only if netdev is in REGISTERED state. Fixes: 03db3a2d81e6 ("IB/core: Add RoCE GID table management") Signed-off-by: Parav Pandit Reviewed-by: Mark Bloch Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 074fca3a18e7e1e0d4d7dcc9d7badc43b90232f4 Author: Majd Dibbiny Date: Mon Nov 5 08:07:37 2018 +0200 RDMA/mlx5: Fix fence type for IB_WR_LOCAL_INV WR Currently, for IB_WR_LOCAL_INV WR, when the next fence is None, the current fence will be SMALL instead of Normal Fence. Without this patch krping doesn't work on CX-5 devices and throws following error: The error messages are from CX5 driver are: (from server side) [ 710.434014] mlx5_0:dump_cqe:278:(pid 2712): dump error cqe [ 710.434016] 00000000 00000000 00000000 00000000 [ 710.434016] 00000000 00000000 00000000 00000000 [ 710.434017] 00000000 00000000 00000000 00000000 [ 710.434018] 00000000 93003204 100000b8 000524d2 [ 710.434019] krping: cq completion failed with wr_id 0 status 4 opcode 128 vender_err 32 Fixed the logic to set the correct fence type. Fixes: 6e8484c5cf07 ("RDMA/mlx5: set UMR wqe fence according to HCA cap") Signed-off-by: Majd Dibbiny Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 04ac4b0ed412f65230b456fcd9aa07e13befff89 Author: Lyude Paul Date: Mon Nov 19 19:44:55 2018 +0000 drm/amd/dm: Understand why attaching path/tile properties are needed Path property is used for userspace to know what MST connector goes to what actual DRM DisplayPort connector, the tiling property is for tiling configurations. Not sure what else there is to figure out. Signed-off-by: Lyude Paul Reviewed-by: Jerry (Fangzhi) Zuo Cc: Stable Signed-off-by: Alex Deucher commit c9e0ab86b2e03154bb898cd2f851827783224727 Author: Lyude Paul Date: Mon Nov 19 15:00:10 2018 +0000 drm/amd/dm: Don't forget to attach MST encoders The change fixed huge delay in SST daisy chain and S3 soft hang observed in 4.19 kernel rebase. Regression point in drm: drm/fb-helper: Eliminate the .best_encoder() usage The aux sequence is altered due to the failure in drm_connector_for_each_possible_encoder(). The failure is caused by missing attached encoder in the process of adding MST connector.   drm_dp_send_enum_path_resources() aux transaction is pushed after mode probe, which causes conflict to drm_dp_mst_i2c_xfer(), leading to the transaction timeout. Signed-off-by: Lyude Paul Reviewed-by: Jerry (Fangzhi) Zuo Cc: Stable Signed-off-by: Alex Deucher commit 92b419289ceecdd1eae03114928913f298b84327 Merge: c8ce94b8fe53 5d8f81ba1da5 Author: Linus Torvalds Date: Wed Nov 21 11:28:20 2018 -0800 Merge tag 'riscv-for-linus-4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux Pull RISC-V fixes from Palmer Dabbelt: "This week is a bit bigger than I expected. That's my fault, as I missed a few patches while I was at Plumbers last week. We have: - A fix to a quite embarassing issue where raw_copy_to_user() was implemented with asm_copy_from_user() (and vice versa). - Improvements to our makefile to allow flat binaries to be generated. - A build fix that predeclares "struct module" at the top of , which triggers warnings later in that header. - The addition of our own header, which is necessary to align our stat ABI on 32-bit systems. - A fix to avoid printing a warning when the S or U bits are set in print_isa(). I already have one patch in the queue for next week" * tag 'riscv-for-linus-4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux: RISC-V: recognize S/U mode bits in print_isa riscv: add asm/unistd.h UAPI header riscv: fix warning in arch/riscv/include/asm/module.h RISC-V: Build flat and compressed kernel images RISC-V: Fix raw_copy_{to,from}_user() commit 6b04114f6fae5e84d33404c2970b1949c032546e Author: Alexey Brodkin Date: Tue Nov 20 13:30:19 2018 +0300 arc: [devboards] Add support of NFSv3 ACL By default NFSv3 doesn't support ACL (Access Control Lists) which might be quite convenient to have so that mounted NFS behaves exactly as any other local file-system. In particular missing support of ACL makes umask useless. This among other thigs fixes Glibc's "nptl/tst-umask1". Signed-off-by: Alexey Brodkin Cc: Cupertino Miranda Cc: stable@vger.kernel.org #4.14+ Signed-off-by: Vineet Gupta commit c50cbd85cd7027d32ac5945bb60217936b4f7eaf Author: Dmitry V. Levin Date: Wed Nov 21 22:14:39 2018 +0300 mips: fix mips_get_syscall_arg o32 check When checking for TIF_32BIT_REGS flag, mips_get_syscall_arg() should use the task specified as its argument instead of the current task. This potentially affects all syscall_get_arguments() users who specify tasks different from the current. Fixes: c0ff3c53d4f99 ("MIPS: Enable HAVE_ARCH_TRACEHOOK.") Signed-off-by: Dmitry V. Levin Signed-off-by: Paul Burton Patchwork: https://patchwork.linux-mips.org/patch/21185/ Cc: Elvira Khabirova Cc: Ralf Baechle Cc: James Hogan Cc: linux-mips@linux-mips.org Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org # v3.13+ commit 8c110d43c6bca4b24dd13272a9d4e0ba6f2ec957 Author: Dave Chinner Date: Wed Nov 21 08:06:37 2018 -0800 iomap: readpages doesn't zero page tail beyond EOF When we read the EOF page of the file via readpages, we need to zero the region beyond EOF that we either do not read or should not contain data so that mmap does not expose stale data to user applications. However, iomap_adjust_read_range() fails to detect EOF correctly, and so fsx on 1k block size filesystems fails very quickly with mapreads exposing data beyond EOF. There are two problems here. Firstly, when calculating the end block of the EOF byte, we have to round the size by one to avoid a block aligned EOF from reporting a block too large. i.e. a size of 1024 bytes is 1 block, which in index terms is block 0. Therefore we have to calculate the end block from (isize - 1), not isize. The second bug is determining if the current page spans EOF, and so whether we need split it into two half, one for the IO, and the other for zeroing. Unfortunately, the code that checks whether we should split the block doesn't actually check if we span EOF, it just checks if the read spans the /offset in the page/ that EOF sits on. So it splits every read into two if EOF is not page aligned, regardless of whether we are reading the EOF block or not. Hence we need to restrict the "does the read span EOF" check to just the page that spans EOF, not every page we read. This patch results in correct EOF detection through readpages: xfs_vm_readpages: dev 259:0 ino 0x43 nr_pages 24 xfs_iomap_found: dev 259:0 ino 0x43 size 0x66c00 offset 0x4f000 count 98304 type hole startoff 0x13c startblock 1368 blockcount 0x4 iomap_readpage_actor: orig pos 323584 pos 323584, length 4096, poff 0 plen 4096, isize 420864 xfs_iomap_found: dev 259:0 ino 0x43 size 0x66c00 offset 0x50000 count 94208 type hole startoff 0x140 startblock 1497 blockcount 0x5c iomap_readpage_actor: orig pos 327680 pos 327680, length 94208, poff 0 plen 4096, isize 420864 iomap_readpage_actor: orig pos 331776 pos 331776, length 90112, poff 0 plen 4096, isize 420864 iomap_readpage_actor: orig pos 335872 pos 335872, length 86016, poff 0 plen 4096, isize 420864 iomap_readpage_actor: orig pos 339968 pos 339968, length 81920, poff 0 plen 4096, isize 420864 iomap_readpage_actor: orig pos 344064 pos 344064, length 77824, poff 0 plen 4096, isize 420864 iomap_readpage_actor: orig pos 348160 pos 348160, length 73728, poff 0 plen 4096, isize 420864 iomap_readpage_actor: orig pos 352256 pos 352256, length 69632, poff 0 plen 4096, isize 420864 iomap_readpage_actor: orig pos 356352 pos 356352, length 65536, poff 0 plen 4096, isize 420864 iomap_readpage_actor: orig pos 360448 pos 360448, length 61440, poff 0 plen 4096, isize 420864 iomap_readpage_actor: orig pos 364544 pos 364544, length 57344, poff 0 plen 4096, isize 420864 iomap_readpage_actor: orig pos 368640 pos 368640, length 53248, poff 0 plen 4096, isize 420864 iomap_readpage_actor: orig pos 372736 pos 372736, length 49152, poff 0 plen 4096, isize 420864 iomap_readpage_actor: orig pos 376832 pos 376832, length 45056, poff 0 plen 4096, isize 420864 iomap_readpage_actor: orig pos 380928 pos 380928, length 40960, poff 0 plen 4096, isize 420864 iomap_readpage_actor: orig pos 385024 pos 385024, length 36864, poff 0 plen 4096, isize 420864 iomap_readpage_actor: orig pos 389120 pos 389120, length 32768, poff 0 plen 4096, isize 420864 iomap_readpage_actor: orig pos 393216 pos 393216, length 28672, poff 0 plen 4096, isize 420864 iomap_readpage_actor: orig pos 397312 pos 397312, length 24576, poff 0 plen 4096, isize 420864 iomap_readpage_actor: orig pos 401408 pos 401408, length 20480, poff 0 plen 4096, isize 420864 iomap_readpage_actor: orig pos 405504 pos 405504, length 16384, poff 0 plen 4096, isize 420864 iomap_readpage_actor: orig pos 409600 pos 409600, length 12288, poff 0 plen 4096, isize 420864 iomap_readpage_actor: orig pos 413696 pos 413696, length 8192, poff 0 plen 4096, isize 420864 iomap_readpage_actor: orig pos 417792 pos 417792, length 4096, poff 0 plen 3072, isize 420864 iomap_readpage_actor: orig pos 420864 pos 420864, length 1024, poff 3072 plen 1024, isize 420864 As you can see, it now does full page reads until the last one which is split correctly at the block aligned EOF, reading 3072 bytes and zeroing the last 1024 bytes. The original version of the patch got this right, but it got another case wrong. The EOF detection crossing really needs to the the original length as plen, while it starts at the end of the block, will be shortened as up-to-date blocks are found on the page. This means "orig_pos + plen" no longer points to the end of the page, and so will not correctly detect EOF crossing. Hence we have to use the length passed in to detect this partial page case: xfs_filemap_fault: dev 259:1 ino 0x43 write_fault 0 xfs_vm_readpage: dev 259:1 ino 0x43 nr_pages 1 xfs_iomap_found: dev 259:1 ino 0x43 size 0x2cc00 offset 0x2c000 count 4096 type hole startoff 0xb0 startblock 282 blockcount 0x4 iomap_readpage_actor: orig pos 180224 pos 181248, length 4096, poff 1024 plen 2048, isize 183296 xfs_iomap_found: dev 259:1 ino 0x43 size 0x2cc00 offset 0x2cc00 count 1024 type hole startoff 0xb3 startblock 285 blockcount 0x1 iomap_readpage_actor: orig pos 183296 pos 183296, length 1024, poff 3072 plen 1024, isize 183296 Heere we see a trace where the first block on the EOF page is up to date, hence poff = 1024 bytes. The offset into the page of EOF is 3072, so the range we want to read is 1024 - 3071, and the range we want to zero is 3072 - 4095. You can see this is split correctly now. This fixes the stale data beyond EOF problem that fsx quickly uncovers on 1k block size filesystems. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 494633fac7896afc2bce6f83fe7319946270540b Author: Dave Chinner Date: Mon Nov 19 13:31:12 2018 -0800 vfs: vfs_dedupe_file_range() doesn't return EOPNOTSUPP It returns EINVAL when the operation is not supported by the filesystem. Fix it to return EOPNOTSUPP to be consistent with the man page and clone_file_range(). Clean up the inconsistent error return handling while I'm there. (I know, lipstick on a pig, but every little bit helps...) Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 4721a6010990971440b4ffefbdf014976b8eda2f Author: Dave Chinner Date: Mon Nov 19 13:31:11 2018 -0800 iomap: dio data corruption and spurious errors when pipes fill When doing direct IO to a pipe for do_splice_direct(), then pipe is trivial to fill up and overflow as it can only hold 16 pages. At this point bio_iov_iter_get_pages() then returns -EFAULT, and we abort the IO submission process. Unfortunately, iomap_dio_rw() propagates the error back up the stack. The error is converted from the EFAULT to EAGAIN in generic_file_splice_read() to tell the splice layers that the pipe is full. do_splice_direct() completely fails to handle EAGAIN errors (it aborts on error) and returns EAGAIN to the caller. copy_file_write() then completely fails to handle EAGAIN as well, and so returns EAGAIN to userspace, having failed to copy the data it was asked to. Avoid this whole steaming pile of fail by having iomap_dio_rw() silently swallow EFAULT errors and so do short reads. To make matters worse, iomap_dio_actor() has a stale data exposure bug bio_iov_iter_get_pages() fails - it does not zero the tail block that it may have been left uncovered by partial IO. Fix the error handling case to drop to the sub-block zeroing rather than immmediately returning the -EFAULT error. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Darrick J. Wong commit b450672fb66b4a991a5b55ee24209ac7ae7690ce Author: Dave Chinner Date: Mon Nov 19 13:31:10 2018 -0800 iomap: sub-block dio needs to zeroout beyond EOF If we are doing sub-block dio that extends EOF, we need to zero the unused tail of the block to initialise the data in it it. If we do not zero the tail of the block, then an immediate mmap read of the EOF block will expose stale data beyond EOF to userspace. Found with fsx running sub-block DIO sizes vs MAPREAD/MAPWRITE operations. Fix this by detecting if the end of the DIO write is beyond EOF and zeroing the tail if necessary. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 0929d8580071c6a1cec1a7916a8f674c243ceee1 Author: Dave Chinner Date: Mon Nov 19 13:31:10 2018 -0800 iomap: FUA is wrong for DIO O_DSYNC writes into unwritten extents When we write into an unwritten extent via direct IO, we dirty metadata on IO completion to convert the unwritten extent to written. However, when we do the FUA optimisation checks, the inode may be clean and so we issue a FUA write into the unwritten extent. This means we then bypass the generic_write_sync() call after unwritten extent conversion has ben done and we don't force the modified metadata to stable storage. This violates O_DSYNC semantics. The window of exposure is a single IO, as the next DIO write will see the inode has dirty metadata and hence will not use the FUA optimisation. Calling generic_write_sync() after completion of the second IO will also sync the first write and it's metadata. Fix this by avoiding the FUA optimisation when writing to unwritten extents. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 9230a0b65b47fe6856c4468ec0175c4987e5bede Author: Dave Chinner Date: Mon Nov 19 22:50:08 2018 -0800 xfs: delalloc -> unwritten COW fork allocation can go wrong Long saga. There have been days spent following this through dead end after dead end in multi-GB event traces. This morning, after writing a trace-cmd wrapper that enabled me to be more selective about XFS trace points, I discovered that I could get just enough essential tracepoints enabled that there was a 50:50 chance the fsx config would fail at ~115k ops. If it didn't fail at op 115547, I stopped fsx at op 115548 anyway. That gave me two traces - one where the problem manifested, and one where it didn't. After refining the traces to have the necessary information, I found that in the failing case there was a real extent in the COW fork compared to an unwritten extent in the working case. Walking back through the two traces to the point where the CWO fork extents actually diverged, I found that the bad case had an extra unwritten extent in it. This is likely because the bug it led me to had triggered multiple times in those 115k ops, leaving stray COW extents around. What I saw was a COW delalloc conversion to an unwritten extent (as they should always be through xfs_iomap_write_allocate()) resulted in a /written extent/: xfs_writepage: dev 259:0 ino 0x83 pgoff 0x17000 size 0x79a00 offset 0 length 0 xfs_iext_remove: dev 259:0 ino 0x83 state RC|LF|RF|COW cur 0xffff888247b899c0/2 offset 32 block 152 count 20 flag 1 caller xfs_bmap_add_extent_delay_real xfs_bmap_pre_update: dev 259:0 ino 0x83 state RC|LF|RF|COW cur 0xffff888247b899c0/1 offset 1 block 4503599627239429 count 31 flag 0 caller xfs_bmap_add_extent_delay_real xfs_bmap_post_update: dev 259:0 ino 0x83 state RC|LF|RF|COW cur 0xffff888247b899c0/1 offset 1 block 121 count 51 flag 0 caller xfs_bmap_add_ex Basically, Cow fork before: 0 1 32 52 +H+DDDDDDDDDDDD+UUUUUUUUUUU+ PREV RIGHT COW delalloc conversion allocates: 1 32 +uuuuuuuuuuuu+ NEW And the result according to the xfs_bmap_post_update trace was: 0 1 32 52 +H+wwwwwwwwwwwwwwwwwwwwwwww+ PREV Which is clearly wrong - it should be a merged unwritten extent, not an unwritten extent. That lead me to look at the LEFT_FILLING|RIGHT_FILLING|RIGHT_CONTIG case in xfs_bmap_add_extent_delay_real(), and sure enough, there's the bug. It takes the old delalloc extent (PREV) and adds the length of the RIGHT extent to it, takes the start block from NEW, removes the RIGHT extent and then updates PREV with the new extent. What it fails to do is update PREV.br_state. For delalloc, this is always XFS_EXT_NORM, while in this case we are converting the delayed allocation to unwritten, so it needs to be updated to XFS_EXT_UNWRITTEN. This LF|RF|RC case does not do this, and so the resultant extent is always written. And that's the bug I've been chasing for a week - a bmap btree bug, not a reflink/dedupe/copy_file_range bug, but a BMBT bug introduced with the recent in core extent tree scalability enhancements. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 2c307174ab77e34645e75e12827646e044d273c3 Author: Dave Chinner Date: Mon Nov 19 13:31:10 2018 -0800 xfs: flush removing page cache in xfs_reflink_remap_prep On a sub-page block size filesystem, fsx is failing with a data corruption after a series of operations involving copying a file with the destination offset beyond EOF of the destination of the file: 8093(157 mod 256): TRUNCATE DOWN from 0x7a120 to 0x50000 ******WWWW 8094(158 mod 256): INSERT 0x25000 thru 0x25fff (0x1000 bytes) 8095(159 mod 256): COPY 0x18000 thru 0x1afff (0x3000 bytes) to 0x2f400 8096(160 mod 256): WRITE 0x5da00 thru 0x651ff (0x7800 bytes) HOLE 8097(161 mod 256): COPY 0x2000 thru 0x5fff (0x4000 bytes) to 0x6fc00 The second copy here is beyond EOF, and it is to sub-page (4k) but block aligned (1k) offset. The clone runs the EOF zeroing, landing in a pre-existing post-eof delalloc extent. This zeroes the post-eof extents in the page cache just fine, dirtying the pages correctly. The problem is that xfs_reflink_remap_prep() now truncates the page cache over the range that it is copying it to, and rounds that down to cover the entire start page. This removes the dirty page over the delalloc extent from the page cache without having written it back. Hence later, when the page cache is flushed, the page at offset 0x6f000 has not been written back and hence exposes stale data, which fsx trips over less than 10 operations later. Fix this by changing xfs_reflink_remap_prep() to use xfs_flush_unmap_range(). Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit cb216b84d6ea24fa10f1e7aac35de77246841041 Author: Robin Murphy Date: Wed Nov 21 16:00:51 2018 +0000 swiotlb: Skip cache maintenance on map error If swiotlb_bounce_page() failed, calling arch_sync_dma_for_device() may lead to such delights as performing cache maintenance on whatever address phys_to_virt(SWIOTLB_MAP_ERROR) looks like, which is typically outside the kernel memory map and goes about as well as expected. Don't do that. Fixes: a4a4330db46a ("swiotlb: add support for non-coherent DMA") Tested-by: John Stultz Signed-off-by: Robin Murphy Signed-off-by: Christoph Hellwig commit b34087157dd76e8d96e5e52808134a791ac61e57 Author: Robin Murphy Date: Wed Nov 21 16:00:50 2018 +0000 dma-direct: Make DIRECT_MAPPING_ERROR viable for SWIOTLB With the overflow buffer removed, we no longer have a unique address which is guaranteed not to be a valid DMA target to use as an error token. The DIRECT_MAPPING_ERROR value of 0 tries to at least represent an unlikely DMA target, but unfortunately there are already SWIOTLB users with DMA-able memory at physical address 0 which now gets falsely treated as a mapping failure and leads to all manner of misbehaviour. The best we can do to mitigate that is flip DIRECT_MAPPING_ERROR to the other commonly-used error value of all-bits-set, since the last single byte of memory is by far the least-likely-valid DMA target. Fixes: dff8d6c1ed58 ("swiotlb: remove the overflow buffer") Reported-by: John Stultz Tested-by: John Stultz Acked-by: Konrad Rzeszutek Wilk Signed-off-by: Robin Murphy Signed-off-by: Christoph Hellwig commit a4390aee72713d9e73f1132bcdeb17d72fbbf974 Author: Robbie Ko Date: Wed Nov 14 18:32:37 2018 +0000 Btrfs: send, fix infinite loop due to directory rename dependencies When doing an incremental send, due to the need of delaying directory move (rename) operations we can end up in infinite loop at apply_children_dir_moves(). An example scenario that triggers this problem is described below, where directory names correspond to the numbers of their respective inodes. Parent snapshot: . |--- 261/ |--- 271/ |--- 266/ |--- 259/ |--- 260/ | |--- 267 | |--- 264/ | |--- 258/ | |--- 257/ | |--- 265/ |--- 268/ |--- 269/ | |--- 262/ | |--- 270/ |--- 272/ | |--- 263/ | |--- 275/ | |--- 274/ |--- 273/ Send snapshot: . |-- 275/ |-- 274/ |-- 273/ |-- 262/ |-- 269/ |-- 258/ |-- 271/ |-- 268/ |-- 267/ |-- 270/ |-- 259/ | |-- 265/ | |-- 272/ |-- 257/ |-- 260/ |-- 264/ |-- 263/ |-- 261/ |-- 266/ When processing inode 257 we delay its move (rename) operation because its new parent in the send snapshot, inode 272, was not yet processed. Then when processing inode 272, we delay the move operation for that inode because inode 274 is its ancestor in the send snapshot. Finally we delay the move operation for inode 274 when processing it because inode 275 is its new parent in the send snapshot and was not yet moved. When finishing processing inode 275, we start to do the move operations that were previously delayed (at apply_children_dir_moves()), resulting in the following iterations: 1) We issue the move operation for inode 274; 2) Because inode 262 depended on the move operation of inode 274 (it was delayed because 274 is its ancestor in the send snapshot), we issue the move operation for inode 262; 3) We issue the move operation for inode 272, because it was delayed by inode 274 too (ancestor of 272 in the send snapshot); 4) We issue the move operation for inode 269 (it was delayed by 262); 5) We issue the move operation for inode 257 (it was delayed by 272); 6) We issue the move operation for inode 260 (it was delayed by 272); 7) We issue the move operation for inode 258 (it was delayed by 269); 8) We issue the move operation for inode 264 (it was delayed by 257); 9) We issue the move operation for inode 271 (it was delayed by 258); 10) We issue the move operation for inode 263 (it was delayed by 264); 11) We issue the move operation for inode 268 (it was delayed by 271); 12) We verify if we can issue the move operation for inode 270 (it was delayed by 271). We detect a path loop in the current state, because inode 267 needs to be moved first before we can issue the move operation for inode 270. So we delay again the move operation for inode 270, this time we will attempt to do it after inode 267 is moved; 13) We issue the move operation for inode 261 (it was delayed by 263); 14) We verify if we can issue the move operation for inode 266 (it was delayed by 263). We detect a path loop in the current state, because inode 270 needs to be moved first before we can issue the move operation for inode 266. So we delay again the move operation for inode 266, this time we will attempt to do it after inode 270 is moved (its move operation was delayed in step 12); 15) We issue the move operation for inode 267 (it was delayed by 268); 16) We verify if we can issue the move operation for inode 266 (it was delayed by 270). We detect a path loop in the current state, because inode 270 needs to be moved first before we can issue the move operation for inode 266. So we delay again the move operation for inode 266, this time we will attempt to do it after inode 270 is moved (its move operation was delayed in step 12). So here we added again the same delayed move operation that we added in step 14; 17) We attempt again to see if we can issue the move operation for inode 266, and as in step 16, we realize we can not due to a path loop in the current state due to a dependency on inode 270. Again we delay inode's 266 rename to happen after inode's 270 move operation, adding the same dependency to the empty stack that we did in steps 14 and 16. The next iteration will pick the same move dependency on the stack (the only entry) and realize again there is still a path loop and then again the same dependency to the stack, over and over, resulting in an infinite loop. So fix this by preventing adding the same move dependency entries to the stack by removing each pending move record from the red black tree of pending moves. This way the next call to get_pending_dir_moves() will not return anything for the current parent inode. A test case for fstests, with this reproducer, follows soon. Signed-off-by: Robbie Ko Reviewed-by: Filipe Manana [Wrote changelog with example and more clear explanation] Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit b1a9d7b0190119dad5b9b7841751b5a7586bbc8b Merge: 2a5bf23d5b79 a4243e149453 Author: Ingo Molnar Date: Wed Nov 21 15:57:21 2018 +0100 Merge tag 'perf-urgent-for-mingo-4.20-20181121' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent fixes: - Update kernel ABI headers, one of them lead to a small change in the ioctl 'cmd' beautifier in 'perf trace' to support the new ISO7816 commands. (Arnaldo Carvalho de Melo) - Restore proper cwd on return from mnt namespace (Jiri Olsa) - Add feature check for the get_current_dir_name() function used in the namespace fix from Jiri, that is not available in systems such as Alpine Linux, which uses the musl libc (Arnaldo Carvalho de Melo) - Fix crash in 'perf record' when synthesizing the unit for events such as 'cpu-clock' (Jiri Olsa) Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit 14b04063cc994effc86f976625bf8f806d8d44cb Merge: 8dc765d438f1 4cff280a5fcc Author: Jens Axboe Date: Wed Nov 21 05:56:28 2018 -0700 Merge branch 'nvme-4.20' of git://git.infradead.org/nvme into for-linus Pull NVMe fix from Christoph. * 'nvme-4.20' of git://git.infradead.org/nvme: nvme-fc: resolve io failures during connect commit 0db699f747cc24835af77a34852882a33b3e1fc6 Merge: 9ff01193a20d dbc4ca339c8d Author: Rafael J. Wysocki Date: Wed Nov 21 13:33:06 2018 +0100 Merge tag 'linux-cpupower-4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux Pull cpupower utility updates for 4.20-rc4 from Shuah Khan: "This cpupower update for Linux 4.20-rc4 consists of compile fixes to allow use of outside build flags and override of CFLAGS from Jiri Olsa, and fix to compilation with STATIC=true from Konstantin Khlebnikov." * tag 'linux-cpupower-4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux: tools cpupower: Override CFLAGS assignments tools cpupower debug: Allow to use outside build flags tools/power/cpupower: fix compilation with STATIC=true commit f559156c399cfb11d53a128d210118fbea36816e Author: Ville Syrjälä Date: Tue Nov 20 15:54:50 2018 +0200 drm/i915: Add rotation readout for plane initial config If we need to force a full plane update before userspace/fbdev have given us a proper plane state we should try to maintain the current plane state as much as possible (apart from the parts of the state we're trying to fix up with the plane update). To that end add basic readout for the plane rotation and maintain it during the initial fb takeover. Cc: Hans de Goede Fixes: 516a49cc1946 ("drm/i915: Fix assert_plane() warning on bootup with external display") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20181120135450.3634-2-ville.syrjala@linux.intel.com Tested-by: Hans de Goede Reviewed-by: Rodrigo Vivi Reviewed-by: Maarten Lankhorst (cherry picked from commit f43348a3db89305bb1935da9fe4499fdcdde9796) Signed-off-by: Joonas Lahtinen commit c773058dde9a4f919a8069f3828d9f4adb1fce1e Author: Ville Syrjälä Date: Tue Nov 20 15:54:49 2018 +0200 drm/i915: Force a LUT update in intel_initial_commit() If we force a plane update to fix up our half populated plane state we'll also force on the pipe gamma for the plane (since we always enable pipe gamma currently). If the BIOS hasn't programmed a sensible LUT into the hardware this will cause the image to become corrupted. Typical symptoms are a purple/yellow/etc. flash when the driver loads. To avoid this let's program something sensible into the LUT when we do the plane update. In the future I plan to add proper plane gamma enable readout so this is just a temporary measure. Cc: Hans de Goede Fixes: 516a49cc1946 ("drm/i915: Fix assert_plane() warning on bootup with external display") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20181120135450.3634-1-ville.syrjala@linux.intel.com Tested-by: Hans de Goede Reviewed-by: Rodrigo Vivi (cherry picked from commit fa6af5145b4e87a30a530be0d80734a9dd40da77) Signed-off-by: Joonas Lahtinen commit 2bbb5fa37475d7aa5fa62f34db1623f3da2dfdfa Author: Hans de Goede Date: Mon Nov 19 19:06:01 2018 +0100 ACPI / platform: Add SMB0001 HID to forbidden_id_list Many HP AMD based laptops contain an SMB0001 device like this: Device (SMBD) { Name (_HID, "SMB0001") // _HID: Hardware ID Name (_CRS, ResourceTemplate () // _CRS: Current Resource Settings { IO (Decode16, 0x0B20, // Range Minimum 0x0B20, // Range Maximum 0x20, // Alignment 0x20, // Length ) IRQ (Level, ActiveLow, Shared, ) {7} }) } The legacy style IRQ resource here causes acpi_dev_get_irqresource() to be called with legacy=true and this message to show in dmesg: ACPI: IRQ 7 override to edge, high This causes issues when later on the AMD0030 GPIO device gets enumerated: Device (GPIO) { Name (_HID, "AMDI0030") // _HID: Hardware ID Name (_CID, "AMDI0030") // _CID: Compatible ID Name (_UID, Zero) // _UID: Unique ID Method (_CRS, 0, NotSerialized) // _CRS: Current Resource Settings { Name (RBUF, ResourceTemplate () { Interrupt (ResourceConsumer, Level, ActiveLow, Shared, ,, ) { 0x00000007, } Memory32Fixed (ReadWrite, 0xFED81500, // Address Base 0x00000400, // Address Length ) }) Return (RBUF) /* \_SB_.GPIO._CRS.RBUF */ } } Now acpi_dev_get_irqresource() gets called with legacy=false, but because of the earlier override of the trigger-type acpi_register_gsi() returns -EBUSY (because we try to register the same interrupt with a different trigger-type) and we end up setting IORESOURCE_DISABLED in the flags. The setting of IORESOURCE_DISABLED causes platform_get_irq() to call acpi_irq_get() which is not implemented on x86 and returns -EINVAL. resulting in the following in dmesg: amd_gpio AMDI0030:00: Failed to get gpio IRQ: -22 amd_gpio: probe of AMDI0030:00 failed with error -22 The SMB0001 is a "virtual" device in the sense that the only way the OS interacts with it is through calling a couple of methods to do SMBus transfers. As such it is weird that it has IO and IRQ resources at all, because the driver for it is not expected to ever access the hardware directly. The Linux driver for the SMB0001 device directly binds to the acpi_device through the acpi_bus, so we do not need to instantiate a platform_device for this ACPI device. This commit adds the SMB0001 HID to the forbidden_id_list, avoiding the instantiating of a platform_device for it. Not instantiating a platform_device means we will no longer call acpi_dev_get_irqresource() for the legacy IRQ resource fixing the probe of the AMDI0030 device failing. BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1644013 BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=198715 BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=199523 Reported-by: Lukas Kahnert Tested-by: Marc Cc: All applicable Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 4ab7ca092c3c7ac8b16aa28eba723a8868f82f14 Author: Romain Izard Date: Tue Nov 20 17:57:37 2018 +0100 ARM: dts: at91: sama5d2: use the divided clock for SMC The SAMA5D2 is different from SAMA5D3 and SAMA5D4, as there are two different clocks for the peripherals in the SoC. The Static Memory controller is connected to the divided master clock. Unfortunately, the device tree does not correctly show this and uses the master clock directly. This clock is then used by the code for the NAND controller to calculate the timings for the controller, and we end up with slow NAND Flash access. Fix the device tree, and the performance of Flash access is improved. Signed-off-by: Romain Izard Signed-off-by: Alexandre Belloni commit 155b8a0492a90a4c6e22f046a3568b92a6bc48da Author: Amir Goldstein Date: Mon Nov 5 07:50:10 2018 +0200 ovl: fix decode of dir file handle with multi lower layers When decoding a lower file handle, we first call ovl_check_origin_fh() with connected=false to get any real lower dentry for overlay inode cache lookup. If the real dentry is a disconnected dir dentry, ovl_check_origin_fh() is called again with connected=true to get a connected real dentry and find the lower layer the real dentry belongs to. If the first call returned a connected real dentry, we use it to lookup an overlay connected dentry, but the first ovl_check_origin_fh() call with connected=false did not check that the found dentry is under the root of the layer (see ovl_acceptable()), it only checked that the found dentry super block matches the uuid of the lower file handle. In case there are multiple lower layers on the same fs and the found dentry is not from the top most lower layer, using the layer index returned from the first ovl_check_origin_fh() is wrong and we end up failing to decode the file handle. Fix this by always calling ovl_check_origin_fh() with connected=true if we got a directory dentry in the first call. Fixes: 8b58924ad55c ("ovl: lookup in inode cache first when decoding...") Cc: # v4.17 Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit 8fd3b90300bec541806dac271de2fd44e2e4e2d2 Author: Paul Kocialkowski Date: Thu Nov 15 17:32:48 2018 +0100 drm/fb-helper: Blacklist writeback when adding connectors to fbdev Writeback connectors do not produce any on-screen output and require special care for use. Such connectors are hidden from enumeration in DRM resources by default, but they are still picked-up by fbdev. This makes rather little sense since fbdev is not really adapted for dealing with writeback. Moreover, this is also a source of issues when userspace disables the CRTC (and associated plane) without detaching the CRTC from the connector (which is hidden by default). In this case, the connector is still using the CRTC, leading to am "enabled/connectors mismatch" and eventually the failure of the associated atomic commit. This situation happens with VC4 testing under IGT GPU Tools. Filter out writeback connectors in the fbdev helper to solve this. Signed-off-by: Paul Kocialkowski Reviewed-by: Boris Brezillon Reviewed-by: Maxime Ripard Tested-by: Maxime Ripard Fixes: 935774cd71fe ("drm: Add writeback connector type") Cc: # v4.19+ Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20181115163248.21168-1-paul.kocialkowski@bootlin.com commit 7513edbc096a006f967eaf39088091442e623b83 Author: Chris Wilson Date: Tue Nov 20 20:24:38 2018 +0000 drm/i915/gvt: Avoid use-after-free iterating the gtt list Found by smatch: drivers/gpu/drm/i915/gvt/gtt.c:2452 intel_vgpu_destroy_ggtt_mm() error: dereferencing freed memory 'pos' Signed-off-by: Chris Wilson Cc: Zhenyu Wang Reviewed-by: Zhenyu Wang Signed-off-by: Zhenyu Wang commit b181b3b801da8893c8eb706e448dd5111b02de60 Author: Stephen Boyd Date: Mon Nov 5 11:40:11 2018 -0800 clk: qcom: Support 'protected-clocks' property Certain firmware configurations "protect" clks and cause the entire system to reboot when a non-secure OS such as Linux tries to read or write protected clk registers. But other firmware configurations allow reading or writing the same registers, and they may actually require that the OS use the otherwise locked down clks. Support the 'protected-clocks' property by never registering these protected clks with the common clk framework. This way, when firmware is protecting these clks we won't have the chance to ever read or write these registers and take down the entire system. Cc: Taniya Das Cc: Bjorn Andersson Signed-off-by: Stephen Boyd Reviewed-by: Bjorn Andersson Signed-off-by: Stephen Boyd commit 48d7f160b10711f014bf07b574c73452646c9fdd Author: Stephen Boyd Date: Mon Nov 5 11:40:10 2018 -0800 dt-bindings: clk: Introduce 'protected-clocks' property Add a generic clk property for clks which are not intended to be used by the OS due to security restrictions put in place by firmware. For example, on some Qualcomm firmwares reading or writing certain clk registers causes the entire system to reboot, but on other firmwares reading and writing those same registers is required to make devices like QSPI work. Rather than adding one-off properties each time a new set of clks appears to be protected, let's add a generic clk property to describe any set of clks that shouldn't be touched by the OS. This way we never need to register the clks or use them in certain firmware configurations. Cc: Rob Herring Cc: Bjorn Andersson Cc: Taniya Das Signed-off-by: Stephen Boyd Reviewed-by: Bjorn Andersson Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd commit c88520db18ba0b9a41326c3b8680e7c09eb4c381 Author: Manu Gautam Date: Tue Oct 16 12:52:07 2018 +0530 phy: qcom-qusb2: Fix HSTX_TRIM tuning with fused value for SDM845 Tune1 register on sdm845 is used to update HSTX_TRIM with fused setting. Enable same by specifying update_tune1_with_efuse flag for sdm845, otherwise driver ends up programming tune2 register. Fixes: ef17f6e212ca ("phy: qcom-qusb2: Add QUSB2 PHYs support for sdm845") Signed-off-by: Manu Gautam Reviewed-by: Douglas Anderson Reviewed-by: Stephen Boyd Acked-by: Vivek Gautam Signed-off-by: Kishon Vijay Abraham I commit 6e34d358b24ffc40764eb3681164c79091765429 Author: Manu Gautam Date: Tue Oct 16 12:52:06 2018 +0530 phy: qcom-qusb2: Use HSTX_TRIM fused value as is Fix HSTX_TRIM tuning logic which instead of using fused value as HSTX_TRIM, incorrectly performs bitwise OR operation with existing default value. Fixes: ca04d9d3e1b1 ("phy: qcom-qusb2: New driver for QUSB2 PHY on Qcom chips") Signed-off-by: Manu Gautam Reviewed-by: Douglas Anderson Reviewed-by: Stephen Boyd Acked-by: Vivek Gautam Signed-off-by: Kishon Vijay Abraham I commit f8577fb3c273bcae821a5254c8fbcf82016d9a8d Author: Chris Wilson Date: Mon Nov 19 15:41:53 2018 +0000 drm/i915: Write GPU relocs harder with gen3 Under moderate amounts of GPU stress, we can observe on Bearlake and Pineview (later gen3 models) that we execute the following batch buffer before the write into the batch is coherent. Adding extra (tested with upto 32x) MI_FLUSH to either the invalidation, flush or both phases does not solve the incoherency issue with the relocations, but emitting the MI_STORE_DWORD_IMM twice does. So be it. Fixes: 7dd4f6729f92 ("drm/i915: Async GPU relocation processing") Testcase: igt/gem_tiled_fence_blits # blb/pnv Signed-off-by: Chris Wilson Cc: Joonas Lahtinen Reviewed-by: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20181119154153.15327-1-chris@chris-wilson.co.uk (cherry picked from commit 7fa28e146994da1e8a4124623d7da97b798ea520) Signed-off-by: Joonas Lahtinen commit f2cbd485282014132851bf37cb2ca624a456275d Author: Davide Caratti Date: Tue Nov 20 22:18:44 2018 +0100 net/sched: act_police: fix race condition on state variables after 'police' configuration parameters were converted to use RCU instead of spinlock, the state variables used to compute the traffic rate (namely 'tcfp_toks', 'tcfp_ptoks' and 'tcfp_t_c') are erroneously read/updated in the traffic path without any protection. Use a dedicated spinlock to avoid race conditions on these variables, and ensure proper cache-line alignment. In this way, 'police' is still faster than what we observed when 'tcf_lock' was used in the traffic path _ i.e. reverting commit 2d550dbad83c ("net/sched: act_police: don't use spinlock in the data path"). Moreover, we preserve the throughput improvement that was obtained after 'police' started using per-cpu counters, when 'avrate' is used instead of 'rate'. Changes since v1 (thanks to Eric Dumazet): - call ktime_get_ns() before acquiring the lock in the traffic path - use a dedicated spinlock instead of tcf_lock - improve cache-line usage Fixes: 2d550dbad83c ("net/sched: act_police: don't use spinlock in the data path") Reported-and-suggested-by: Eric Dumazet Signed-off-by: Davide Caratti Reviewed-by: Eric Dumazet commit c8ce94b8fe5324aca4c10baeb53dea2d5775a170 Merge: 06e68fed3282 1229ace4a4a2 Author: Linus Torvalds Date: Tue Nov 20 14:31:00 2018 -0800 Merge tag 'mips_fixes_4.20_3' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Paul Burton: "A few MIPS fixes for 4.20: - Re-enable the Cavium Octeon USB driver in its defconfig after it was accidentally removed back in 4.14. - Have early memblock allocations be performed bottom-up to more closely match the behaviour we used to have with bootmem, which seems a safer choice since we've seen fallout from the change made in the 4.20 merge window. - Simplify max_low_pfn calculation in the NUMA code for the Loongson3 and SGI IP27 platforms to both clean up the code & ensure max_low_pfn has been set appropriately before it is used" * tag 'mips_fixes_4.20_3' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: Loongson3,SGI-IP27: Simplify max_low_pfn calculation MIPS: Let early memblock_alloc*() allocate memories bottom-up MIPS: OCTEON: cavium_octeon_defconfig: re-enable OCTEON USB driver commit b1d982330134bbba371821bc850da6fa4bfa3271 Author: Heiner Kallweit Date: Tue Nov 20 21:22:50 2018 +0100 MAINTAINERS: add myself as co-maintainer for r8169 Meanwhile I know the driver quite well and I refactored bigger parts of it. As a result people contact me already with r8169 questions. Therefore I'd volunteer to become co-maintainer of the driver also officially. Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit a5d0f4565996e5595a10cb57b3d1e3d74379c502 Author: Kenneth Feng Date: Mon Nov 19 14:49:16 2018 +0800 drm/amdgpu: Enable HDP memory light sleep Due to the register name and setting change of HDP memory light sleep on Vega20,change accordingly in the driver. Signed-off-by: Kenneth Feng Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit 7f9f71be84bcab368e58020a42f6d0dd97adf0ce Author: Dave Chinner Date: Mon Nov 19 13:31:09 2018 -0800 xfs: extent shifting doesn't fully invalidate page cache The extent shifting code uses a flush and invalidate mechainsm prior to shifting extents around. This is similar to what xfs_free_file_space() does, but it doesn't take into account things like page cache vs block size differences, and it will fail if there is a page that it currently busy. xfs_flush_unmap_range() handles all of these cases, so just convert xfs_prepare_shift() to us that mechanism rather than having it's own special sauce. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit c08768977b9a65cab9bcfd1ba30ffb686b2b7c69 Author: Dave Chinner Date: Mon Nov 19 13:31:08 2018 -0800 xfs: finobt AG reserves don't consider last AG can be a runt The last AG may be very small comapred to all other AGs, and hence AG reservations based on the superblock AG size may actually consume more space than the AG actually has. This results on assert failures like: XFS: Assertion failed: xfs_perag_resv(pag, XFS_AG_RESV_METADATA)->ar_reserved + xfs_perag_resv(pag, XFS_AG_RESV_RMAPBT)->ar_reserved <= pag->pagf_freeblks + pag->pagf_flcount, file: fs/xfs/libxfs/xfs_ag_resv.c, line: 319 [ 48.932891] xfs_ag_resv_init+0x1bd/0x1d0 [ 48.933853] xfs_fs_reserve_ag_blocks+0x37/0xb0 [ 48.934939] xfs_mountfs+0x5b3/0x920 [ 48.935804] xfs_fs_fill_super+0x462/0x640 [ 48.936784] ? xfs_test_remount_options+0x60/0x60 [ 48.937908] mount_bdev+0x178/0x1b0 [ 48.938751] mount_fs+0x36/0x170 [ 48.939533] vfs_kern_mount.part.43+0x54/0x130 [ 48.940596] do_mount+0x20e/0xcb0 [ 48.941396] ? memdup_user+0x3e/0x70 [ 48.942249] ksys_mount+0xba/0xd0 [ 48.943046] __x64_sys_mount+0x21/0x30 [ 48.943953] do_syscall_64+0x54/0x170 [ 48.944835] entry_SYSCALL_64_after_hwframe+0x49/0xbe Hence we need to ensure the finobt per-ag space reservations take into account the size of the last AG rather than treat it like all the other full size AGs. Note that both refcountbt and rmapbt already take the size of the AG into account via reading the AGF length directly. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit d43aaf1685aa471f0593685c9f54d53e3af3cf3f Author: Dave Chinner Date: Mon Nov 19 13:31:08 2018 -0800 xfs: fix transient reference count error in xfs_buf_resubmit_failed_buffers When retrying a failed inode or dquot buffer, xfs_buf_resubmit_failed_buffers() clears all the failed flags from the inde/dquot log items. In doing so, it also drops all the reference counts on the buffer that the failed log items hold. This means it can drop all the active references on the buffer and hence free the buffer before it queues it for write again. Putting the buffer on the delwri queue takes a reference to the buffer (so that it hangs around until it has been written and completed), but this goes bang if the buffer has already been freed. Hence we need to add the buffer to the delwri queue before we remove the failed flags from the log items attached to the buffer to ensure it always remains referenced during the resubmit process. Reported-by: Josef Bacik Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit d61fa8cbf3da85ffca6620f261354941c126ee23 Author: Dave Chinner Date: Mon Nov 19 13:31:07 2018 -0800 xfs: uncached buffer tracing needs to print bno Useless: xfs_buf_get_uncached: dev 253:32 bno 0xffffffffffffffff nblks 0x1 ... xfs_buf_unlock: dev 253:32 bno 0xffffffffffffffff nblks 0x1 ... xfs_buf_submit: dev 253:32 bno 0xffffffffffffffff nblks 0x1 ... xfs_buf_hold: dev 253:32 bno 0xffffffffffffffff nblks 0x1 ... xfs_buf_iowait: dev 253:32 bno 0xffffffffffffffff nblks 0x1 ... xfs_buf_iodone: dev 253:32 bno 0xffffffffffffffff nblks 0x1 ... xfs_buf_iowait_done: dev 253:32 bno 0xffffffffffffffff nblks 0x1 ... xfs_buf_rele: dev 253:32 bno 0xffffffffffffffff nblks 0x1 ... Useful: xfs_buf_get_uncached: dev 253:32 bno 0xffffffffffffffff nblks 0x1 ... xfs_buf_unlock: dev 253:32 bno 0xffffffffffffffff nblks 0x1 ... xfs_buf_submit: dev 253:32 bno 0x200b5 nblks 0x1 ... xfs_buf_hold: dev 253:32 bno 0x200b5 nblks 0x1 ... xfs_buf_iowait: dev 253:32 bno 0x200b5 nblks 0x1 ... xfs_buf_iodone: dev 253:32 bno 0x200b5 nblks 0x1 ... xfs_buf_iowait_done: dev 253:32 bno 0x200b5 nblks 0x1 ... xfs_buf_rele: dev 253:32 bno 0x200b5 nblks 0x1 ... Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit cadf9df27e7cf40e390e060a1c71bb86ecde798b Author: Stephen Mallon Date: Tue Nov 20 19:15:02 2018 +1100 tcp: Fix SOF_TIMESTAMPING_RX_HARDWARE to use the latest timestamp during TCP coalescing During tcp coalescing ensure that the skb hardware timestamp refers to the highest sequence number data. Previously only the software timestamp was updated during coalescing. Signed-off-by: Stephen Mallon Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 59663e42199c93d1d7314d1446f6782fc4b1eb81 Author: Siva Reddy Kallam Date: Tue Nov 20 10:04:04 2018 +0530 tg3: Add PHY reset for 5717/5719/5720 in change ring and flow control paths This patch has the fix to avoid PHY lockup with 5717/5719/5720 in change ring and flow control paths. This patch solves the RX hang while doing continuous ring or flow control parameters with heavy traffic from peer. Signed-off-by: Siva Reddy Kallam Acked-by: Michael Chan Signed-off-by: David S. Miller commit 22566c1603030f0a036ad564634b064ad1a55db2 Author: Artem Savkov Date: Tue Nov 20 11:52:16 2018 -0600 objtool: Fix segfault in .cold detection with -ffunction-sections Because find_symbol_by_name() traverses the same lists as read_symbols(), changing sym->name in place without copying it affects the result of find_symbol_by_name(). In the case where a ".cold" function precedes its parent in sec->symbol_list, it can result in a function being considered a parent of itself. This leads to function length being set to 0 and other consequent side-effects including a segfault in add_switch_table(). The effects of this bug are only visible when building with -ffunction-sections in KCFLAGS. Fix by copying the search string instead of modifying it in place. Signed-off-by: Artem Savkov Signed-off-by: Josh Poimboeuf Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Fixes: 13810435b9a7 ("objtool: Support GCC 8's cold subfunctions") Link: http://lkml.kernel.org/r/910abd6b5a4945130fd44f787c24e07b9e07c8da.1542736240.git.jpoimboe@redhat.com Signed-off-by: Ingo Molnar commit 0b9301fb632f7111a3293a30cc5b20f1b82ed08d Author: Artem Savkov Date: Tue Nov 20 11:52:15 2018 -0600 objtool: Fix double-free in .cold detection error path If read_symbols() fails during second list traversal (the one dealing with ".cold" subfunctions) it frees the symbol, but never deletes it from the list/hash_table resulting in symbol being freed again in elf_close(). Fix it by just returning an error, leaving cleanup to elf_close(). Signed-off-by: Artem Savkov Signed-off-by: Josh Poimboeuf Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Fixes: 13810435b9a7 ("objtool: Support GCC 8's cold subfunctions") Link: http://lkml.kernel.org/r/beac5a9b7da9e8be90223459dcbe07766ae437dd.1542736240.git.jpoimboe@redhat.com Signed-off-by: Ingo Molnar commit 2a5bf23d5b795d5df33dc284e8f5cf8b6a5b4042 Author: Peter Zijlstra Date: Tue Nov 20 18:08:42 2018 +0100 perf/x86/intel: Fix regression by default disabling perfmon v4 interrupt handling Kyle Huey reported that 'rr', a replay debugger, broke due to the following commit: af3bdb991a5c ("perf/x86/intel: Add a separate Arch Perfmon v4 PMI handler") Rework the 'disable_counter_freezing' __setup() parameter such that we can explicitly enable/disable it and switch to default disabled. To this purpose, rename the parameter to "perf_v4_pmi=" which is a much better description and allows requiring a bool argument. [ mingo: Improved the changelog some more. ] Reported-by: Kyle Huey Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Kan Liang Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Robert O'Callahan Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Cc: acme@kernel.org Link: http://lkml.kernel.org/r/20181120170842.GZ2131@hirez.programming.kicks-ass.net Signed-off-by: Ingo Molnar commit cb3b2ffb757e75fef40fb94bc093cbbf49a6bf6e Author: Hans Verkuil Date: Sat Nov 17 06:25:08 2018 -0500 media: vicodec: fix memchr() kernel oops The size passed to memchr is too large as it assumes the search starts at the start of the buffer, but it can start at an offset. Cc: # for v4.19 and up Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 0408b205f1ae60c1b99c9888ac0326543d96a091 Author: Hans Verkuil Date: Thu Nov 15 02:49:24 2018 -0500 media: cedrus: add action item to the TODO Mention that the request validation should increment the memory refcount of reference buffers so we don't forget to do this. Acked-by: Paul Kocialkowski Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit f44e361e37eb074df2e2ca204ef31c834ce44af8 Author: Jernej Skrabec Date: Sun Nov 11 06:06:21 2018 -0500 media: media-request: Add compat ioctl Currently media request ioctl operations fail on 64-bit kernel with 32-bit userspace due to missing .compat_ioctl callback. Because no ioctl command uses any argument, just reuse existing ioctl handler for compat_ioctl too. Signed-off-by: Jernej Skrabec Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 4212368750cf94623f5b382293625dbb3d8d041a Author: Jasmin Jessich Date: Fri Nov 9 16:06:05 2018 -0500 media: Use wait_queue_head_t for media_request The portable type for a wait queue is wait_queue_head_t. Signed-off-by: Jasmin Jessich Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 544b03da39e2d7b4961d3163976ed4bfb1fac509 Author: Will Deacon Date: Mon Nov 19 11:07:18 2018 +0000 Documentation/security-bugs: Postpone fix publication in exceptional cases At the request of the reporter, the Linux kernel security team offers to postpone the publishing of a fix for up to 5 business days from the date of a report. While it is generally undesirable to keep a fix private after it has been developed, this short window is intended to allow distributions to package the fix into their kernel builds and permits early inclusion of the security team in the case of a co-ordinated disclosure with other parties. Unfortunately, discussions with major Linux distributions and cloud providers has revealed that 5 business days is not sufficient to achieve either of these two goals. As an example, cloud providers need to roll out KVM security fixes to a global fleet of hosts with sufficient early ramp-up and monitoring. An end-to-end timeline of less than two weeks dramatically cuts into the amount of early validation and increases the chance of guest-visible regressions. The consequence of this timeline mismatch is that security issues are commonly fixed without the involvement of the Linux kernel security team and are instead analysed and addressed by an ad-hoc group of developers across companies contributing to Linux. In some cases, mainline (and therefore the official stable kernels) can be left to languish for extended periods of time. This undermines the Linux kernel security process and puts upstream developers in a difficult position should they find themselves involved with an undisclosed security problem that they are unable to report due to restrictions from their employer. To accommodate the needs of these users of the Linux kernel and encourage them to engage with the Linux security team when security issues are first uncovered, extend the maximum period for which fixes may be delayed to 7 calendar days, or 14 calendar days in exceptional cases, where the logistics of QA and large scale rollouts specifically need to be accommodated. This brings parity with the linux-distros@ maximum embargo period of 14 calendar days. Cc: Paolo Bonzini Cc: David Woodhouse Cc: Amit Shah Cc: Laura Abbott Acked-by: Kees Cook Co-developed-by: Thomas Gleixner Co-developed-by: David Woodhouse Signed-off-by: Thomas Gleixner Signed-off-by: David Woodhouse Signed-off-by: Will Deacon Reviewed-by: Tyler Hicks Acked-by: Peter Zijlstra Signed-off-by: Greg Kroah-Hartman commit cb5d21946d2a2f4687c482ab4604af1d29dac35a Author: Greg Kroah-Hartman Date: Thu Nov 15 15:03:24 2018 -0800 MAINTAINERS: Add Sasha as a stable branch maintainer Sasha has somehow been convinced into helping me with the stable kernel maintenance. Codify this slip in good judgement before he realizes what he really signed up for :) Signed-off-by: Greg Kroah-Hartman Acked-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman commit a3e620f8422832afd832ad5e20aa97d0c72bada8 Author: Keyon Jie Date: Fri Nov 16 18:47:04 2018 -0600 ASoC: acpi: fix: continue searching when machine is ignored The machine_quirk may return NULL which means the acpi entries should be skipped and search for next matched entry is needed, here add return check here and continue for NULL case. Signed-off-by: Keyon Jie Signed-off-by: Pierre-Louis Bossart Signed-off-by: Mark Brown commit 8c4e7c2ee8096b5ca8214418f287b3878d578cc0 Author: Pierre-Louis Bossart Date: Sun Nov 18 16:38:09 2018 -0600 ASoC: Intel: Skylake: fix Kconfigs, make HDaudio codec optional The Skylake driver currently has a set of problems supporting load/unload modules. We need to make the HDaudio codec support optional to help narrow down the issues. Support for HDaudio codecs also leads to a Kconfig issue. We want the hdac_hda codec to be compilable independently of Skylake (e.g. with ALL_CODECS) but when Skylake is selected as built-in the hdac_hda codec needs to use the same option due a a code dependency Solve both problems by adding a user-selectable boolean Kconfig, select HDAC_HDA as needed and make the HDaudio codec support in the Skylake driver optional. Tests on a Chell Chromebook device without HDaudio show no regression for speaker and HDMI playback. This is submitted as an RFC to allow for comments and more validation. Signed-off-by: Pierre-Louis Bossart Signed-off-by: Mark Brown commit 68239654acafe6aad5a3c1dc7237e60accfebc03 Author: Sebastian Andrzej Siewior Date: Tue Nov 20 11:26:35 2018 +0100 x86/fpu: Disable bottom halves while loading FPU registers The sequence fpu->initialized = 1; /* step A */ preempt_disable(); /* step B */ fpu__restore(fpu); preempt_enable(); in __fpu__restore_sig() is racy in regard to a context switch. For 32bit frames, __fpu__restore_sig() prepares the FPU state within fpu->state. To ensure that a context switch (switch_fpu_prepare() in particular) does not modify fpu->state it uses fpu__drop() which sets fpu->initialized to 0. After fpu->initialized is cleared, the CPU's FPU state is not saved to fpu->state during a context switch. The new state is loaded via fpu__restore(). It gets loaded into fpu->state from userland and ensured it is sane. fpu->initialized is then set to 1 in order to avoid fpu__initialize() doing anything (overwrite the new state) which is part of fpu__restore(). A context switch between step A and B above would save CPU's current FPU registers to fpu->state and overwrite the newly prepared state. This looks like a tiny race window but the Kernel Test Robot reported this back in 2016 while we had lazy FPU support. Borislav Petkov made the link between that report and another patch that has been posted. Since the removal of the lazy FPU support, this race goes unnoticed because the warning has been removed. Disable bottom halves around the restore sequence to avoid the race. BH need to be disabled because BH is allowed to run (even with preemption disabled) and might invoke kernel_fpu_begin() by doing IPsec. [ bp: massage commit message a bit. ] Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Borislav Petkov Acked-by: Ingo Molnar Acked-by: Thomas Gleixner Cc: Andy Lutomirski Cc: Dave Hansen Cc: "H. Peter Anvin" Cc: "Jason A. Donenfeld" Cc: kvm ML Cc: Paolo Bonzini Cc: Radim Krčmář Cc: Rik van Riel Cc: stable@vger.kernel.org Cc: x86-ml Link: http://lkml.kernel.org/r/20181120102635.ddv3fvavxajjlfqk@linutronix.de Link: https://lkml.kernel.org/r/20160226074940.GA28911@pd.tnic commit 06e68fed32826b44aa9ffcf282c14d3c58918a70 Merge: f2ce1065e767 4e26f692e2e2 Author: Linus Torvalds Date: Tue Nov 20 07:37:15 2018 -0800 Merge tag 'media/v4.20-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - add a missing include at v4l2-controls uAPI header - minor kAPI update for the request API - some fixes at CEC core - use a lower minimum height for the virtual codec driver - cleanup a gcc warning due to the lack of a fall though markup - tc358743: Remove unnecessary self assignment - fix the V4L event subscription logic - docs: Document metadata format in struct v4l2_format - omap3isp and ipu3-cio2: fix unbinding logic * tag 'media/v4.20-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: ipu3-cio2: Use cio2_queues_exit media: ipu3-cio2: Unregister device nodes first, then release resources media: omap3isp: Unregister media device as first media: docs: Document metadata format in struct v4l2_format media: v4l: event: Add subscription to list before calling "add" operation media: dm365_ipipeif: better annotate a fall though media: Rename vb2_m2m_request_queue -> v4l2_m2m_request_queue media: cec: increase debug level for 'queue full' media: cec: check for non-OK/NACK conditions while claiming a LA media: vicodec: lower minimum height to 360 media: tc358743: Remove unnecessary self assignment media: v4l: fix uapi mpeg slice params definition v4l2-controls: add a missing include commit e8828ec1c003727fc001eab06aa19bd2ca9b677e Author: Tudor.Ambarus@microchip.com Date: Fri Nov 16 17:46:37 2018 +0000 mtd: spi-nor: fix selection of uniform erase type in flexible conf There are uniform, non-uniform and flexible erase flash configurations. The non-uniform erase types, are the erase types that can _not_ erase the entire flash by their own. As the code was, in case flashes had flexible erase capabilities (support both uniform and non-uniform erase types in the same flash configuration) and supported multiple uniform erase type sizes, the code did not sort the uniform erase types, and could select a wrong erase type size. Sort the uniform erase mask in case of flexible erase flash configurations, in order to select the best uniform erase type size. Uniform, non-uniform, and flexible configurations with just a valid uniform erase type, are not affected by this change. Uniform erase tested on mx25l3273fm2i-08g and sst26vf064B-104i/sn. Non uniform erase tested on sst26vf064B-104i/sn. Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI NOR flash memories") Signed-off-by: Tudor Ambarus Signed-off-by: Boris Brezillon commit 5d8f81ba1da55210123b9595e87b913c79579d02 Author: Patrick Stählin Date: Fri Nov 9 22:42:16 2018 +0100 RISC-V: recognize S/U mode bits in print_isa Removes the warning about an unsupported ISA when reading /proc/cpuinfo on QEMU. The "S" extension is not being returned as it is not accessible from userspace. Signed-off-by: Patrick Stählin Signed-off-by: Palmer Dabbelt commit 27f8899d6002e11a6e2d995e29b8deab5aa9cc25 Author: David Abdurachmanov Date: Thu Nov 8 20:02:39 2018 +0100 riscv: add asm/unistd.h UAPI header Marcin Juszkiewicz reported issues while generating syscall table for riscv using 4.20-rc1. The patch refactors our unistd.h files to match some other architectures. - Add asm/unistd.h UAPI header, which has __ARCH_WANT_NEW_STAT only for 64-bit - Remove asm/syscalls.h UAPI header and merge to asm/unistd.h - Adjust kernel asm/unistd.h So now asm/unistd.h UAPI header should show all syscalls for riscv. Before this, Makefile simply put `#include ` into generated asm/unistd.h UAPI header thus user didn't see: - __NR_riscv_flush_icache - __NR_newfstatat - __NR_fstat which are supported by riscv kernel. Signed-off-by: David Abdurachmanov Cc: Arnd Bergmann Cc: Marcin Juszkiewicz Cc: Guenter Roeck Fixes: 67314ec7b025 ("RISC-V: Request newstat syscalls") Signed-off-by: David Abdurachmanov Acked-by: Olof Johansson Signed-off-by: Palmer Dabbelt commit 0138ebb90c633f76bc71617f8f23635ce41c84fd Author: David Abdurachmanov Date: Thu Nov 8 20:07:00 2018 +0100 riscv: fix warning in arch/riscv/include/asm/module.h Fixes warning: 'struct module' declared inside parameter list will not be visible outside of this definition or declaration Signed-off-by: David Abdurachmanov Acked-by: Olof Johansson Signed-off-by: Palmer Dabbelt commit c0fbcd9918607e85c9598bfa3dd0a84ed77ea210 Author: Anup Patel Date: Mon Nov 12 11:25:15 2018 +0530 RISC-V: Build flat and compressed kernel images This patch extends Linux RISC-V build system to build and install: Image - Flat uncompressed kernel image Image.gz - Flat and GZip compressed kernel image Quiet a few bootloaders (such as Uboot, UEFI, etc) are capable of booting flat and compressed kernel images. In case of Uboot, booting Image or Image.gz is achieved using bootm command. The flat and uncompressed kernel image (i.e. Image) is very useful in pre-silicon developent and testing because we can create back-door HEX files for RAM on FPGAs from Image. Signed-off-by: Anup Patel Signed-off-by: Palmer Dabbelt commit 21f70d4abf9e17c2e3d7e64b7bfa3424e017f176 Author: Olof Johansson Date: Wed Nov 14 16:27:55 2018 -0800 RISC-V: Fix raw_copy_{to,from}_user() Sparse highlighted it, and appears to be a pure bug (from vs to). ./arch/riscv/include/asm/uaccess.h:403:35: warning: incorrect type in argument 1 (different address spaces) ./arch/riscv/include/asm/uaccess.h:403:39: warning: incorrect type in argument 2 (different address spaces) ./arch/riscv/include/asm/uaccess.h:409:37: warning: incorrect type in argument 1 (different address spaces) ./arch/riscv/include/asm/uaccess.h:409:41: warning: incorrect type in argument 2 (different address spaces) Signed-off-by: Olof Johansson Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit fb862c3b199d28bee238d52e8270eae8650d6cb0 Author: Sebastian Parschauer Date: Tue Nov 20 07:25:08 2018 +0100 HID: Add quirk for Primax PIXART OEM mice The PixArt OEM mice are known for disconnecting every minute in runlevel 1 or 3 if they are not always polled. So add quirk ALWAYS_POLL for two Primax mice as well. 0x4e22 is the Dell MS111-P and 0x4d0f is the unbranded HP Portia mouse HP 697738-001. Both were built until approx. 2014. Those were the standard mice from those vendors and are still around - even as new old stock. Reference: https://github.com/sriemer/fix-linux-mouse/issues/11 Signed-off-by: Sebastian Parschauer CC: stable@vger.kernel.org Signed-off-by: Jiri Kosina commit 63529eaa6164ef7ab4b907b25ac3648177e5e78f Author: Maarten Jacobs Date: Mon Nov 19 23:18:49 2018 +0000 usb: cdc-acm: add entry for Hiro (Conexant) modem The cdc-acm kernel module currently does not support the Hiro (Conexant) H05228 USB modem. The patch below adds the device specific information: idVendor 0x0572 idProduct 0x1349 Signed-off-by: Maarten Jacobs Acked-by: Oliver Neukum Cc: stable Signed-off-by: Greg Kroah-Hartman commit c6fd6fe9dea44732cdcd970f1130b8cc50ad685a Author: Hou Zhiqiang Date: Wed Nov 7 05:16:49 2018 +0000 PCI: layerscape: Fix wrong invocation of outbound window disable accessor The order of parameters is not correct when invoking the outbound window disable routine. Fix it. Fixes: 4a2745d760fa ("PCI: layerscape: Disable outbound windows configured by bootloader") Signed-off-by: Hou Zhiqiang [lorenzo.pieralisi@arm.com: commit log] Signed-off-by: Lorenzo Pieralisi Cc: stable@vger.kernel.org commit 68bc10bf992180f269816ff3d22eb30383138577 Author: Trent Piepho Date: Mon Nov 5 18:11:36 2018 +0000 PCI: imx6: Fix link training status detection in link up check This bug was introduced in the interaction for two commits on either branch of the merge commit 562df5c8521e ("Merge branch 'pci/host-designware' into next"). Commit 4d107d3b5a68 ("PCI: imx6: Move link up check into imx6_pcie_wait_for_link()"), changed imx6_pcie_wait_for_link() to poll the link status register directly, checking for link up and not training, and made imx6_pcie_link_up() only check the link up bit (once, not a polling loop). While commit 886bc5ceb5cc ("PCI: designware: Add generic dw_pcie_wait_for_link()"), replaced the loop in imx6_pcie_wait_for_link() with a call to a new dwc core function, which polled imx6_pcie_link_up(), which still checked both link up and not training in a loop. When these two commits were merged, the version of imx6_pcie_wait_for_link() from 886bc5ceb5cc was kept, which eliminated the link training check placed there by 4d107d3b5a68. However, the version of imx6_pcie_link_up() from 4d107d3b5a68 was kept, which eliminated the link training check that had been there and was moved to imx6_pcie_wait_for_link(). The result was the link training check got lost for the imx6 driver. Eliminate imx6_pcie_link_up() so that the default handler, dw_pcie_link_up(), is used instead. The default handler has the correct code, which checks for link up and also that it still is not training, fixing the regression. Fixes: 562df5c8521e ("Merge branch 'pci/host-designware' into next") Signed-off-by: Trent Piepho [lorenzo.pieralisi@arm.com: rewrote the commit log] Signed-off-by: Lorenzo Pieralisi Reviewed-by: Lucas Stach Cc: Bjorn Helgaas Cc: Joao Pinto Cc: Lorenzo Pieralisi Cc: Richard Zhu commit e6e094e053af75cbc164e950814d3d084fb1e698 Author: Juergen Gross Date: Tue Nov 20 08:25:29 2018 +0100 x86/acpi, x86/boot: Take RSDP address from boot params if available In case the RSDP address in struct boot_params is specified don't try to find the table by searching, but take the address directly as set by the boot loader. Suggested-by: "H. Peter Anvin" Signed-off-by: Juergen Gross Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: boris.ostrovsky@oracle.com Cc: bp@alien8.de Cc: daniel.kiper@oracle.com Cc: sstabellini@kernel.org Cc: xen-devel@lists.xenproject.org Link: http://lkml.kernel.org/r/20181120072529.5489-3-jgross@suse.com Signed-off-by: Ingo Molnar commit 3841840449817ba6cf3e636008bc4e1061a03388 Author: Juergen Gross Date: Tue Nov 20 08:25:28 2018 +0100 x86/boot: Mostly revert commit ae7e1238e68f2a ("Add ACPI RSDP address to setup_header") Peter Anvin pointed out that commit: ae7e1238e68f2a ("x86/boot: Add ACPI RSDP address to setup_header") should be reverted as setup_header should only contain items set by the legacy BIOS. So revert said commit. Instead of fully reverting the dependent commit of: e7b66d16fe4172 ("x86/acpi, x86/boot: Take RSDP address for boot params if available") just remove the setup_header reference in order to replace it by a boot_params in a followup patch. Suggested-by: "H. Peter Anvin" Signed-off-by: Juergen Gross Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: boris.ostrovsky@oracle.com Cc: bp@alien8.de Cc: daniel.kiper@oracle.com Cc: sstabellini@kernel.org Cc: xen-devel@lists.xenproject.org Link: http://lkml.kernel.org/r/20181120072529.5489-2-jgross@suse.com Signed-off-by: Ingo Molnar commit 8830f26bcd3cf1ff07d9078cd310a534c03b6a10 Author: Chris Wilson Date: Fri Nov 2 16:12:12 2018 +0000 drm/i915: Prevent machine hang from Broxton's vtd w/a and error capture Since capturing the error state requires fiddling around with the GGTT to read arbitrary buffers and is itself run under stop_machine(), it deadlocks the machine (effectively a hard hang) when run in conjunction with Broxton's VTd workaround to serialize GGTT access. v2: Store the ERR_PTR in first_error so that the error can be reported to the user via sysfs. v3: Mention the quirk in dmesg (using info as per usual) Fixes: 0ef34ad6222a ("drm/i915: Serialize GTT/Aperture accesses on BXT") Signed-off-by: Chris Wilson Cc: Jon Bloomfield Cc: John Harrison Cc: Tvrtko Ursulin Cc: Joonas Lahtinen Cc: Daniel Vetter Reviewed-by: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20181102161232.17742-5-chris@chris-wilson.co.uk (cherry picked from commit fb6f0b64e455b207a636346588e65bf9598d30eb) Signed-off-by: Joonas Lahtinen commit 1359f25106cad6535812f900625150379c51df82 Merge: a5681e20b541 9184e51b5b3e Author: David S. Miller Date: Mon Nov 19 19:04:33 2018 -0800 Merge tag 'mlx5-fixes-2018-11-19' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== Mellanox, mlx5 fixes 2018-11-19 The following fixes are for mlx5 core and netdev driver. For -stable v4.16 bc7fda7d4637 ('net/mlx5e: IPoIB, Reset QP after channels are closed') For -stable v4.17 36917a270395 ('net/mlx5: IPSec, Fix the SA context hash key') For -stable v4.18 6492a432be3a ('net/mlx5e: Always use the match level enum when parsing TC rule match') c3f81be236b1 ('net/mlx5e: Removed unnecessary warnings in FEC caps query') c5ce2e736b64 ('net/mlx5e: Fix selftest for small MTUs') For -stable v4.19 effcd896b25e ('net/mlx5e: Adjust to max number of channles when re-attaching') 394cbc5acd68 ('net/mlx5e: RX, verify received packet size in Linear Striding RQ') 447cbb3613c8 ('net/mlx5e: Don't match on vlan non-existence if ethertype is wildcarded') c223c1574612 ('net/mlx5e: Claim TC hw offloads support only under a proper build config') Please pull and let me know if there's any problem. ==================== Signed-off-by: David S. Miller commit a5681e20b541a507c7d4fd48ae4a4040d32ee1ef Author: Juliet Kim Date: Mon Nov 19 15:59:22 2018 -0600 net/ibmnvic: Fix deadlock problem in reset This patch changes to use rtnl_lock only during a reset to avoid deadlock that could occur when a thread operating close is holding rtnl_lock and waiting for reset_lock acquired by another thread, which is waiting for rtnl_lock in order to set the number of tx/rx queues during a reset. Also, we now setting the number of tx/rx queues during a soft reset for failover or LPM events. Signed-off-by: Juliet Kim Signed-off-by: David S. Miller commit db9a0bae8ffca4e1ce5089b999e40afd4edb8e79 Merge: d7c60210a9d7 eb62cca9bee8 Author: David S. Miller Date: Mon Nov 19 18:38:16 2018 -0800 Merge branch 'qed-Fix-Queue-Manager-getters' Denis Bolotin says: ==================== qed: Fix Queue Manager getters This patch series fixes various queue manager getter functions. It is important to make sure the getter's caller will receive a valid queue even in error case to prevent more serious bugs. Please consider applying to net. ==================== Signed-off-by: David S. Miller commit eb62cca9bee842e5b23bd0ddfb1f271ca95e8759 Author: Denis Bolotin Date: Mon Nov 19 16:28:31 2018 +0200 qed: Fix QM getters to always return a valid pq The getter callers doesn't know the valid Physical Queues (PQ) values. This patch makes sure that a valid PQ will always be returned. The patch consists of 3 fixes: - When qed_init_qm_get_idx_from_flags() receives a disabled flag, it returned PQ 0, which can potentially be another function's pq. Verify that flag is enabled, otherwise return default start_pq. - When qed_init_qm_get_idx_from_flags() receives an unknown flag, it returned NULL and could lead to a segmentation fault. Return default start_pq instead. - A modulo operation was added to MCOS/VFS PQ getters to make sure the PQ returned is in range of the required flag. Fixes: b5a9ee7cf3be ("qed: Revise QM cofiguration") Signed-off-by: Denis Bolotin Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit 276d43f0ae963312c0cd0e2b9a85fd11ac65dfcc Author: Denis Bolotin Date: Mon Nov 19 16:28:30 2018 +0200 qed: Fix bitmap_weight() check Fix the condition which verifies that only one flag is set. The API bitmap_weight() should receive size in bits instead of bytes. Fixes: b5a9ee7cf3be ("qed: Revise QM cofiguration") Signed-off-by: Denis Bolotin Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit aeabb3c96186a0f944fc2b1f25c84d5eb3a93fa9 Author: Trond Myklebust Date: Mon Nov 19 20:11:45 2018 -0500 NFSv4: Fix a NFSv4 state manager deadlock Fix a deadlock whereby the NFSv4 state manager can get stuck in the delegation return code, waiting for a layout return to complete in another thread. If the server reboots before that other thread completes, then we need to be able to start a second state manager thread in order to perform recovery. Signed-off-by: Trond Myklebust commit 9184e51b5b3ef4509ea869f43e34a60f78f0d32a Author: Shay Agroskin Date: Thu Nov 8 14:23:36 2018 +0200 net/mlx5e: Fix failing ethtool query on FEC query error If FEC caps query fails when executing 'ethtool ' the whole callback fails unnecessarily, fixed that by replacing the error return code with debug logging only. Fixes: 6cfa94605091 ("net/mlx5e: Ethtool driver callback for query/set FEC policy") Signed-off-by: Shay Agroskin Signed-off-by: Saeed Mahameed commit 64e283348458e2fd2fe41b60dfb6c30e88ee695f Author: Shay Agroskin Date: Sun Oct 28 09:06:11 2018 +0200 net/mlx5e: Removed unnecessary warnings in FEC caps query Querying interface FEC caps with 'ethtool [int]' after link reset throws warning regading link speed. This warning is not needed as there is already an indication in user space that the link is not up. Fixes: 0696d60853d5 ("net/mlx5e: Receive buffer configuration") Signed-off-by: Shay Agroskin Signed-off-by: Saeed Mahameed commit febd72f27c02713823cdd011e0087c0e80eb8f62 Author: Shay Agroskin Date: Sun Oct 28 09:17:29 2018 +0200 net/mlx5e: Fix wrong field name in FEC related functions This bug would result in reading wrong FEC capabilities for 10G/40G. Fixes: 2095b2641477 ("net/mlx5e: Add port FEC get/set functions") Signed-off-by: Shay Agroskin Signed-off-by: Saeed Mahameed commit 9cdeaab3b7e72fe60f582e7658511f30c19f1e29 Author: Shay Agroskin Date: Sun Oct 28 16:13:46 2018 +0200 net/mlx5e: Fix a bug in turning off FEC policy in unsupported speeds Some speeds don't support turning FEC policy off. In case a requested FEC policy is not supported for a speed (including current speed), its new FEC policy would be: no FEC - if disabling FEC is supported for that speed unchanged - else Fixes: 2095b2641477 ("net/mlx5e: Add port FEC get/set functions") Signed-off-by: Shay Agroskin Signed-off-by: Saeed Mahameed commit d7c60210a9d72210c9cf348f1221b2367b9c0bb4 Merge: e1e46479847e 4c23738a3f9f Author: David S. Miller Date: Mon Nov 19 15:13:00 2018 -0800 Merge branch 'ena-hibernation-and-rmmod-bug-fixes' Arthur Kiyanovski says: ==================== net: ena: hibernation and rmmod bug fixes This patchset includes 2 bug fixes: 1. A fix to a crash during resume from hibernation. 2. A fix to an illegal memory access during driver removal (e.g. during rmmod) which might cause a crash in certain systems. The subminor number in the driver version is also promoted to indicate driver was changed. ==================== Signed-off-by: David S. Miller commit 4c23738a3f9f203a9b41c89e030eaa8ee241f90f Author: Arthur Kiyanovski Date: Mon Nov 19 12:05:22 2018 +0200 net: ena: update driver version from 2.0.1 to 2.0.2 Update driver version due to critical bug fixes. Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller commit 58a54b9c62e206b8d5f6e59020bcb178fc271d8e Author: Arthur Kiyanovski Date: Mon Nov 19 12:05:21 2018 +0200 net: ena: fix crash during ena_remove() In ena_remove() we have the following stack call: ena_remove() unregister_netdev() ena_destroy_device() netif_carrier_off() Calling netif_carrier_off() causes linkwatch to try to handle the link change event on the already unregistered netdev, which leads to a read from an unreadable memory address. This patch switches the order of the two functions, so that netif_carrier_off() is called on a regiestered netdev. To accomplish this fix we also had to: 1. Remove the set bit ENA_FLAG_TRIGGER_RESET 2. Add a sanitiy check in ena_close() both to prevent double device reset (when calling unregister_netdev() ena_close is called, but the device was already deleted in ena_destroy_device()). 3. Set the admin_queue running state to false to avoid using it after device was reset (for example when calling ena_destroy_all_io_queues() right after ena_com_dev_reset() in ena_down) Fixes: 944b28aa2982 ("net: ena: fix missing lock during device destruction") Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller commit e76ad21d070f79e566ac46ce0b0584c3c93e1b43 Author: Arthur Kiyanovski Date: Mon Nov 19 12:05:20 2018 +0200 net: ena: fix crash during failed resume from hibernation During resume from hibernation if ena_restore_device fails, ena_com_dev_reset() is called, and uses the readless read mechanism, which was already destroyed by the call to ena_com_mmio_reg_read_request_destroy(). This causes a NULL pointer reference. In this commit we switch the call order of the above two functions to avoid this crash. Fixes: d7703ddbd7c9 ("net: ena: fix rare bug when failed restart/resume is followed by driver removal") Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller commit e1e46479847e66f78f79d8c24d5169a5954b3fc2 Author: Xin Long Date: Sun Nov 18 21:59:49 2018 +0800 sctp: not increase stream's incnt before sending addstrm_in request Different from processing the addstrm_out request, The receiver handles an addstrm_in request by sending back an addstrm_out request to the sender who will increase its stream's in and incnt later. Now stream->incnt has been increased since it sent out the addstrm_in request in sctp_send_add_streams(), with the wrong stream->incnt will even cause crash when copying stream info from the old stream's in to the new one's in sctp_process_strreset_addstrm_out(). This patch is to fix it by simply removing the stream->incnt change from sctp_send_add_streams(). Fixes: 242bd2d519d7 ("sctp: implement sender-side procedures for Add Incoming/Outgoing Streams Request Parameter") Reported-by: Jianwen Ji Signed-off-by: Xin Long Signed-off-by: David S. Miller commit 228c4cd04dfd0667eda182c91504b83c17d97584 Author: Valentine Fatiev Date: Wed Oct 17 11:45:07 2018 +0300 net/mlx5e: Fix selftest for small MTUs Loopback test had fixed packet size, which can be bigger than configured MTU. Shorten the loopback packet size to be bigger than minimal MTU allowed by the device. Text field removed from struct 'mlx5ehdr' as redundant to allow send small packets as minimal allowed MTU. Fixes: d605d66 ("net/mlx5e: Add support for ethtool self diagnostics test") Signed-off-by: Valentine Fatiev Reviewed-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed commit 0073c8f72736b423aade8a817587a5f3e4df4ad8 Author: Moshe Shemesh Date: Thu Oct 11 07:31:10 2018 +0300 net/mlx5e: RX, verify received packet size in Linear Striding RQ In case of striding RQ, we use MPWRQ (Multi Packet WQE RQ), which means that WQE (RX descriptor) can be used for many packets and so the WQE is much bigger than MTU. In virtualization setups where the port mtu can be larger than the vf mtu, if received packet is bigger than MTU, it won't be dropped by HW on too small receive WQE. If we use linear SKB in striding RQ, since each stride has room for mtu size payload and skb info, an oversized packet can lead to crash for crossing allocated page boundary upon the call to build_skb. So driver needs to check packet size and drop it. Introduce new SW rx counter, rx_oversize_pkts_sw_drop, which counts the number of packets dropped by the driver for being too large. As a new field is added to the RQ struct, re-open the channels whenever this field is being used in datapath (i.e., in the case of linear Striding RQ). Fixes: 619a8f2a42f1 ("net/mlx5e: Use linear SKB in Striding RQ") Signed-off-by: Moshe Shemesh Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 1392f44bba22533b8dfdc6b0e73610b27c3f76cf Author: Roi Dayan Date: Tue Oct 23 17:30:04 2018 +0300 net/mlx5e: Apply the correct check for supporting TC esw rules split The mirror and not the output count is the one denoting a split. Fix to condition the offload attempt on the mirror count being > 0 along the firmware to have the related capability. Fixes: 592d36515969 ("net/mlx5e: Parse mirroring action for offloaded TC eswitch flows") Signed-off-by: Roi Dayan Reviewed-by: Yossi Kuperman Reviewed-by: Chris Mi Acked-by: Or Gerlitz Reviewed-by: Or Gerlitz Signed-off-by: Saeed Mahameed commit a1f240f1801721f76bee734c50df2d9529da86e0 Author: Yuval Avnery Date: Tue Oct 16 15:20:20 2018 -0500 net/mlx5e: Adjust to max number of channles when re-attaching When core driver enters deattach/attach flow after pci reset, Number of logical CPUs may have changed. As a result we need to update the cpu affiliated resource tables. 1. indirect rqt list 2. eq table Reproduction (PowerPC): echo 1000 > /sys/kernel/debug/powerpc/eeh_max_freezes ppc64_cpu --smt=on # Restart driver modprobe -r ... ; modprobe ... # Link up ifconfig ... # Only physical CPUs ppc64_cpu --smt=off # Inject PCI errors so PCI will reset - calling the pci error handler echo 0x8000000000000000 > /sys/kernel/debug/powerpc//err_injct_inboundA Call trace when trying to add non-existing rqs to an indirect rqt: mlx5e_redirect_rqt+0x84/0x260 [mlx5_core] (unreliable) mlx5e_redirect_rqts+0x188/0x190 [mlx5_core] mlx5e_activate_priv_channels+0x488/0x570 [mlx5_core] mlx5e_open_locked+0xbc/0x140 [mlx5_core] mlx5e_open+0x50/0x130 [mlx5_core] mlx5e_nic_enable+0x174/0x1b0 [mlx5_core] mlx5e_attach_netdev+0x154/0x290 [mlx5_core] mlx5e_attach+0x88/0xd0 [mlx5_core] mlx5_attach_device+0x168/0x1e0 [mlx5_core] mlx5_load_one+0x1140/0x1210 [mlx5_core] mlx5_pci_resume+0x6c/0xf0 [mlx5_core] Create cq will fail when trying to use non-existing EQ. Fixes: 89d44f0a6c73 ("net/mlx5_core: Add pci error handlers to mlx5_core driver") Signed-off-by: Yuval Avnery Signed-off-by: Saeed Mahameed commit 83621b7df6a646e550fd3d36db2e301cf9a5096b Author: Or Gerlitz Date: Sun Oct 28 12:27:29 2018 +0200 net/mlx5e: Always use the match level enum when parsing TC rule match We get the match level (none, l2, l3, l4) while going over the match dissectors of an offloaded tc rule. When doing this, the match level enum and the not min inline enum values should be used, fix that. This worked accidentally b/c both enums have the same numerical values. Fixes: d708f902989b ('net/mlx5e: Get the required HW match level while parsing TC flow matches') Signed-off-by: Or Gerlitz Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 077ecd785d90c6cbba08d719faa4be8561aa0a1e Author: Or Gerlitz Date: Thu Oct 18 12:31:27 2018 +0200 net/mlx5e: Claim TC hw offloads support only under a proper build config Currently, we are only supporting tc hw offloads when the eswitch support is compiled in, but we are not gating the adevertizment of the NETIF_F_HW_TC feature on this config being set. Fix it, and while doing that, also avoid dealing with the feature on ethtool when the config is not set. Fixes: e8f887ac6a45 ('net/mlx5e: Introduce tc offload support') Signed-off-by: Or Gerlitz Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit d3a80bb5a3eac311ddf28387402593977574460d Author: Or Gerlitz Date: Thu Oct 25 15:41:58 2018 +0000 net/mlx5e: Don't match on vlan non-existence if ethertype is wildcarded For the "all" ethertype we should not care whether the packet has vlans. Besides being wrong, the way we did it caused FW error for rules such as: tc filter add dev eth0 protocol all parent ffff: \ prio 1 flower skip_sw action drop b/c the matching meta-data (outer headers bit in struct mlx5_flow_spec) wasn't set. Fix that by matching on vlan non-existence only if we were also told to match on the ethertype. Fixes: cee26487620b ('net/mlx5e: Set vlan masks for all offloaded TC rules') Signed-off-by: Or Gerlitz Reported-by: Slava Ovsiienko Reviewed-by: Jianbo Liu Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit acf3766b36d8e59ecbc307894c6d05703ee48014 Author: Denis Drozdov Date: Thu Sep 27 14:17:54 2018 +0300 net/mlx5e: IPoIB, Reset QP after channels are closed The mlx5e channels should be closed before mlx5i_uninit_underlay_qp puts the QP into RST (reset) state during mlx5i_close. Currently QP state incorrectly set to RST before channels got deactivated and closed, since mlx5_post_send request expects QP in RTS (Ready To Send) state. The fix is to keep QP in RTS state until mlx5e channels get closed and to reset QP afterwards. Also this fix is simply correct in order to keep the open/close flow symmetric, i.e mlx5i_init_underlay_qp() is called first thing at open, the correct thing to do is to call mlx5i_uninit_underlay_qp() last thing at close, which is exactly what this patch is doing. Fixes: dae37456c8ac ("net/mlx5: Support for attaching multiple underlay QPs to root flow table") Signed-off-by: Denis Drozdov Signed-off-by: Saeed Mahameed commit f2b18732ee9863ac036759baf616ffa03c252ed5 Author: Raed Salem Date: Thu Oct 18 08:55:21 2018 +0300 net/mlx5: IPSec, Fix the SA context hash key The commit "net/mlx5: Refactor accel IPSec code" introduced a bug where asynchronous short time change in hash key value by create/release SA context might happen during an asynchronous hash resize operation this could cause a subsequent remove SA context operation to fail as the key value used during resize is not the same key value used when remove SA context operation is invoked. This commit fixes the bug by defining the SA context hash key such that it includes only fields that never change during the lifetime of the SA context object. Fixes: d6c4f0298cec ("net/mlx5: Refactor accel IPSec code") Signed-off-by: Raed Salem Reviewed-by: Aviad Yehezkel Signed-off-by: Saeed Mahameed commit da034bcc6aaaf2a6ba6c5b5e63565c5ef4816a0e Author: Eric Biggers Date: Wed Nov 14 21:48:18 2018 -0800 xfs: make xfs_file_remap_range() static xfs_file_remap_range() is only used in fs/xfs/xfs_file.c, so make it static. This addresses a gcc warning when -Wmissing-prototypes is enabled. Signed-off-by: Eric Biggers Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 59e4293149106fb92530f8e56fa3992d8548c5e6 Author: Brian Foster Date: Wed Nov 14 07:46:40 2018 -0800 xfs: fix shared extent data corruption due to missing cow reservation Page writeback indirectly handles shared extents via the existence of overlapping COW fork blocks. If COW fork blocks exist, writeback always performs the associated copy-on-write regardless if the underlying blocks are actually shared. If the blocks are shared, then overlapping COW fork blocks must always exist. fstests shared/010 reproduces a case where a buffered write occurs over a shared block without performing the requisite COW fork reservation. This ultimately causes writeback to the shared extent and data corruption that is detected across md5 checks of the filesystem across a mount cycle. The problem occurs when a buffered write lands over a shared extent that crosses an extent size hint boundary and that also happens to have a partial COW reservation that doesn't cover the start and end blocks of the data fork extent. For example, a buffered write occurs across the file offset (in FSB units) range of [29, 57]. A shared extent exists at blocks [29, 35] and COW reservation already exists at blocks [32, 34]. After accommodating a COW extent size hint of 32 blocks and the existing reservation at offset 32, xfs_reflink_reserve_cow() allocates 32 blocks of reservation at offset 0 and returns with COW reservation across the range of [0, 34]. The associated data fork extent is still [29, 35], however, which isn't fully covered by the COW reservation. This leads to a buffered write at file offset 35 over a shared extent without associated COW reservation. Writeback eventually kicks in, performs an overwrite of the underlying shared block and causes the associated data corruption. Update xfs_reflink_reserve_cow() to accommodate the fact that a delalloc allocation request may not fully cover the extent in the data fork. Trim the data fork extent appropriately, just as is done for shared extent boundaries and/or existing COW reservations that happen to overlap the start of the data fork extent. This prevents shared/010 failures due to data corruption on reflink enabled filesystems. Signed-off-by: Brian Foster Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit a6a66f80c85e8e20573ca03fabf32445954a88d5 Author: Thor Thayer Date: Fri Nov 16 08:25:49 2018 -0600 mtd: spi-nor: Fix Cadence QSPI page fault kernel panic The current Cadence QSPI driver caused a kernel panic sporadically when writing to QSPI. The problem was caused by writing more bytes than needed because the QSPI operated on 4 bytes at a time. [ 11.202044] Unable to handle kernel paging request at virtual address bffd3000 [ 11.209254] pgd = e463054d [ 11.211948] [bffd3000] *pgd=2fffb811, *pte=00000000, *ppte=00000000 [ 11.218202] Internal error: Oops: 7 [#1] SMP ARM [ 11.222797] Modules linked in: [ 11.225844] CPU: 1 PID: 1317 Comm: systemd-hwdb Not tainted 4.17.7-d0c45cd44a8f [ 11.235796] Hardware name: Altera SOCFPGA Arria10 [ 11.240487] PC is at __raw_writesl+0x70/0xd4 [ 11.244741] LR is at cqspi_write+0x1a0/0x2cc On a page boundary limit the number of bytes copied from the tx buffer to remain within the page. This patch uses a temporary buffer to hold the 4 bytes to write and then copies only the bytes required from the tx buffer. Reported-by: Adrian Amborzewicz Signed-off-by: Thor Thayer Signed-off-by: Boris Brezillon commit a4233cc944d1b7125d906f1fa276bda3df48df0c Author: Greathouse, Joseph Date: Mon Nov 19 16:59:28 2018 +0000 drm/amd/pp: handle negative values when reading OD Reading the sysfs files pp_sclk_od and pp_mclk_od return the percentage difference between the VBIOS-provided default frequency and the current (possibly user-set) frequency in the highest SCLK and MCLK DPM states, respectively. Writing to these files provides an easy mechanism for setting a higher-than-default maximum frequency. We normally only allow values >= 0 to be written here. However, with the addition of pp_od_clk_voltage, we now allow users to set custom DPM tables. If they then set the maximum DPM state to something less than the default, later reads of pp_*_od should return a negative value. The highest DPM state is now less than the VBIOS-provided default, so the percentage is negative. The math to calculate this was originally performed with unsigned values, meaning reads that should return negative values returned meaningless data. This patch corrects that issue and normalizes how all of the calculations are done across the various hwmgr types. Acked-by: Alex Deucher Signed-off-by: Joseph Greathouse Signed-off-by: Alex Deucher commit 8d4d7c58994759bbd9f4fec32d88bf0e0b89302e Author: Takashi Iwai Date: Mon Nov 19 12:55:12 2018 +0100 drm/amdgpu: Add missing firmware entry for HAINAN Due to lack of MODULE_FIRMWARE() with hainan_mc.bin, the driver doesn't work properly in initrd. Let's add it. Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1116239 Fixes: 8eaf2b1faaf4 ("drm/amdgpu: switch firmware path for SI parts") Cc: Reviewed-by: Christian König Signed-off-by: Takashi Iwai Signed-off-by: Alex Deucher commit 009dd011762925e5e03a59282b1785214f8470e0 Author: Evan Quan Date: Mon Nov 19 12:03:24 2018 +0800 drm/amd/powerplay: disable Vega20 DS related features Disable these features on Vega20 for now. Signed-off-by: Evan Quan Acked-by: Feifei Xu Signed-off-by: Alex Deucher commit 919a52fc4ca137c871f295224507fa3401e08472 Author: Felix Kuehling Date: Fri Jul 20 11:37:25 2018 -0400 drm/amdgpu: Fix oops when pp_funcs->switch_power_profile is unset On Vega20 and other pre-production GPUs, powerplay is not enabled yet. Check for NULL pointers before calling pp_funcs function pointers. Also affects Kaveri. CC: Joerg Roedel Signed-off-by: Felix Kuehling Reviewed-by: Alex Deucher Tested-by: Joerg Roedel Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 69fec325a64383667b8a35df5d48d6ce52fb2782 Author: Xin Long Date: Sun Nov 18 16:14:47 2018 +0800 Revert "sctp: remove sctp_transport_pmtu_check" This reverts commit 22d7be267eaa8114dcc28d66c1c347f667d7878a. The dst's mtu in transport can be updated by a non sctp place like in xfrm where the MTU information didn't get synced between asoc, transport and dst, so it is still needed to do the pmtu check in sctp_packet_config. Acked-by: Neil Horman Signed-off-by: David S. Miller commit cc3ccf26f0649089b3a34a2781977755ea36e72c Author: Xin Long Date: Sun Nov 18 15:21:53 2018 +0800 sctp: not allow to set asoc prsctp_enable by sockopt As rfc7496#section4.5 says about SCTP_PR_SUPPORTED: This socket option allows the enabling or disabling of the negotiation of PR-SCTP support for future associations. For existing associations, it allows one to query whether or not PR-SCTP support was negotiated on a particular association. It means only sctp sock's prsctp_enable can be set. Note that for the limitation of SCTP_{CURRENT|ALL}_ASSOC, we will add it when introducing SCTP_{FUTURE|CURRENT|ALL}_ASSOC for linux sctp in another patchset. v1->v2: - drop the params.assoc_id check as Neil suggested. Fixes: 28aa4c26fce2 ("sctp: add SCTP_PR_SUPPORTED on sctp sockopt") Reported-by: Ying Xu Signed-off-by: Xin Long Signed-off-by: David S. Miller commit 02968ccf0125d39b08ecef5946300a8a873c0942 Author: Xin Long Date: Sun Nov 18 15:07:38 2018 +0800 sctp: count sk_wmem_alloc by skb truesize in sctp_packet_transmit Now sctp increases sk_wmem_alloc by 1 when doing set_owner_w for the skb allocked in sctp_packet_transmit and decreases by 1 when freeing this skb. But when this skb goes through networking stack, some subcomponents might change skb->truesize and add the same amount on sk_wmem_alloc. However sctp doesn't know the amount to decrease by, it would cause a leak on sk->sk_wmem_alloc and the sock can never be freed. Xiumei found this issue when it hit esp_output_head() by using sctp over ipsec, where skb->truesize is added and so is sk->sk_wmem_alloc. Since sctp has used sk_wmem_queued to count for writable space since Commit cd305c74b0f8 ("sctp: use sk_wmem_queued to check for writable space"), it's ok to fix it by counting sk_wmem_alloc by skb truesize in sctp_packet_transmit. Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible") Reported-by: Xiumei Mu Signed-off-by: Xin Long Signed-off-by: David S. Miller commit a4243e1494532ab8fa679a4134153149a71fa331 Author: Arnaldo Carvalho de Melo Date: Mon Nov 19 12:38:50 2018 -0800 perf tools beauty ioctl: Support new ISO7816 commands Introduced in: ad8c0eaa0a41 ("tty/serial_core: add ISO7816 infrastructure") Now 'perf trace' will be able to pretty-print the 'cmd' ioctl arg when used in capable systems with software emitting those commands. Cc: Adrian Hunter Cc: David Ahern Cc: Greg Kroah-Hartman Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nicolas Ferre Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-7bds48dhckfnleie08mit314@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 83d9bdeaedd8f7aa9749828364f0018cacd1dad3 Author: Arnaldo Carvalho de Melo Date: Mon Nov 19 12:31:45 2018 -0800 tools uapi asm-generic: Synchronize ioctls.h To pick up the changes in: ad8c0eaa0a41 ("tty/serial_core: add ISO7816 infrastructure") That is a change that imply a change to be made in tools/perf/trace/beauty/ioctl.c to make 'perf trace' ioctl syscall argument beautifier to support these new commands: TIOCGISO7816 and TIOCSISO7816. This is not yet done automatically by a script like is done for some other headers, for instance: $ tools/perf/trace/beauty/drm_ioctl.sh | head #ifndef DRM_COMMAND_BASE #define DRM_COMMAND_BASE 0x40 #endif static const char *drm_ioctl_cmds[] = { [0x00] = "VERSION", [0x01] = "GET_UNIQUE", [0x02] = "GET_MAGIC", [0x03] = "IRQ_BUSID", [0x04] = "GET_MAP", [0x05] = "GET_CLIENT", $ So we will need to change tools/perf/trace/beauty/ioctl.c in a follow up patch until we switch to a generator script. Cc: Adrian Hunter Cc: David Ahern Cc: Greg Kroah-Hartman Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nicolas Ferre Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-zin76fe6iykqsilvo6u47f9o@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 65e259d5c4ae425f7c80e40b838eba1b9e8608fd Author: Arnaldo Carvalho de Melo Date: Mon Nov 19 12:27:07 2018 -0800 tools arch x86: Update tools's copy of cpufeatures.h To get the changes in the following csets: ace6485a0326 ("x86/cpufeatures: Enumerate MOVDIR64B instruction") 33823f4d63f7 ("x86/cpufeatures: Enumerate MOVDIRI instruction") No tools were affected, copy it to silence this perf tool build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/asm/cpufeatures.h' differs from latest version at 'arch/x86/include/asm/cpufeatures.h' diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Cc: Fenghua Yu Link: https://lkml.kernel.org/n/tip-83kcyqa1qkxkhm1s7q3hbpel@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 53f00f4548ef700e3c6867a35fd7d4f824cd165a Author: Arnaldo Carvalho de Melo Date: Mon Nov 19 12:17:42 2018 -0800 tools headers uapi: Synchronize i915_drm.h To pick up the changes in: 900ccf30f9e1 ("drm/i915: Only force GGTT coherency w/a on required chipsets") No changes are required in tools/ nor does anything gets automatically generated to be used in the 'perf trace' syscall arg beautifiers. This silences this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/drm/i915_drm.h' differs from latest version at 'include/uapi/drm/i915_drm.h' diff -u tools/include/uapi/drm/i915_drm.h include/uapi/drm/i915_drm.h Cc: Chris Wilson Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-t2vor2wegv41gt5n49095kly@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit b01c1f69c8660eaeab7d365cd570103c5c073a02 Author: Jiri Olsa Date: Thu Nov 1 18:00:01 2018 +0100 perf tools: Restore proper cwd on return from mnt namespace When reporting on 'record' server we try to retrieve/use the mnt namespace of the profiled tasks. We use following API with cookie to hold the return namespace, roughly: nsinfo__mountns_enter(struct nsinfo *nsi, struct nscookie *nc) setns(newns, 0); ... new ns related open.. ... nsinfo__mountns_exit(struct nscookie *nc) setns(nc->oldns) Once finished we setns to old namespace, which also sets the current working directory (cwd) to "/", trashing the cwd we had. This is mostly fine, because we use absolute paths almost everywhere, but it screws up 'perf diff': # perf diff failed to open perf.data: No such file or directory (try 'perf record' first) ... Adding the current working directory to be part of the cookie and restoring it in the nsinfo__mountns_exit call. Signed-off-by: Jiri Olsa Cc: Alexander Shishkin Cc: Krister Johansen Cc: Namhyung Kim Cc: Peter Zijlstra Fixes: 843ff37bb59e ("perf symbols: Find symbols in different mount namespace") Link: http://lkml.kernel.org/r/20181101170001.30019-1-jolsa@kernel.org [ No need to check for NULL args for free(), use zfree() for struct members ] Signed-off-by: Arnaldo Carvalho de Melo commit 8feb8efef97a134933620071e0b6384cb3238b4e Author: Arnaldo Carvalho de Melo Date: Mon Nov 19 16:56:22 2018 -0300 tools build feature: Check if get_current_dir_name() is available As the namespace support code will use this, which is not available in some non _GNU_SOURCE libraries such as Android's bionic used in my container build tests (r12b and r15c at the moment). Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-x56ypm940pwclwu45d7jfj47@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit a36b5444b1ec79ed5fedd12295626c05b4f788eb Author: Heiner Kallweit Date: Mon Nov 19 08:01:03 2018 +0100 MAINTAINERS: Add myself as third phylib maintainer Add myself as third phylib maintainer. Signed-off-by: Heiner Kallweit Acked-by: Andrew Lunn Acked-by: Florian Fainelli Signed-off-by: David S. Miller commit f2ce1065e767fc7da106a5f5381d1e8f842dc6f4 Merge: 9ff01193a20d 8ebebcba559a Author: Linus Torvalds Date: Mon Nov 19 09:24:04 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Fix some potentially uninitialized variables and use-after-free in kvaser_usb can drier, from Jimmy Assarsson. 2) Fix leaks in qed driver, from Denis Bolotin. 3) Socket leak in l2tp, from Xin Long. 4) RSS context allocation fix in bnxt_en from Michael Chan. 5) Fix cxgb4 build errors, from Ganesh Goudar. 6) Route leaks in ipv6 when removing exceptions, from Xin Long. 7) Memory leak in IDR allocation handling of act_pedit, from Davide Caratti. 8) Use-after-free of bridge vlan stats, from Nikolay Aleksandrov. 9) When MTU is locked, do not force DF bit on ipv4 tunnels. From Sabrina Dubroca. 10) When NAPI cached skb is reused, we must set it to the proper initial state which includes skb->pkt_type. From Eric Dumazet. 11) Lockdep and non-linear SKB handling fix in tipc from Jon Maloy. 12) Set RX queue properly in various tuntap receive paths, from Matthew Cover. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (61 commits) tuntap: fix multiqueue rx ipv6: Fix PMTU updates for UDP/raw sockets in presence of VRF tipc: don't assume linear buffer when reading ancillary data tipc: fix lockdep warning when reinitilaizing sockets net-gro: reset skb->pkt_type in napi_reuse_skb() tc-testing: tdc.py: Guard against lack of returncode in executed command tc-testing: tdc.py: ignore errors when decoding stdout/stderr ip_tunnel: don't force DF when MTU is locked MAINTAINERS: Add entry for CAKE qdisc net: bridge: fix vlan stats use-after-free on destruction socket: do a generic_file_splice_read when proto_ops has no splice_read net: phy: mdio-gpio: Fix working over slow can_sleep GPIOs Revert "net: phy: mdio-gpio: Fix working over slow can_sleep GPIOs" net: phy: mdio-gpio: Fix working over slow can_sleep GPIOs net/sched: act_pedit: fix memory leak when IDR allocation fails net: lantiq: Fix returned value in case of error in 'xrx200_probe()' ipv6: fix a dst leak when removing its exception net: mvneta: Don't advertise 2.5G modes drivers/net/ethernet/qlogic/qed/qed_rdma.h: fix typo net/mlx4: Fix UBSAN warning of signed integer overflow ... commit 7e241f647dc7087a0401418a187f3f5b527cc690 Author: Ilya Dryomov Date: Thu Nov 8 15:55:37 2018 +0100 libceph: fall back to sendmsg for slab pages skb_can_coalesce() allows coalescing neighboring slab objects into a single frag: return page == skb_frag_page(frag) && off == frag->page_offset + skb_frag_size(frag); ceph_tcp_sendpage() can be handed slab pages. One example of this is XFS: it passes down sector sized slab objects for its metadata I/O. If the kernel client is co-located on the OSD node, the skb may go through loopback and pop on the receive side with the exact same set of frags. When tcp_recvmsg() attempts to copy out such a frag, hardened usercopy complains because the size exceeds the object's allocated size: usercopy: kernel memory exposure attempt detected from ffff9ba917f20a00 (kmalloc-512) (1024 bytes) Although skb_can_coalesce() could be taught to return false if the resulting frag would cross a slab object boundary, we already have a fallback for non-refcounted pages. Utilize it for slab pages too. Cc: stable@vger.kernel.org # 4.8+ Signed-off-by: Ilya Dryomov commit 86c31524b27c7e686841dd4a79eda95cfd989f16 Author: Kai-Heng Feng Date: Wed Nov 14 07:24:57 2018 +0000 HID: i2c-hid: Disable runtime PM for LG touchscreen LG touchscreen (1fd2:8001) stops working after reboot: [ 4.859153] i2c_hid i2c-SAPS2101:00: i2c_hid_get_input: incomplete report (64/66) [ 4.936070] i2c_hid i2c-SAPS2101:00: i2c_hid_get_input: incomplete report (64/66) [ 9.948224] i2c_hid i2c-SAPS2101:00: failed to reset device. The device in question stops working after receives SLEEP, ON, SLEEP commands in a short period. The scenario is like this: - Once the desktop session closes, it also closed the hid device, so the device gets runtime suspended and receives a SLEEP command. - Before calling shutdown callback, it gets runtime resumed and received an ON command. - In the shutdown callback, it receives another SLEEP command. I failed to find a reliable interval between ON/SLEEP commands that can make it work, so let's simply disable runtime PM for the device. Signed-off-by: Kai-Heng Feng Signed-off-by: Jiri Kosina commit 12d43aacf9a74d0eb66fd0ea54ebeb79ca28940f Author: Kai-Heng Feng Date: Wed Nov 14 05:35:20 2018 +0000 HID: multitouch: Add pointstick support for Cirque Touchpad Cirque Touchpad/Pointstick combo is similar to Alps devices, it requires MT_CLS_WIN_8_DUAL to expose its pointstick as a mouse. Signed-off-by: Kai-Heng Feng Signed-off-by: Jiri Kosina commit 91ff20f34e94424e586f57f4f593beae16504f86 Author: Amir Goldstein Date: Wed Nov 14 16:01:34 2018 +0200 ovl: fix missing override creds in link of a metacopy upper Theodore Ts'o reported a v4.19 regression with docker-dropbox: https://marc.info/?l=linux-fsdevel&m=154070089431116&w=2 "I was rebuilding my dropbox Docker container, and it failed in 4.19 with the following error: ... dpkg: error: error creating new backup file \ '/var/lib/dpkg/status-old': Invalid cross-device link" The problem did not reproduce with metacopy feature disabled. The error was caused by insufficient credentials to set "trusted.overlay.redirect" xattr on link of a metacopy file. Reproducer: echo Y > /sys/module/overlay/parameters/redirect_dir echo Y > /sys/module/overlay/parameters/metacopy cd /tmp mkdir l u w m chmod 777 l u touch l/foo ln l/foo l/link chmod 666 l/foo mount -t overlay none -olowerdir=l,upperdir=u,workdir=w m su fsgqa ln m/foo m/bar [ 21.455823] overlayfs: failed to set redirect (-1) ln: failed to create hard link 'm/bar' => 'm/foo':\ Invalid cross-device link Reported-by: Theodore Y. Ts'o Reported-by: Maciej Zięba Fixes: 4120fe64dce4 ("ovl: Set redirect on upper inode when it is linked") Cc: # v4.19 Signed-off-by: Amir Goldstein Acked-by: Vivek Goyal Signed-off-by: Miklos Szeredi commit 385a4886778f6d6e61eff1d4d295af332d7130e1 Author: Rodrigo Rivas Costa Date: Sun Oct 14 19:36:43 2018 +0200 HID: steam: remove input device when a hid client is running. Previously, when a HID client such as the Steam Client was running, this driver disabled its input device to avoid doubling the input events. While it worked mostly fine, some games got confused by the idle gamepad, and switched to two player mode, or asked the user to choose which gamepad to use. Other games just crashed, probably a bug in Unity [1]. With this commit, when a HID client starts, the input device is removed; when the HID client ends the input device is recreated. [1]: https://github.com/ValveSoftware/steam-for-linux/issues/5645 Signed-off-by: Rodrigo Rivas Costa Signed-off-by: Jiri Kosina commit fffc9a260e38acec3187515738122a3ecb24ac90 Author: Matthew Wilcox Date: Mon Nov 19 09:36:29 2018 -0500 XArray tests: Add missing locking Lockdep caught me being sloppy in the test suite and failing to lock the XArray appropriately. Reported-by: kernel test robot Signed-off-by: Matthew Wilcox commit 25bbe21bf427a81b8e3ccd480ea0e1d940256156 Author: Matthew Wilcox Date: Fri Nov 16 15:50:02 2018 -0500 dax: Avoid losing wakeup in dax_lock_mapping_entry After calling get_unlocked_entry(), you have to call put_unlocked_entry() to avoid subsequent waiters losing wakeups. Fixes: c2a7d2a11552 ("filesystem-dax: Introduce dax_lock_mapping_entry()") Cc: stable@vger.kernel.org Signed-off-by: Matthew Wilcox commit 614b1868a125a0ba24be08f3a7fa832ddcde6bca Author: Jerome Brunet Date: Tue Nov 13 11:55:36 2018 +0100 pinctrl: meson: fix pull enable register calculation We just changed the code so we apply bias disable on the correct register but forgot to align the register calculation. The result is that we apply the change on the correct register, but possibly at the incorrect offset/bit This went undetected because offsets tends to be the same between REG_PULL and REG_PULLEN for a given pin the EE controller. This is not true for the AO controller. Fixes: e39f9dd8206a ("pinctrl: meson: fix pinconf bias disable") Signed-off-by: Jerome Brunet Acked-by: Neil Armstrong Signed-off-by: Linus Walleij commit 5db0b0a298d26c007e06a96d7e60849b4829a57c Author: Craig Tatlor Date: Mon Nov 12 20:25:53 2018 +0000 pinctrl: sdm660: Set tile property for pingroups This was missed when tiles support was added in a revison and causes the driver to fail to load. Fixes: 9cf0c526bc58 ("pinctrl: qcom: Add sdm660 pinctrl driver") Signed-off-by: Craig Tatlor Reviewed-by: Bjorn Andersson Signed-off-by: Linus Walleij commit 512cab3e7e0be11234f965d9898936dce2325382 Author: Fabio Estevam Date: Sat Nov 10 15:53:59 2018 -0200 ARM: dts: imx51-zii-rdu1: Remove EEPROM node The EEPROM under I2C2 was put by mistake in the dts. Remove it as it is not really present on the real hardware. Fixes: ceef0396f367 ("ARM: dts: imx: add ZII RDU1 board") Reported-by: Chris Healy Signed-off-by: Fabio Estevam Reviewed-by: Chris Healy Signed-off-by: Shawn Guo commit 4d26d1d1e8065bb3326a7c06d5d4698e581443a9 Author: David Herrmann Date: Wed Nov 14 14:16:42 2018 +0100 Revert "HID: uhid: use strlcpy() instead of strncpy()" This reverts commit 336fd4f5f25157e9e8bd50e898a1bbcd99eaea46. Please note that `strlcpy()` does *NOT* do what you think it does. strlcpy() *ALWAYS* reads the full input string, regardless of the 'length' parameter. That is, if the input is not zero-terminated, strlcpy() will *READ* beyond input boundaries. It does this, because it always returns the size it *would* copy if the target was big enough, not the truncated size it actually copied. The original code was perfectly fine. The hid device is zero-initialized and the strncpy() functions copied up to n-1 characters. The result is always zero-terminated this way. This is the third time someone tried to replace strncpy with strlcpy in this function, and gets it wrong. I now added a comment that should at least make people reconsider. Signed-off-by: David Herrmann Signed-off-by: Jiri Kosina commit 8c01db7619f07c85c5cd81ec5eb83608b56c88f5 Author: Eric Biggers Date: Wed Nov 14 13:55:09 2018 -0800 HID: uhid: forbid UHID_CREATE under KERNEL_DS or elevated privileges When a UHID_CREATE command is written to the uhid char device, a copy_from_user() is done from a user pointer embedded in the command. When the address limit is KERNEL_DS, e.g. as is the case during sys_sendfile(), this can read from kernel memory. Alternatively, information can be leaked from a setuid binary that is tricked to write to the file descriptor. Therefore, forbid UHID_CREATE in these cases. No other commands in uhid_char_write() are affected by this bug and UHID_CREATE is marked as "obsolete", so apply the restriction to UHID_CREATE only rather than to uhid_char_write() entirely. Thanks to Dmitry Vyukov for adding uhid definitions to syzkaller and to Jann Horn for commit 9da3f2b740544 ("x86/fault: BUG() when uaccess helpers fault on kernel addresses"), allowing this bug to be found. Reported-by: syzbot+72473edc9bf4eb1c6556@syzkaller.appspotmail.com Fixes: d365c6cfd337 ("HID: uhid: add UHID_CREATE and UHID_DESTROY events") Cc: # v3.6+ Cc: Jann Horn Cc: Andy Lutomirski Signed-off-by: Eric Biggers Reviewed-by: Jann Horn Signed-off-by: Jiri Kosina commit 5305ec6a27b2dc7398a689e661a4a2e951026f09 Author: Adrian Hunter Date: Mon Nov 19 14:53:07 2018 +0200 mmc: sdhci-pci: Workaround GLK firmware failing to restore the tuning value GLK firmware can indicate that the tuning value will be restored after runtime suspend, but not actually do that. Add a workaround that detects such cases, and lets the driver do re-tuning instead. Reported-by: Anisse Astier Tested-by: Anisse Astier Signed-off-by: Adrian Hunter Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 5bb9b84b0796336b18c8b8651628009eace70202 Author: Clément Péron Date: Sat Nov 17 13:14:52 2018 +0100 MAINTAINERS: add ASoC maintainers for sound dt-bindings Sound dt-bindings are applied by ASoC maintainers and should be submit to ASoC list in addition to the devicetree list. Hence, add this information into the MAINTAINERS file. Signed-off-by: Clément Péron Signed-off-by: Mark Brown commit 21556350ade3cb5d7afecc8b3544e56431d21695 Author: Ville Syrjälä Date: Wed Nov 14 19:34:40 2018 +0200 drm/i915: Disable LP3 watermarks on all SNB machines I have a Thinkpad X220 Tablet in my hands that is losing vblank interrupts whenever LP3 watermarks are used. If I nudge the latency value written to the WM3 register just by one in either direction the problem disappears. That to me suggests that the punit will not enter the corrsponding powersave mode (MPLL shutdown IIRC) unless the latency value in the register matches exactly what we read from SSKPD. Ie. it's not really a latency value but rather just a cookie by which the punit can identify the desired power saving state. On HSW/BDW this was changed such that we actually just write the WM level number into those bits, which makes much more sense given the observed behaviour. We could try to handle this by disallowing LP3 watermarks only when vblank interrupts are enabled but we'd first have to prove that only vblank interrupts are affected, which seems unlikely. Also we can't grab the wm mutex from the vblank enable/disable hooks because those are called with various spinlocks held. Thus we'd have to redesigne the watermark locking. So to play it safe and keep the code simple we simply disable LP3 watermarks on all SNB machines. To do that we simply zero out the latency values for watermark level 3, and we adjust the watermark computation to check for that. The behaviour now matches that of the g4x/vlv/skl wm code in the presence of a zeroed latency value. v2: s/USHRT_MAX/U32_MAX/ for consistency with the types (Chris) Cc: stable@vger.kernel.org Cc: Chris Wilson Acked-by: Chris Wilson Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=101269 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=103713 Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20181114173440.6730-1-ville.syrjala@linux.intel.com (cherry picked from commit 03981c6ebec4fc7056b9b45f847393aeac90d060) Signed-off-by: Joonas Lahtinen commit a6b0961b39896a9f9f1350d26d202f078a7d9dbc Author: Connor McAdams Date: Fri Nov 16 14:24:56 2018 -0500 ALSA: hda/ca0132 - fix AE-5 pincfg This patch fixes the pincfg assignment for the AE-5, which was previously using the Recon3D pincfg's by mistake. Fixes: d06feaf02fe6 ("ALSA: hda/ca0132 - Add pincfg for AE-5") Signed-off-by: Connor McAdams Signed-off-by: Takashi Iwai commit cce997292a5264c5342c968bbd226d7c365f03d6 Author: Connor McAdams Date: Fri Nov 16 14:24:55 2018 -0500 ALSA: hda/ca0132 - Add new ZxR quirk This patch adds a new PCI subsys ID for the ZxR, as found and tested by other users. Without a way to know if any Z's use it as well, it keeps the quirk of QUIRK_SBZ and goes through the HDA subsys test function. Signed-off-by: Connor McAdams Signed-off-by: Takashi Iwai commit cdcefe6bd9df754f528ffc339d3cc143cea4ddf6 Author: Rajat Jain Date: Mon Oct 29 15:17:01 2018 -0700 mmc: sdhci-pci: Try "cd" for card-detect lookup before using NULL Problem: The card detect IRQ does not work with modern BIOS (that want to use _DSD to provide the card detect GPIO to the driver). Details: The mmc core provides the mmc_gpiod_request_cd() API to let host drivers request the gpio descriptor for the "card detect" pin. This pin is specified in the ACPI for the SDHC device: * Either as a resource using _CRS. This is a method used by legacy BIOS. (The driver needs to tell which resource index). * Or as a named property ("cd-gpios"/"cd-gpio") in _DSD (which internally points to an entry in _CRS). This way, the driver can lookup using a string. This is what modern BIOS prefer to use. This API finally results in a call to the following code: struct gpio_desc *acpi_find_gpio(..., const char *con_id,...) { ... /* Lookup gpio (using "-gpio") in the _DSD */ ... if (!acpi_can_fallback_to_crs(adev, con_id)) return ERR_PTR(-ENOENT); ... /* Falling back to _CRS is allowed, Lookup gpio in the _CRS */ ... } Note that this means that if the ACPI has _DSD properties, the kernel will never use _CRS for the lookup (Because acpi_can_fallback_to_crs() will always be false for any device hat has _DSD entries). The SDHCI driver is thus currently broken on a modern BIOS, even if BIOS provides both _CRS (for index based lookup) and _DSD entries (for string based lookup). Ironically, none of these will be used for the lookup currently because: * Since the con_id is NULL, acpi_find_gpio() does not find a matching entry in DSDT. (The _DSDT entry has the property name = "cd-gpios") * Because ACPI contains DSDT entries, thus acpi_can_fallback_to_crs() returns false (because device properties have been populated from _DSD), thus the _CRS is never used for the lookup. Fix: Try "cd" for lookup in the _DSD before falling back to using NULL so as to try looking up in the _CRS. I've tested this patch successfully with both Legacy BIOS (that provide only _CRS method) as well as modern BIOS (that provide both _CRS and _DSD). Also the use of "cd" appears to be fairly consistent across other users of this API (other MMC host controller drivers). Link: https://lkml.org/lkml/2018/9/25/1113 Signed-off-by: Rajat Jain Acked-by: Adrian Hunter Fixes: f10e4bf6632b ("gpio: acpi: Even more tighten up ACPI GPIO lookups") Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit c22397888f1eed98cd59f0a88f2a5f6925f80e15 Author: Chanho Min Date: Mon Nov 12 12:54:45 2018 +0900 exec: make de_thread() freezable Suspend fails due to the exec family of functions blocking the freezer. The casue is that de_thread() sleeps in TASK_UNINTERRUPTIBLE waiting for all sub-threads to die, and we have the deadlock if one of them is frozen. This also can occur with the schedule() waiting for the group thread leader to exit if it is frozen. In our machine, it causes freeze timeout as bellows. Freezing of tasks failed after 20.010 seconds (1 tasks refusing to freeze, wq_busy=0): setcpushares-ls D ffffffc00008ed70 0 5817 1483 0x0040000d Call trace: [] __switch_to+0x88/0xa0 [] __schedule+0x1bc/0x720 [] schedule+0x40/0xa8 [] flush_old_exec+0xdc/0x640 [] load_elf_binary+0x2a8/0x1090 [] search_binary_handler+0x9c/0x240 [] load_script+0x20c/0x228 [] search_binary_handler+0x9c/0x240 [] do_execveat_common.isra.14+0x4f8/0x6e8 [] compat_SyS_execve+0x38/0x48 [] el0_svc_naked+0x24/0x28 To fix this, make de_thread() freezable. It looks safe and works fine. Suggested-by: Oleg Nesterov Signed-off-by: Chanho Min Acked-by: Oleg Nesterov Acked-by: Pavel Machek Acked-by: Michal Hocko Signed-off-by: Rafael J. Wysocki commit d98ccfc3948ab63152494bb6b9c17e15295c0310 Author: Dave Gerlach Date: Tue Nov 13 13:30:40 2018 -0600 cpufreq: ti-cpufreq: Only register platform_device when supported Currently the ti-cpufreq driver blindly registers a 'ti-cpufreq' to force the driver to probe on any platforms where the driver is built in. However, this should only happen on platforms that actually can make use of the driver. There is already functionality in place to match the SoC compatible so let's factor this out into a separate call and make sure we find a match before creating the ti-cpufreq platform device. Reviewed-by: Johan Hovold Signed-off-by: Dave Gerlach Acked-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit 6eb5c9b5edffe626d2df6a22f449dc7fab253841 Merge: 9ff01193a20d 622fecbccfe8 Author: Rafael J. Wysocki Date: Mon Nov 19 11:22:04 2018 +0100 Merge branch 'opp/fixes-for-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull operating performance points (OPP) framework fixes for 4.20 from Viresh Kumar. * 'opp/fixes-for-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: opp: ti-opp-supply: Correct the supply in _get_optimal_vdd_voltage call opp: ti-opp-supply: Dynamically update u_volt_min commit ae6b3e54aa52cd29965b8e4e47000ed2c5d78eb8 Author: Hans de Goede Date: Sun Nov 18 20:25:35 2018 +0100 ACPICA: Fix handling of buffer-size in acpi_ex_write_data_to_field() Generic Serial Bus transfers use a data struct like this: struct gsb_buffer { u8 status; u8 len; u8 data[0]; }; acpi_ex_write_data_to_field() copies the data which is to be written from the source-buffer to a temp-buffer. This is done because the OpReg-handler overwrites the status field and some transfers do a write + read-back. Commit f99b89eefeb6 ("ACPICA: Update for generic_serial_bus and attrib_raw_process_bytes protocol") acpi_ex_write_data_to_field() introduces a number of problems with this: 1) It drops a "length += 2" statement used to calculate the temp-buffer size causing the temp-buffer to only be 1/2 bytes large for byte/word transfers while it should be 3/4 bytes (taking the status and len field into account). This is already fixed in commit e324e10109fc ("ACPICA: Update for field unit access") which refactors the code. The ACPI 6.0 spec (ACPI_6.0.pdf) "5.5.2.4.5.2 Declaring and Using a GenericSerialBusData Buffer" (page 232) states that the GenericSerialBus Data Buffer Length field is only valid when doing a Read/Write Block (AttribBlock) transfer, but since the troublesome commit we unconditionally use the len field to determine how much data to copy from the source-buffer into the temp-buffer passed to the OpRegion. This causes 3 further issues: 2) This may lead to not copying enough data to the temp-buffer causing the OpRegion handler for the serial-bus to write garbage to the hardware. 3) The temp-buffer passed to the OpRegion is allocated to the size returned by acpi_ex_get_serial_access_length(), which may be as little as 1, so potentially this may lead to a write overflow of the temp-buffer. 4) Commit e324e10109fc ("ACPICA: Update for field unit access") drops a length check on the source-buffer, leading to a potential read overflow of the source-buffer. This commit fixes all 3 remaining issues by not looking at the len field at all (the interpretation of this field is left up to the OpRegion handler), and copying the minimum of the source- and temp-buffer sizes from the source-buffer to the temp-buffer. This fixes e.g. an Acer S1003 no longer booting since the troublesome commit. Fixes: f99b89eefeb6 (ACPICA: Update for generic_serial_bus and ...) Fixes: e324e10109fc (ACPICA: Update for field unit access) Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit b54e41f5efcb4316b2f30b30c2535cc194270373 Author: Jan Kara Date: Fri Nov 16 13:43:17 2018 +0100 udf: Allow mounting volumes with incorrect identification strings Commit c26f6c615788 ("udf: Fix conversion of 'dstring' fields to UTF8") started to be more strict when checking whether converted strings are properly formatted. Sudip reports that there are DVDs where the volume identification string is actually too long - UDF reports: [ 632.309320] UDF-fs: incorrect dstring lengths (32/32) during mount and fails the mount. This is mostly harmless failure as we don't need volume identification (and even less volume set identification) for anything. So just truncate the volume identification string if it is too long and replace it with 'Invalid' if we just cannot convert it for other reasons. This keeps slightly incorrect media still mountable. CC: stable@vger.kernel.org Fixes: c26f6c615788 ("udf: Fix conversion of 'dstring' fields to UTF8") Reported-and-tested-by: Sudip Mukherjee Signed-off-by: Jan Kara commit 672e60b72bbe7aace88721db55b380b6a51fb8f9 Author: Heiko Stuebner Date: Sun Nov 18 20:03:02 2018 +0100 ARM: dts: rockchip: Remove @0 from the veyron memory node The Coreboot version on veyron ChromeOS devices seems to ignore memory@0 nodes when updating the available memory and instead inserts another memory node without the address. This leads to 4GB systems only ever be using 2GB as the memory@0 node takes precedence. So remove the @0 for veyron devices. Fixes: 0b639b815f15 ("ARM: dts: rockchip: Add missing unit name to memory nodes in rk3288 boards") Cc: stable@vger.kernel.org Reported-by: Heikki Lindholm Signed-off-by: Heiko Stuebner commit 909e22e05353a783c526829427e9a8de122fba9c Author: YueHaibing Date: Mon Nov 19 11:32:41 2018 +0800 exportfs: fix 'passing zero to ERR_PTR()' warning Fix a static code checker warning: fs/exportfs/expfs.c:171 reconnect_one() warn: passing zero to 'ERR_PTR' The error path for lookup_one_len_unlocked failure should set err to PTR_ERR. Fixes: bbf7a8a3562f ("exportfs: move most of reconnect_path to helper function") Signed-off-by: YueHaibing Signed-off-by: Al Viro commit 8ebebcba559a1bfbaec7bbda64feb9870b9c58da Author: Matthew Cover Date: Sun Nov 18 00:46:00 2018 -0700 tuntap: fix multiqueue rx When writing packets to a descriptor associated with a combined queue, the packets should end up on that queue. Before this change all packets written to any descriptor associated with a tap interface end up on rx-0, even when the descriptor is associated with a different queue. The rx traffic can be generated by either of the following. 1. a simple tap program which spins up multiple queues and writes packets to each of the file descriptors 2. tx from a qemu vm with a tap multiqueue netdev The queue for rx traffic can be observed by either of the following (done on the hypervisor in the qemu case). 1. a simple netmap program which opens and reads from per-queue descriptors 2. configuring RPS and doing per-cpu captures with rxtxcpu Alternatively, if you printk() the return value of skb_get_rx_queue() just before each instance of netif_receive_skb() in tun.c, you will get 65535 for every skb. Calling skb_record_rx_queue() to set the rx queue to the queue_index fixes the association between descriptor and rx queue. Signed-off-by: Matthew Cover Signed-off-by: David S. Miller commit 7ddacfa564870cdd97275fd87decb6174abc6380 Author: David Ahern Date: Sun Nov 18 10:45:30 2018 -0800 ipv6: Fix PMTU updates for UDP/raw sockets in presence of VRF Preethi reported that PMTU discovery for UDP/raw applications is not working in the presence of VRF when the socket is not bound to a device. The problem is that ip6_sk_update_pmtu does not consider the L3 domain of the skb device if the socket is not bound. Update the function to set oif to the L3 master device if relevant. Fixes: ca254490c8df ("net: Add VRF support to IPv6 stack") Reported-by: Preethi Ramachandra Signed-off-by: David Ahern Signed-off-by: David S. Miller commit 86322ba9571a36b0b149a5f27fc3423c2dadbe39 Author: Sabyasachi Gupta Date: Sat Nov 3 10:54:52 2018 +0530 arch/sparc: Use kzalloc_node Replaced kmalloc_node + memset with kzalloc_node Signed-off-by: Sabyasachi Gupta Signed-off-by: David S. Miller commit 5478ad10e7850ce3d8b7056db05ddfa3c9ddad9a Author: Thomas Zimmermann Date: Thu Nov 15 11:42:16 2018 +0100 drm/ast: Remove existing framebuffers before loading driver If vesafb attaches to the AST device, it configures the framebuffer memory for uncached access by default. When ast.ko later tries to attach itself to the device, it wants to use write-combining on the framebuffer memory, but vesefb's existing configuration for uncached access takes precedence. This results in reduced performance. Removing the framebuffer's configuration before loding the AST driver fixes the problem. Other DRM drivers already contain equivalent code. Link: https://bugzilla.opensuse.org/show_bug.cgi?id=1112963 Signed-off-by: Thomas Zimmermann Cc: Tested-by: Y.C. Chen Reviewed-by: Jean Delvare Tested-by: Jean Delvare Signed-off-by: Dave Airlie commit 09aaf6813cfca4c18034fda7a43e68763f34abb1 Author: Huacai Chen Date: Thu Nov 15 10:44:57 2018 +0800 hwmon: (w83795) temp4_type has writable permission Both datasheet and comments of store_temp_mode() tell us that temp1~4_type is writable, so fix it. Signed-off-by: Yao Wang Signed-off-by: Huacai Chen Fixes: 39deb6993e7c (" hwmon: (w83795) Simplify temperature sensor type handling") Signed-off-by: Guenter Roeck commit 9ff01193a20d391e8dbce4403dd5ef87c7eaaca6 Author: Linus Torvalds Date: Sun Nov 18 13:33:44 2018 -0800 Linux 4.20-rc3 commit 25e19c1fe421280a47f37c3571aa379e6e67966c Merge: c67a98c00ea3 2121db096301 Author: Linus Torvalds Date: Sun Nov 18 12:21:09 2018 -0800 Merge tag 'libnvdimm-fixes-4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm fixes from Dan Williams: "A small batch of fixes for v4.20-rc3. The overflow continuation fix addresses something that has been broken for several releases. Arguably it could wait even longer, but it's a one line fix and this finishes the last of the known address range scrub bug reports. The revert addresses a lockdep regression. The unit tests are not critical to fix, but no reason to hold this fix back. Summary: - Address Range Scrub overflow continuation handling has been broken since it was initially merged. It was only recently that error injection and platform-BIOS support enabled this corner case to be exercised. - The recent attempt to provide more isolation for the kernel Address Range Scrub state machine from userapace initiated sessions triggers a lockdep report. Revert and try again at the next merge window. - Fix a kasan reported buffer overflow in libnvdimm unit test infrastrucutre (nfit_test)" * tag 'libnvdimm-fixes-4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: Revert "acpi, nfit: Further restrict userspace ARS start requests" acpi, nfit: Fix ARS overflow continuation tools/testing/nvdimm: Fix the array size for dimm devices. commit c67a98c00ea3c1fad14833f440fcd770232d24e7 Merge: 03582f338e39 45e79815b891 Author: Linus Torvalds Date: Sun Nov 18 11:31:26 2018 -0800 Merge branch 'akpm' (patches from Andrew) Merge misc fixes from Andrew Morton: "16 fixes" * emailed patches from Andrew Morton : mm/memblock.c: fix a typo in __next_mem_pfn_range() comments mm, page_alloc: check for max order in hot path scripts/spdxcheck.py: make python3 compliant tmpfs: make lseek(SEEK_DATA/SEK_HOLE) return ENXIO with a negative offset lib/ubsan.c: don't mark __ubsan_handle_builtin_unreachable as noreturn mm/vmstat.c: fix NUMA statistics updates mm/gup.c: fix follow_page_mask() kerneldoc comment ocfs2: free up write context when direct IO failed scripts/faddr2line: fix location of start_kernel in comment mm: don't reclaim inodes with many attached pages mm, memory_hotplug: check zone_movable in has_unmovable_pages mm/swapfile.c: use kvzalloc for swap_info_struct allocation MAINTAINERS: update OMAP MMC entry hugetlbfs: fix kernel BUG at fs/hugetlbfs/inode.c:444! kernel/sched/psi.c: simplify cgroup_move_task() z3fold: fix possible reclaim races commit 03582f338e39ed8f8e8451ef1ef04f060d785a87 Merge: b53e27f618b5 c469933e7721 Author: Linus Torvalds Date: Sun Nov 18 10:58:20 2018 -0800 Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Ingo Molnar: "Fix an exec() related scalability/performance regression, which was caused by incorrectly calculating load and migrating tasks on exec() when they shouldn't be" * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/fair: Fix cpu_util_wake() for 'execl' type workloads commit b53e27f618b58d50db72375eb8e1b6ddcef7cdb5 Merge: 743a4863fddc 4d47d6407ac7 Author: Linus Torvalds Date: Sun Nov 18 10:54:59 2018 -0800 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "Fix uncore PMU enumeration for CofeeLake CPUs" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel/uncore: Support CoffeeLake 8th CBOX perf/x86/intel/uncore: Add more IMC PCI IDs for KabyLake and CoffeeLake CPUs commit 743a4863fddc4fdd591e1cbf4157e981a71b0f09 Merge: cfaa9f029f81 63eb322d89c8 Author: Linus Torvalds Date: Sun Nov 18 10:52:26 2018 -0800 Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI fixes from Ingo Molnar: "Misc fixes: two warning splat fixes, a leak fix and persistent memory allocation fixes for ARM" * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: efi: Permit calling efi_mem_reserve_persistent() from atomic context efi/arm: Defer persistent reservations until after paging_init() efi/arm/libstub: Pack FDT after populating it efi/arm: Revert deferred unmap of early memmap mapping efi: Fix debugobjects warning on 'efi_rts_work' commit cfaa9f029f8141e9ee8d621a126d9dd4cc89aa63 Merge: 1ce80e0fe98e 383fb3ee8024 Author: Linus Torvalds Date: Sun Nov 18 10:45:09 2018 -0800 Merge branch 'spectre' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM spectre updates from Russell King: "These are the currently known final bits that resolve the Spectre issues. big.Little systems used to be sufficiently identical in that there were no differences between individual CPUs in the system that mattered to the kernel. With the advent of the Spectre problem, the CPUs now have differences in how the workaround is applied. As a result of previous Spectre patches, these systems ended up reporting quite a lot of: "CPUx: Spectre v2: incorrect context switching function, system vulnerable" messages due to the action of the big.Little switcher causing the CPUs to be re-initialised regularly. This series resolves that issue by making the CPU vtable unique to each CPU. However, since this is used very early, before per-cpu is setup, per-cpu can't be used. We also have a problem that two of the methods are not called from preempt-safe paths, but thankfully these remain identical between all CPUs in the system. To make sure, we validate that these are identical during boot" * 'spectre' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: spectre-v2: per-CPU vtables to work around big.Little systems ARM: add PROC_VTABLE and PROC_TABLE macros ARM: clean up per-processor check_bugs method call ARM: split out processor lookup ARM: make lookup_processor_type() non-__init commit 45e79815b89149dc6698e71b587c86ffaf4062aa Author: Chen Chang Date: Fri Nov 16 15:08:57 2018 -0800 mm/memblock.c: fix a typo in __next_mem_pfn_range() comments Link: http://lkml.kernel.org/r/20181107100247.13359-1-rainccrun@gmail.com Signed-off-by: Chen Chang Acked-by: Michal Hocko Acked-by: Mike Rapoport Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c63ae43ba53bc432b414fd73dd5f4b01fcb1ab43 Author: Michal Hocko Date: Fri Nov 16 15:08:53 2018 -0800 mm, page_alloc: check for max order in hot path Konstantin has noticed that kvmalloc might trigger the following warning: WARNING: CPU: 0 PID: 6676 at mm/vmstat.c:986 __fragmentation_index+0x54/0x60 [...] Call Trace: fragmentation_index+0x76/0x90 compaction_suitable+0x4f/0xf0 shrink_node+0x295/0x310 node_reclaim+0x205/0x250 get_page_from_freelist+0x649/0xad0 __alloc_pages_nodemask+0x12a/0x2a0 kmalloc_large_node+0x47/0x90 __kmalloc_node+0x22b/0x2e0 kvmalloc_node+0x3e/0x70 xt_alloc_table_info+0x3a/0x80 [x_tables] do_ip6t_set_ctl+0xcd/0x1c0 [ip6_tables] nf_setsockopt+0x44/0x60 SyS_setsockopt+0x6f/0xc0 do_syscall_64+0x67/0x120 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 the problem is that we only check for an out of bound order in the slow path and the node reclaim might happen from the fast path already. This is fixable by making sure that kvmalloc doesn't ever use kmalloc for requests that are larger than KMALLOC_MAX_SIZE but this also shows that the code is rather fragile. A recent UBSAN report just underlines that by the following report UBSAN: Undefined behaviour in mm/page_alloc.c:3117:19 shift exponent 51 is too large for 32-bit type 'int' CPU: 0 PID: 6520 Comm: syz-executor1 Not tainted 4.19.0-rc2 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xd2/0x148 lib/dump_stack.c:113 ubsan_epilogue+0x12/0x94 lib/ubsan.c:159 __ubsan_handle_shift_out_of_bounds+0x2b6/0x30b lib/ubsan.c:425 __zone_watermark_ok+0x2c7/0x400 mm/page_alloc.c:3117 zone_watermark_fast mm/page_alloc.c:3216 [inline] get_page_from_freelist+0xc49/0x44c0 mm/page_alloc.c:3300 __alloc_pages_nodemask+0x21e/0x640 mm/page_alloc.c:4370 alloc_pages_current+0xcc/0x210 mm/mempolicy.c:2093 alloc_pages include/linux/gfp.h:509 [inline] __get_free_pages+0x12/0x60 mm/page_alloc.c:4414 dma_mem_alloc+0x36/0x50 arch/x86/include/asm/floppy.h:156 raw_cmd_copyin drivers/block/floppy.c:3159 [inline] raw_cmd_ioctl drivers/block/floppy.c:3206 [inline] fd_locked_ioctl+0xa00/0x2c10 drivers/block/floppy.c:3544 fd_ioctl+0x40/0x60 drivers/block/floppy.c:3571 __blkdev_driver_ioctl block/ioctl.c:303 [inline] blkdev_ioctl+0xb3c/0x1a30 block/ioctl.c:601 block_ioctl+0x105/0x150 fs/block_dev.c:1883 vfs_ioctl fs/ioctl.c:46 [inline] do_vfs_ioctl+0x1c0/0x1150 fs/ioctl.c:687 ksys_ioctl+0x9e/0xb0 fs/ioctl.c:702 __do_sys_ioctl fs/ioctl.c:709 [inline] __se_sys_ioctl fs/ioctl.c:707 [inline] __x64_sys_ioctl+0x7e/0xc0 fs/ioctl.c:707 do_syscall_64+0xc4/0x510 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Note that this is not a kvmalloc path. It is just that the fast path really depends on having sanitzed order as well. Therefore move the order check to the fast path. Link: http://lkml.kernel.org/r/20181113094305.GM15120@dhcp22.suse.cz Signed-off-by: Michal Hocko Reported-by: Konstantin Khlebnikov Reported-by: Kyungtae Kim Acked-by: Vlastimil Babka Cc: Balbir Singh Cc: Mel Gorman Cc: Pavel Tatashin Cc: Oscar Salvador Cc: Mike Rapoport Cc: Aaron Lu Cc: Joonsoo Kim Cc: Byoungyoung Lee Cc: "Dae R. Jeong" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6f4d29df66acd49303a99025046b85cabe7aa17a Author: Uwe Kleine-König Date: Fri Nov 16 15:08:43 2018 -0800 scripts/spdxcheck.py: make python3 compliant Without this change the following happens when using Python3 (3.6.6): $ echo "GPL-2.0" | python3 scripts/spdxcheck.py - FAIL: 'str' object has no attribute 'decode' Traceback (most recent call last): File "scripts/spdxcheck.py", line 253, in parser.parse_lines(sys.stdin, args.maxlines, '-') File "scripts/spdxcheck.py", line 171, in parse_lines line = line.decode(locale.getpreferredencoding(False), errors='ignore') AttributeError: 'str' object has no attribute 'decode' So as the line is already a string, there is no need to decode it and the line can be dropped. /usr/bin/python on Arch is Python 3. So this would indeed be worth going into 4.19. Link: http://lkml.kernel.org/r/20181023070802.22558-1-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Cc: Thomas Gleixner Cc: Joe Perches Cc: Greg Kroah-Hartman Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1a413646931cb14442065cfc17561e50f5b5bb44 Author: Yufen Yu Date: Fri Nov 16 15:08:39 2018 -0800 tmpfs: make lseek(SEEK_DATA/SEK_HOLE) return ENXIO with a negative offset Other filesystems such as ext4, f2fs and ubifs all return ENXIO when lseek (SEEK_DATA or SEEK_HOLE) requests a negative offset. man 2 lseek says : EINVAL whence is not valid. Or: the resulting file offset would be : negative, or beyond the end of a seekable device. : : ENXIO whence is SEEK_DATA or SEEK_HOLE, and the file offset is beyond : the end of the file. Make tmpfs return ENXIO under these circumstances as well. After this, tmpfs also passes xfstests's generic/448. [akpm@linux-foundation.org: rewrite changelog] Link: http://lkml.kernel.org/r/1540434176-14349-1-git-send-email-yuyufen@huawei.com Signed-off-by: Yufen Yu Reviewed-by: Andrew Morton Cc: Al Viro Cc: Hugh Dickins Cc: William Kucharski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1c23b4108d716cc848b38532063a8aca4f86add8 Author: Arnd Bergmann Date: Fri Nov 16 15:08:35 2018 -0800 lib/ubsan.c: don't mark __ubsan_handle_builtin_unreachable as noreturn gcc-8 complains about the prototype for this function: lib/ubsan.c:432:1: error: ignoring attribute 'noreturn' in declaration of a built-in function '__ubsan_handle_builtin_unreachable' because it conflicts with attribute 'const' [-Werror=attributes] This is actually a GCC's bug. In GCC internals __ubsan_handle_builtin_unreachable() declared with both 'noreturn' and 'const' attributes instead of only 'noreturn': https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84210 Workaround this by removing the noreturn attribute. [aryabinin: add information about GCC bug in changelog] Link: http://lkml.kernel.org/r/20181107144516.4587-1-aryabinin@virtuozzo.com Signed-off-by: Arnd Bergmann Signed-off-by: Andrey Ryabinin Acked-by: Olof Johansson Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 13c9aaf7fa01cc7600c61981609feadeef3354ec Author: Janne Huttunen Date: Fri Nov 16 15:08:32 2018 -0800 mm/vmstat.c: fix NUMA statistics updates Scan through the whole array to see if an update is needed. While we're at it, use sizeof() to be safe against any possible type changes in the future. The bug here is that we wouldn't sync per-cpu counters into global ones if there was an update of numa_stats for higher cpus. Highly theoretical one though because it is much more probable that zone_stats are updated so we would refresh anyway. So I wouldn't bother to mark this for stable, yet something nice to fix. [mhocko@suse.com: changelog enhancement] Link: http://lkml.kernel.org/r/1541601517-17282-1-git-send-email-janne.huttunen@nokia.com Fixes: 1d90ca897cb0 ("mm: update NUMA counter threshold size") Signed-off-by: Janne Huttunen Acked-by: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 78179556e7605ba07fd3ddba6ab8891fa457b93e Author: Mike Rapoport Date: Fri Nov 16 15:08:29 2018 -0800 mm/gup.c: fix follow_page_mask() kerneldoc comment Commit df06b37ffe5a ("mm/gup: cache dev_pagemap while pinning pages") modified the signature of follow_page_mask() but left the parameter description behind. Update the description to make the code and comments agree again. While at it, update formatting of the return value description to match Documentation/doc-guide/kernel-doc.rst guidelines. Link: http://lkml.kernel.org/r/1541603316-27832-1-git-send-email-rppt@linux.ibm.com Signed-off-by: Mike Rapoport Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5040f8df56fb90c7919f1c9b0b6e54c843437456 Author: Wengang Wang Date: Fri Nov 16 15:08:25 2018 -0800 ocfs2: free up write context when direct IO failed The write context should also be freed even when direct IO failed. Otherwise a memory leak is introduced and entries remain in oi->ip_unwritten_list causing the following BUG later in unlink path: ERROR: bug expression: !list_empty(&oi->ip_unwritten_list) ERROR: Clear inode of 215043, inode has unwritten extents ... Call Trace: ? __set_current_blocked+0x42/0x68 ocfs2_evict_inode+0x91/0x6a0 [ocfs2] ? bit_waitqueue+0x40/0x33 evict+0xdb/0x1af iput+0x1a2/0x1f7 do_unlinkat+0x194/0x28f SyS_unlinkat+0x1b/0x2f do_syscall_64+0x79/0x1ae entry_SYSCALL_64_after_hwframe+0x151/0x0 This patch also logs, with frequency limit, direct IO failures. Link: http://lkml.kernel.org/r/20181102170632.25921-1-wen.gang.wang@oracle.com Signed-off-by: Wengang Wang Reviewed-by: Junxiao Bi Reviewed-by: Changwei Ge Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f5f67cc0e0d3d17ee046ba83f831f267767b8554 Author: Randy Dunlap Date: Fri Nov 16 15:08:22 2018 -0800 scripts/faddr2line: fix location of start_kernel in comment Fix a source file reference location to the correct path name. Link: http://lkml.kernel.org/r/1d50bd3d-178e-dcd8-779f-9711887440eb@infradead.org Signed-off-by: Randy Dunlap Acked-by: Josh Poimboeuf Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a76cf1a474d7dbcd9336b5f5afb0162baa142cf0 Author: Roman Gushchin Date: Fri Nov 16 15:08:18 2018 -0800 mm: don't reclaim inodes with many attached pages Spock reported that commit 172b06c32b94 ("mm: slowly shrink slabs with a relatively small number of objects") leads to a regression on his setup: periodically the majority of the pagecache is evicted without an obvious reason, while before the change the amount of free memory was balancing around the watermark. The reason behind is that the mentioned above change created some minimal background pressure on the inode cache. The problem is that if an inode is considered to be reclaimed, all belonging pagecache page are stripped, no matter how many of them are there. So, if a huge multi-gigabyte file is cached in the memory, and the goal is to reclaim only few slab objects (unused inodes), we still can eventually evict all gigabytes of the pagecache at once. The workload described by Spock has few large non-mapped files in the pagecache, so it's especially noticeable. To solve the problem let's postpone the reclaim of inodes, which have more than 1 attached page. Let's wait until the pagecache pages will be evicted naturally by scanning the corresponding LRU lists, and only then reclaim the inode structure. Link: http://lkml.kernel.org/r/20181023164302.20436-1-guro@fb.com Signed-off-by: Roman Gushchin Reported-by: Spock Tested-by: Spock Reviewed-by: Andrew Morton Cc: Michal Hocko Cc: Rik van Riel Cc: Randy Dunlap Cc: [4.19.x] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9d7899999c62c1a81129b76d2a6ecbc4655e1597 Author: Michal Hocko Date: Fri Nov 16 15:08:15 2018 -0800 mm, memory_hotplug: check zone_movable in has_unmovable_pages Page state checks are racy. Under a heavy memory workload (e.g. stress -m 200 -t 2h) it is quite easy to hit a race window when the page is allocated but its state is not fully populated yet. A debugging patch to dump the struct page state shows has_unmovable_pages: pfn:0x10dfec00, found:0x1, count:0x0 page:ffffea0437fb0000 count:1 mapcount:1 mapping:ffff880e05239841 index:0x7f26e5000 compound_mapcount: 1 flags: 0x5fffffc0090034(uptodate|lru|active|head|swapbacked) Note that the state has been checked for both PageLRU and PageSwapBacked already. Closing this race completely would require some sort of retry logic. This can be tricky and error prone (think of potential endless or long taking loops). Workaround this problem for movable zones at least. Such a zone should only contain movable pages. Commit 15c30bc09085 ("mm, memory_hotplug: make has_unmovable_pages more robust") has told us that this is not strictly true though. Bootmem pages should be marked reserved though so we can move the original check after the PageReserved check. Pages from other zones are still prone to races but we even do not pretend that memory hotremove works for those so pre-mature failure doesn't hurt that much. Link: http://lkml.kernel.org/r/20181106095524.14629-1-mhocko@kernel.org Fixes: 15c30bc09085 ("mm, memory_hotplug: make has_unmovable_pages more robust") Signed-off-by: Michal Hocko Reported-by: Baoquan He Tested-by: Baoquan He Acked-by: Baoquan He Reviewed-by: Oscar Salvador Acked-by: Balbir Singh Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 873d7bcfd066663e3e50113dc4a0de19289b6354 Author: Vasily Averin Date: Fri Nov 16 15:08:11 2018 -0800 mm/swapfile.c: use kvzalloc for swap_info_struct allocation Commit a2468cc9bfdf ("swap: choose swap device according to numa node") changed 'avail_lists' field of 'struct swap_info_struct' to an array. In popular linux distros it increased size of swap_info_struct up to 40 Kbytes and now swap_info_struct allocation requires order-4 page. Switch to kvzmalloc allows to avoid unexpected allocation failures. Link: http://lkml.kernel.org/r/fc23172d-3c75-21e2-d551-8b1808cbe593@virtuozzo.com Fixes: a2468cc9bfdf ("swap: choose swap device according to numa node") Signed-off-by: Vasily Averin Acked-by: Aaron Lu Acked-by: Michal Hocko Reviewed-by: Andrew Morton Cc: Huang Ying Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f341e16fb67ddc199582d187b0d39120a9dfd2bf Author: Aaro Koskinen Date: Fri Nov 16 15:08:08 2018 -0800 MAINTAINERS: update OMAP MMC entry Jarkko's e-mail address hasn't worked for a long time. We still want to keep this driver working as it is critical for some of the OMAP boards. I use and test this driver frequently, so change myself as a maintainer with "Odd Fixes" status. Link: http://lkml.kernel.org/r/20181106222750.12939-1-aaro.koskinen@iki.fi Signed-off-by: Aaro Koskinen Acked-by: Tony Lindgren Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5e41540c8a0f0e98c337dda8b391e5dda0cde7cf Author: Mike Kravetz Date: Fri Nov 16 15:08:04 2018 -0800 hugetlbfs: fix kernel BUG at fs/hugetlbfs/inode.c:444! This bug has been experienced several times by the Oracle DB team. The BUG is in remove_inode_hugepages() as follows: /* * If page is mapped, it was faulted in after being * unmapped in caller. Unmap (again) now after taking * the fault mutex. The mutex will prevent faults * until we finish removing the page. * * This race can only happen in the hole punch case. * Getting here in a truncate operation is a bug. */ if (unlikely(page_mapped(page))) { BUG_ON(truncate_op); In this case, the elevated map count is not the result of a race. Rather it was incorrectly incremented as the result of a bug in the huge pmd sharing code. Consider the following: - Process A maps a hugetlbfs file of sufficient size and alignment (PUD_SIZE) that a pmd page could be shared. - Process B maps the same hugetlbfs file with the same size and alignment such that a pmd page is shared. - Process B then calls mprotect() to change protections for the mapping with the shared pmd. As a result, the pmd is 'unshared'. - Process B then calls mprotect() again to chage protections for the mapping back to their original value. pmd remains unshared. - Process B then forks and process C is created. During the fork process, we do dup_mm -> dup_mmap -> copy_page_range to copy page tables. Copying page tables for hugetlb mappings is done in the routine copy_hugetlb_page_range. In copy_hugetlb_page_range(), the destination pte is obtained by: dst_pte = huge_pte_alloc(dst, addr, sz); If pmd sharing is possible, the returned pointer will be to a pte in an existing page table. In the situation above, process C could share with either process A or process B. Since process A is first in the list, the returned pte is a pointer to a pte in process A's page table. However, the check for pmd sharing in copy_hugetlb_page_range is: /* If the pagetables are shared don't copy or take references */ if (dst_pte == src_pte) continue; Since process C is sharing with process A instead of process B, the above test fails. The code in copy_hugetlb_page_range which follows assumes dst_pte points to a huge_pte_none pte. It copies the pte entry from src_pte to dst_pte and increments this map count of the associated page. This is how we end up with an elevated map count. To solve, check the dst_pte entry for huge_pte_none. If !none, this implies PMD sharing so do not copy. Link: http://lkml.kernel.org/r/20181105212315.14125-1-mike.kravetz@oracle.com Fixes: c5c99429fa57 ("fix hugepages leak due to pagetable page sharing") Signed-off-by: Mike Kravetz Reviewed-by: Naoya Horiguchi Cc: Michal Hocko Cc: Hugh Dickins Cc: Andrea Arcangeli Cc: "Kirill A . Shutemov" Cc: Davidlohr Bueso Cc: Prakash Sangappa Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8fcb2312d1e3300e81aa871aad00d4c038cfc184 Author: Olof Johansson Date: Fri Nov 16 15:08:00 2018 -0800 kernel/sched/psi.c: simplify cgroup_move_task() The existing code triggered an invalid warning about 'rq' possibly being used uninitialized. Instead of doing the silly warning suppression by initializa it to NULL, refactor the code to bail out early instead. Warning was: kernel/sched/psi.c: In function `cgroup_move_task': kernel/sched/psi.c:639:13: warning: `rq' may be used uninitialized in this function [-Wmaybe-uninitialized] Link: http://lkml.kernel.org/r/20181103183339.8669-1-olof@lixom.net Fixes: 2ce7135adc9ad ("psi: cgroup support") Signed-off-by: Olof Johansson Reviewed-by: Andrew Morton Acked-by: Johannes Weiner Cc: Ingo Molnar Cc: Peter Zijlstra Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ca0246bb97c23da9d267c2107c07fb77e38205c9 Author: Vitaly Wool Date: Fri Nov 16 15:07:56 2018 -0800 z3fold: fix possible reclaim races Reclaim and free can race on an object which is basically fine but in order for reclaim to be able to map "freed" object we need to encode object length in the handle. handle_to_chunks() is then introduced to extract object length from a handle and use it during mapping. Moreover, to avoid racing on a z3fold "headless" page release, we should not try to free that page in z3fold_free() if the reclaim bit is set. Also, in the unlikely case of trying to reclaim a page being freed, we should not proceed with that page. While at it, fix the page accounting in reclaim function. This patch supersedes "[PATCH] z3fold: fix reclaim lock-ups". Link: http://lkml.kernel.org/r/20181105162225.74e8837d03583a9b707cf559@gmail.com Signed-off-by: Vitaly Wool Signed-off-by: Jongseok Kim Reported-by-by: Jongseok Kim Reviewed-by: Snild Dolkow Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 33bf5519ae5dd356b182a94e3622f42860274a38 Author: Olof Johansson Date: Fri Nov 16 19:43:27 2018 -0800 mtd: rawnand: qcom: Namespace prefix some commands PAGE_READ is used by RISC-V arch code included through mm headers, and it makes sense to bring in a prefix on these in the driver. drivers/mtd/nand/raw/qcom_nandc.c:153: warning: "PAGE_READ" redefined #define PAGE_READ 0x2 In file included from include/linux/memremap.h:7, from include/linux/mm.h:27, from include/linux/scatterlist.h:8, from include/linux/dma-mapping.h:11, from drivers/mtd/nand/raw/qcom_nandc.c:17: arch/riscv/include/asm/pgtable.h:48: note: this is the location of the previous definition Caught by riscv allmodconfig. Signed-off-by: Olof Johansson Reviewed-by: Miquel Raynal Signed-off-by: Boris Brezillon commit 5d1e9c2212ea6b4dd735e4fc3dd6279a365d5d10 Author: Johan Hovold Date: Mon Aug 27 10:21:49 2018 +0200 mtd: rawnand: atmel: fix OF child-node lookup Use the new of_get_compatible_child() helper to lookup the nfc child node instead of using of_find_compatible_node(), which searches the entire tree from a given start node and thus can return an unrelated (i.e. non-child) node. This also addresses a potential use-after-free (e.g. after probe deferral) as the tree-wide helper drops a reference to its first argument (i.e. the node of the device being probed). While at it, also fix a related nfc-node reference leak. Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") Cc: stable # 4.11 Cc: Nicolas Ferre Cc: Josh Wu Cc: Boris Brezillon Signed-off-by: Johan Hovold Signed-off-by: Boris Brezillon commit 1c1274a56999fbdf9cf84e332b28448bb2d55221 Author: Jon Maloy Date: Sat Nov 17 12:17:06 2018 -0500 tipc: don't assume linear buffer when reading ancillary data The code for reading ancillary data from a received buffer is assuming the buffer is linear. To make this assumption true we have to linearize the buffer before message data is read. Signed-off-by: Jon Maloy Signed-off-by: David S. Miller commit adba75be0d23cca92a028749d92c60c8909bbdb3 Author: Jon Maloy Date: Fri Nov 16 16:55:04 2018 -0500 tipc: fix lockdep warning when reinitilaizing sockets We get the following warning: [ 47.926140] 32-bit node address hash set to 2010a0a [ 47.927202] [ 47.927433] ================================ [ 47.928050] WARNING: inconsistent lock state [ 47.928661] 4.19.0+ #37 Tainted: G E [ 47.929346] -------------------------------- [ 47.929954] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. [ 47.930116] swapper/3/0 [HC0[0]:SC1[3]:HE1:SE0] takes: [ 47.930116] 00000000af8bc31e (&(&ht->lock)->rlock){+.?.}, at: rhashtable_walk_enter+0x36/0xb0 [ 47.930116] {SOFTIRQ-ON-W} state was registered at: [ 47.930116] _raw_spin_lock+0x29/0x60 [ 47.930116] rht_deferred_worker+0x556/0x810 [ 47.930116] process_one_work+0x1f5/0x540 [ 47.930116] worker_thread+0x64/0x3e0 [ 47.930116] kthread+0x112/0x150 [ 47.930116] ret_from_fork+0x3a/0x50 [ 47.930116] irq event stamp: 14044 [ 47.930116] hardirqs last enabled at (14044): [] __local_bh_enable_ip+0x7a/0xf0 [ 47.938117] hardirqs last disabled at (14043): [] __local_bh_enable_ip+0x41/0xf0 [ 47.938117] softirqs last enabled at (14028): [] irq_enter+0x5e/0x60 [ 47.938117] softirqs last disabled at (14029): [] irq_exit+0xb5/0xc0 [ 47.938117] [ 47.938117] other info that might help us debug this: [ 47.938117] Possible unsafe locking scenario: [ 47.938117] [ 47.938117] CPU0 [ 47.938117] ---- [ 47.938117] lock(&(&ht->lock)->rlock); [ 47.938117] [ 47.938117] lock(&(&ht->lock)->rlock); [ 47.938117] [ 47.938117] *** DEADLOCK *** [ 47.938117] [ 47.938117] 2 locks held by swapper/3/0: [ 47.938117] #0: 0000000062c64f90 ((&d->timer)){+.-.}, at: call_timer_fn+0x5/0x280 [ 47.938117] #1: 00000000ee39619c (&(&d->lock)->rlock){+.-.}, at: tipc_disc_timeout+0xc8/0x540 [tipc] [ 47.938117] [ 47.938117] stack backtrace: [ 47.938117] CPU: 3 PID: 0 Comm: swapper/3 Tainted: G E 4.19.0+ #37 [ 47.938117] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 47.938117] Call Trace: [ 47.938117] [ 47.938117] dump_stack+0x5e/0x8b [ 47.938117] print_usage_bug+0x1ed/0x1ff [ 47.938117] mark_lock+0x5b5/0x630 [ 47.938117] __lock_acquire+0x4c0/0x18f0 [ 47.938117] ? lock_acquire+0xa6/0x180 [ 47.938117] lock_acquire+0xa6/0x180 [ 47.938117] ? rhashtable_walk_enter+0x36/0xb0 [ 47.938117] _raw_spin_lock+0x29/0x60 [ 47.938117] ? rhashtable_walk_enter+0x36/0xb0 [ 47.938117] rhashtable_walk_enter+0x36/0xb0 [ 47.938117] tipc_sk_reinit+0xb0/0x410 [tipc] [ 47.938117] ? mark_held_locks+0x6f/0x90 [ 47.938117] ? __local_bh_enable_ip+0x7a/0xf0 [ 47.938117] ? lockdep_hardirqs_on+0x20/0x1a0 [ 47.938117] tipc_net_finalize+0xbf/0x180 [tipc] [ 47.938117] tipc_disc_timeout+0x509/0x540 [tipc] [ 47.938117] ? call_timer_fn+0x5/0x280 [ 47.938117] ? tipc_disc_msg_xmit.isra.19+0xa0/0xa0 [tipc] [ 47.938117] ? tipc_disc_msg_xmit.isra.19+0xa0/0xa0 [tipc] [ 47.938117] call_timer_fn+0xa1/0x280 [ 47.938117] ? tipc_disc_msg_xmit.isra.19+0xa0/0xa0 [tipc] [ 47.938117] run_timer_softirq+0x1f2/0x4d0 [ 47.938117] __do_softirq+0xfc/0x413 [ 47.938117] irq_exit+0xb5/0xc0 [ 47.938117] smp_apic_timer_interrupt+0xac/0x210 [ 47.938117] apic_timer_interrupt+0xf/0x20 [ 47.938117] [ 47.938117] RIP: 0010:default_idle+0x1c/0x140 [ 47.938117] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 41 54 55 53 65 8b 2d d8 2b 74 65 0f 1f 44 00 00 e8 c6 2c 8b ff fb f4 <65> 8b 2d c5 2b 74 65 0f 1f 44 00 00 5b 5d 41 5c c3 65 8b 05 b4 2b [ 47.938117] RSP: 0018:ffffaf6ac0207ec8 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13 [ 47.938117] RAX: ffff8f5b3735e200 RBX: 0000000000000003 RCX: 0000000000000001 [ 47.938117] RDX: 0000000000000001 RSI: 0000000000000001 RDI: ffff8f5b3735e200 [ 47.938117] RBP: 0000000000000003 R08: 0000000000000001 R09: 0000000000000000 [ 47.938117] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 47.938117] R13: 0000000000000000 R14: ffff8f5b3735e200 R15: ffff8f5b3735e200 [ 47.938117] ? default_idle+0x1a/0x140 [ 47.938117] do_idle+0x1bc/0x280 [ 47.938117] cpu_startup_entry+0x19/0x20 [ 47.938117] start_secondary+0x187/0x1c0 [ 47.938117] secondary_startup_64+0xa4/0xb0 The reason seems to be that tipc_net_finalize()->tipc_sk_reinit() is calling the function rhashtable_walk_enter() within a timer interrupt. We fix this by executing tipc_net_finalize() in work queue context. Acked-by: Ying Xue Signed-off-by: Jon Maloy Signed-off-by: David S. Miller commit 33d9a2c72f086cbf1087b2fd2d1a15aa9df14a7f Author: Eric Dumazet Date: Sat Nov 17 21:57:02 2018 -0800 net-gro: reset skb->pkt_type in napi_reuse_skb() eth_type_trans() assumes initial value for skb->pkt_type is PACKET_HOST. This is indeed the value right after a fresh skb allocation. However, it is possible that GRO merged a packet with a different value (like PACKET_OTHERHOST in case macvlan is used), so we need to make sure napi->skb will have pkt_type set back to PACKET_HOST. Otherwise, valid packets might be dropped by the stack because their pkt_type is not PACKET_HOST. napi_reuse_skb() was added in commit 96e93eab2033 ("gro: Add internal interfaces for VLAN"), but this bug always has been there. Fixes: 96e93eab2033 ("gro: Add internal interfaces for VLAN") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 5396527f8c002018bcfc9576b4c151a0695e7db4 Merge: 16f7eb2b77b5 c6cecf4ae44e Author: David S. Miller Date: Sat Nov 17 21:54:53 2018 -0800 Merge branch 'tdc-fixes' Lucas Bates says: ==================== Prevent uncaught exceptions in tdc This patch series addresses two potential bugs in tdc that can cause exceptions to be raised in certain circumstances. These exceptions are generally not handled, so instead we will prevent them from being raised. ==================== Signed-off-by: David S. Miller commit c6cecf4ae44e4ce9158ef8806358142c3512cd33 Author: Brenda J. Butler Date: Fri Nov 16 17:37:56 2018 -0500 tc-testing: tdc.py: Guard against lack of returncode in executed command Add some defensive coding in case one of the subprocesses created by tdc returns nothing. If no object is returned from exec_cmd, then tdc will halt with an unhandled exception. Signed-off-by: Brenda J. Butler Signed-off-by: Lucas Bates Signed-off-by: David S. Miller commit 5aaf6428526bcad98d6f51f2f679c919bb75d7e9 Author: Lucas Bates Date: Fri Nov 16 17:37:55 2018 -0500 tc-testing: tdc.py: ignore errors when decoding stdout/stderr Prevent exceptions from being raised while decoding output from an executed command. There is no impact on tdc's execution and the verify command phase would fail the pattern match. Signed-off-by: Lucas Bates Signed-off-by: David S. Miller commit 16f7eb2b77b55da816c4e207f3f9440a8cafc00a Author: Sabrina Dubroca Date: Fri Nov 16 16:58:19 2018 +0100 ip_tunnel: don't force DF when MTU is locked The various types of tunnels running over IPv4 can ask to set the DF bit to do PMTU discovery. However, PMTU discovery is subject to the threshold set by the net.ipv4.route.min_pmtu sysctl, and is also disabled on routes with "mtu lock". In those cases, we shouldn't set the DF bit. This patch makes setting the DF bit conditional on the route's MTU locking state. This issue seems to be older than git history. Signed-off-by: Sabrina Dubroca Reviewed-by: Stefano Brivio Signed-off-by: David S. Miller commit 8840c3e2344a456267d7989b97d097e798b28b0b Author: Toke Høiland-Jørgensen Date: Fri Nov 16 12:13:59 2018 -0800 MAINTAINERS: Add entry for CAKE qdisc We would like the existing community to be kept in the loop for any new developments on CAKE; and I certainly plan to keep maintaining it. Reflect this in MAINTAINERS. Signed-off-by: Toke Høiland-Jørgensen Signed-off-by: David S. Miller commit 9d332e69c1dc74dcd748de7cbd2dac5c61bda265 Author: Nikolay Aleksandrov Date: Fri Nov 16 18:50:01 2018 +0200 net: bridge: fix vlan stats use-after-free on destruction Syzbot reported a use-after-free of the global vlan context on port vlan destruction. When I added per-port vlan stats I missed the fact that the global vlan context can be freed before the per-port vlan rcu callback. There're a few different ways to deal with this, I've chosen to add a new private flag that is set only when per-port stats are allocated so we can directly check it on destruction without dereferencing the global context at all. The new field in net_bridge_vlan uses a hole. v2: cosmetic change, move the check to br_process_vlan_info where the other checks are done v3: add change log in the patch, add private (in-kernel only) flags in a hole in net_bridge_vlan struct and use that instead of mixing user-space flags with private flags Fixes: 9163a0fc1f0c ("net: bridge: add support for per-port vlan stats") Reported-by: syzbot+04681da557a0e49a52e5@syzkaller.appspotmail.com Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit 95506588d2c1d72ca29adef8ae9bf771bcfb4ced Author: Slavomir Kaslev Date: Fri Nov 16 11:27:53 2018 +0200 socket: do a generic_file_splice_read when proto_ops has no splice_read splice(2) fails with -EINVAL when called reading on a socket with no splice_read set in its proto_ops (such as vsock sockets). Switch this to fallbacks to a generic_file_splice_read instead. Signed-off-by: Slavomir Kaslev Signed-off-by: David S. Miller commit df5a8ec64eed7fe45b556cfff503acd6429ab817 Author: Martin Schiller Date: Fri Nov 16 08:38:36 2018 +0100 net: phy: mdio-gpio: Fix working over slow can_sleep GPIOs Up until commit 7e5fbd1e0700 ("net: mdio-gpio: Convert to use gpiod functions where possible"), the _cansleep variants of the gpio_ API was used. After that commit and the change to gpiod_ API, the _cansleep() was dropped. This then results in WARN_ON() when used with GPIO devices which do sleep. Add back the _cansleep() to avoid this. Fixes: 7e5fbd1e0700 ("net: mdio-gpio: Convert to use gpiod functions where possible") Signed-off-by: Martin Schiller Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit b4e955e9f372035361fbc6f07b21fe2cc6a5be4a Author: Taehee Yoo Date: Fri Nov 16 21:32:35 2018 +0900 netfilter: xt_hashlimit: fix a possible memory leak in htable_create() In the htable_create(), hinfo is allocated by vmalloc() So that if error occurred, hinfo should be freed. Fixes: 11d5f15723c9 ("netfilter: xt_hashlimit: Create revision 2 to support higher pps rates") Signed-off-by: Taehee Yoo Signed-off-by: Pablo Neira Ayuso commit 0e40de0338d005f73d46898a21544cd26f01b4ce Author: Matthew Wilcox Date: Fri Nov 16 15:19:13 2018 -0500 dax: Fix huge page faults Using xas_load() with a PMD-sized xa_state would work if either a PMD-sized entry was present or a PTE sized entry was present in the first 64 entries (of the 512 PTEs in a PMD on x86). If there was no PTE in the first 64 entries, grab_mapping_entry() would believe there were no entries present, allocate a PMD-sized entry and overwrite the PTE in the page cache. Use xas_find_conflict() instead which turns out to simplify both get_unlocked_entry() and grab_mapping_entry(). Also remove a WARN_ON_ONCE from grab_mapping_entry() as it will have already triggered in get_unlocked_entry(). Fixes: cfc93c6c6c96 ("dax: Convert dax_insert_pfn_mkwrite to XArray") Signed-off-by: Matthew Wilcox commit fda490d39fc0668d92e170d95c11e35a010019aa Author: Matthew Wilcox Date: Fri Nov 16 15:07:31 2018 -0500 dax: Fix dax_unlock_mapping_entry for PMD pages Device DAX PMD pages do not set the PageHead bit for compound pages. Fix for now by retrieving the PMD bit from the entry, but eventually we will be passed the page size by the caller. Reported-by: Dan Williams Fixes: 9f32d221301c ("dax: Convert dax_lock_mapping_entry to XArray") Signed-off-by: Matthew Wilcox commit 53fffe29a9e664a999dd3787e4428da8c30533e0 Author: Jens Axboe Date: Sat Nov 17 07:43:42 2018 -0700 aio: fix failure to put the file pointer If the ioprio capability check fails, we return without putting the file pointer. Fixes: d9a08a9e616b ("fs: Add aio iopriority support") Signed-off-by: Jens Axboe Signed-off-by: Al Viro commit 160396a722e0c4dfd462f3eec779251bf944f438 Author: David S. Miller Date: Fri Nov 16 23:04:37 2018 -0800 Revert "net: phy: mdio-gpio: Fix working over slow can_sleep GPIOs" This reverts commit dfa0d55ff6be64e7b6881212a291cb95f8da3b08. Discussion still ongoing, I shouldn't have applied this. Signed-off-by: David S. Miller commit 569a933b03f3c48b392fe67c0086b3a6b9306b5a Author: Roman Gushchin Date: Wed Nov 14 10:00:34 2018 -0800 bpf: allocate local storage buffers using GFP_ATOMIC Naresh reported an issue with the non-atomic memory allocation of cgroup local storage buffers: [ 73.047526] BUG: sleeping function called from invalid context at /srv/oe/build/tmp-rpb-glibc/work-shared/intel-corei7-64/kernel-source/mm/slab.h:421 [ 73.060915] in_atomic(): 1, irqs_disabled(): 0, pid: 3157, name: test_cgroup_sto [ 73.068342] INFO: lockdep is turned off. [ 73.072293] CPU: 2 PID: 3157 Comm: test_cgroup_sto Not tainted 4.20.0-rc2-next-20181113 #1 [ 73.080548] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS 2.0b 07/27/2017 [ 73.088018] Call Trace: [ 73.090463] dump_stack+0x70/0xa5 [ 73.093783] ___might_sleep+0x152/0x240 [ 73.097619] __might_sleep+0x4a/0x80 [ 73.101191] __kmalloc_node+0x1cf/0x2f0 [ 73.105031] ? cgroup_storage_update_elem+0x46/0x90 [ 73.109909] cgroup_storage_update_elem+0x46/0x90 cgroup_storage_update_elem() (as well as other update map update callbacks) is called with disabled preemption, so GFP_ATOMIC allocation should be used: e.g. alloc_htab_elem() in hashtab.c. Reported-by: Naresh Kamboju Tested-by: Naresh Kamboju Signed-off-by: Roman Gushchin Cc: Alexei Starovoitov Cc: Daniel Borkmann Signed-off-by: Alexei Starovoitov commit afd594240806acc138cf696c09f2f4829d55d02f Author: Edward Cree Date: Fri Nov 16 12:00:07 2018 +0000 bpf: fix off-by-one error in adjust_subprog_starts When patching in a new sequence for the first insn of a subprog, the start of that subprog does not change (it's the first insn of the sequence), so adjust_subprog_starts should check start <= off (rather than < off). Also added a test to test_verifier.c (it's essentially the syz reproducer). Fixes: cc8b0b92a169 ("bpf: introduce function calls (function boundaries)") Reported-by: syzbot+4fc427c7af994b0948be@syzkaller.appspotmail.com Signed-off-by: Edward Cree Acked-by: Yonghong Song Signed-off-by: Alexei Starovoitov commit 5594923f6e708d393c906e38399b3d4a65d390e9 Merge: dfa0d55ff6be d7d8bbb40a5b Author: David S. Miller Date: Fri Nov 16 20:26:30 2018 -0800 Merge tag 'batadv-net-for-davem-20181114' of git://git.open-mesh.org/linux-merge Simon Wunderlich says: ==================== Here are two batman-adv bugfixes: - Explicitly pad short ELP packets with zeros, by Sven Eckelmann - Fix packet size calculation when merging fragments, by Sven Eckelmann ==================== Signed-off-by: David S. Miller commit dfa0d55ff6be64e7b6881212a291cb95f8da3b08 Author: Martin Schiller Date: Wed Nov 14 12:54:49 2018 +0100 net: phy: mdio-gpio: Fix working over slow can_sleep GPIOs This commit re-enables support for slow GPIO pins. It was initially introduced by commit 2d6c9091ab76 ("net: mdio-gpio: support access that may sleep") and got lost by commit 7e5fbd1e0700 ("net: mdio-gpio: Convert to use gpiod functions where possible"). Also add a warning about slow GPIO pins like it is done in i2c-gpio. Signed-off-by: Martin Schiller Signed-off-by: David S. Miller commit 19ab69107d3ecfb7cd3e38ad262a881be40c01a3 Author: Davide Caratti Date: Wed Nov 14 12:17:25 2018 +0100 net/sched: act_pedit: fix memory leak when IDR allocation fails tcf_idr_check_alloc() can return a negative value, on allocation failures (-ENOMEM) or IDR exhaustion (-ENOSPC): don't leak keys_ex in these cases. Fixes: 0190c1d452a9 ("net: sched: atomically check-allocate action") Signed-off-by: Davide Caratti Acked-by: Cong Wang Signed-off-by: David S. Miller commit 06bc4d0079ab6a2de86f56703ce1bd13e90b9d9d Author: Christophe JAILLET Date: Tue Nov 13 18:42:24 2018 +0100 net: lantiq: Fix returned value in case of error in 'xrx200_probe()' Return 'err' in the error handling path instead of 0. Return explicitly 0 in the normal path, instead of 'err', which is known to be 0 at this point. Fixes: fe1a56420cf2 ("net: lantiq: Add Lantiq / Intel VRX200 Ethernet driver") Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller commit 761f60261b4401aa368d71d431b4c218af0efcee Author: Xin Long Date: Wed Nov 14 00:48:28 2018 +0800 ipv6: fix a dst leak when removing its exception These is no need to hold dst before calling rt6_remove_exception_rt(). The call to dst_hold_safe() in ip6_link_failure() was for ip6_del_rt(), which has been removed in Commit 93531c674315 ("net/ipv6: separate handling of FIB entries from dst based routes"). Otherwise, it will cause a dst leak. This patch is to simply remove the dst_hold_safe() call before calling rt6_remove_exception_rt() and also do the same in ip6_del_cached_rt(). It's safe, because the removal of the exception that holds its dst's refcnt is protected by rt6_exception_lock. Fixes: 93531c674315 ("net/ipv6: separate handling of FIB entries from dst based routes") Fixes: 23fb93a4d3f1 ("net/ipv6: Cleanup exception and cache route handling") Reported-by: Li Shuang Signed-off-by: Xin Long Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 83e65df6dfece9eb588735459428f221eb930c0c Author: Maxime Chevallier Date: Fri Nov 9 09:17:33 2018 +0100 net: mvneta: Don't advertise 2.5G modes Using 2.5G speed relies on the SerDes lanes being configured accordingly. The lanes have to be reconfigured to switch between 1G and 2.5G, and for now only the bootloader does this configuration. In the case we add a Comphy driver to handle switching the lanes dynamically, it's better for now to stick with supporting only 1G and add advertisement for 2.5G once we really are capable of handling both speeds without problem. Since the interface mode is initialy taken from the DT, we want to make sure that adding comphy support won't break boards that don't update their dtb. Fixes: da58a931f248 ("net: mvneta: Add support for 2500Mbps SGMII") Reported-by: Andrew Lunn Reported-by: Russell King Signed-off-by: Maxime Chevallier Signed-off-by: David S. Miller commit 10547d956d590fbb846a7bd053a1dfc30e8f9a68 Author: Andy Shevchenko Date: Fri Nov 9 17:40:16 2018 +0200 MAINTAINERS: Do maintain Intel GPIO drivers via separate tree We would like to consolidate Intel pure GPIO drivers, including PMICs and some old x86 platforms, in one tree which is maintained by Intel. Signed-off-by: Andy Shevchenko Signed-off-by: Linus Walleij commit bff466bac59994cfcceabe4d0be5fdc1c20cd5b8 Author: Bartosz Golaszewski Date: Thu Nov 8 17:52:53 2018 +0100 gpio: mockup: fix indicated direction Commit 3edfb7bd76bd ("gpiolib: Show correct direction from the beginning") fixed an existing issue but broke libgpiod tests by changing the default direction of dummy lines to output. We don't break user-space so make gpio-mockup behave as before. Signed-off-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit 70cdb6ad6dc342d9643a00c9092e88f0075f2b9a Author: Robert Jarzmik Date: Thu Nov 15 18:16:38 2018 +0100 gpio: pxa: fix legacy non pinctrl aware builds again As pointed out by Gregor, spitz keyboard matrix is broken, with or without CONFIG_PINCTRL set, quoting : "The gpio matrix keypard on the Zaurus C3x00 (see spitz.c) does not work properly. Noticeable are that rshift+c does nothing where as lshift+c creates C. Opposite it is for rshift+a vs lshift+a, here only rshift works. This affects a few other combinations using the rshift or lshift buttons." As a matter of fact, as for platform_data based builds CONFIG_PINCTRL=n is required for now (as opposed for devicetree builds where it should be set), this means gpio driver should change the direction, which is what was attempted by commit c4e5ffb6f224 ("gpio: pxa: fix legacy non pinctrl aware builds"). Unfortunately, the input case was inverted, and the direction change was never done. This wasn't seen up until now because the initial platform setup (MFP) was setting this direction. Yet in Gregory's case, the matrix-keypad driver changes back and forth the direction dynamically, and this is why he's the first to report it. Fixes: c4e5ffb6f224 ("gpio: pxa: fix legacy non pinctrl aware builds") Tested-by: Greg Signed-off-by: Robert Jarzmik Signed-off-by: Linus Walleij commit c5bbd4515a05f8acb7e6ab6297044a529762cbf5 Author: Matthew Wilcox Date: Fri Nov 16 14:37:06 2018 -0500 dax: Reinstate RCU protection of inode For the device-dax case, it is possible that the inode can go away underneath us. The rcu_read_lock() was there to prevent it from being freed, and not (as I thought) to protect the tree. Bring back the rcu_read_lock() protection. Also add a little kernel-doc; while this function is not exported to modules, it is used from outside dax.c Reported-by: Dan Williams Fixes: 9f32d221301c ("dax: Convert dax_lock_mapping_entry to XArray") Signed-off-by: Matthew Wilcox commit 7ae2ea7dc45e8250a74cfaaecdce578427669ae5 Author: Matthew Wilcox Date: Fri Nov 9 20:09:37 2018 -0500 dax: Make sure the unlocking entry isn't locked I wrote the semantics in the commit message, but didn't document it in the source code. Use a BUG_ON instead (if any code does do this, it's really buggy; we can't recover and it's worth taking the machine down). Signed-off-by: Matthew Wilcox commit 6d7cd8c1373746a93dc868ee9d38a82df78b38aa Author: Matthew Wilcox Date: Tue Nov 6 13:11:57 2018 -0500 dax: Remove optimisation from dax_lock_mapping_entry Skipping some of the revalidation after we sleep can lead to returning a mapping which has already been freed. Just drop this optimisation. Reported-by: Dan Williams Fixes: 9f32d221301c ("dax: Convert dax_lock_mapping_entry to XArray") Signed-off-by: Matthew Wilcox commit 5404a7f1c21cfda061712bedf2d06cc0f6c755e9 Author: Matthew Wilcox Date: Mon Nov 5 09:34:04 2018 -0500 XArray tests: Correct some 64-bit assumptions The test-suite caught these two mistakes when compiled for 32-bit. I had only been running the test-suite in 64-bit mode. Signed-off-by: Matthew Wilcox commit 44a4a66b619a0a83a52e707ebcd80182207bd50e Author: Matthew Wilcox Date: Mon Nov 5 10:53:09 2018 -0500 XArray: Correct xa_store_range The explicit '64' should have been BITS_PER_LONG, but while looking at this code I realised I meant to use __ffs(), not ilog2(). Signed-off-by: Matthew Wilcox commit 1ce80e0fe98e72af4125f47c65b0bc01b60a7feb Merge: e6a2562fe27f b469e7e47c8a Author: Linus Torvalds Date: Fri Nov 16 13:18:36 2018 -0600 Merge tag 'fsnotify_for_v4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify fix from Jan Kara: "One small fsnotify fix for duplicate events" * tag 'fsnotify_for_v4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fanotify: fix handling of events on child sub-directory commit e6a2562fe27f0a42243ca5a0aec5408c9a1d42a5 Merge: 32e2524a529c c26b5aa8ef0d Author: Linus Torvalds Date: Fri Nov 16 11:38:14 2018 -0600 Merge tag 'gfs2-4.20.fixes3' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull bfs2 fixes from Andreas Gruenbacher: "Fix two bugs leading to leaked buffer head references: - gfs2: Put bitmap buffers in put_super - gfs2: Fix iomap buffer head reference counting bug And one bug leading to significant slow-downs when deleting large files: - gfs2: Fix metadata read-ahead during truncate (2)" * tag 'gfs2-4.20.fixes3' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: gfs2: Fix iomap buffer head reference counting bug gfs2: Fix metadata read-ahead during truncate (2) gfs2: Put bitmap buffers in put_super commit c26b5aa8ef0d46035060fded475e6ab957b9f69f Author: Andreas Gruenbacher Date: Sun Nov 11 11:15:21 2018 +0000 gfs2: Fix iomap buffer head reference counting bug GFS2 passes the inode buffer head (dibh) from gfs2_iomap_begin to gfs2_iomap_end in iomap->private. It sets that private pointer in gfs2_iomap_get. Users of gfs2_iomap_get other than gfs2_iomap_begin would have to release iomap->private, but this isn't done correctly, leading to a leak of buffer head references. To fix this, move the code for setting iomap->private from gfs2_iomap_get to gfs2_iomap_begin. Fixes: 64bc06bb32 ("gfs2: iomap buffered write support") Cc: stable@vger.kernel.org # v4.19+ Signed-off-by: Andreas Gruenbacher Signed-off-by: Linus Torvalds commit 32e2524a529c1fd8e377738d6cdc2268ffd171ce Merge: 4efd34602fc0 9f4debe38415 Author: Linus Torvalds Date: Fri Nov 16 10:37:27 2018 -0600 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: "This fixes the following issues: - Potential memory overwrite in simd - Kernel info leaks in crypto_user - NULL dereference and use-after-free in hisilicon" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: user - Zeroize whole structure given to user space crypto: user - fix leaking uninitialized memory to userspace crypto: simd - correctly take reqsize of wrapped skcipher into account crypto: hisilicon - Fix reference after free of memories on error path crypto: hisilicon - Fix NULL dereference for same dst and src commit 4efd34602fc0da31f87dca8669388edcafba622d Merge: ef268de19756 20325e8a6143 Author: Linus Torvalds Date: Fri Nov 16 10:17:29 2018 -0600 Merge tag 'drm-fixes-2018-11-16' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Live from Vancouver, SoC maintainer talk, this weeks drm fixes pull for rc3: omapdrm: - regression fixes for the reordering bridge stuff that went into rc1 i915: - incorrect EU count fix - HPD storm fix - MST fix - relocation fix for gen4/5 amdgpu: - huge page handling fix - IH ring setup - XGMI aperture setup - watermark setup fix misc: - docs and MST fix" * tag 'drm-fixes-2018-11-16' of git://anongit.freedesktop.org/drm/drm: (23 commits) drm/i915: Account for scale factor when calculating initial phase drm/i915: Clean up skl_program_scaler() drm/i915: Move programming plane scaler to its own function. drm/i915/icl: Drop spurious register read from icl_dbuf_slices_update drm/i915: fix broadwell EU computation drm/amdgpu: fix huge page handling on Vega10 drm/amd/pp: Fix truncated clock value when set watermark drm/amdgpu: fix bug with IH ring setup drm/meson: venc: dmt mode must use encp drm/amdgpu: set system aperture to cover whole FB region drm/i915: Fix hpd handling for pins with two encoders drm/i915/execlists: Force write serialisation into context image vs execution drm/i915/icl: Fix power well 2 wrt. DC-off toggling order drm/i915: Fix NULL deref when re-enabling HPD IRQs on systems with MST drm/i915: Fix possible race in intel_dp_add_mst_connector() drm/i915/ringbuffer: Delay after EMIT_INVALIDATE for gen4/gen5 drm/omap: dsi: Fix missing of_platform_depopulate() drm/omap: Move DISPC runtime PM handling to omapdrm drm/omap: dsi: Ensure the device is active during probe drm/omap: hdmi4: Ensure the device is active during bind ... commit ef268de19756e6bc78cd3e6d9b15545f7df97ef2 Merge: 50d25bdc6431 b2fed34a628d Author: Linus Torvalds Date: Fri Nov 16 10:14:54 2018 -0600 Merge tag 'powerpc-4.20-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "Two weeks worth of fixes since rc1. - I broke 16-byte alignment of the stack when we moved PPR into pt_regs. Despite being required by the ABI this broke almost nothing, we eventually hit it in code where GCC does arithmetic on the stack pointer assuming the bottom 4 bits are clear. Fix it by padding the in-kernel pt_regs by 8 bytes. - A couple of commits fixing minor bugs in the recent SLB rewrite. - A build fix related to tracepoints in KVM in some configurations. - Our old "IO workarounds" code written for Cell couldn't coexist in a kernel that runs on Power9 with the Radix MMU, fix that. - Remove the NPU DMA ops, these just printed a warning and should never have been called. - Suppress an overly chatty message triggered by CPU hotplug in some configs. - Two small selftest fixes. Thanks to: Alistair Popple, Gustavo Romero, Nicholas Piggin, Satheesh Rajendran, Scott Wood" * tag 'powerpc-4.20-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: selftests/powerpc: Adjust wild_bctr to build with old binutils powerpc/64: Fix kernel stack 16-byte alignment powerpc/numa: Suppress "VPHN is not supported" messages selftests/powerpc: Fix wild_bctr test to work on ppc64 powerpc/io: Fix the IO workarounds code to work with Radix powerpc/mm/64s: Fix preempt warning in slb_allocate_kernel() KVM: PPC: Move and undef TRACE_INCLUDE_PATH/FILE powerpc/mm/64s: Only use slbfee on CPUs that support it powerpc/mm/64s: Use PPC_SLBFEE macro powerpc/mm/64s: Consolidate SLB assertions powerpc/powernv/npu: Remove NPU DMA ops commit 50d25bdc64318a8a367c4433fa1e030c38331f05 Merge: 59749c2d49bf 40dc948f234b Author: Linus Torvalds Date: Fri Nov 16 10:10:27 2018 -0600 Merge tag 'xtensa-20181115' of git://github.com/jcmvbkbc/linux-xtensa Pull Xtensa fixes from Max Filippov: - fix stack alignment for bFLT binaries. - fix physical-to-virtual address translation for boot parameters in MMUv3 256+256 and 512+512 virtual memory layouts. * tag 'xtensa-20181115' of git://github.com/jcmvbkbc/linux-xtensa: xtensa: fix boot parameters address translation xtensa: make sure bFLT stack is 16 byte aligned commit 243cfe3fb8978c7eec24511aba7dac98819ed896 Author: Vadim Pasternak Date: Fri Nov 16 13:47:11 2018 +0000 hwmon: (mlxreg-fan) Fix macros for tacho fault reading Fix macros for tacometer fault reading. This fix is relevant for three Mellanox systems MQMB7, MSN37, MSN34, which are about to be released to the customers. At the moment, none of them is at customers sites. Fixes: 65afb4c8e7e4 ("hwmon: (mlxreg-fan) Add support for Mellanox FAN driver") Signed-off-by: Vadim Pasternak Signed-off-by: Guenter Roeck commit 59749c2d49bf28df69ac4bcabf1f69b00d3dca59 Merge: 9b5f361ac4a9 8dc765d438f1 Author: Linus Torvalds Date: Fri Nov 16 09:31:59 2018 -0600 Merge tag 'for-linus-20181115' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: - Discard loop fix, caused by integer overflow (Dave) - Blacklist of Samsung drive that hangs with power management (Diego) - Copy bio priority when cloning it (Hannes) - Fix race condition exposed in floppy (me) - Fix SCSI queue cleanup regression. While elusive, it caused oopses in queue running (Ming) - Fix bad string copy in kyber tracing (Omar) * tag 'for-linus-20181115' of git://git.kernel.dk/linux-block: SCSI: fix queue cleanup race before queue initialization is done block: fix 32 bit overflow in __blkdev_issue_discard() libata: blacklist SAMSUNG MZ7TD256HAFV-000L9 SSD block: copy ioprio in __bio_clone_fast() and bounce kyber: fix wrong strlcpy() size in trace_kyber_latency() floppy: fix race condition in __floppy_read_block_0() commit 9b5f361ac4a923bf53ca8c0875509ef68c8958cd Merge: da5322e65940 ebacb8127359 Author: Linus Torvalds Date: Fri Nov 16 09:30:13 2018 -0600 Merge tag 'fuse-fixes-4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse fixes from Miklos Szeredi: "A couple of fixes, all bound for -stable (i.e. not regressions in this cycle)" * tag 'fuse-fixes-4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: fuse: fix use-after-free in fuse_direct_IO() fuse: fix possibly missed wake-up after abort fuse: fix leaked notify reply commit 1770f0fa978ed691a454fa9d3ba903d5a70630cc Author: Lorenzo Bianconi Date: Sat Nov 10 12:03:09 2018 +0100 mt76: fix uninitialized mutex access setting rts threshold Fix following crash due to a leftover uninitialized mutex access in mt76x2_set_rts_threshold routine. [ 31.018059] Call Trace: [ 31.018341] register_lock_class+0x51f/0x530 [ 31.018828] __lock_acquire+0x6c/0x1580 [ 31.019247] lock_acquire+0x88/0x120 [ 31.021089] __mutex_lock+0x4a/0x4f0 [ 31.023343] mt76x2_set_rts_threshold+0x28/0x50 [ 31.023831] ieee80211_set_wiphy_params+0x16d/0x4e0 [ 31.024344] nl80211_set_wiphy+0x72b/0xbc0 [ 31.024781] genl_family_rcv_msg+0x192/0x3a0 [ 31.025233] genl_rcv_msg+0x42/0x89 [ 31.026079] netlink_rcv_skb+0x38/0x100 [ 31.026475] genl_rcv+0x1f/0x30 [ 31.026804] netlink_unicast+0x19c/0x250 [ 31.027212] netlink_sendmsg+0x1ed/0x390 [ 31.027615] sock_sendmsg+0x31/0x40 [ 31.027973] ___sys_sendmsg+0x23c/0x280 [ 31.030414] __sys_sendmsg+0x42/0x80 [ 31.030783] do_syscall_64+0x4a/0x170 [ 31.031160] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 31.031677] RIP: 0033:0x7f3498b39ba7 [ 31.033953] RSP: 002b:00007fffe19675b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 31.034883] RAX: ffffffffffffffda RBX: 00000000012d5350 RCX: 00007f3498b39ba7 [ 31.035756] RDX: 0000000000000000 RSI: 00007fffe19675f0 RDI: 0000000000000003 [ 31.036587] RBP: 00000000012da740 R08: 0000000000000002 R09: 0000000000000000 [ 31.037422] R10: 0000000000000006 R11: 0000000000000246 R12: 00000000012da880 [ 31.038252] R13: 00007fffe19675f0 R14: 00007fffe19678c0 R15: 00000000012da880 Fixes: 108a4861ef19 ("mt76: create new mt76x02-lib module for common mt76x{0,2} code") Reported-by: lorenzo.trisolini@fluidmesh.com Reported-by: luca.bisti@fluidmesh.com Signed-off-by: Lorenzo Bianconi Signed-off-by: Kalle Valo commit d1fe6ad6f6bd61c84788d3a7b11e459a439c6169 Author: Rafał Miłecki Date: Thu Nov 8 16:08:29 2018 +0100 brcmfmac: fix reporting support for 160 MHz channels Driver can report IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ so it's important to provide valid & complete info about supported bands for each channel. By default no support for 160 MHz should be assumed unless firmware reports it for a given channel later. This fixes info passed to the userspace. Without that change userspace could try to use invalid channel and fail to start an interface. Signed-off-by: Rafał Miłecki Cc: stable@vger.kernel.org Signed-off-by: Kalle Valo commit d987f783a4808ce0636f58e2412addd453cba88c Author: Brian Norris Date: Wed Nov 7 16:40:35 2018 -0800 ath10k: don't assume 'vif' is non-NULL in flush() mac80211 may call us with vif == NULL, if the station is not currently active (e.g., not associated). It is trivially easy to reproduce a crash by suspending the system when not connected to an AP: [ 65.533934] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 ... [ 65.574521] pc : ath10k_flush+0x30/0xd0 [ath10k_core] [ 65.574538] lr : __ieee80211_flush_queues+0x180/0x244 [mac80211] [ 65.599680] Process kworker/u12:1 (pid: 57, stack limit = 0x(____ptrval____)) [ 65.599682] Call trace: [ 65.599695] ath10k_flush+0x30/0xd0 [ath10k_core] [ 65.642064] __ieee80211_flush_queues+0x180/0x244 [mac80211] [ 65.642079] ieee80211_flush_queues+0x34/0x40 [mac80211] [ 65.642095] __ieee80211_suspend+0xfc/0x47c [mac80211] [ 65.658611] ieee80211_suspend+0x30/0x3c [mac80211] [ 65.658627] wiphy_suspend+0x15c/0x3a8 [cfg80211] [ 65.672810] dpm_run_callback+0xf0/0x1f0 [ 65.672814] __device_suspend+0x3ac/0x4f8 [ 65.672819] async_suspend+0x34/0xbc [ 65.684096] async_run_entry_fn+0x54/0x104 [ 65.684099] worker_thread+0x4cc/0x72c [ 65.684102] kthread+0x134/0x13c [ 65.684105] ret_from_fork+0x10/0x18 Fixes: 9de4162f0999 ("ath10k: add peer flush in ath10k_flush for STATION") Signed-off-by: Brian Norris Signed-off-by: Kalle Valo commit 0145b50566e7de5637e80ecba96c7f0e6fff1aad Author: Hans de Goede Date: Wed Oct 31 15:20:05 2018 +0100 iio/hid-sensors: Fix IIO_CHAN_INFO_RAW returning wrong values for signed numbers Before this commit sensor_hub_input_attr_get_raw_value() failed to take the signedness of 16 and 8 bit values into account, returning e.g. 65436 instead of -100 for the z-axis reading of an accelerometer. This commit adds a new is_signed parameter to the function and makes all callers pass the appropriate value for this. While at it, this commit also fixes up some neighboring lines where statements were needlessly split over 2 lines to improve readability. Signed-off-by: Hans de Goede Acked-by: Srinivas Pandruvada Acked-by: Benjamin Tissoires Cc: Signed-off-by: Jonathan Cameron commit 5c074eeabbd332b11559f7fc1e89d456f94801fb Author: Gerd Hoffmann Date: Wed Nov 14 13:20:29 2018 +0100 udmabuf: set read/write flag when exporting Otherwise, mmap fails when done with PROT_WRITE. Suggested-by: Gurchetan Singh Signed-off-by: Gerd Hoffmann Reviewed-by: Gurchetan Singh Tested-by: Gurchetan Singh Link: http://patchwork.freedesktop.org/patch/msgid/20181114122029.16766-1-kraxel@redhat.com commit 4ec321c14693458acae02054e51471e4390049c2 Merge: b374e8686fc3 5d041c46ccb9 Author: Kalle Valo Date: Fri Nov 16 09:03:38 2018 +0200 Merge tag 'iwlwifi-for-kalle-2018-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next First batch of iwlwifi fixes for 4.20 * New FW debugging infrastructure; * Some more work on 802.11ax; * Improve support for multiple RF modules with 22000 devices; * Remove an unused FW parameter; * Other debugging improvements; commit a97b9565338350d70d8d971c4ee6f0d4fa967418 Author: Andrew Morton Date: Thu Nov 15 16:15:20 2018 -0800 drivers/net/ethernet/qlogic/qed/qed_rdma.h: fix typo Add missing semicolon. Fixes: 291d57f67d244973 ("qed: Fix rdma_info structure allocation") Cc: Michal Kalderon Cc: Denis Bolotin Cc: David S. Miller Signed-off-by: Andrew Morton Signed-off-by: David S. Miller commit 91b9deefedf4c35a01027ce38bed7299605026a3 Author: Tony Lindgren Date: Thu Nov 15 15:59:39 2018 -0800 spi: omap2-mcspi: Add missing suspend and resume calls I've been wondering still about omap2-mcspi related suspend and resume flakeyness and looks like we're missing calls to spi_master_suspend() and spi_master_resume(). Adding those and using pm_runtime_force_suspend() and pm_runtime_force_resume() makes things work for suspend and resume and allows us to stop using noirq suspend and resume. And while at it, let's use SET_SYSTEM_SLEEP_PM_OPS to simplify things further. Signed-off-by: Tony Lindgren Signed-off-by: Mark Brown commit 35bf9f1fd2508d2652e1b638570d4b13f3dc185a Merge: 08e14fe429a0 a463146e67c8 Author: David S. Miller Date: Thu Nov 15 16:09:31 2018 -0800 Merge branch 'mlx4-fixes' Tariq Toukan says: ==================== mlx4 fixes for 4.20-rc This patchset includes small fixes for mlx4_core driver. First patch by Jack zeros a field in a FW communication command, to match the FW spec. Please queue it to -stable >= v3.17. In the second patch I zero-initialize a variable to silence a compliation warning. Please queue it to -stable >= v3.19. Third patch by Aya replaces int fields with unsigned int, to fix a UBSAN warning. Please queue it to -stable >= v3.13. Series generated against net commit: db8ddde766ad Merge branch 'qed-Miscellaneous-bug-fixes' ==================== Signed-off-by: David S. Miller commit a463146e67c848cbab5ce706d6528281b7cded08 Author: Aya Levin Date: Thu Nov 15 18:05:15 2018 +0200 net/mlx4: Fix UBSAN warning of signed integer overflow UBSAN: Undefined behavior in drivers/net/ethernet/mellanox/mlx4/resource_tracker.c:626:29 signed integer overflow: 1802201963 + 1802201963 cannot be represented in type 'int' The union of res_reserved and res_port_rsvd[MLX4_MAX_PORTS] monitors granting of reserved resources. The grant operation is calculated and protected, thus both members of the union cannot be negative. Changed type of res_reserved and of res_port_rsvd[MLX4_MAX_PORTS] from signed int to unsigned int, allowing large value. Fixes: 5a0d0a6161ae ("mlx4: Structures and init/teardown for VF resource quotas") Signed-off-by: Aya Levin Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller commit 3ea7e7ea53c9f6ee41cb69a29c375fe9dd9a56a7 Author: Tariq Toukan Date: Thu Nov 15 18:05:14 2018 +0200 net/mlx4_core: Fix uninitialized variable compilation warning Initialize the uid variable to zero to avoid the compilation warning. Fixes: 7a89399ffad7 ("net/mlx4: Add mlx4_bitmap zone allocator") Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller commit bd85fbc2038a1bbe84990b23ff69b6fc81a32b2c Author: Jack Morgenstein Date: Thu Nov 15 18:05:13 2018 +0200 net/mlx4_core: Zero out lkey field in SW2HW_MPT fw command When re-registering a user mr, the mpt information for the existing mr when running SRIOV is obtained via the QUERY_MPT fw command. The returned information includes the mpt's lkey. This retrieved mpt information is used to move the mpt back to hardware ownership in the rereg flow (via the SW2HW_MPT fw command when running SRIOV). The fw API spec states that for SW2HW_MPT, the lkey field must be zero. Any ConnectX-3 PF driver which checks for strict spec adherence will return failure for SW2HW_MPT if the lkey field is not zero (although the fw in practice ignores this field for SW2HW_MPT). Thus, in order to conform to the fw API spec, set the lkey field to zero before invoking SW2HW_MPT when running SRIOV. Fixes: e630664c8383 ("mlx4_core: Add helper functions to support MR re-registration") Signed-off-by: Jack Morgenstein Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller commit 1229ace4a4a2e2c982a32fb075dc1bf95423924f Author: Paul Burton Date: Mon Nov 12 22:18:01 2018 +0000 MIPS: Loongson3,SGI-IP27: Simplify max_low_pfn calculation Both the Loongson3 & SGI-IP27 platforms set max_low_pfn to the last available PFN describing memory. They both do it in paging_init() which is later than ideal since max_low_pfn is used before that function is called. Simplify both platforms to trivially initialize max_low_pfn using the end address of DRAM, and do it earlier in prom_meminit(). Signed-off-by: Paul Burton Suggested-by: Mike Rapoport Tested-by: Thomas Bogendoerfer Patchwork: https://patchwork.linux-mips.org/patch/21104/ References: https://patchwork.linux-mips.org/patch/21031/ Cc: Huacai Chen Cc: Mike Rapoport Cc: Thomas Bogendoerfer Cc: linux-mips@linux-mips.org commit 20325e8a614377967644cf63050095c9f2ea8ab9 Merge: 9826b1138e49 6e8adf6f4a4f Author: Dave Airlie Date: Fri Nov 16 08:52:14 2018 +1000 Merge tag 'drm-intel-fixes-2018-11-15' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Fix Bugzilla #108712: Fix incorrect EU count report from kernel - Fix to account for scale factor when calculating initial phase on scaled output - Avoid too trigger-happy HPD storm detection and fix a race and an OOPS for MST systems. - Relocation race fix for Gen4/5 - A couple ICL fixes and dependencies for above Fixes:. Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20181115164709.GA13430@jlahtine-desk.ger.corp.intel.com commit 07e3a1cfb0568b6d8d7862077029af96af6690ea Author: Nicholas Kazlauskas Date: Thu Nov 15 17:21:34 2018 -0500 drm/amd/display: Support amdgpu "max bpc" connector property (v2) [Why] Many panels support more than 8bpc but some modes are unavailable while running at greater than 8bpc due to DP/HDMI bandwidth constraints. Support for more than 8bpc was added recently in the driver but it defaults to the maximum supported bpc - locking out these modes. This should be a user configurable option such that the user can select what bpc configuration they would like. [How] This patch adds support for getting and setting the amdgpu driver specific "max bpc" property on the connector. It also adds support for limiting the output bpc based on the property value. The default limitation is the lowest value in the range, 8bpc. This was the old value before the range was uncapped. This patch should be updated/replaced later once common drm support for max bpc lands. Bugzilla: https://bugs.freedesktop.org/108542 Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=201585 Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=200645 Fixes: e03fd3f300f6 ("drm/amd/display: Do not limit color depth to 8bpc") v2: rebase on upstream (Alex) Signed-off-by: Nicholas Kazlauskas Acked-by: Alex Deucher Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit 69756c6ff0de478c10100481f16c966dde3b5339 Author: Nicholas Kazlauskas Date: Thu Nov 15 17:19:12 2018 -0500 drm/amdgpu: Add amdgpu "max bpc" connector property (v2) [Why] Many panels support more than 8bpc but some modes are unavailable while running at greater than 8bpc due to DP/HDMI bandwidth constraints. Support for more than 8bpc was added recently in the driver but it defaults to the maximum supported bpc - locking out these modes. This should be a user configurable option such that the user can select what bpc configuration they would like. [How] This patch introduces the "max bpc" amdgpu driver specific connector property so the user can limit the maximum bpc. It ranges from 8 to 16. This doesn't directly set the preferred bpc for the panel since it follows Intel's existing driver conventions. This proprety should be removed once common drm support for max bpc lands. v2: rebase on upstream (Alex) Signed-off-by: Nicholas Kazlauskas Acked-by: Alex Deucher Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit 5d041c46ccb9b48acc110e214beff5e2789311df Author: Luca Coelho Date: Wed Oct 17 08:35:15 2018 +0300 iwlwifi: mvm: don't use SAR Geo if basic SAR is not used We can't use SAR Geo if basic SAR is not enabled, since the SAR Geo tables define offsets in relation to the basic SAR table in use. To fix this, make iwl_mvm_sar_init() return one in case WRDS is not available, so we can skip reading WGDS entirely. Fixes: a6bff3cb19b7 ("iwlwifi: mvm: add GEO_TX_POWER_LIMIT cmd for geographic tx power table") Cc: stable@vger.kernel.org # 4.12+ Signed-off-by: Luca Coelho commit 54f3f994e9964466855e11068c0f7d952d58b260 Author: Shahar S Matityahu Date: Mon Aug 20 17:16:21 2018 +0300 iwlwifi: fix D3 debug data buffer memory leak If the driver is unloaded when D3 debug data pulling is enabled but not triggered, it doesn't release the data buffer. Fix this by adding iwl_fw_runtime_free and calling it from the relevant places. Fixes: 2d8c261511ab ("iwlwifi: add d3 debug data support") Signed-off-by: Shahar S Matityahu Signed-off-by: Luca Coelho commit 82715ac71e6b94a2c2136e31f3a8e6748e33aa8c Author: Emmanuel Grumbach Date: Wed Oct 3 11:16:54 2018 +0300 iwlwifi: mvm: fix regulatory domain update when the firmware starts When the firmware starts, it doesn't have any regulatory information, hence it uses the world wide limitations. The driver can feed the firmware with previous knowledge that was kept in the driver, but the firmware may still not update its internal tables. This happens when we start a BSS interface, and then the firmware can change the regulatory tables based on our location and it'll use more lenient, location specific rules. Then, if the firmware is shut down (when the interface is brought down), and then an AP interface is created, the firmware will forget the country specific rules. The host will think that we are in a certain country that may allow channels and will try to teach the firmware about our location, but the firmware may still not allow to drop the world wide limitations and apply country specific rules because it was just re-started. In this case, the firmware will reply with MCC_RESP_ILLEGAL to the MCC_UPDATE_CMD. In that case, iwlwifi needs to let the upper layers (cfg80211 / hostapd) know that the channel list they know about has been updated. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=201105 Cc: stable@vger.kernel.org Signed-off-by: Emmanuel Grumbach Signed-off-by: Luca Coelho commit ec484d03ef0df8d34086b95710e355a259cbe1f2 Author: Emmanuel Grumbach Date: Thu Aug 16 13:25:48 2018 +0300 iwlwifi: mvm: support sta_statistics() even on older firmware The oldest firmware supported by iwlmvm do support getting the average beacon RSSI. Enable the sta_statistics() call from mac80211 even on older firmware versions. Fixes: 33cef9256342 ("iwlwifi: mvm: support beacon statistics for BSS client") Cc: stable@vger.kernel.org # 4.2+ Signed-off-by: Emmanuel Grumbach Signed-off-by: Luca Coelho commit 66e839030fd698586734e017fd55c4f2a89dba0b Author: Matt Chen Date: Fri Aug 3 14:29:20 2018 +0800 iwlwifi: fix wrong WGDS_WIFI_DATA_SIZE From coreboot/BIOS: Name ("WGDS", Package() { Revision, Package() { DomainType, // 0x7:WiFi ==> We miss this one. WgdsWiFiSarDeltaGroup1PowerMax1, // Group 1 FCC 2400 Max WgdsWiFiSarDeltaGroup1PowerChainA1, // Group 1 FCC 2400 A Offset WgdsWiFiSarDeltaGroup1PowerChainB1, // Group 1 FCC 2400 B Offset WgdsWiFiSarDeltaGroup1PowerMax2, // Group 1 FCC 5200 Max WgdsWiFiSarDeltaGroup1PowerChainA2, // Group 1 FCC 5200 A Offset WgdsWiFiSarDeltaGroup1PowerChainB2, // Group 1 FCC 5200 B Offset WgdsWiFiSarDeltaGroup2PowerMax1, // Group 2 EC Jap 2400 Max WgdsWiFiSarDeltaGroup2PowerChainA1, // Group 2 EC Jap 2400 A Offset WgdsWiFiSarDeltaGroup2PowerChainB1, // Group 2 EC Jap 2400 B Offset WgdsWiFiSarDeltaGroup2PowerMax2, // Group 2 EC Jap 5200 Max WgdsWiFiSarDeltaGroup2PowerChainA2, // Group 2 EC Jap 5200 A Offset WgdsWiFiSarDeltaGroup2PowerChainB2, // Group 2 EC Jap 5200 B Offset WgdsWiFiSarDeltaGroup3PowerMax1, // Group 3 ROW 2400 Max WgdsWiFiSarDeltaGroup3PowerChainA1, // Group 3 ROW 2400 A Offset WgdsWiFiSarDeltaGroup3PowerChainB1, // Group 3 ROW 2400 B Offset WgdsWiFiSarDeltaGroup3PowerMax2, // Group 3 ROW 5200 Max WgdsWiFiSarDeltaGroup3PowerChainA2, // Group 3 ROW 5200 A Offset WgdsWiFiSarDeltaGroup3PowerChainB2, // Group 3 ROW 5200 B Offset } }) When read the ACPI data to find out the WGDS, the DATA_SIZE is never matched. From the above format, it gives 19 numbers, but our driver is hardcode as 18. Fix it to pass then can parse the data into our wgds table. Then we will see: iwlwifi 0000:01:00.0: U iwl_mvm_sar_geo_init Sending GEO_TX_POWER_LIMIT iwlwifi 0000:01:00.0: U iwl_mvm_sar_geo_init SAR geographic profile[0] Band[0]: chain A = 68 chain B = 69 max_tx_power = 54 iwlwifi 0000:01:00.0: U iwl_mvm_sar_geo_init SAR geographic profile[0] Band[1]: chain A = 48 chain B = 49 max_tx_power = 70 iwlwifi 0000:01:00.0: U iwl_mvm_sar_geo_init SAR geographic profile[1] Band[0]: chain A = 51 chain B = 67 max_tx_power = 50 iwlwifi 0000:01:00.0: U iwl_mvm_sar_geo_init SAR geographic profile[1] Band[1]: chain A = 69 chain B = 70 max_tx_power = 68 iwlwifi 0000:01:00.0: U iwl_mvm_sar_geo_init SAR geographic profile[2] Band[0]: chain A = 49 chain B = 50 max_tx_power = 48 iwlwifi 0000:01:00.0: U iwl_mvm_sar_geo_init SAR geographic profile[2] Band[1]: chain A = 52 chain B = 53 max_tx_power = 51 Cc: stable@vger.kernel.org # 4.12+ Fixes: a6bff3cb19b7 ("iwlwifi: mvm: add GEO_TX_POWER_LIMIT cmd for geographic tx power table") Signed-off-by: Matt Chen Signed-off-by: Luca Coelho commit 08e14fe429a07475ee9f29a283945d602e4a6d92 Author: Eric Dumazet Date: Mon Nov 12 16:17:16 2018 -0800 net_sched: sch_fq: ensure maxrate fq parameter applies to EDT flows When EDT conversion happened, fq lost the ability to enfore a maxrate for all flows. It kept it for non EDT flows. This commit restores the functionality. Tested: tc qd replace dev eth0 root fq maxrate 500Mbit netperf -P0 -H host -- -O THROUGHPUT 489.75 Fixes: ab408b6dc744 ("tcp: switch tcp and sch_fq to new earliest departure time model") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 7150ceaacb27f7b3bf494e72cd4be4e11612dfff Author: David Howells Date: Mon Nov 12 22:33:22 2018 +0000 rxrpc: Fix life check The life-checking function, which is used by kAFS to make sure that a call is still live in the event of a pending signal, only samples the received packet serial number counter; it doesn't actually provoke a change in the counter, rather relying on the server to happen to give us a packet in the time window. Fix this by adding a function to force a ping to be transmitted. kAFS then keeps track of whether there's been a stall, and if so, uses the new function to ping the server, resetting the timeout to allow the reply to come back. If there's a stall, a ping and the call is *still* stalled in the same place after another period, then the call will be aborted. Fixes: bc5e3a546d55 ("rxrpc: Use MSG_WAITALL to tell sendmsg() to temporarily ignore signals") Fixes: f4d15fb6f99a ("rxrpc: Provide functions for allowing cleaner handling of signals") Signed-off-by: David Howells Signed-off-by: David S. Miller commit 5277715639ff6f75c729e657690751a831112c4b Author: Andreas Dannenberg Date: Thu Nov 15 11:01:31 2018 -0600 ASoC: pcm186x: Fix device reset-registers trigger value According to the current device datasheet (TI Lit # SLAS831D, revised March 2018) the value written to the device's PAGE register to trigger a complete register reset should be 0xfe, not 0xff. So go ahead and update to the correct value. Reported-by: Stephane Le Provost Tested-by: Stephane Le Provost Signed-off-by: Andreas Dannenberg Acked-by: Andrew F. Davis Signed-off-by: Mark Brown Cc: stable@vger.kernel.org commit 10f91c73cc41ceead210a905dbd196398e99c7d2 Author: Vitaly Kuznetsov Date: Thu Nov 15 11:05:10 2018 -0800 Input: hyper-v - fix wakeup from suspend-to-idle It makes little sense but still possible to put Hyper-V guests into suspend-to-idle state. To wake them up two wakeup sources were registered in the past: hyperv-keyboard and hid-hyperv. However, since commit eed4d47efe95 ("ACPI / sleep: Ignore spurious SCI wakeups from suspend-to-idle") pm_wakeup_event() from these devices is ignored. Switch to pm_wakeup_hard_event() API as these devices are actually the only possible way to wakeup Hyper-V guests. Fixes: eed4d47efe95 (ACPI / sleep: Ignore spurious SCI wakeups from suspend-to-idle) Reviewed-by: Rafael J. Wysocki Acked-by: K. Y. Srinivasan Acked-by: Jiri Kosina Signed-off-by: Vitaly Kuznetsov Signed-off-by: Dmitry Torokhov commit ebcd210e93b2a984b7a7b82d45f7f0d21b7ec2d2 Author: Ganesh Goudar Date: Thu Nov 15 15:36:21 2018 +0530 cxgb4: fix thermal zone build error with CONFIG_THERMAL=m and cxgb4 as built-in build fails, and 'commit e70a57fa59bb ("cxgb4: fix thermal configuration dependencies")' tries to fix it but when cxgb4i is made built-in build fails again, use IS_REACHABLE instead of IS_ENABLED to fix the issue. Fixes: e70a57fa59bb (cxgb4: fix thermal configuration dependencies) Reported-by: Randy Dunlap Signed-off-by: Ganesh Goudar Signed-off-by: David S. Miller commit b8c3c10cf68d7556466bb7d99f249ed586ddfbe3 Author: Thor Thayer Date: Mon Nov 12 11:50:56 2018 -0600 MAINTAINERS: Replace Vince Bridgers as Altera TSE maintainer Vince has moved to a different role. Replace him as Altera TSE maintainer. Signed-off-by: Thor Thayer Acked-by: Vince Bridgers Acked-by: Alan Tull Signed-off-by: David S. Miller commit e371357f0760af7a1f199f1c9e80d1ed3c676208 Merge: f8504f4ca0a0 8dc5ae2d4897 Author: David S. Miller Date: Thu Nov 15 09:37:16 2018 -0800 Merge branch 'bnxt_en-Bug-fixes' Michael Chan says: ==================== bnxt_en: Bug fixes. Most of the bug fixes are related to the new 57500 chips, including some initialization and counter fixes, disabling RDMA support, and a workaround for occasional missing interrupts. The last patch from Vasundhara fixes the year/month parameters for firmware coredump. ==================== Signed-off-by: David S. Miller commit 8dc5ae2d48976764cf3498e97963fa06befefb0e Author: Vasundhara Volam Date: Thu Nov 15 03:25:42 2018 -0500 bnxt_en: Fix filling time in bnxt_fill_coredump_record() Fix the year and month offset while storing it in bnxt_fill_coredump_record(). Fixes: 6c5657d085ae ("bnxt_en: Add support for ethtool get dump.") Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 83eb5c5cff32681f3769f502cb5589c7d7509bfe Author: Michael Chan Date: Thu Nov 15 03:25:41 2018 -0500 bnxt_en: Add software "missed_irqs" counter. To keep track of the number of times the workaround code for 57500 A0 has been triggered. This is a per NQ counter. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit ffd77621700ec3adcf859681e24910c38e0931f5 Author: Michael Chan Date: Thu Nov 15 03:25:40 2018 -0500 bnxt_en: Workaround occasional TX timeout on 57500 A0. Hardware can sometimes not generate NQ MSIX with a single pending CP ring entry. This seems to always happen at the last entry of the CP ring before it wraps. Add logic to check all the CP rings for pending entries without the CP ring consumer index advancing. Calling HWRM_DBG_RING_INFO_GET to read the context of the CP ring will flush out the NQ entry and MSIX. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit addd4df6d763556e16d5316e4e8cd441050cc2af Author: Michael Chan Date: Thu Nov 15 03:25:39 2018 -0500 bnxt_en: Disable RDMA support on the 57500 chips. There is no RDMA support on 57500 chips yet, so prevent bnxt_re from registering on these chips. There is intermittent failure if bnxt_re is allowed to register and proceed with RDMA operations. Fixes: 1ab968d2f1d6 ("bnxt_en: Add PCI ID for BCM57508 device.") Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit d19819297d9284bd990e22116b8b43d0abcbf488 Author: Michael Chan Date: Thu Nov 15 03:25:38 2018 -0500 bnxt_en: Fix rx_l4_csum_errors counter on 57500 devices. The software counter structure is defined in both the CP ring's structure and the NQ ring's structure on the new devices. The legacy code adds the counter to the CP ring's structure and the counter won't get displayed since the ethtool code is looking at the NQ ring's structure. Since all other counters are contained in the NQ ring's structure, it makes more sense to count rx_l4_csum_errors in the NQ. Fixes: 50e3ab7836b5 ("bnxt_en: Allocate completion ring structures for 57500 series chips.") Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 6ba990384e924476b5eed1734f3bcca0df6fd77e Author: Michael Chan Date: Thu Nov 15 03:25:37 2018 -0500 bnxt_en: Fix RSS context allocation. Recent commit has added the reservation of RSS context. This requires bnxt_hwrm_vnic_qcaps() to be called before allocating any RSS contexts. The bnxt_hwrm_vnic_qcaps() call sets up proper flags that will determine how many RSS contexts to allocate to support NTUPLE. This causes a regression that too many RSS contexts are being reserved and causing resource shortage when enabling many VFs. Fix it by calling bnxt_hwrm_vnic_qcaps() earlier. Fixes: 41e8d7983752 ("bnxt_en: Modify the ring reservation functions for 57500 series chips.") Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit da5322e65940e4e8426613a8ff3d99a08b350a52 Merge: 282fd2a2adb4 877181a8d9dc Author: Linus Torvalds Date: Thu Nov 15 11:26:09 2018 -0600 Merge tag 'selinux-pr-20181115' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull SELinux fixes from Paul Moore: "Two small SELinux fixes for v4.20. Ondrej's patch adds a check on user input, and my patch ensures we don't look past the end of a buffer. Both patches are quite small and pass the selinux-testsuite" * tag 'selinux-pr-20181115' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: fix non-MLS handling in mls_context_to_sid() selinux: check length properly in SCTP bind hook commit 282fd2a2adb487e97ef9cd757848b2112d7b8d0c Merge: 94ca5c18e1e3 595b0674ce78 Author: Linus Torvalds Date: Thu Nov 15 11:20:06 2018 -0600 Merge tag 'pinctrl-v4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: - A bunch of fixes for the Allwinner meson platform - Establish a git repo for Intel pin control in MAINTAINERS * tag 'pinctrl-v4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: MAINTAINERS: Add tree link for Intel pin control driver pinctrl: meson: fix meson8b ao pull register bits pinctrl: meson: fix meson8 ao pull register bits pinctrl: meson: fix gxl ao pull register bits pinctrl: meson: fix gxbb ao pull register bits pinctrl: meson: fix pinconf bias disable commit 2f31a67f01a8beb22cae754c53522cb61a005750 Author: Mathias Nyman Date: Thu Nov 15 11:38:41 2018 +0200 usb: xhci: Prevent bus suspend if a port connect change or polling state is detected USB3 roothub might autosuspend before a plugged USB3 device is detected, causing USB3 device enumeration failure. USB3 devices don't show up as connected and enabled until USB3 link trainig completes. On a fast booting platform with a slow USB3 link training the link might reach the connected enabled state just as the bus is suspending. If this device is discovered first time by the xhci_bus_suspend() routine it will be put to U3 suspended state like the other ports which failed to suspend earlier. The hub thread will notice the connect change and resume the bus, moving the port back to U0 This U0 -> U3 -> U0 transition right after being connected seems to be too much for some devices, causing them to first go to SS.Inactive state, and finally end up stuck in a polling state with reset asserted Fix this by failing the bus suspend if a port has a connect change or is in a polling state in xhci_bus_suspend(). Don't do any port changes until all ports are checked, buffer all port changes and only write them in the end if suspend can proceed Cc: stable@vger.kernel.org Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman commit 94ca5c18e1e3742102ba3d054d36f4ee7c71fb7a Merge: 5929a1f0ff30 e39d8a186ed0 Author: Linus Torvalds Date: Thu Nov 15 10:59:37 2018 -0600 Merge tag 'nfs-for-4.20-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client bugfixes from Trond Myklebust: "Highlights include: Stable fixes: - Don't exit the NFSv4 state manager without clearing NFS4CLNT_MANAGER_RUNNING Bugfixes: - Fix an Oops when destroying the RPCSEC_GSS credential cache - Fix an Oops during delegation callbacks - Ensure that the NFSv4 state manager exits the loop on SIGKILL - Fix a bogus get/put in generic_key_to_expire()" * tag 'nfs-for-4.20-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: NFSv4: Fix an Oops during delegation callbacks SUNRPC: Fix a bogus get/put in generic_key_to_expire() SUNRPC: Fix a Oops when destroying the RPCSEC_GSS credential cache NFSv4: Ensure that the state manager exits the loop on SIGKILL NFSv4: Don't exit the state manager without clearing NFS4CLNT_MANAGER_RUNNING commit fcc86cb45d38ca2f24bcea9c29c7f4742041caed Author: Boris Brezillon Date: Thu Nov 15 11:58:52 2018 +0100 drm/vc4: Set ->legacy_cursor_update to false when doing non-async updates drm_atomic_helper_setup_commit() auto-completes commit->flip_done when state->legacy_cursor_update is true, but we know for sure that we want a sync update when we call drm_atomic_helper_setup_commit() from vc4_atomic_commit(). Explicitly set state->legacy_cursor_update to false to prevent this auto-completion. Fixes: 184d3cf4f738 ("drm/vc4: Use wait_for_flip_done() instead of wait_for_vblanks()") Cc: Signed-off-by: Boris Brezillon Reviewed-by: Eric Anholt Link: https://patchwork.freedesktop.org/patch/msgid/20181115105852.9844-2-boris.brezillon@bootlin.com commit 5a43911fd256f1c9748f3f82aee1c3a3adad2719 Author: Boris Brezillon Date: Thu Nov 15 11:58:51 2018 +0100 drm/vc4: Fix NULL pointer dereference in the async update path vc4_plane_atomic_async_update() calls vc4_plane_atomic_check() which in turn calls vc4_plane_setup_clipping_and_scaling(), and since commit 58a6a36fe8e0 ("drm/vc4: Use drm_atomic_helper_check_plane_state() to simplify the logic"), this function accesses plane_state->state which will be NULL when called from the async update path because we're passing the current plane state, and plane_state->state has been assigned to NULL in drm_atomic_helper_swap_state(). Pass the new state instead of the current one (the new state has ->state set to a non-NULL value). Fixes: 58a6a36fe8e0 ("drm/vc4: Use drm_atomic_helper_check_plane_state() to simplify the logic") Signed-off-by: Boris Brezillon Reviewed-by: Eric Anholt Link: https://patchwork.freedesktop.org/patch/msgid/20181115105852.9844-1-boris.brezillon@bootlin.com commit 9826b1138e497dfb48f5cc64a82c219b4d0932da Merge: 7b74026d9c4e c1a17777eb45 Author: Dave Airlie Date: Fri Nov 16 02:14:42 2018 +1000 Merge branch 'drm-fixes-4.20' of git://people.freedesktop.org/~agd5f/linux into drm-fixes Fixes for 4.20: - Fix for huge page handling that caused a GPUVM fault in some cases - Fix IH ring setup - Fix for xgmi aperture setup - Fix for watermark setup for SMU Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20181114171853.2866-1-alexander.deucher@amd.com commit 7b74026d9c4ee0cfc5b24e51b7f8d5771bdef1f8 Merge: ccda4af0f4b9 adf59dd2408c Author: Dave Airlie Date: Fri Nov 16 02:12:27 2018 +1000 Merge tag 'drm-misc-fixes-2018-11-14' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Cross-subsystem: - omap: Instantiate dss children in omapdss instead of mach (Laurent) Other: - htmldocs build warning (Sean) - MST NULL deref fix (Stanislav) - omap: Various runtime ref gets on probe/bind (Laurent) - omap: Fix to the above dss children patch (Tony) Cc: Sean Paul Cc: Stanislav Lisovskiy Cc: Laurent Pinchart Cc: Tony Lindgren Signed-off-by: Dave Airlie From: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20181114204542.GA52569@art_vandelay commit b2fed34a628df6118b5d4e13f49a33e15f704fa9 Author: Gustavo Romero Date: Wed Nov 14 21:33:30 2018 -0500 selftests/powerpc: Adjust wild_bctr to build with old binutils Currently the selftest wild_bctr can fail to build when an old gcc is used, notably on gcc using a binutils version <= 2.27, because the assembler does not support the integer suffix UL. This patch adjusts the wild_bctr test so the REG_POISON value is still treated as an unsigned long for the shifts on compilation but the UL suffix is absent on the stringification, so the inline asm code generated has no UL suffixes. Signed-off-by: Gustavo Romero [mpe: Wrap long line] Signed-off-by: Michael Ellerman commit 6e8adf6f4a4fa57dd3bef6b70de96e2b7b311204 Author: Ville Syrjälä Date: Wed Nov 14 15:32:55 2018 +0200 drm/i915: Account for scale factor when calculating initial phase To get the initial phase correct we need to account for the scale factor as well. I forgot this initially and was mostly looking at heavily upscaled content where the minor difference between -0.5 and the proper initial phase was not readily apparent. And let's toss in a comment that tries to explain the formula a little bit. v2: The initial phase upper limit is 1.5, not 24.0! Cc: Maarten Lankhorst Fixes: 0a59952b24e2 ("drm/i915: Configure SKL+ scaler initial phase correctly") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20181029181820.21956-1-ville.syrjala@linux.intel.com Tested-by: Juha-Pekka Heikkila Tested-by: Maarten Lankhorst #irc Reviewed-by: Maarten Lankhorst #irc (cherry picked from commit e7a278a329dd8aa2c70c564849f164cb5673689c) Signed-off-by: Joonas Lahtinen commit 27971d613fcb5b6ad96320bc4f2c90f4d4fde768 Author: Ville Syrjälä Date: Wed Nov 14 13:49:24 2018 +0200 drm/i915: Clean up skl_program_scaler() Remove the "sizes are 0 based" stuff that is not even true for the scaler. v2: Rebase Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20181101151736.20522-1-ville.syrjala@linux.intel.com Reviewed-by: Rodrigo Vivi (cherry picked from commit d0105af939769393d6447a04cee2d1ae12e3f09a) Signed-off-by: Joonas Lahtinen commit 2a2777990a342b05f611e78822fc4fa2d9789ade Author: Maarten Lankhorst Date: Wed Nov 14 13:49:23 2018 +0200 drm/i915: Move programming plane scaler to its own function. This cleans the code up slightly, and will make other changes easier. Signed-off-by: Maarten Lankhorst Reviewed-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20180920102711.4184-8-maarten.lankhorst@linux.intel.com (cherry picked from commit ab5c60bf76755d24ae8de5c1c6ac594934656ace) Signed-off-by: Joonas Lahtinen commit 4cff280a5fccf6513ed9e895bb3a4e7ad8b0cedc Author: James Smart Date: Wed Nov 14 16:35:10 2018 -0800 nvme-fc: resolve io failures during connect If an io error occurs on an io issued while connecting, recovery of the io falls flat as the state checking ends up nooping the error handler. Create an err_work work item that is scheduled upon an io error while connecting. The work thread terminates all io on all queues and marks the queues as not connected. The termination of the io will return back to the callee, which will then back out of the connection attempt and will reschedule, if possible, the connection attempt. The changes: - in case there are several commands hitting the error handler, a state flag is kept so that the error work is only scheduled once, on the first error. The subsequent errors can be ignored. - The calling sequence to stop keep alive and terminate the queues and their io is lifted from the reset routine. Made a small service routine used by both reset and err_work. - During debugging, found that the teardown path can reference an uninitialized pointer, resulting in a NULL pointer oops. The aen_ops weren't initialized yet. Add validation on their initialization before calling the teardown routine. Signed-off-by: James Smart Signed-off-by: Christoph Hellwig commit 63eb322d89c8505af9b4a3d703e85e42281ebaa0 Author: Ard Biesheuvel Date: Wed Nov 14 09:55:44 2018 -0800 efi: Permit calling efi_mem_reserve_persistent() from atomic context Currently, efi_mem_reserve_persistent() may not be called from atomic context, since both the kmalloc() call and the memremap() call may sleep. The kmalloc() call is easy enough to fix, but the memremap() call needs to be moved into an init hook since we cannot control the memory allocation behavior of memremap() at the call site. Signed-off-by: Ard Biesheuvel Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/20181114175544.12860-6-ard.biesheuvel@linaro.org Signed-off-by: Ingo Molnar commit eff896288872d687d9662000ec9ae11b6d61766f Author: Ard Biesheuvel Date: Wed Nov 14 09:55:43 2018 -0800 efi/arm: Defer persistent reservations until after paging_init() The new memory EFI reservation feature we introduced to allow memory reservations to persist across kexec may trigger an unbounded number of calls to memblock_reserve(). The memblock subsystem can deal with this fine, but not before memblock resizing is enabled, which we can only do after paging_init(), when the memory we reallocate the array into is actually mapped. So break out the memreserve table processing into a separate routine and call it after paging_init() on arm64. On ARM, because of limited reviewing bandwidth of the maintainer, we cannot currently fix this, so instead, disable the EFI persistent memreserve entirely on ARM so we can fix it later. Tested-by: Marc Zyngier Signed-off-by: Ard Biesheuvel Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/20181114175544.12860-5-ard.biesheuvel@linaro.org Signed-off-by: Ingo Molnar commit 72a58a63a164b4e9d2d914e65caeb551846883f1 Author: Ard Biesheuvel Date: Wed Nov 14 09:55:42 2018 -0800 efi/arm/libstub: Pack FDT after populating it Commit: 24d7c494ce46 ("efi/arm-stub: Round up FDT allocation to mapping size") increased the allocation size for the FDT image created by the stub to a fixed value of 2 MB, to simplify the former code that made several attempts with increasing values for the size. This is reasonable given that the allocation is of type EFI_LOADER_DATA, which is released to the kernel unless it is explicitly memblock_reserve()d by the early boot code. However, this allocation size leaked into the 'size' field of the FDT header metadata, and so the entire allocation remains occupied by the device tree binary, even if most of it is not used to store device tree information. So call fdt_pack() to shrink the FDT data structure to its minimum size after populating all the fields, so that the remaining memory is no longer wasted. Signed-off-by: Ard Biesheuvel Cc: # v4.12+ Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Fixes: 24d7c494ce46 ("efi/arm-stub: Round up FDT allocation to mapping size") Link: http://lkml.kernel.org/r/20181114175544.12860-4-ard.biesheuvel@linaro.org Signed-off-by: Ingo Molnar commit 33412b8673135b18ea42beb7f5117ed0091798b6 Author: Ard Biesheuvel Date: Wed Nov 14 09:55:41 2018 -0800 efi/arm: Revert deferred unmap of early memmap mapping Commit: 3ea86495aef2 ("efi/arm: preserve early mapping of UEFI memory map longer for BGRT") deferred the unmap of the early mapping of the UEFI memory map to accommodate the ACPI BGRT code, which looks up the memory type that backs the BGRT table to validate it against the requirements of the UEFI spec. Unfortunately, this causes problems on ARM, which does not permit early mappings to persist after paging_init() is called, resulting in a WARN() splat. Since we don't support the BGRT table on ARM anway, let's revert ARM to the old behaviour, which is to take down the early mapping at the end of efi_init(). Signed-off-by: Ard Biesheuvel Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Fixes: 3ea86495aef2 ("efi/arm: preserve early mapping of UEFI memory ...") Link: http://lkml.kernel.org/r/20181114175544.12860-3-ard.biesheuvel@linaro.org Signed-off-by: Ingo Molnar commit ef1491e791308317bb9851a0ad380c4a68b58d54 Author: Waiman Long Date: Wed Nov 14 09:55:40 2018 -0800 efi: Fix debugobjects warning on 'efi_rts_work' The following commit: 9dbbedaa6171 ("efi: Make efi_rts_work accessible to efi page fault handler") converted 'efi_rts_work' from an auto variable to a global variable. However, when submitting the work, INIT_WORK_ONSTACK() was still used, causing the following complaint from debugobjects: ODEBUG: object 00000000ed27b500 is NOT on stack 00000000c7d38760, but annotated. Change the macro to just INIT_WORK() to eliminate the warning. Signed-off-by: Waiman Long Signed-off-by: Ard Biesheuvel Acked-by: Sai Praneeth Prakhya Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Fixes: 9dbbedaa6171 ("efi: Make efi_rts_work accessible to efi page fault handler") Link: http://lkml.kernel.org/r/20181114175544.12860-2-ard.biesheuvel@linaro.org Signed-off-by: Ingo Molnar commit f8504f4ca0a0e9f84546ef86e00b24d2ea9a0bd2 Author: Xin Long Date: Tue Nov 13 01:08:25 2018 +0800 l2tp: fix a sock refcnt leak in l2tp_tunnel_register This issue happens when trying to add an existent tunnel. It doesn't call sock_put() before returning -EEXIST to release the sock refcnt that was held by calling sock_hold() before the existence check. This patch is to fix it by holding the sock after doing the existence check. Fixes: f6cd651b056f ("l2tp: fix race in duplicate tunnel detection") Reported-by: Jianlin Shi Signed-off-by: Xin Long Reviewed-by: Guillaume Nault Signed-off-by: David S. Miller commit 66f93c5a02d5ba6ef17fef459143961382593212 Author: Nicholas Piggin Date: Thu Nov 15 12:34:27 2018 +1000 powerpc/64: Fix kernel stack 16-byte alignment Commit 4c2de74cc869 ("powerpc/64: Interrupts save PPR on stack rather than thread_struct") changed sizeof(struct pt_regs) % 16 from 0 to 8, which causes the interrupt frame allocation on kernel entry to put the kernel stack out of alignment. Quadword (16-byte) alignment for the stack is required by both the 64-bit v1 ABI (v1.9 § 3.2.2) and the 64-bit v2 ABI (v1.1 § 2.2.2.1). Add a pad field to fix alignment, and add a BUILD_BUG_ON to catch this in future. Fixes: 4c2de74cc869 ("powerpc/64: Interrupts save PPR on stack rather than thread_struct") Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman commit 6c08ec1216b7b2f84b9755f339d6009768599256 Author: Michael Roth Date: Thu Nov 8 21:27:23 2018 -0600 KVM: PPC: Book3S HV: Fix handling for interrupted H_ENTER_NESTED While running a nested guest VCPU on L0 via H_ENTER_NESTED hcall, a pending signal in the L0 QEMU process can generate the following sequence: ret0 = kvmppc_pseries_do_hcall() ret1 = kvmhv_enter_nested_guest() ret2 = kvmhv_run_single_vcpu() if (ret2 == -EINTR) return H_INTERRUPT if (ret1 == H_INTERRUPT) kvmppc_set_gpr(vcpu, 3, 0) return -EINTR /* skipped: */ kvmppc_set_gpr(vcpu, 3, ret) vcpu->arch.hcall_needed = 0 return RESUME_GUEST which causes an exit to L0 userspace with ret0 == -EINTR. The intention seems to be to set the hcall return value to 0 (via VCPU r3) so that L1 will see a successful return from H_ENTER_NESTED once we resume executing the VCPU. However, because we don't set vcpu->arch.hcall_needed = 0, we do the following once userspace resumes execution via kvm_arch_vcpu_ioctl_run(): ... } else if (vcpu->arch.hcall_needed) { int i kvmppc_set_gpr(vcpu, 3, run->papr_hcall.ret); for (i = 0; i < 9; ++i) kvmppc_set_gpr(vcpu, 4 + i, run->papr_hcall.args[i]); vcpu->arch.hcall_needed = 0; since vcpu->arch.hcall_needed == 1 indicates that userspace should have handled the hcall and stored the return value in run->papr_hcall.ret. Since that's not the case here, we can get an unexpected value in VCPU r3, which can result in kvmhv_p9_guest_entry() reporting an unexpected trap value when it returns from H_ENTER_NESTED, causing the following register dump to console via subsequent call to kvmppc_handle_exit_hv() in L1: [ 350.612854] vcpu 00000000f9564cf8 (0): [ 350.612915] pc = c00000000013eb98 msr = 8000000000009033 trap = 1 [ 350.613020] r 0 = c0000000004b9044 r16 = 0000000000000000 [ 350.613075] r 1 = c00000007cffba30 r17 = 0000000000000000 [ 350.613120] r 2 = c00000000178c100 r18 = 00007fffc24f3b50 [ 350.613166] r 3 = c00000007ef52480 r19 = 00007fffc24fff58 [ 350.613212] r 4 = 0000000000000000 r20 = 00000a1e96ece9d0 [ 350.613253] r 5 = 70616d00746f6f72 r21 = 00000a1ea117c9b0 [ 350.613295] r 6 = 0000000000000020 r22 = 00000a1ea1184360 [ 350.613338] r 7 = c0000000783be440 r23 = 0000000000000003 [ 350.613380] r 8 = fffffffffffffffc r24 = 00000a1e96e9e124 [ 350.613423] r 9 = c00000007ef52490 r25 = 00000000000007ff [ 350.613469] r10 = 0000000000000004 r26 = c00000007eb2f7a0 [ 350.613513] r11 = b0616d0009eccdb2 r27 = c00000007cffbb10 [ 350.613556] r12 = c0000000004b9000 r28 = c00000007d83a2c0 [ 350.613597] r13 = c000000001b00000 r29 = c0000000783cdf68 [ 350.613639] r14 = 0000000000000000 r30 = 0000000000000000 [ 350.613681] r15 = 0000000000000000 r31 = c00000007cffbbf0 [ 350.613723] ctr = c0000000004b9000 lr = c0000000004b9044 [ 350.613765] srr0 = 0000772f954dd48c srr1 = 800000000280f033 [ 350.613808] sprg0 = 0000000000000000 sprg1 = c000000001b00000 [ 350.613859] sprg2 = 0000772f9565a280 sprg3 = 0000000000000000 [ 350.613911] cr = 88002848 xer = 0000000020040000 dsisr = 42000000 [ 350.613962] dar = 0000772f95390000 [ 350.614031] fault dar = c000000244b278c0 dsisr = 00000000 [ 350.614073] SLB (0 entries): [ 350.614157] lpcr = 0040000003d40413 sdr1 = 0000000000000000 last_inst = ffffffff [ 350.614252] trap=0x1 | pc=0xc00000000013eb98 | msr=0x8000000000009033 followed by L1's QEMU reporting the following before stopping execution of the nested guest: KVM: unknown exit, hardware reason 1 NIP c00000000013eb98 LR c0000000004b9044 CTR c0000000004b9000 XER 0000000020040000 CPU#0 MSR 8000000000009033 HID0 0000000000000000 HF 8000000000000000 iidx 3 didx 3 TB 00000000 00000000 DECR 00000000 GPR00 c0000000004b9044 c00000007cffba30 c00000000178c100 c00000007ef52480 GPR04 0000000000000000 70616d00746f6f72 0000000000000020 c0000000783be440 GPR08 fffffffffffffffc c00000007ef52490 0000000000000004 b0616d0009eccdb2 GPR12 c0000000004b9000 c000000001b00000 0000000000000000 0000000000000000 GPR16 0000000000000000 0000000000000000 00007fffc24f3b50 00007fffc24fff58 GPR20 00000a1e96ece9d0 00000a1ea117c9b0 00000a1ea1184360 0000000000000003 GPR24 00000a1e96e9e124 00000000000007ff c00000007eb2f7a0 c00000007cffbb10 GPR28 c00000007d83a2c0 c0000000783cdf68 0000000000000000 c00000007cffbbf0 CR 88002848 [ L L - - E L G L ] RES ffffffffffffffff SRR0 0000772f954dd48c SRR1 800000000280f033 PVR 00000000004e1202 VRSAVE 0000000000000000 SPRG0 0000000000000000 SPRG1 c000000001b00000 SPRG2 0000772f9565a280 SPRG3 0000000000000000 SPRG4 0000000000000000 SPRG5 0000000000000000 SPRG6 0000000000000000 SPRG7 0000000000000000 HSRR0 0000000000000000 HSRR1 0000000000000000 CFAR 0000000000000000 LPCR 0000000003d40413 PTCR 0000000000000000 DAR 0000772f95390000 DSISR 0000000042000000 Fix this by setting vcpu->arch.hcall_needed = 0 to indicate completion of H_ENTER_NESTED before we exit to L0 userspace. Fixes: 360cae313702 ("KVM: PPC: Book3S HV: Nested guest entry via hypercall") Cc: linuxppc-dev@ozlabs.org Cc: David Gibson Signed-off-by: Michael Roth Reviewed-by: Suraj Jitindar Singh Signed-off-by: Paul Mackerras commit 5929a1f0ff30d04ccf4b0f9c648e7aa8bc816bbd Merge: 9746e46737a1 ef3a61406618 Author: Linus Torvalds Date: Wed Nov 14 17:14:40 2018 -0600 Merge tag 'riscv-for-linus-4.20-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux Pull RISC-V fixes from Palmer Dabbelt: "This contains a few patches that fix various issues in the RISC-V port: - enable printk timestamps in the RISC-V defconfig. - a whitespace fix to "struct pt_regs". - add a "vdso_install" target for RISC-V. - a pair of build fixes: one to fix a typo in our makefile, and one to clean up some warnings. There will probably be more patches from us for 4.20, but I don't have anything that's ready to go right now so I'm going to hold off a bit. Right now the only concrete thing I know I want to make sure gets sorted out is our 32-bit stat interface, which I don't want sitting in limbo for another cycle as we have to get RV32I glibc sone" * tag 'riscv-for-linus-4.20-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux: RISC-V: Silence some module warnings on 32-bit RISC-V: lib: Fix build error for 64-bit riscv: add missing vdso_install target riscv: fix spacing in struct pt_regs RISC-V: defconfig: Enable printk timestamps commit 9746e46737a143631a301be9a09fafdae3349138 Merge: e4c4b0e45dfd 646558ff1643 Author: Linus Torvalds Date: Wed Nov 14 17:07:01 2018 -0600 Merge tag 'kgdb-fixes-4.20-rc3' of https://git.linaro.org/people/daniel.thompson/linux Pull kgdb fixes from Daniel Thompson: "The most important changes here are two fixes for kdb regressions causes by the hashing of %p pointers together with a fix for a potential overflow in kdb tab completion handling (and warning fix). Also included are a set of changes in preparation to (eventually) enable -Wimplicit-fallthrough" * tag 'kgdb-fixes-4.20-rc3' of https://git.linaro.org/people/daniel.thompson/linux: kdb: kdb_support: mark expected switch fall-throughs kdb: kdb_keyboard: mark expected switch fall-throughs kdb: kdb_main: refactor code in kdb_md_line kdb: Use strscpy with destination buffer size kdb: print real address of pointers instead of hashed addresses kdb: use correct pointer when 'btc' calls 'btt' commit e4c4b0e45dfd1212831ad5bd129c6781d55e162a Merge: 3472f66013d1 fd35f192e42c Author: Linus Torvalds Date: Wed Nov 14 17:03:24 2018 -0600 Merge branch 'fixes-v4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull integrity fix from James Morris: "Fix a bug introduced with in this merge window in 82f94f24475c ("KEYS: Provide software public key query function [ver #2]")" * 'fixes-v4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: integrity: support new struct public_key_signature encoding field commit 5082a7df5251b361be8f8edc1f0a148d07999820 Merge: 432798195bbc 1decef370456 Author: Greg Kroah-Hartman Date: Wed Nov 14 14:57:39 2018 -0800 Merge tag 'gnss-4.20-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/gnss into char-misc-linus Johan writes: GNSS fixes for v4.20-rc3 The two serdev drivers were using the wrong timeout argument when expecting the serdev_device_write() helper to wait indefinitely, something which could result in incomplete writes when the controller write buffer was getting full. Signed-off-by: Johan Hovold commit 27c0f2b0197070c8e94bdf28686d4c63b959dea8 Author: Rajan Vaja Date: Tue Nov 13 23:46:49 2018 -0800 clk: zynqmp: handle fixed factor param query error Return proper error code in case query for fixed factor parameter fails. This also fixes build warning for set but not used variable 'ret'. Signed-off-by: Rajan Vaja Fixes: 3fde0e16d016 ("drivers: clk: Add ZynqMP clock driver") Signed-off-by: Stephen Boyd commit 22454b79e6de05fa61a2a72d00d2eed798abbb75 Author: Dennis Wassenberg Date: Tue Nov 13 14:40:34 2018 +0100 usb: core: Fix hub port connection events lost This will clear the USB_PORT_FEAT_C_CONNECTION bit in case of a hub port reset only if a device is was attached to the hub port before resetting the hub port. Using a Lenovo T480s attached to the ultra dock it was not possible to detect some usb-c devices at the dock usb-c ports because the hub_port_reset code will clear the USB_PORT_FEAT_C_CONNECTION bit after the actual hub port reset. Using this device combo the USB_PORT_FEAT_C_CONNECTION bit was set between the actual hub port reset and the clear of the USB_PORT_FEAT_C_CONNECTION bit. This ends up with clearing the USB_PORT_FEAT_C_CONNECTION bit after the new device was attached such that it was not detected. This patch will not clear the USB_PORT_FEAT_C_CONNECTION bit if there is currently no device attached to the port before the hub port reset. This will avoid clearing the connection bit for new attached devices. Signed-off-by: Dennis Wassenberg Acked-by: Mathias Nyman Cc: stable Signed-off-by: Greg Kroah-Hartman commit 882eab6c28d23a970ae73b7eb831b169a672d456 Author: Tzung-Bi Shih Date: Wed Nov 14 17:06:13 2018 +0800 ASoC: dapm: Recalculate audio map forcely when card instantiated Audio map are possible in wrong state before card->instantiated has been set to true. Imaging the following examples: time 1: at the beginning in:-1 in:-1 in:-1 in:-1 out:-1 out:-1 out:-1 out:-1 SIGGEN A B Spk time 2: after someone called snd_soc_dapm_new_widgets() (e.g. create_fill_widget_route_map() in sound/soc/codecs/hdac_hdmi.c) in:1 in:0 in:0 in:0 out:0 out:0 out:0 out:1 SIGGEN A B Spk time 3: routes added in:1 in:0 in:0 in:0 out:0 out:0 out:0 out:1 SIGGEN -----> A -----> B ---> Spk In the end, the path should be powered on but it did not. At time 3, "in" of SIGGEN and "out" of Spk did not propagate to their neighbors because snd_soc_dapm_add_path() will not invalidate the paths if the card has not instantiated (i.e. card->instantiated is false). To correct the state of audio map, recalculate the whole map forcely. Signed-off-by: Tzung-Bi Shih Signed-off-by: Mark Brown commit 4b8440abc9025e214474b11f1ee7db146ce30afa Merge: 11644a765952 2fc6d4be35fb Author: Greg Kroah-Hartman Date: Wed Nov 14 14:24:07 2018 -0800 Merge tag 'fixes-for-v4.20-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus Felipe writes: For now only 5 small fixes. Most importantly, we have a fix for the TRB type used on unaligned transfers on dwc3. Also a fix for a NULL pointer dereference in dwc3_pci_remove(). Note that a recent commit on ffs was reverted because it causes a regression elsewere. * tag 'fixes-for-v4.20-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb: usb: dwc3: gadget: fix ISOC TRB type on unaligned transfers Revert "usb: gadget: ffs: Fix BUG when userland exits with submitted AIO transfers" usb: dwc2: pci: Fix an error code in probe usb: dwc3: Fix NULL pointer exception in dwc3_pci_remove() usb: dwc3: gadget: Properly check last unaligned/zero chain TRB usb: dwc3: core: Clean up ULPI device commit 007b656851ed7f94ba0fa358ac3e5d7705da6846 Author: Ursula Braun Date: Mon Nov 12 17:06:12 2018 +0100 s390/ism: clear dmbe_mask bit before SMC IRQ handling SMC-D stress workload showed connection stalls. Since the firmware decides to skip raising an interrupt if the SBA DMBE mask bit is still set, this SBA DMBE mask bit should be cleared before the IRQ handling in the SMC code runs. Otherwise there are small windows possible with missing interrupts for incoming data. SMC-D currently does not care about the old value of the SBA DMBE mask. Acked-by: Sebastian Ott Signed-off-by: Ursula Braun Signed-off-by: David S. Miller commit 76836fd354922ebe4798a64fda01f8dc6a8b0984 Author: Peter Ujfalusi Date: Wed Nov 14 14:58:20 2018 +0200 ASoC: omap-abe-twl6040: Fix missing audio card caused by deferred probing The machine driver fails to probe in next-20181113 with: [ 2.539093] omap-abe-twl6040 sound: ASoC: CODEC DAI twl6040-legacy not registered [ 2.546630] omap-abe-twl6040 sound: devm_snd_soc_register_card() failed: -517 ... [ 3.693206] omap-abe-twl6040 sound: ASoC: Both platform name/of_node are set for TWL6040 [ 3.701446] omap-abe-twl6040 sound: ASoC: failed to init link TWL6040 [ 3.708007] omap-abe-twl6040 sound: devm_snd_soc_register_card() failed: -22 [ 3.715148] omap-abe-twl6040: probe of sound failed with error -22 Bisect pointed to a merge commit: first bad commit: [0f688ab20a540aafa984c5dbd68a71debebf4d7f] Merge remote-tracking branch 'net-next/master' and a diff between a working kernel does not reveal anything which would explain the change in behavior. Further investigation showed that on the second try of loading fails because the dai_link->platform is no longer NULL and it might be pointing to uninitialized memory. The fix is to move the snd_soc_dai_link and snd_soc_card inside of the abe_twl6040 struct, which is dynamically allocated every time the driver probes. Signed-off-by: Peter Ujfalusi Signed-off-by: Mark Brown commit 3472f66013d1972f0baf1631ea1e02479b902579 Merge: dbb3c26034fa 017ce359a718 Author: Linus Torvalds Date: Wed Nov 14 15:36:45 2018 -0600 Merge tag 'acpi-4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Fix a recently introduced build issue in the xpower PMIC driver (Arnd Bergmann)" * tag 'acpi-4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI / PMIC: xpower: fix IOSF_MBI dependency commit dbb3c26034fa5336de45e667e2faf80a78531cd0 Merge: 4e4490d438a1 97dc6c03c1b0 Author: Linus Torvalds Date: Wed Nov 14 15:33:45 2018 -0600 Merge tag 'pm-4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These remove a stale DT entry left behind after recent removal of a cpufreq driver without users, fix up error handling in the imx6q cpufreq driver, fix two issues in the cpufreq documentation, and update the ARM cpufreq driver. Specifics: - Drop stale DT binding for the arm_big_little_dt driver removed recently (Sudeep Holla). - Fix up error handling in the imx6q cpufreq driver to make it report voltage scaling failures (Anson Huang). - Fix two issues in the cpufreq documentation (Viresh Kumar, Zhao Wei Liew). - Fix ARM cpuidle driver initialization regression from the 4.19 time frame and rework the driver registration part of it to simplify code (Ulf Hansson)" * tag 'pm-4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ARM: cpuidle: Convert to use cpuidle_register|unregister() ARM: cpuidle: Don't register the driver when back-end init returns -ENXIO dt-bindings: cpufreq: remove stale arm_big_little_dt entry Documentation: cpufreq: Correct a typo cpufreq: imx6q: add return value check for voltage scale Documentation: cpu-freq: Frequencies aren't always sorted commit 4e4490d438a1c84411e3ebd0b850b46dd2e752cf Merge: d41217aac0a5 025911a5f4e3 Author: Linus Torvalds Date: Wed Nov 14 15:31:15 2018 -0600 Merge tag 'nfsd-4.20-1' of git://linux-nfs.org/~bfields/linux Pull nfsd fixes from Bruce Fields: "Three nfsd bugfixes. None are new bugs, but they all take a little effort to hit, which might explain why they weren't found sooner" * tag 'nfsd-4.20-1' of git://linux-nfs.org/~bfields/linux: SUNRPC: drop pointless static qualifier in xdr_get_next_encode_buffer() nfsd: COPY and CLONE operations require the saved filehandle to be set sunrpc: correct the computation for page_ptr when truncating commit d41217aac0a577a247c9c8cde688419fde25fba5 Merge: dbcec2e6bcfe 0d76bcc960e6 Author: Linus Torvalds Date: Wed Nov 14 13:51:47 2018 -0600 Merge tag 'pci-v4.20-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fix from Bjorn Helgaas: "Revert a _PXM change that causes silent early boot failure on some AMD ThreadRipper systems" * tag 'pci-v4.20-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: Revert "ACPI/PCI: Pay attention to device-specific _PXM node values" commit dbcec2e6bcfeb9769005cf529f0b5050f9557ff6 Merge: b7bbf9935fb7 f635e48e866e Author: Linus Torvalds Date: Wed Nov 14 13:49:29 2018 -0600 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "This is mostly a set of minor and obvious fixes (three in one of the new drivers). The only substantial change is to move the ufs to the blk-mq now that the merge window fixed the suspend/resume issues with blk-mq" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: qla2xxx: Initialize port speed to avoid setting lower speed Revert "scsi: ufs: Disable blk-mq for now" scsi: NCR5380: Return false instead of NULL scsi: qla2xxx: Fix a typo in MODULE_PARM_DESC scsi: hisi_sas: Remove set but not used variable 'dq_list' scsi: myrs: only build on little-endian platforms scsi: myrs: avoid stack overflow warning scsi: lpfc: fix remoteport access scsi: myrb: fix sprintf buffer overflow warning scsi: target/core: Avoid that a kernel oops is triggered when COMPARE AND WRITE fails commit b7bbf9935fb793ef8dc42c61a459d74e8606a799 Merge: 47e624c03043 9bde0afb7a90 Author: Linus Torvalds Date: Wed Nov 14 13:47:15 2018 -0600 Merge tag 'rtc-4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC driver fixes from Alexandre Belloni: - cmos: stop exporting alarms when not supported - hctosys: correctly report range error - pcf2127: fix a memory leak * tag 'rtc-4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: rtc: pcf2127: fix a kmemleak caused in pcf2127_i2c_gather_write rtc: hctosys: Add missing range error reporting rtc: cmos: Do not export alarm rtc_ops when we do not support alarms commit 47e624c03043f544ab797ee073d958cfa57dbf51 Merge: 857c34cd094b 1e9c75fb9c47 Author: Linus Torvalds Date: Wed Nov 14 13:44:52 2018 -0600 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace Pull namespace fix from Eric Biederman: "Benjamin Coddington noticed an unkillable busy loop in the kernel that anyone who is sufficiently motivated can trigger. This bug did not exist in earlier kernels making this bug a regression. I have tested the change personally and confirmed that the bug exists and that the fix works. This fix has been picked up by linux-next and hopefully the automated testing bots and no problems have been reported from those sources. Ordinarily I would let something like this sit a little longer but I am going to be away at Linux Plumbers the rest of this week and I am afraid if I don't send the pull request now this fix will get lost" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: mnt: fix __detach_mounts infinite loop commit 857c34cd094b94a82aceba23fdd9af47296404a2 Merge: e2f8b472a708 86d4d068df57 Author: Linus Torvalds Date: Wed Nov 14 13:42:41 2018 -0600 Merge branch 'parisc-4.20-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fix from Helge Deller: "Revert one patch which changed how spinlocks get released. It breaks the rwlock implementation in glibc" * 'parisc-4.20-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Revert "Release spinlocks using ordered store" commit e2f8b472a70827348ce2007e121d67f49047ba62 Merge: ccda4af0f4b9 5df7a99bdd0d Author: Linus Torvalds Date: Wed Nov 14 13:40:22 2018 -0600 Merge branch 'spectre' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM fix from Russell King: "It was noticed that one of Julien's patches contained an error, this fixes that up" * 'spectre' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 8810/1: vfp: Fix wrong assignement to ufp_exc commit 1decef370456870bf448a565be95db636428e106 Author: Johan Hovold Date: Wed Nov 14 09:37:54 2018 +0100 gnss: sirf: fix synchronous write timeout Passing a timeout of zero to the synchronous serdev_device_write() helper does currently not imply to wait forever (unlike passing zero to serdev_device_wait_until_sent()). Instead, if there's insufficient room in the write buffer, we'd end up with an incomplete write. Fixes: d2efbbd18b1e ("gnss: add driver for sirfstar-based receivers") Cc: stable # 4.19 Signed-off-by: Johan Hovold commit 56a6c7268312cba9436b84cac01b3e502c5c511d Author: Johan Hovold Date: Wed Nov 14 09:33:57 2018 +0100 gnss: serial: fix synchronous write timeout Passing a timeout of zero to the synchronous serdev_device_write() helper does currently not imply to wait forever (unlike passing zero to serdev_device_wait_until_sent()). Instead, if there's insufficient room in the write buffer, we'd end up with an incomplete write. Fixes: 37768b054f20 ("gnss: add generic serial driver") Cc: stable # 4.19 Signed-off-by: Johan Hovold commit f505754fd6599230371cb01b9332754ddc104be1 Author: Filipe Manana Date: Wed Nov 14 11:35:24 2018 +0000 Btrfs: ensure path name is null terminated at btrfs_control_ioctl We were using the path name received from user space without checking that it is null terminated. While btrfs-progs is well behaved and does proper validation and null termination, someone could call the ioctl and pass a non-null terminated patch, leading to buffer overrun problems in the kernel. The ioctl is protected by CAP_SYS_ADMIN. So just set the last byte of the path to a null character, similar to what we do in other ioctls (add/remove/resize device, snapshot creation, etc). CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 38cd989ee38c16388cde89db5b734f9d55b905f9 Author: Nicolin Chen Date: Tue Nov 13 19:48:54 2018 -0800 hwmon: (ina2xx) Fix current value calculation The current register (04h) has a sign bit at MSB. The comments for this calculation also mention that it's a signed register. However, the regval is unsigned type so result of calculation turns out to be an incorrect value when current is negative. This patch simply fixes this by adding a casting to s16. Fixes: 5d389b125186c ("hwmon: (ina2xx) Make calibration register value fixed") Signed-off-by: Nicolin Chen Signed-off-by: Guenter Roeck commit 8dc765d438f1e42b3e8227b3b09fad7d73f4ec9a Author: Ming Lei Date: Wed Nov 14 16:25:51 2018 +0800 SCSI: fix queue cleanup race before queue initialization is done c2856ae2f315d ("blk-mq: quiesce queue before freeing queue") has already fixed this race, however the implied synchronize_rcu() in blk_mq_quiesce_queue() can slow down LUN probe a lot, so caused performance regression. Then 1311326cf4755c7 ("blk-mq: avoid to synchronize rcu inside blk_cleanup_queue()") tried to quiesce queue for avoiding unnecessary synchronize_rcu() only when queue initialization is done, because it is usual to see lots of inexistent LUNs which need to be probed. However, turns out it isn't safe to quiesce queue only when queue initialization is done. Because when one SCSI command is completed, the user of sending command can be waken up immediately, then the scsi device may be removed, meantime the run queue in scsi_end_request() is still in-progress, so kernel panic can be caused. In Red Hat QE lab, there are several reports about this kind of kernel panic triggered during kernel booting. This patch tries to address the issue by grabing one queue usage counter during freeing one request and the following run queue. Fixes: 1311326cf4755c7 ("blk-mq: avoid to synchronize rcu inside blk_cleanup_queue()") Cc: Andrew Jones Cc: Bart Van Assche Cc: linux-scsi@vger.kernel.org Cc: Martin K. Petersen Cc: Christoph Hellwig Cc: James E.J. Bottomley Cc: stable Cc: jianchao.wang Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 4800bf7bc8c725e955fcbc6191cc872f43f506d3 Author: Dave Chinner Date: Wed Nov 14 08:17:18 2018 -0700 block: fix 32 bit overflow in __blkdev_issue_discard() A discard cleanup merged into 4.20-rc2 causes fstests xfs/259 to fall into an endless loop in the discard code. The test is creating a device that is exactly 2^32 sectors in size to test mkfs boundary conditions around the 32 bit sector overflow region. mkfs issues a discard for the entire device size by default, and hence this throws a sector count of 2^32 into blkdev_issue_discard(). It takes the number of sectors to discard as a sector_t - a 64 bit value. The commit ba5d73851e71 ("block: cleanup __blkdev_issue_discard") takes this sector count and casts it to a 32 bit value before comapring it against the maximum allowed discard size the device has. This truncates away the upper 32 bits, and so if the lower 32 bits of the sector count is zero, it starts issuing discards of length 0. This causes the code to fall into an endless loop, issuing a zero length discards over and over again on the same sector. Fixes: ba5d73851e71 ("block: cleanup __blkdev_issue_discard") Tested-by: Darrick J. Wong Reviewed-by: Darrick J. Wong Signed-off-by: Dave Chinner Killed pointless WARN_ON(). Signed-off-by: Jens Axboe commit 613a41b0d16e617f46776a93b975a1eeea96417c Author: Thomas Richter Date: Tue Nov 13 15:38:22 2018 +0000 s390/cpum_cf: Reject request for sampling in event initialization On s390 command perf top fails [root@s35lp76 perf] # ./perf top -F100000 --stdio Error: cycles: PMU Hardware doesn't support sampling/overflow-interrupts. Try 'perf stat' [root@s35lp76 perf] # Using event -e rb0000 works as designed. Event rb0000 is the event number of the sampling facility for basic sampling. During system start up the following PMUs are installed in the kernel's PMU list (from head to tail): cpum_cf --> s390 PMU counter facility device driver cpum_sf --> s390 PMU sampling facility device driver uprobe kprobe tracepoint task_clock cpu_clock Perf top executes following functions and calls perf_event_open(2) system call with different parameters many times: cmd_top --> __cmd_top --> perf_evlist__add_default --> __perf_evlist__add_default --> perf_evlist__new_cycles (creates event type:0 (HW) config 0 (CPU_CYCLES) --> perf_event_attr__set_max_precise_ip Uses perf_event_open(2) to detect correct precise_ip level. Fails 3 times on s390 which is ok. Then functions cmd_top --> __cmd_top --> perf_top__start_counters -->perf_evlist__config --> perf_can_comm_exec --> perf_probe_api This functions test support for the following events: "cycles:u", "instructions:u", "cpu-clock:u" using --> perf_do_probe_api --> perf_event_open_cloexec Test the close on exec flag support with perf_event_open(2). perf_do_probe_api returns true if the event is supported. The function returns true because event cpu-clock is supported by the PMU cpu_clock. This is achieved by many calls to perf_event_open(2). Function perf_top__start_counters now calls perf_evsel__open() for every event, which is the default event cpu_cycles (config:0) and type HARDWARE (type:0) which a predfined frequence of 4000. Given the above order of the PMU list, the PMU cpum_cf gets called first and returns 0, which indicates support for this sampling. The event is fully allocated in the function perf_event_open (file kernel/event/core.c near line 10521 and the following check fails: event = perf_event_alloc(&attr, cpu, task, group_leader, NULL, NULL, NULL, cgroup_fd); if (IS_ERR(event)) { err = PTR_ERR(event); goto err_cred; } if (is_sampling_event(event)) { if (event->pmu->capabilities & PERF_PMU_CAP_NO_INTERRUPT) { err = -EOPNOTSUPP; goto err_alloc; } } The check for the interrupt capabilities fails and the system call perf_event_open() returns -EOPNOTSUPP (-95). Add a check to return -ENODEV when sampling is requested in PMU cpum_cf. This allows common kernel code in the perf_event_open() system call to test the next PMU in above list. Fixes: 97b1198fece0 (" "s390, perf: Use common PMU interrupt disabled code") Signed-off-by: Thomas Richter Reviewed-by: Hendrik Brueckner Signed-off-by: Martin Schwidefsky commit a22612301ae61d78a7c0c82dc556931a35db0e91 Author: Mika Kuoppala Date: Fri Nov 9 16:09:23 2018 +0200 drm/i915/icl: Drop spurious register read from icl_dbuf_slices_update Register DBUF_CTL_S2 is read and it's value is not used. As there is no explanation why we should prime the hardware with read, remove it as spurious. Fixes: aa9664ffe863 ("drm/i915/icl: Enable 2nd DBuf slice only when needed") Cc: Mahesh Kumar Cc: Rodrigo Vivi Signed-off-by: Mika Kuoppala Reviewed-by: Imre Deak Link: https://patchwork.freedesktop.org/patch/msgid/20181109140924.2663-1-mika.kuoppala@linux.intel.com (cherry picked from commit 8577c319b6511fbc391f3775225fecd8b979bc26) Signed-off-by: Joonas Lahtinen commit 6a67a20366f894c172734f28c5646bdbe48a46e3 Author: Lionel Landwerlin Date: Mon Nov 12 12:39:31 2018 +0000 drm/i915: fix broadwell EU computation subslice_mask is an array indexed by slice, not subslice. Signed-off-by: Lionel Landwerlin Fixes: 8cc7669355136f ("drm/i915: store all subslice masks") Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108712 Reviewed-by: Chris Wilson Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20181112123931.2815-1-lionel.g.landwerlin@intel.com (cherry picked from commit 63ac3328f0d1d37f286e397b14d9596ed09d7ca5) Signed-off-by: Joonas Lahtinen commit 2fc6d4be35fb1e262f209758e25bfe2b7a113a7f Author: Felipe Balbi Date: Wed Aug 1 09:37:34 2018 +0300 usb: dwc3: gadget: fix ISOC TRB type on unaligned transfers When chaining ISOC TRBs together, only the first ISOC TRB should be of type ISOC_FIRST, all others should be of type ISOC. This patch fixes that. Fixes: c6267a51639b ("usb: dwc3: gadget: align transfers to wMaxPacketSize") Cc: # v4.11+ Signed-off-by: Felipe Balbi commit a9c859033f6ec772f8e3228c343bb1321584ae0e Author: Shen Jing Date: Thu Nov 1 15:35:17 2018 +0530 Revert "usb: gadget: ffs: Fix BUG when userland exits with submitted AIO transfers" This reverts commit b4194da3f9087dd38d91b40f9bec42d59ce589a8 since it causes list corruption followed by kernel panic: Workqueue: adb ffs_aio_cancel_worker RIP: 0010:__list_add_valid+0x4d/0x70 Call Trace: insert_work+0x47/0xb0 __queue_work+0xf6/0x400 queue_work_on+0x65/0x70 dwc3_gadget_giveback+0x44/0x50 [dwc3] dwc3_gadget_ep_dequeue+0x83/0x2d0 [dwc3] ? finish_wait+0x80/0x80 usb_ep_dequeue+0x1e/0x90 process_one_work+0x18c/0x3b0 worker_thread+0x3c/0x390 ? process_one_work+0x3b0/0x3b0 kthread+0x11e/0x140 ? kthread_create_worker_on_cpu+0x70/0x70 ret_from_fork+0x3a/0x50 This issue is seen with warm reboot stability testing. Signed-off-by: Shen Jing Signed-off-by: Saranya Gopal Signed-off-by: Felipe Balbi commit 3c135e8900199e3b9375c1eff808cceba2ee37de Author: Dan Carpenter Date: Thu Oct 18 10:36:47 2018 +0300 usb: dwc2: pci: Fix an error code in probe We added some error handling to this function but forgot to set the error code on this path. Fixes: ecd29dabb2ba ("usb: dwc2: pci: Handle error cleanup in probe") Acked-by: Minas Harutyunyan Signed-off-by: Dan Carpenter Signed-off-by: Felipe Balbi commit 7b412b04a0c7000293008231ce8413056abb1982 Author: Kuppuswamy Sathyanarayanan Date: Wed Oct 17 11:40:26 2018 -0700 usb: dwc3: Fix NULL pointer exception in dwc3_pci_remove() In dwc3_pci_quirks() function, gpiod lookup table is only registered for baytrail SOC. But in dwc3_pci_remove(), we try to unregistered it without any checks. This leads to NULL pointer de-reference exception in gpiod_remove_lookup_table() when unloading the module for non baytrail SOCs. This patch fixes this issue. Fixes: 5741022cbdf3 ("usb: dwc3: pci: Add GPIO lookup table on platforms without ACPI GPIO resources") Cc: Signed-off-by: Kuppuswamy Sathyanarayanan Reviewed-by: Heikki Krogerus Signed-off-by: Felipe Balbi commit 40dc948f234b73497c3278875eb08a01d5854d3f Author: Max Filippov Date: Tue Nov 13 23:46:42 2018 -0800 xtensa: fix boot parameters address translation The bootloader may pass physical address of the boot parameters structure to the MMUv3 kernel in the register a2. Code in the _SetupMMU block in the arch/xtensa/kernel/head.S is supposed to map that physical address to the virtual address in the configured virtual memory layout. This code haven't been updated when additional 256+256 and 512+512 memory layouts were introduced and it may produce wrong addresses when used with these layouts. Cc: stable@vger.kernel.org Signed-off-by: Max Filippov commit 5f8208f557065163f9a8089ea2ea7888f9d96922 Author: Corentin Labbe Date: Mon Jul 9 19:51:54 2018 +0000 ARM: dts: sun8i: a83t: bananapi-m3: increase vcc-pd voltage to 3.3V Since commit d7c5f6863550 ("ARM: dts: sun8i: a83t: bananapi-m3: Add AXP813 regulator nodes") my BPIM3 no longer works at gigabit speed. With the default setting, dldo3 is regulated at 2.9v which seems sufficient for the PHY but the aforementioned commit drops it to 2.5V which is insufficient. Note that this behaviour is random for all BPIM3. Some work with 2.5V, but some don't. Finnaly, someone from Bananapi confirmed that this regulator must be set to 3.3V. Fixes: d7c5f6863550 ("ARM: dts: sun8i: a83t: bananapi-m3: Add AXP813 regulator nodes") Signed-off-by: Corentin Labbe [wens@csie.org: Reworked commit message] Signed-off-by: Chen-Yu Tsai commit 437ccdc8ce629470babdda1a7086e2f477048cbd Author: Satheesh Rajendran Date: Thu Nov 8 10:47:56 2018 +0530 powerpc/numa: Suppress "VPHN is not supported" messages When VPHN function is not supported and during cpu hotplug event, kernel prints message 'VPHN function not supported. Disabling polling...'. Currently it prints on every hotplug event, it floods dmesg when a KVM guest tries to hotplug huge number of vcpus, let's just print once and suppress further kernel prints. Signed-off-by: Satheesh Rajendran Signed-off-by: Michael Ellerman commit 877181a8d9dc663f7a73f77f50af714d7888ec3b Author: Paul Moore Date: Tue Nov 13 21:44:33 2018 -0500 selinux: fix non-MLS handling in mls_context_to_sid() Commit 95ffe194204a ("selinux: refactor mls_context_to_sid() and make it stricter") inadvertently changed how we handle labels that did not contain MLS information. This patch restores the proper behavior in mls_context_to_sid() and adds a comment explaining the proper behavior to help ensure this doesn't happen again. Fixes: 95ffe194204a ("selinux: refactor mls_context_to_sid() and make it stricter") Reported-by: Stephen Smalley Signed-off-by: Paul Moore commit 933a95496e48bde40e366a79e6dd9f9740905573 Author: Kirill Marinushkin Date: Mon Nov 12 08:08:34 2018 +0100 ASoC: pcm3060: Rename output widgets In the initial commit [1], I added differential output of the codec as separate `+` and `-` widgets: OUTL+ OUTR+ OUTL- OUTR- Later, in the commit [2], I added a device tree property to configure the output as single-ended or differential. Having this property, the `+` and `-` separation in widgets seems for me confusing. There are no functional benefits in such separation, so I find reasonable to get rid of it: OUTL OUTR The new naming is more friendly for sound cards, and is better aligned with other codec drivers in kernel. Renaming the output widgets now should not be a problem from the backwards- compatibility perspective, as the driver for PCM3060 is added into the mainline very recently, and did not yet appear in any releases. [1] commit 6ee47d4a8dac ("ASoC: pcm3060: Add codec driver") [2] commit a78c62de00d5 ("ASoC: pcm3060: Add DT property for single-ended output") Signed-off-by: Kirill Marinushkin Signed-off-by: Mark Brown commit 67fd1437d11620de8768b22fe20942e752ed52e9 Author: Rohit kumar Date: Thu Nov 8 19:11:40 2018 +0530 ASoC: qcom: Set dai_link id to each dai_link Frontend dai_link id is used for closing ADM sessions. During concurrent usecase when one session is closed, it closes other ADM session associated with other usecase too. Dai_link->id should always point to Frontend dai id. Set cpu_dai id as dai_link id to fix the issue. Signed-off-by: Rohit kumar Acked-by: Srinivas Kandagatla Signed-off-by: Mark Brown commit 9ee325d029c4abb75716851ce38863845911d605 Author: Vasily Khoruzhick Date: Thu Nov 8 20:24:19 2018 -0800 ASoC: sun8i-codec: add missing route for ADC sun8i-codec misses a route from ADC to AIF1 Slot 0 ADC. Add it to the driver to avoid adding it to every dts. Fixes: eda85d1fee05d ("ASoC: sun8i-codec: Add ADC support for a33") Signed-off-by: Vasily Khoruzhick Signed-off-by: Mark Brown commit e39d8a186ed002854196668cb7562ffdfbc6d379 Author: Trond Myklebust Date: Tue Nov 13 16:37:54 2018 -0500 NFSv4: Fix an Oops during delegation callbacks If the server sends a CB_GETATTR or a CB_RECALL while the filesystem is being unmounted, then we can Oops when releasing the inode in nfs4_callback_getattr() and nfs4_callback_recall(). Signed-off-by: Trond Myklebust commit fd35f192e42cf7c0df1e2480bfd5965e35b2f4ca Author: Mimi Zohar Date: Fri Nov 9 00:53:40 2018 -0500 integrity: support new struct public_key_signature encoding field On systems with IMA-appraisal enabled with a policy requiring file signatures, the "good" signature values are stored on the filesystem as extended attributes (security.ima). Signature verification failure would normally be limited to just a particular file (eg. executable), but during boot signature verification failure could result in a system hang. Defining and requiring a new public_key_signature field requires all callers of asymmetric signature verification to be updated to reflect the change. This patch updates the integrity asymmetric_verify() caller. Fixes: 82f94f24475c ("KEYS: Provide software public key query function [ver #2]") Signed-off-by: Mimi Zohar Cc: David Howells Acked-by: Denis Kenzior Signed-off-by: James Morris commit 646558ff1643467d3b941b47f519867cbca462c3 Author: Gustavo A. R. Silva Date: Sat Aug 4 21:48:44 2018 -0500 kdb: kdb_support: mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Notice that in this particular case, I replaced the code comments with a proper "fall through" annotation, which is what GCC is expecting to find. Signed-off-by: Gustavo A. R. Silva Reviewed-by: Daniel Thompson Signed-off-by: Daniel Thompson commit 01cb37351bafc1b44b962842926210115e231f0a Author: Gustavo A. R. Silva Date: Sat Aug 4 23:18:25 2018 -0500 kdb: kdb_keyboard: mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Notice that in this particular case, I replaced the code comments with a proper "fall through" annotation, which is what GCC is expecting to find. Signed-off-by: Gustavo A. R. Silva Reviewed-by: Daniel Thompson Signed-off-by: Daniel Thompson commit 9eb62f0e1bc70ebc9b15837a0c4e8f12a7b910cb Author: Gustavo A. R. Silva Date: Thu Aug 16 09:01:41 2018 -0500 kdb: kdb_main: refactor code in kdb_md_line Replace the whole switch statement with a for loop. This makes the code clearer and easy to read. This also addresses the following Coverity warnings: Addresses-Coverity-ID: 115090 ("Missing break in switch") Addresses-Coverity-ID: 115091 ("Missing break in switch") Addresses-Coverity-ID: 114700 ("Missing break in switch") Suggested-by: Daniel Thompson Signed-off-by: Gustavo A. R. Silva Reviewed-by: Daniel Thompson [daniel.thompson@linaro.org: Tiny grammar change in description] Signed-off-by: Daniel Thompson commit c2b94c72d93d0929f48157eef128c4f9d2e603ce Author: Prarit Bhargava Date: Thu Sep 20 08:59:14 2018 -0400 kdb: Use strscpy with destination buffer size gcc 8.1.0 warns with: kernel/debug/kdb/kdb_support.c: In function ‘kallsyms_symbol_next’: kernel/debug/kdb/kdb_support.c:239:4: warning: ‘strncpy’ specified bound depends on the length of the source argument [-Wstringop-overflow=] strncpy(prefix_name, name, strlen(name)+1); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/debug/kdb/kdb_support.c:239:31: note: length computed here Use strscpy() with the destination buffer size, and use ellipses when displaying truncated symbols. v2: Use strscpy() Signed-off-by: Prarit Bhargava Cc: Jonathan Toppins Cc: Jason Wessel Cc: Daniel Thompson Cc: kgdb-bugreport@lists.sourceforge.net Reviewed-by: Daniel Thompson Signed-off-by: Daniel Thompson commit 568fb6f42ac6851320adaea25f8f1b94de14e40a Author: Christophe Leroy Date: Thu Sep 27 17:17:57 2018 +0000 kdb: print real address of pointers instead of hashed addresses Since commit ad67b74d2469 ("printk: hash addresses printed with %p"), all pointers printed with %p are printed with hashed addresses instead of real addresses in order to avoid leaking addresses in dmesg and syslog. But this applies to kdb too, with is unfortunate: Entering kdb (current=0x(ptrval), pid 329) due to Keyboard Entry kdb> ps 15 sleeping system daemon (state M) processes suppressed, use 'ps A' to see all. Task Addr Pid Parent [*] cpu State Thread Command 0x(ptrval) 329 328 1 0 R 0x(ptrval) *sh 0x(ptrval) 1 0 0 0 S 0x(ptrval) init 0x(ptrval) 3 2 0 0 D 0x(ptrval) rcu_gp 0x(ptrval) 4 2 0 0 D 0x(ptrval) rcu_par_gp 0x(ptrval) 5 2 0 0 D 0x(ptrval) kworker/0:0 0x(ptrval) 6 2 0 0 D 0x(ptrval) kworker/0:0H 0x(ptrval) 7 2 0 0 D 0x(ptrval) kworker/u2:0 0x(ptrval) 8 2 0 0 D 0x(ptrval) mm_percpu_wq 0x(ptrval) 10 2 0 0 D 0x(ptrval) rcu_preempt The whole purpose of kdb is to debug, and for debugging real addresses need to be known. In addition, data displayed by kdb doesn't go into dmesg. This patch replaces all %p by %px in kdb in order to display real addresses. Fixes: ad67b74d2469 ("printk: hash addresses printed with %p") Cc: Signed-off-by: Christophe Leroy Signed-off-by: Daniel Thompson commit dded2e159208a9edc21dd5c5f583afa28d378d39 Author: Christophe Leroy Date: Thu Sep 27 17:17:49 2018 +0000 kdb: use correct pointer when 'btc' calls 'btt' On a powerpc 8xx, 'btc' fails as follows: Entering kdb (current=0x(ptrval), pid 282) due to Keyboard Entry kdb> btc btc: cpu status: Currently on cpu 0 Available cpus: 0 kdb_getarea: Bad address 0x0 when booting the kernel with 'debug_boot_weak_hash', it fails as well Entering kdb (current=0xba99ad80, pid 284) due to Keyboard Entry kdb> btc btc: cpu status: Currently on cpu 0 Available cpus: 0 kdb_getarea: Bad address 0xba99ad80 On other platforms, Oopses have been observed too, see https://github.com/linuxppc/linux/issues/139 This is due to btc calling 'btt' with %p pointer as an argument. This patch replaces %p by %px to get the real pointer value as expected by 'btt' Fixes: ad67b74d2469 ("printk: hash addresses printed with %p") Cc: Signed-off-by: Christophe Leroy Reviewed-by: Daniel Thompson Signed-off-by: Daniel Thompson commit 1d5ceff25aa1edcaf84e7ee26fdcc746cb245af8 Author: Tudor.Ambarus@microchip.com Date: Fri Nov 9 16:56:54 2018 +0000 mtd: spi_nor: pass DMA-able buffer to spi_nor_read_raw() spi_nor_read_raw() calls nor->read() which might be implemented by the m25p80 driver. m25p80 uses the spi-mem layer which requires DMA-able in/out buffers. Pass kmalloc'ed dma buffer to spi_nor_read_raw(). Fixes: b038e8e3be72 ("mtd: spi-nor: parse SFDP Sector Map Parameter Table") Signed-off-by: Tudor Ambarus Signed-off-by: Boris Brezillon commit b9f07cc8207a2a69496beec3f5a5a8372bacdfdc Author: Tudor.Ambarus@microchip.com Date: Fri Nov 9 16:56:52 2018 +0000 mtd: spi-nor: don't overwrite errno in spi_nor_get_map_in_use() Don't overwrite the errno from spi_nor_read_raw(). Signed-off-by: Tudor Ambarus Signed-off-by: Boris Brezillon commit c797bd81d10e648ec8c84c041191527113e63e85 Author: Tudor.Ambarus@microchip.com Date: Fri Nov 9 16:56:50 2018 +0000 mtd: spi-nor: fix iteration over smpt array Iterate over smpt array using its starting address and length instead of the blind iterations that used data found in the array. This prevents possible memory accesses outside of the smpt array boundaries in case software, or manufacturers, misrepresent smpt array fields. Fixes: b038e8e3be72 ("mtd: spi-nor: parse SFDP Sector Map Parameter Table") Suggested-by: Boris Brezillon Signed-off-by: Tudor Ambarus Signed-off-by: Boris Brezillon commit cd5e6d79384eb2dd47de6cb9569150053d4a6803 Author: Tudor.Ambarus@microchip.com Date: Fri Nov 9 16:56:48 2018 +0000 mtd: spi-nor: don't drop sfdp data if optional parsers fail JESD216C states that just the Basic Flash Parameter Table is mandatory. Already defined (or future) additional parameter headers and tables are optional. Don't drop already collected sfdp data in case an optional table parser fails. In case of failing, each optional parser is responsible to roll back to the previously known spi_nor data. Fixes: b038e8e3be72 ("mtd: spi-nor: parse SFDP Sector Map Parameter Table") Reported-by: Yogesh Gaur Suggested-by: Boris Brezillon Signed-off-by: Tudor Ambarus Tested-by: Yogesh Gaur Signed-off-by: Boris Brezillon commit 63415a3c38ddd952608a0bc9afd856f5fcdb6edb Merge: a619b72a3670 7900f06c3fee Author: Olof Johansson Date: Tue Nov 13 11:24:24 2018 -0800 Merge tag 'arm-soc/for-4.20/maintainers-part2' of https://github.com/Broadcom/stblinux into fixes This pull request contains update to the MAINTAINERS file for Broadcom SoCs, please pull the following changes for 4.20: - Jon removes himself from the MAINTAINERS file since he is no longer with Broadcom * tag 'arm-soc/for-4.20/maintainers-part2' of https://github.com/Broadcom/stblinux: MAINTAINERS: Remove self from Broadcom SoCs Signed-off-by: Olof Johansson commit 4c10473d6ddf12ec124c9ff71a5d23bb5388478b Author: Pierre-Louis Bossart Date: Fri Nov 9 13:39:23 2018 -0600 ASoC: Intel: Power down links before turning off display audio power On certain platforms, Display HDMI HDA codec was not going to sleep state after the use when links are powered down after turning off the display power. As per the HW recommendation, links are powered down before turning off the display power to ensure that the codec goes to sleep state. This patch was updated from an earlier version submitted upstream [1] which conflicted with the changes merged for HDaudio codec support with the Intel DSP. [1] https://patchwork.kernel.org/patch/10540213/ Signed-off-by: Sriram Periyasamy Signed-off-by: Sanyog Kale Signed-off-by: Pierre-Louis Bossart Signed-off-by: Mark Brown commit 20e00db2f59bdddf8a8e241473ef8be94631d3ae Author: Richard Fitzgerald Date: Mon Nov 12 13:36:38 2018 +0000 ASoC: wm_adsp: Fix dma-unsafe read of scratch registers Stack memory isn't DMA-safe so it isn't safe to use either regmap_raw_read or regmap_bulk_read to read into stack memory. The two functions to read the scratch registers were using stack memory and regmap_raw_read. It's not worth allocating memory just for this trivial read, and it isn't time-critical. A simple regmap_read for each register is sufficient. Signed-off-by: Richard Fitzgerald Signed-off-by: Mark Brown commit 16a8ee4c80b45984b6de1f90a49edcf336b7c621 Author: Katsuhiro Suzuki Date: Sun Nov 11 00:18:44 2018 +0900 ASoC: rockchip: add missing slave_config setting for I2S This patch adds missing prepare_sleve_config that is needed for setup the DMA slave channel for I2S. Signed-off-by: Katsuhiro Suzuki Signed-off-by: Mark Brown commit 35fdc3902179366489a12cae4cb3ccc3b95f0afe Author: Stefan Wahren Date: Sun Nov 11 13:01:11 2018 +0100 hwmon: (raspberrypi) Fix initial notify In case an under-voltage happens before probing the driver wont write the critical warning into the kernel log. So don't init of last_throttled during probe and fix this issue. Fixes: 74d1e007915f ("hwmon: Add support for RPi voltage sensor") Reported-by: "Noralf Trønnes" Signed-off-by: Stefan Wahren Signed-off-by: Guenter Roeck commit 70df9ebbd82c794ddfbb49d45b337f18d5588dc2 Author: Nicolin Chen Date: Fri Nov 9 16:42:14 2018 -0800 hwmon (ina2xx) Fix NULL id pointer in probe() When using DT configurations, the id pointer might turn out to be NULL. Then the driver encounters NULL pointer access: Unable to handle kernel read from unreadable memory at vaddr 00000018 [...] PC is at ina2xx_probe+0x114/0x200 LR is at ina2xx_probe+0x10c/0x200 [...] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b The reason is that i2c core returns the id pointer by matching id_table with client->name, while the client->name is actually using the name from the first string in the DT compatible list, not the best one. So i2c core would fail to match the id_table if the best matched compatible string isn't the first one, and then would return a NULL id pointer. This probably should be fixed in i2c core. But it doesn't hurt to make the driver robust. So this patch fixes it by using the "chip" that's added to unify both DT and non-DT configurations. Additionally, since id pointer could be null, so as id->name: ina2xx 10-0047: power monitor (null) (Rshunt = 1000 uOhm) ina2xx 10-0048: power monitor (null) (Rshunt = 10000 uOhm) So this patch also fixes NULL name pointer, using client->name to play safe and to align with hwmon->name. Fixes: bd0ddd4d0883 ("hwmon: (ina2xx) Add OF device ID table") Signed-off-by: Nicolin Chen Signed-off-by: Guenter Roeck commit db8ddde766adf09605b5282e7978fa0ba76c3ee3 Merge: 11123ab9d90c ed4eac20dcff Author: David S. Miller Date: Tue Nov 13 08:51:17 2018 -0800 Merge branch 'qed-Miscellaneous-bug-fixes' Denis Bolotin says: ==================== qed: Miscellaneous bug fixes This patch series fixes several unrelated bugs across the driver. Please consider applying to net. V1->V2: ------- Use dma_rmb() instead of rmb(). ==================== Signed-off-by: David S. Miller commit ed4eac20dcffdad47709422e0cb925981b056668 Author: Denis Bolotin Date: Mon Nov 12 12:50:23 2018 +0200 qed: Fix reading wrong value in loop condition The value of "sb_index" is written by the hardware. Reading its value and writing it to "index" must finish before checking the loop condition. Signed-off-by: Denis Bolotin Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit 291d57f67d2449737d1e370ab5b9a583818eaa0c Author: Michal Kalderon Date: Mon Nov 12 12:50:22 2018 +0200 qed: Fix rdma_info structure allocation Certain flows need to access the rdma-info structure, for example dcbx update flows. In some cases there can be a race between the allocation or deallocation of the structure which was done in roce start / roce stop and an asynchrounous dcbx event that tries to access the structure. For this reason, we move the allocation of the rdma_info structure to be similar to the iscsi/fcoe info structures which are allocated during device setup. We add a new field of "active" to the struct to define whether roce has already been started or not, and this is checked instead of whether the pointer to the info structure. Fixes: 51ff17251c9c ("qed: Add support for RoCE hw init") Signed-off-by: Michal Kalderon Signed-off-by: Denis Bolotin Signed-off-by: David S. Miller commit e90202ed1cf9672c48a363c84a929932ebfe6fc0 Author: Denis Bolotin Date: Mon Nov 12 12:50:21 2018 +0200 qed: Fix overriding offload_tc by protocols without APP TLV The TC received from APP TLV is stored in offload_tc, and should not be set by protocols which did not receive an APP TLV. Fixed the condition when overriding the offload_tc. Signed-off-by: Denis Bolotin Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit 9aaa4e8ba12972d674caeefbc5f88d83235dd697 Author: Denis Bolotin Date: Mon Nov 12 12:50:20 2018 +0200 qed: Fix PTT leak in qed_drain() Release PTT before entering error flow. Signed-off-by: Denis Bolotin Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit 11123ab9d90c5f426beadfe01507616c3654b06d Merge: 77e461d14ed1 d788905f68fd Author: David S. Miller Date: Tue Nov 13 08:43:05 2018 -0800 Merge tag 'linux-can-fixes-for-4.20-20181109' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2018-11-09 this is a pull request of 20 patches for net/master. First we have a patch by Oliver Hartkopp which changes the raw socket's raw_sendmsg() to return an error value if the user tries to send a CANFD frame to a CAN-2.0 device. The next two patches are by Jimmy Assarsson and fix potential problems in the kvaser_usb driver. YueHaibing's patches for the ucan driver fix a compile time warning and remove a duplicate include. Eugeniu Rosca patch adds more binding documentation to the rcar_can driver bindings. The next two patches are by Fabrizio Castro for the rcar_can driver and fixes a problem in the driver's probe function and document the r8a774a1 binding. Lukas Wunner's patch fixes a recpetion problem in hi311x driver by switching from edge to level triggered interruts. The next three patches all target the flexcan driver. Pankaj Bansal's patch unconditionally unlocks the last mailbox used for RX. Alexander Stein provides a better workaround for a hardware limitation when sending RTR frames, by using the last mailbox for TX, resulting in fewer lost frames. The patch by me simplyfies the driver, by making a runtime value a compile time constant. The following 4 patches are by me and provide the groundwork for the next patches by Oleksij Rempel. To avoid code duplication common code in the common CAN driver infrastructure is factured out and error handling is cleaned up. The next 4 patches are by Oleksij Rempel and fix the problem in the flexcan driver that other processes see TX frames arrive out of order with ragards to a RX'ed frame (which are send by a different system on the CAN bus as the result of our TX frame). ==================== Signed-off-by: David S. Miller commit c138325fb8713472d5a0c3c7258b9131bab40725 Author: Ondrej Mosnacek Date: Tue Nov 13 16:16:08 2018 +0100 selinux: check length properly in SCTP bind hook selinux_sctp_bind_connect() must verify if the address buffer has sufficient length before accessing the 'sa_family' field. See __sctp_connect() for a similar check. The length of the whole address ('len') is already checked in the callees. Reported-by: Qian Cai Fixes: d452930fd3b9 ("selinux: Add SCTP support") Cc: # 4.17+ Cc: Richard Haines Signed-off-by: Ondrej Mosnacek Tested-by: Qian Cai Signed-off-by: Paul Moore commit c1a17777eb45d9f3821f35e9869c0a08cd2e664e Author: Christian König Date: Mon Nov 12 18:08:31 2018 +0100 drm/amdgpu: fix huge page handling on Vega10 We accidentially set the huge flag on the parent instead of the childs. This caused some VM faults under memory pressure. Signed-off-by: Christian König Acked-by: Alex Deucher Tested-by: Samuel Pitoiset Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 4d454e9ffdb1ef5a51ebc147b5389c96048db683 Author: Rex Zhu Date: Tue Nov 13 11:15:56 2018 +0800 drm/amd/pp: Fix truncated clock value when set watermark the clk value should be tranferred to MHz first and then transfer to uint16. otherwise, the clock value will be truncated. Reviewed-by: Alex Deucher Reported-by: Hersen Wu Signed-off-by: Rex Zhu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 005af85c50f79b48a1d3aaeb7dfe88b07c125d46 Merge: ccda4af0f4b9 b89e242eee8d Author: Martin Schwidefsky Date: Tue Nov 13 15:42:39 2018 +0100 Merge tag 'vfio-ccw-20181113' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/vfio-ccw into fixes Pull vfio-ccw from Cornelia Huck with the following changes: - Several bugfixes for vfio-ccw commit c837243ff4017f493c7d6f4ab57278d812a86859 Author: Philip Yang Date: Mon Nov 12 14:00:45 2018 -0500 drm/amdgpu: fix bug with IH ring setup The bug limits the IH ring wptr address to 40bit. When the system memory is bigger than 1TB, the bus address is more than 40bit, this causes the interrupt cannot be handled and cleared correctly. Reviewed-by: Christian König Signed-off-by: Philip Yang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 0d76bcc960e6057750fcf556b65da13f8bbdfd2b Author: Bjorn Helgaas Date: Tue Nov 13 08:38:17 2018 -0600 Revert "ACPI/PCI: Pay attention to device-specific _PXM node values" This reverts commit bad7dcd94f3956bcfc0a69ef71fdf0fcca3de4a8. bad7dcd94f39 ("ACPI/PCI: Pay attention to device-specific _PXM node values") caused boot failures (no console output at all) for Martin [1] and Ingo [2] on AMD ThreadRipper systems. Revert the commit until we figure out how to safely use these device-specific _PXM values. [1] https://lore.kernel.org/linux-pci/20180912152140.3676-2-Jonathan.Cameron@huawei.com [2] https://lore.kernel.org/linux-pci/20181113071712.GA2353@gmail.com Fixes: bad7dcd94f39 ("ACPI/PCI: Pay attention to device-specific _PXM node values") Signed-off-by: Bjorn Helgaas commit c1d91f86a1b4c9c05854d59c6a0abd5d0f75b849 Author: Christoph Muellner Date: Tue Nov 13 11:25:35 2018 +0100 arm64: dts: rockchip: Fix PCIe reset polarity for rk3399-puma-haikou. This patch fixes the wrong polarity setting for the PCIe host driver's pre-reset pin for rk3399-puma-haikou. Without this patch link training will most likely fail. Fixes: 60fd9f72ce8a ("arm64: dts: rockchip: add Haikou baseboard with RK3399-Q7 SoM") Cc: stable@vger.kernel.org Signed-off-by: Christoph Muellner Signed-off-by: Heiko Stuebner commit aab15e8ec25765cf7968c72cbec7583acf99d8a4 Author: Filipe Manana Date: Mon Nov 12 10:23:58 2018 +0000 Btrfs: fix rare chances for data loss when doing a fast fsync After the simplification of the fast fsync patch done recently by commit b5e6c3e170b7 ("btrfs: always wait on ordered extents at fsync time") and commit e7175a692765 ("btrfs: remove the wait ordered logic in the log_one_extent path"), we got a very short time window where we can get extents logged without writeback completing first or extents logged without logging the respective data checksums. Both issues can only happen when doing a non-full (fast) fsync. As soon as we enter btrfs_sync_file() we trigger writeback, then lock the inode and then wait for the writeback to complete before starting to log the inode. However before we acquire the inode's lock and after we started writeback, it's possible that more writes happened and dirtied more pages. If that happened and those pages get writeback triggered while we are logging the inode (for example, the VM subsystem triggering it due to memory pressure, or another concurrent fsync), we end up seeing the respective extent maps in the inode's list of modified extents and will log matching file extent items without waiting for the respective ordered extents to complete, meaning that either of the following will happen: 1) We log an extent after its writeback finishes but before its checksums are added to the csum tree, leading to -EIO errors when attempting to read the extent after a log replay. 2) We log an extent before its writeback finishes. Therefore after the log replay we will have a file extent item pointing to an unwritten extent (and without the respective data checksums as well). This could not happen before the fast fsync patch simplification, because for any extent we found in the list of modified extents, we would wait for its respective ordered extent to finish writeback or collect its checksums for logging if it did not complete yet. Fix this by triggering writeback again after acquiring the inode's lock and before waiting for ordered extents to complete. Fixes: e7175a692765 ("btrfs: remove the wait ordered logic in the log_one_extent path") Fixes: b5e6c3e170b7 ("btrfs: always wait on ordered extents at fsync time") CC: stable@vger.kernel.org # 4.19+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit b89e242eee8d4cd8261d8d821c62c5d1efc454d0 Author: Eric Farman Date: Fri Nov 9 03:39:29 2018 +0100 s390/cio: Fix cleanup when unsupported IDA format is used Direct returns from within a loop are rude, but it doesn't mean it gets to avoid releasing the memory acquired beforehand. Signed-off-by: Eric Farman Message-Id: <20181109023937.96105-3-farman@linux.ibm.com> Reviewed-by: Farhan Ali Reviewed-by: Pierre Morel Acked-by: Halil Pasic Signed-off-by: Cornelia Huck commit 806212f91c874b24cf9eb4a9f180323671b6c5ed Author: Eric Farman Date: Fri Nov 9 03:39:28 2018 +0100 s390/cio: Fix cleanup of pfn_array alloc failure If pfn_array_alloc fails somehow, we need to release the pfn_array_table that was malloc'd earlier. Signed-off-by: Eric Farman Message-Id: <20181109023937.96105-2-farman@linux.ibm.com> Acked-by: Halil Pasic Signed-off-by: Cornelia Huck commit 55e93ecdc1ef9256279e0a0b08edf72cc47fc2f6 Author: Pierre Morel Date: Thu Oct 25 19:15:20 2018 +0200 vfio: ccw: Register mediated device once all structures are initialized Let's register the mediated device when all the data structures which could be used are initialized. Signed-off-by: Pierre Morel Reviewed-by: Eric Farman Message-Id: <1540487720-11634-3-git-send-email-pmorel@linux.ibm.com> Acked-by: Halil Pasic Signed-off-by: Cornelia Huck commit 52df7837560e51a47903b49243291fb8039653d2 Author: Sebastian Ott Date: Mon Oct 15 13:31:39 2018 +0200 s390/cio: make vfio_ccw_io_region static Fix the following sparse warning: drivers/s390/cio/vfio_ccw_drv.c:25:19: warning: symbol 'vfio_ccw_io_region' was not declared. Should it be static? Signed-off-by: Sebastian Ott Message-Id: Signed-off-by: Cornelia Huck commit adf59dd2408c4536d490bee649784f0465562444 Author: Jorge Ramirez-Ortiz Date: Mon Nov 12 19:41:09 2018 +0100 drm/meson: venc: dmt mode must use encp The video mode for DMT is only populated to support encp. Signed-off-by: Jorge Ramirez-Ortiz Acked-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/1542048069-22603-1-git-send-email-jramirez@baylibre.com commit 29e3880109e357fdc607b4393f8308cef6af9413 Author: Florian Westphal Date: Mon Nov 12 22:43:45 2018 +0100 netfilter: nf_tables: fix use-after-free when deleting compat expressions nft_compat ops do not have static storage duration, unlike all other expressions. When nf_tables_expr_destroy() returns, expr->ops might have been free'd already, so we need to store next address before calling expression destructor. For same reason, we can't deref match pointer after nft_xt_put(). This can be easily reproduced by adding msleep() before nft_match_destroy() returns. Fixes: 0ca743a55991 ("netfilter: nf_tables: add compatibility layer for x_tables") Reported-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 0fbcc5b568edab7d848b7c7fa66d44ffbd4133c0 Author: Taehee Yoo Date: Fri Oct 19 00:27:57 2018 +0900 netfilter: xt_RATEEST: remove netns exit routine xt_rateest_net_exit() was added to check whether rules are flushed successfully. but ->net_exit() callback is called earlier than ->destroy() callback. So that ->net_exit() callback can't check that. test commands: %ip netns add vm1 %ip netns exec vm1 iptables -t mangle -I PREROUTING -p udp \ --dport 1111 -j RATEEST --rateest-name ap \ --rateest-interval 250ms --rateest-ewma 0.5s %ip netns del vm1 splat looks like: [ 668.813518] WARNING: CPU: 0 PID: 87 at net/netfilter/xt_RATEEST.c:210 xt_rateest_net_exit+0x210/0x340 [xt_RATEEST] [ 668.813518] Modules linked in: xt_RATEEST xt_tcpudp iptable_mangle bpfilter ip_tables x_tables [ 668.813518] CPU: 0 PID: 87 Comm: kworker/u4:2 Not tainted 4.19.0-rc7+ #21 [ 668.813518] Workqueue: netns cleanup_net [ 668.813518] RIP: 0010:xt_rateest_net_exit+0x210/0x340 [xt_RATEEST] [ 668.813518] Code: 00 48 8b 85 30 ff ff ff 4c 8b 23 80 38 00 0f 85 24 01 00 00 48 8b 85 30 ff ff ff 4d 85 e4 4c 89 a5 58 ff ff ff c6 00 f8 74 b2 <0f> 0b 48 83 c3 08 4c 39 f3 75 b0 48 b8 00 00 00 00 00 fc ff df 49 [ 668.813518] RSP: 0018:ffff8801156c73f8 EFLAGS: 00010282 [ 668.813518] RAX: ffffed0022ad8e85 RBX: ffff880118928e98 RCX: 5db8012a00000000 [ 668.813518] RDX: ffff8801156c7428 RSI: 00000000cb1d185f RDI: ffff880115663b74 [ 668.813518] RBP: ffff8801156c74d0 R08: ffff8801156633c0 R09: 1ffff100236440be [ 668.813518] R10: 0000000000000001 R11: ffffed002367d852 R12: ffff880115142b08 [ 668.813518] R13: 1ffff10022ad8e81 R14: ffff880118928ea8 R15: dffffc0000000000 [ 668.813518] FS: 0000000000000000(0000) GS:ffff88011b200000(0000) knlGS:0000000000000000 [ 668.813518] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 668.813518] CR2: 0000563aa69f4f28 CR3: 0000000105a16000 CR4: 00000000001006f0 [ 668.813518] Call Trace: [ 668.813518] ? unregister_netdevice_many+0xe0/0xe0 [ 668.813518] ? xt_rateest_net_init+0x2c0/0x2c0 [xt_RATEEST] [ 668.813518] ? default_device_exit+0x1ca/0x270 [ 668.813518] ? remove_proc_entry+0x1cd/0x390 [ 668.813518] ? dev_change_net_namespace+0xd00/0xd00 [ 668.813518] ? __init_waitqueue_head+0x130/0x130 [ 668.813518] ops_exit_list.isra.10+0x94/0x140 [ 668.813518] cleanup_net+0x45b/0x900 [ 668.813518] ? net_drop_ns+0x110/0x110 [ 668.813518] ? swapgs_restore_regs_and_return_to_usermode+0x3c/0x80 [ 668.813518] ? save_trace+0x300/0x300 [ 668.813518] ? lock_acquire+0x196/0x470 [ 668.813518] ? lock_acquire+0x196/0x470 [ 668.813518] ? process_one_work+0xb60/0x1de0 [ 668.813518] ? _raw_spin_unlock_irq+0x29/0x40 [ 668.813518] ? _raw_spin_unlock_irq+0x29/0x40 [ 668.813518] ? __lock_acquire+0x4500/0x4500 [ 668.813518] ? __lock_is_held+0xb4/0x140 [ 668.813518] process_one_work+0xc13/0x1de0 [ 668.813518] ? pwq_dec_nr_in_flight+0x3c0/0x3c0 [ 668.813518] ? set_load_weight+0x270/0x270 [ ... ] Fixes: 3427b2ab63fa ("netfilter: make xt_rateest hash table per net") Signed-off-by: Taehee Yoo Signed-off-by: Pablo Neira Ayuso commit 622fecbccfe86a8052dea6b512d3821dcce29994 Author: Keerthy Date: Wed Nov 7 10:04:23 2018 +0530 opp: ti-opp-supply: Correct the supply in _get_optimal_vdd_voltage call _get_optimal_vdd_voltage call provides new_supply_vbb->u_volt as the reference voltage while it should be really new_supply_vdd->u_volt. Cc: 4.16+ # v4.16+ Fixes: 9a835fa6e47 ("PM / OPP: Add ti-opp-supply driver") Signed-off-by: Keerthy Acked-by: Dave Gerlach Signed-off-by: Viresh Kumar commit ba038546ff9e15d54d1134b5c5d2355648c00dec Author: Keerthy Date: Wed Nov 7 10:04:22 2018 +0530 opp: ti-opp-supply: Dynamically update u_volt_min The voltage range (min, max) provided in the device tree is from the data manual and is pretty big, catering to a wide range of devices. On a i2c read/write failure the regulator_set_voltage_triplet function falls back to set voltage between min and max. The min value from Device Tree can be lesser than the optimal value and in that case that can lead to a hang or crash. Hence set the u_volt_min dynamically to the optimal voltage value. Cc: 4.16+ # v4.16+ Fixes: 9a835fa6e47 ("PM / OPP: Add ti-opp-supply driver") Signed-off-by: Keerthy Acked-by: Dave Gerlach Signed-off-by: Viresh Kumar commit ef3a61406618291c46da168ff91acaa28d85944c Author: Olof Johansson Date: Tue Oct 30 23:47:09 2018 -0700 RISC-V: Silence some module warnings on 32-bit Fixes: arch/riscv/kernel/module.c: In function 'apply_r_riscv_32_rela': ./include/linux/kern_levels.h:5:18: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 3 has type 'Elf32_Addr' {aka 'unsigned int'} [-Wformat=] arch/riscv/kernel/module.c:23:27: note: format string is defined here arch/riscv/kernel/module.c: In function 'apply_r_riscv_pcrel_hi20_rela': ./include/linux/kern_levels.h:5:18: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 3 has type 'Elf32_Addr' {aka 'unsigned int'} [-Wformat=] arch/riscv/kernel/module.c:104:23: note: format string is defined here arch/riscv/kernel/module.c: In function 'apply_r_riscv_hi20_rela': ./include/linux/kern_levels.h:5:18: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 3 has type 'Elf32_Addr' {aka 'unsigned int'} [-Wformat=] arch/riscv/kernel/module.c:146:23: note: format string is defined here arch/riscv/kernel/module.c: In function 'apply_r_riscv_got_hi20_rela': ./include/linux/kern_levels.h:5:18: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 3 has type 'Elf32_Addr' {aka 'unsigned int'} [-Wformat=] arch/riscv/kernel/module.c:190:60: note: format string is defined here arch/riscv/kernel/module.c: In function 'apply_r_riscv_call_plt_rela': ./include/linux/kern_levels.h:5:18: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 3 has type 'Elf32_Addr' {aka 'unsigned int'} [-Wformat=] arch/riscv/kernel/module.c:214:24: note: format string is defined here arch/riscv/kernel/module.c: In function 'apply_r_riscv_call_rela': ./include/linux/kern_levels.h:5:18: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 3 has type 'Elf32_Addr' {aka 'unsigned int'} [-Wformat=] arch/riscv/kernel/module.c:236:23: note: format string is defined here Signed-off-by: Olof Johansson Signed-off-by: Palmer Dabbelt commit 85d90b91807bb0c4a0fcff6a144e73f11cda782a Author: Olof Johansson Date: Tue Oct 30 23:47:07 2018 -0700 RISC-V: lib: Fix build error for 64-bit Fixes the following build error from tinyconfig: riscv64-unknown-linux-gnu-ld: kernel/sched/fair.o: in function `.L8': fair.c:(.text+0x70): undefined reference to `__lshrti3' riscv64-unknown-linux-gnu-ld: kernel/time/clocksource.o: in function `.L0 ': clocksource.c:(.text+0x334): undefined reference to `__lshrti3' Fixes: 7f47c73b355f ("RISC-V: Build tishift only on 64-bit") Signed-off-by: Olof Johansson Signed-off-by: Palmer Dabbelt commit f157d411a9eb170d2ee6b766da7a381962017cc9 Author: David Abdurachmanov Date: Mon Nov 5 15:35:37 2018 +0100 riscv: add missing vdso_install target Building kernel 4.20 for Fedora as RPM fails, because riscv is missing vdso_install target in arch/riscv/Makefile. Signed-off-by: David Abdurachmanov Signed-off-by: Palmer Dabbelt commit 10febb3ecace4b557eaa0d52c9d2c3531c1a715a Author: David Abdurachmanov Date: Mon Nov 5 15:40:04 2018 +0100 riscv: fix spacing in struct pt_regs Replace 8 spaces with tab to match styling. Signed-off-by: David Abdurachmanov Signed-off-by: Palmer Dabbelt commit 4ab49461d9d9b8274cc72d8656fe685ed394b8f7 Author: Anup Patel Date: Thu Nov 1 10:40:33 2018 +0530 RISC-V: defconfig: Enable printk timestamps The printk timestamps are very useful information to visually see where kernel is spending time during boot. It also helps us see the timing of hotplug events at runtime. This patch enables printk timestamps in RISC-V defconfig so that we have it enabled by default (similar to other architectures such as x86_64, arm64, etc). Signed-off-by: Anup Patel Acked-by: Olof Johansson Signed-off-by: Palmer Dabbelt commit f8397d69daef06d358430d3054662fb597e37c00 Author: Nikolay Borisov Date: Tue Nov 6 16:40:20 2018 +0200 btrfs: Always try all copies when reading extent buffers When a metadata read is served the endio routine btree_readpage_end_io_hook is called which eventually runs the tree-checker. If tree-checker fails to validate the read eb then it sets EXTENT_BUFFER_CORRUPT flag. This leads to btree_read_extent_buffer_pages wrongly assuming that all available copies of this extent buffer are wrong and failing prematurely. Fix this modify btree_read_extent_buffer_pages to read all copies of the data. This failure was exhibitted in xfstests btrfs/124 which would spuriously fail its balance operations. The reason was that when balance was run following re-introduction of the missing raid1 disk __btrfs_map_block would map the read request to stripe 0, which corresponded to devid 2 (the disk which is being removed in the test): item 2 key (FIRST_CHUNK_TREE CHUNK_ITEM 3553624064) itemoff 15975 itemsize 112 length 1073741824 owner 2 stripe_len 65536 type DATA|RAID1 io_align 65536 io_width 65536 sector_size 4096 num_stripes 2 sub_stripes 1 stripe 0 devid 2 offset 2156920832 dev_uuid 8466c350-ed0c-4c3b-b17d-6379b445d5c8 stripe 1 devid 1 offset 3553624064 dev_uuid 1265d8db-5596-477e-af03-df08eb38d2ca This caused read requests for a checksum item that to be routed to the stale disk which triggered the aforementioned logic involving EXTENT_BUFFER_CORRUPT flag. This then triggered cascading failures of the balance operation. Fixes: a826d6dcb32d ("Btrfs: check items for correctness as we search") CC: stable@vger.kernel.org # 4.4+ Suggested-by: Qu Wenruo Reviewed-by: Qu Wenruo Signed-off-by: Nikolay Borisov Signed-off-by: David Sterba commit e3d5e573a54dabdc0f9f3cb039d799323372b251 Author: Trond Myklebust Date: Mon Nov 12 16:06:51 2018 -0500 SUNRPC: Fix a bogus get/put in generic_key_to_expire() Signed-off-by: Trond Myklebust commit a652a4bc21695a57c3b8d13d222a6f8b41f100aa Author: Trond Myklebust Date: Mon Nov 12 15:30:52 2018 -0500 SUNRPC: Fix a Oops when destroying the RPCSEC_GSS credential cache Commit 07d02a67b7fa causes a use-after free in the RPCSEC_GSS credential destroy code, because the call to get_rpccred() in gss_destroying_context() will now always fail to increment the refcount. While we could just replace the get_rpccred() with a refcount_set(), that would have the unfortunate consequence of resurrecting a credential in the credential cache for which we are in the process of destroying the RPCSEC_GSS context. Rather than do this, we choose to make a copy that is never added to the cache and use that to destroy the context. Fixes: 07d02a67b7fa ("SUNRPC: Simplify lookup code") Signed-off-by: Trond Myklebust commit a1aa09be21fa344d1f5585aab8164bfae55f57e3 Author: Trond Myklebust Date: Mon Nov 5 12:17:01 2018 -0500 NFSv4: Ensure that the state manager exits the loop on SIGKILL Signed-off-by: Trond Myklebust commit 21a446cf186570168b7281b154b1993968598aca Author: Trond Myklebust Date: Mon Nov 5 11:10:50 2018 -0500 NFSv4: Don't exit the state manager without clearing NFS4CLNT_MANAGER_RUNNING If we exit the NFSv4 state manager due to a umount, then we can end up leaving the NFS4CLNT_MANAGER_RUNNING flag set. If another mount causes the nfs4_client to be rereferenced before it is destroyed, then we end up never being able to recover state. Fixes: 47c2199b6eb5 ("NFSv4.1: Ensure state manager thread dies on last ...") Signed-off-by: Trond Myklebust Cc: stable@vger.kernel.org # v4.15+ commit 5581c670fb7ec267fc79215c6d5176b07e5f6dad Author: shaoyunl Date: Mon Nov 12 11:19:24 2018 -0500 drm/amdgpu: set system aperture to cover whole FB region In XGMI configuration, the FB region covers vram region from peer device, adjust system aperture to cover all of them Reviewed-by: Alex Deucher Reviewed-by: Christian König Signed-off-by: shaoyunl Signed-off-by: Alex Deucher commit e94b9f12fa2ceb4d5067aa2a7580b02850fb272e Author: Colin Ian King Date: Mon Nov 12 11:41:04 2018 -0800 Input: atkbd - clean up indentation issue Trivial fix to clean up indentation issues, add missing tab Signed-off-by: Colin Ian King Signed-off-by: Dmitry Torokhov commit 4aeba6418a160d8e58501cd57800252ba349ad1a Author: Kuninori Morimoto Date: Mon Nov 12 11:30:06 2018 -0800 Input: st1232 - convert to SPDX identifiers This patch updates license to use SPDX-License-Identifier instead of verbose license text. As original license mentioned, it is GPL-2.0 in SPDX. Then, MODULE_LICENSE() should be "GPL v2" instead of "GPL". See ${LINUX}/include/linux/module.h "GPL" [GNU Public License v2 or later] "GPL v2" [GNU Public License v2] Signed-off-by: Kuninori Morimoto Signed-off-by: Dmitry Torokhov commit dda2af7418db9dd51913cb71d9ec9266d4f7924d Author: Kuninori Morimoto Date: Mon Nov 12 11:29:27 2018 -0800 Input: migor_ts - convert to SPDX identifiers This patch updates license to use SPDX-License-Identifier instead of verbose license text. Signed-off-by: Kuninori Morimoto Signed-off-by: Dmitry Torokhov commit 6c4b88288abf908d6fe9fc71fdfeb69cb4135193 Author: Ding Tao Date: Mon Nov 12 11:27:11 2018 -0800 Input: dt-bindings - fix a typo in file input-reset.txt Replace sysrq-reset-seq with keyset. Signed-off-by: Ding Tao Signed-off-by: Dmitry Torokhov commit ac5722c1643a2fb75224c79b578214956d34f989 Author: Brian Norris Date: Mon Nov 12 11:23:39 2018 -0800 Input: cros_ec_keyb - fix button/switch capability reports The cros_ec_keyb_bs array lists buttons and switches together, expecting that its users will match the appropriate type and bit fields. But cros_ec_keyb_register_bs() only checks the 'bit' field, which causes misreported input capabilities in some cases. For example, tablets (e.g., Scarlet -- a.k.a. Acer Chromebook Tab 10) were reporting a SW_LID capability, because EC_MKBP_POWER_BUTTON and EC_MKBP_LID_OPEN happen to share the same bit. (This has comedic effect on a tablet, in which a power-management daemon then thinks this "lid" is closed, and so puts the system to sleep as soon as it boots!) To fix this, check both the 'ev_type' and 'bit' fields before reporting the capability. Tested with a lid (Kevin / Samsung Chromebook Plus) and without a lid (Scarlet / Acer Chromebook Tab 10). This error got introduced when porting the feature from the downstream Chromium OS kernel to be upstreamed. Fixes: cdd7950e7aa4 ("input: cros_ec_keyb: Add non-matrix buttons and switches") Cc: Signed-off-by: Brian Norris Reviewed-by: Heiko Stuebner Signed-off-by: Dmitry Torokhov commit 3ed64da3b790be7c63601e8ca6341b7dff74a660 Author: Patrick Gaskin Date: Mon Nov 12 11:12:24 2018 -0800 Input: elan_i2c - add ELAN0620 to the ACPI table Add ELAN0620 to the ACPI table to support the elan touchpad in the Lenovo IdeaPad 130-15IKB. Signed-off-by: Patrick Gaskin Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit d55bda1b3e7c5a87f10da54fdda866a9a9cef30b Author: Christian Hoff Date: Mon Nov 12 11:11:29 2018 -0800 Input: matrix_keypad - check for errors from of_get_named_gpio() "of_get_named_gpio()" returns a negative error value if it fails and drivers should check for this. This missing check was now added to the matrix_keypad driver. In my case "of_get_named_gpio()" returned -EPROBE_DEFER because the referenced GPIOs belong to an I/O expander, which was not yet probed at the point in time when the matrix_keypad driver was loading. Because the driver did not check for errors from the "of_get_named_gpio()" routine, it was assuming that "-EPROBE_DEFER" is actually a GPIO number and continued as usual, which led to further errors like this later on: WARNING: CPU: 3 PID: 167 at drivers/gpio/gpiolib.c:114 gpio_to_desc+0xc8/0xd0 invalid GPIO -517 Note that the "GPIO number" -517 in the error message above is actually "-EPROBE_DEFER". As part of the patch a misleading error message "no platform data defined" was also removed. This does not lead to information loss because the other error paths in matrix_keypad_parse_dt() already print an error. Signed-off-by: Christian Hoff Suggested-by: Sebastian Reichel Reviewed-by: Sebastian Reichel Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 410b5c7b48368317af95f0113692561d01d8144e Author: Diego Viola Date: Mon Nov 12 17:22:52 2018 -0200 libata: blacklist SAMSUNG MZ7TD256HAFV-000L9 SSD med_power_with_dipm still causes freezes after updating the firmware to the latest version (DXT04L5Q). Set model_rev to NULL and blacklist the device. Cc: stable@vger.kernel.org Signed-off-by: Diego Viola Reviewed-by: Hans de Goede Signed-off-by: Jens Axboe commit 25517ed4e99b3be4244dfd61d1e5c753b09faf2c Author: Huacai Chen Date: Sat Nov 10 11:50:14 2018 +0800 MIPS: Let early memblock_alloc*() allocate memories bottom-up After switched to NO_BOOTMEM, there are several boot failures. Some of them have been fixed and some of them haven't. I find that many of them are because of memory allocations are top-down, while the old behavior is bottom-up. This patch let early memblock_alloc*() allocate memories bottom-up to avoid some potential problems. Signed-off-by: Huacai Chen Signed-off-by: Paul Burton Fixes: bcec54bf3118 ("mips: switch to NO_BOOTMEM") Patchwork: https://patchwork.linux-mips.org/patch/21069/ References: https://patchwork.linux-mips.org/patch/21031/ Cc: Ralf Baechle Cc: James Hogan Cc: Steven J . Hill Cc: linux-mips@linux-mips.org Cc: Fuxin Zhang Cc: Zhangjin Wu commit 82fba2df7f7c019627f24c5036dc99f41731d770 Author: Aaro Koskinen Date: Sun Nov 11 00:06:12 2018 +0200 MIPS: OCTEON: cavium_octeon_defconfig: re-enable OCTEON USB driver Re-enable OCTEON USB driver which is needed on older hardware (e.g. EdgeRouter Lite) for mass storage etc. This got accidentally deleted when config options were changed for OCTEON2/3 USB. Signed-off-by: Aaro Koskinen Signed-off-by: Paul Burton Fixes: f922bc0ad08b ("MIPS: Octeon: cavium_octeon_defconfig: Enable more drivers") Patchwork: https://patchwork.linux-mips.org/patch/21077/ Cc: Ralf Baechle Cc: James Hogan Cc: linux-mips@linux-mips.org Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org # 4.14+ commit 121e38e5acdc8e1e4cdb750fcdcc72f94e420968 Author: Eugeniy Paltsev Date: Wed Nov 7 15:12:49 2018 +0300 ARC: mm: fix uninitialised signal code in do_page_fault Commit 15773ae938d8 ("signal/arc: Use force_sig_fault where appropriate") introduced undefined behaviour by leaving si_code unitiailized and leaking random kernel values to user space. Fixes: 15773ae938d8 ("signal/arc: Use force_sig_fault where appropriate") Signed-off-by: Eugeniy Paltsev Signed-off-by: Vineet Gupta commit 4592f11e47a2b28562d6cfe165d5ea7495ff4dca Author: Eugeniy Paltsev Date: Tue Oct 23 15:09:19 2018 +0300 ARC: [plat-hsdk] Enable DW APB GPIO support Enable GPIO support on HSDK. HSDK SoC includes Synopsys DesignWare DW_apb_gpio IP with 24 GPIOs mapped onto port A. Signed-off-by: Eugeniy Paltsev Acked-by: Alexey Brodkin Signed-off-by: Vineet Gupta commit afba5d157fe1f2e64bc3df46fe83841657ec8fdd Author: Vineet Gupta Date: Mon Oct 29 09:44:18 2018 -0700 ARCv2: boot log unaligned access in use ARC gcc 8.x generates unaligned accesses by default, so call that out Signed-off-by: Vineet Gupta commit 3624379d90ad2b65f9dbb30d7f7ce5498d2fe322 Author: Eugeniy Paltsev Date: Thu Oct 4 16:12:12 2018 +0300 ARC: IOC: panic if kernel was started with previously enabled IOC If IOC was already enabled (due to bootloader) it technically needs to be reconfigured with aperture base,size corresponding to Linux memory map which will certainly be different than uboot's. But disabling and reenabling IOC when DMA might be potentially active is tricky business. To avoid random memory issues later, just panic here and ask user to upgrade bootloader to one which doesn't enable IOC This was actually seen as issue on some of the HSDK board with a version of uboot which enabled IOC. There were random issues later with starting of X or peripherals etc. Also while I'm at it, replace hardcoded bits in ARC_REG_IO_COH_PARTIAL and ARC_REG_IO_COH_ENABLE registers by definitions. Inspired by: https://lkml.org/lkml/2018/1/19/557 Signed-off-by: Eugeniy Paltsev Signed-off-by: Vineet Gupta commit 2c519f583e84eb578d4db48e38160f58aafad2ac Author: Bartlomiej Zolnierkiewicz Date: Wed Oct 10 16:46:17 2018 +0200 ARC: remove redundant 'default n' from Kconfig 'default n' is the default value for any bool or tristate Kconfig setting so there is no need to write it explicitly. Also since commit f467c5640c29 ("kconfig: only write '# CONFIG_FOO is not set' for visible symbols") the Kconfig behavior is the same regardless of 'default n' being present or not: ... One side effect of (and the main motivation for) this change is making the following two definitions behave exactly the same: config FOO bool config FOO bool default n With this change, neither of these will generate a '# CONFIG_FOO is not set' line (assuming FOO isn't selected/implied). That might make it clearer to people that a bare 'default n' is redundant. ... Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Vineet Gupta commit a619b72a36707c9d43a949e5fe63e1c6db238d43 Merge: 2e904398119d 8588eac3ff66 Author: Olof Johansson Date: Mon Nov 12 10:23:47 2018 -0800 Merge tag 'am654-fixes-for-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/kristo/linux into fixes Texas Instruments AM65x fixes for v4.20 - Fix the wkup uart instance addresses to use proper cell sizes, otherwise the uart fails to probe. * tag 'am654-fixes-for-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/kristo/linux: arm64: dts: ti: k3-am654: Fix wakeup_uart reg address Signed-off-by: Olof Johansson commit 2e904398119d64a58ac26cb9a3f2c178a132368f Merge: a89f84a56ec9 9134586715e3 Author: Olof Johansson Date: Mon Nov 12 10:14:45 2018 -0800 Merge tag 'qcom-fixes-for-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/agross/linux into fixes Qualcomm ARM64 DT Fixes for 4.20-rc1 * Fix reserved gpio ranges for SDM845 and MSM8998 * tag 'qcom-fixes-for-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/agross/linux: arm64: dts: qcom: msm8998: Reserve gpio ranges on MTP arm64: dts: sdm845-mtp: Reserve reserved gpios Signed-off-by: Olof Johansson commit ca474b73896bf6e0c1eb8787eb217b0f80221610 Author: Hannes Reinecke Date: Mon Nov 12 10:35:25 2018 -0700 block: copy ioprio in __bio_clone_fast() and bounce We need to copy the io priority, too; otherwise the clone will run with a different priority than the original one. Fixes: 43b62ce3ff0a ("block: move bio io prio to a new field") Signed-off-by: Hannes Reinecke Signed-off-by: Jean Delvare Fixed up subject, and ordered stores. Signed-off-by: Jens Axboe commit 77e461d14ed141253573eeeb4d34eccc51e38328 Author: Sudarsana Reddy Kalluru Date: Sun Nov 11 18:27:34 2018 -0800 bnx2x: Assign unique DMAE channel number for FW DMAE transactions. Driver assigns DMAE channel 0 for FW as part of START_RAMROD command. FW uses this channel for DMAE operations (e.g., TIME_SYNC implementation). Driver also uses the same channel 0 for DMAE operations for some of the PFs (e.g., PF0 on Port0). This could lead to concurrent access to the DMAE channel by FW and driver which is not legal. Hence need to assign unique DMAE id for FW. Currently following DMAE channels are used by the clients, MFW - OCBB/OCSD functionality uses DMAE channel 14/15 Driver 0-3 and 8-11 (for PF dmae operations) 4 and 12 (for stats requests) Assigning unique dmae_id '13' to the FW. Changes from previous version: ------------------------------ v2: Incorporated the review comments. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit fb50c09e923870a358d68b0d58891bd145b8d7c7 Author: Jiri Olsa Date: Mon Nov 12 14:00:12 2018 +0100 perf tools: Fix crash on synthesizing the unit Adam reported a record command crash for simple session like: $ perf record -e cpu-clock ls with following backtrace: Program received signal SIGSEGV, Segmentation fault. 3543 ev = event_update_event__new(size + 1, PERF_EVENT_UPDATE__UNIT, evsel->id[0]); (gdb) bt #0 perf_event__synthesize_event_update_unit #1 0x000000000051e469 in perf_event__synthesize_extra_attr #2 0x00000000004445cb in record__synthesize #3 0x0000000000444bc5 in __cmd_record ... We synthesize an update event that needs to touch the evsel id array, which is not defined at that time. Fix this by forcing the id allocation for events with their unit defined. Reflecting possible read_format ID bit in the attr tests. Reported-by: Yongxin Liu Signed-off-by: Jiri Olsa Cc: Adam Lee Cc: Alexander Shishkin Cc: Namhyung Kim Cc: Peter Zijlstra Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=201477 Fixes: bfd8f72c2778 ("perf record: Synthesize unit/scale/... in event update") Link: http://lkml.kernel.org/r/20181112130012.5424-1-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 18e962ac0781bcb70d433de3b2a325ff792b4288 Author: Omar Sandoval Date: Mon Nov 12 00:08:46 2018 -0800 kyber: fix wrong strlcpy() size in trace_kyber_latency() When copying to the latency type, we should be passing LATENCY_TYPE_LEN, not DOMAIN_LEN (this isn't a problem in practice because we only pass "total" or "I/O"). Fix it by changing all of the strlcpy() calls to use sizeof(). Fixes: 6c3b7af1c975 ("kyber: add tracepoints") Reported-by: Jordan Glover Tested-by: Jordan Glover Signed-off-by: Omar Sandoval Signed-off-by: Jens Axboe commit 447750f281abef547be44fdcfe3bc4447b3115a8 Author: Florian Westphal Date: Sun Nov 4 12:07:14 2018 +0100 netfilter: nf_tables: don't use position attribute on rule replacement Its possible to set both HANDLE and POSITION when replacing a rule. In this case, the rule at POSITION gets replaced using the userspace-provided handle. Rule handles are supposed to be generated by the kernel only. Duplicate handles should be harmless, however better disable this "feature" by only checking for the POSITION attribute on insert operations. Fixes: 5e94846686d0 ("netfilter: nf_tables: add insert operation") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 25d8bcedbf4329895dbaf9dd67baa6f18dad918c Author: Florian Westphal Date: Wed Oct 31 18:26:21 2018 +0100 selftests: add script to stress-test nft packet path vs. control plane Start flood ping for each cpu while loading/flushing rulesets to make sure we do not access already-free'd rules from nf_tables evaluation loop. Also add this to TARGETS so 'make run_tests' in selftest dir runs it automatically. This would have caught the bug fixed in previous change ("netfilter: nf_tables: do not skip inactive chains during generation update") sooner. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 0fb39bbe43d4481fcf300d2b5822de60942fd189 Author: Florian Westphal Date: Wed Oct 31 18:26:20 2018 +0100 netfilter: nf_tables: don't skip inactive chains during update There is no synchronization between packet path and the configuration plane. The packet path uses two arrays with rules, one contains the current (active) generation. The other either contains the last (obsolete) generation or the future one. Consider: cpu1 cpu2 nft_do_chain(c); delete c net->gen++; genbit = !!net->gen; rules = c->rg[genbit]; cpu1 ignores c when updating if c is not active anymore in the new generation. On cpu2, we now use rules from wrong generation, as c->rg[old] contains the rules matching 'c' whereas c->rg[new] was not updated and can even point to rules that have been free'd already, causing a crash. To fix this, make sure that 'current' to the 'next' generation are identical for chains that are going away so that c->rg[new] will just use the matching rules even if genbit was incremented already. Fixes: 0cbc06b3faba7 ("netfilter: nf_tables: remove synchronize_rcu in commit phase") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 44a7276b30c3c15f2b7790a5729640597fb6a1df Author: Ville Syrjälä Date: Mon Nov 12 15:36:16 2018 +0200 drm/i915: Fix hpd handling for pins with two encoders In my haste to remove irq_port[] I accidentally changed the way we deal with hpd pins that are shared by multiple encoders (DP and HDMI for pre-DDI platforms). Previously we would only handle such pins via ->hpd_pulse(), but now we queue up the hotplug work for the HDMI encoder directly. Worse yet, we now count each hpd twice and this increment the hpd storm count twice as fast. This can lead to spurious storms being detected. Go back to the old way of doing things, ie. delegate to ->hpd_pulse() for any pin which has an encoder with that hook implemented. I don't really like the idea of adding irq_port[] back so let's loop through the encoders first to check if we have an encoder with ->hpd_pulse() for the pin, and then go through all the pins and decided on the correct course of action based on the earlier findings. I have occasionally toyed with the idea of unifying the pre-DDI HDMI and DP encoders into a single encoder as well. Besides the hotplug processing it would have the other benefit of preventing userspace from trying to enable both encoders at the same time. That is simply illegal as they share the same clock/data pins. We have some testcases that will attempt that and thus fail on many older machines. But for now let's stick to fixing just the hotplug code. Cc: stable@vger.kernel.org # 4.19+ Cc: Lyude Paul Cc: Rodrigo Vivi Fixes: b6ca3eee18ba ("drm/i915: Nuke dev_priv->irq_port[]") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20181108200424.28371-1-ville.syrjala@linux.intel.com Reviewed-by: Lyude Paul (cherry picked from commit 5a3aeca97af1b6b3498d59a7fd4e8bb95814c108) Signed-off-by: Joonas Lahtinen commit 0a823e8fd4fd67726697854578f3584ee3a49b1d Author: Chris Wilson Date: Thu Nov 8 08:17:38 2018 +0000 drm/i915/execlists: Force write serialisation into context image vs execution Ensure that the writes into the context image are completed prior to the register mmio to trigger execution. Although previously we were assured by the SDM that all writes are flushed before an uncached memory transaction (our mmio write to submit the context to HW for execution), we have empirical evidence to believe that this is not actually the case. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108656 References: https://bugs.freedesktop.org/show_bug.cgi?id=108315 References: https://bugs.freedesktop.org/show_bug.cgi?id=106887 Signed-off-by: Chris Wilson Cc: Mika Kuoppala Cc: Tvrtko Ursulin Acked-by: Mika Kuoppala Link: https://patchwork.freedesktop.org/patch/msgid/20181108081740.25615-1-chris@chris-wilson.co.uk Cc: stable@vger.kernel.org (cherry picked from commit 987abd5c62f92ee4970b45aa077f47949974e615) Signed-off-by: Joonas Lahtinen commit c4f224076d00ccf30c7bd3561cceaed82628c8ce Author: Imre Deak Date: Fri Nov 2 20:22:00 2018 +0200 drm/i915/icl: Fix power well 2 wrt. DC-off toggling order To enable DC5/6 power well 2 has to be disabled as for previous platforms, so fix things up. Bspec: 4234 Fixes: 67ca07e7ac10 ("drm/i915/icl: Add power well support") Cc: Animesh Manna Cc: Paulo Zanoni Cc: Ville Syrjälä Signed-off-by: Imre Deak Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20181102182200.17219-1-imre.deak@intel.com (cherry picked from commit a33e1ece777996ddddb1f23a30f8c66422ed0b68) Signed-off-by: Joonas Lahtinen commit 541ff7e96c13cd5d67f6021d233f8e1c3df49278 Author: Lyude Paul Date: Tue Nov 6 16:30:13 2018 -0500 drm/i915: Fix NULL deref when re-enabling HPD IRQs on systems with MST Turns out that if you trigger an HPD storm on a system that has an MST topology connected to it, you'll end up causing the kernel to eventually hit a NULL deref: [ 332.339041] BUG: unable to handle kernel NULL pointer dereference at 00000000000000ec [ 332.340906] PGD 0 P4D 0 [ 332.342750] Oops: 0000 [#1] SMP PTI [ 332.344579] CPU: 2 PID: 25 Comm: kworker/2:0 Kdump: loaded Tainted: G O 4.18.0-rc3short-hpd-storm+ #2 [ 332.346453] Hardware name: LENOVO 20BWS1KY00/20BWS1KY00, BIOS JBET71WW (1.35 ) 09/14/2018 [ 332.348361] Workqueue: events intel_hpd_irq_storm_reenable_work [i915] [ 332.350301] RIP: 0010:intel_hpd_irq_storm_reenable_work.cold.3+0x2f/0x86 [i915] [ 332.352213] Code: 00 00 ba e8 00 00 00 48 c7 c6 c0 aa 5f a0 48 c7 c7 d0 73 62 a0 4c 89 c1 4c 89 04 24 e8 7f f5 af e0 4c 8b 04 24 44 89 f8 29 e8 <41> 39 80 ec 00 00 00 0f 85 43 13 fc ff 41 0f b6 86 b8 04 00 00 41 [ 332.354286] RSP: 0018:ffffc90000147e48 EFLAGS: 00010006 [ 332.356344] RAX: 0000000000000005 RBX: ffff8802c226c9d4 RCX: 0000000000000006 [ 332.358404] RDX: 0000000000000000 RSI: 0000000000000082 RDI: ffff88032dc95570 [ 332.360466] RBP: 0000000000000005 R08: 0000000000000000 R09: ffff88031b3dc840 [ 332.362528] R10: 0000000000000000 R11: 000000031a069602 R12: ffff8802c226ca20 [ 332.364575] R13: ffff8802c2268000 R14: ffff880310661000 R15: 000000000000000a [ 332.366615] FS: 0000000000000000(0000) GS:ffff88032dc80000(0000) knlGS:0000000000000000 [ 332.368658] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 332.370690] CR2: 00000000000000ec CR3: 000000000200a003 CR4: 00000000003606e0 [ 332.372724] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 332.374773] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 332.376798] Call Trace: [ 332.378809] process_one_work+0x1a1/0x350 [ 332.380806] worker_thread+0x30/0x380 [ 332.382777] ? wq_update_unbound_numa+0x10/0x10 [ 332.384772] kthread+0x112/0x130 [ 332.386740] ? kthread_create_worker_on_cpu+0x70/0x70 [ 332.388706] ret_from_fork+0x35/0x40 [ 332.390651] Modules linked in: i915(O) vfat fat joydev btusb btrtl btbcm btintel bluetooth ecdh_generic iTCO_wdt wmi_bmof i2c_algo_bit drm_kms_helper intel_rapl syscopyarea sysfillrect x86_pkg_temp_thermal sysimgblt coretemp fb_sys_fops crc32_pclmul drm psmouse pcspkr mei_me mei i2c_i801 lpc_ich mfd_core i2c_core tpm_tis tpm_tis_core thinkpad_acpi wmi tpm rfkill video crc32c_intel serio_raw ehci_pci xhci_pci ehci_hcd xhci_hcd [last unloaded: i915] [ 332.394963] CR2: 00000000000000ec This appears to be due to the fact that with an MST topology, not all intel_connector structs will have ->encoder set. So, fix this by skipping connectors without encoders in intel_hpd_irq_storm_reenable_work(). For those wondering, this bug was found on accident while simulating HPD storms using a Chamelium connected to a ThinkPad T450s (Broadwell). Changes since v1: - Check intel_connector->mst_port instead of intel_connector->encoder Signed-off-by: Lyude Paul Reviewed-by: Ville Syrjälä Cc: stable@vger.kernel.org Cc: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/20181106213017.14563-3-lyude@redhat.com (cherry picked from commit fee61deecb1d850bf34f682a6a452e5ee51b7572) Signed-off-by: Joonas Lahtinen commit 7c4512300cfa5a4dcc8c1c52ae61e3fa4bd11a39 Author: Lyude Paul Date: Tue Nov 6 16:30:12 2018 -0500 drm/i915: Fix possible race in intel_dp_add_mst_connector() This hasn't caused any issues yet that I'm aware of, but as Ville Syrjälä pointed out - we need to make sure that intel_connector->mst_port is set before initializing MST connectors, since in theory we could potentially check intel_connector->mst_port in i915_hpd_poll_init_work() after registering the connector but before having written it's value. Signed-off-by: Lyude Paul Reviewed-by: Ville Syrjälä Cc: Rodrigo Vivi Cc: stable@vger.kernel.org Link: https://patchwork.freedesktop.org/patch/msgid/20181106213017.14563-2-lyude@redhat.com (cherry picked from commit 66a5ab1034be801630816d1fa6cfc30db1a2f0b0) Signed-off-by: Joonas Lahtinen commit fb5bbae9b1333d44023713946fdd28db0cd85751 Author: Chris Wilson Date: Mon Nov 5 09:43:05 2018 +0000 drm/i915/ringbuffer: Delay after EMIT_INVALIDATE for gen4/gen5 Exercising the gpu reloc path strenuously revealed an issue where the updated relocations (from MI_STORE_DWORD_IMM) were not being observed upon execution. After some experiments with adding pipecontrols (a lot of pipecontrols (32) as gen4/5 do not have a bit to wait on earlier pipe controls or even the current on), it was discovered that we merely needed to delay the EMIT_INVALIDATE by several flushes. It is important to note that it is the EMIT_INVALIDATE as opposed to the EMIT_FLUSH that needs the delay as opposed to what one might first expect -- that the delay is required for the TLB invalidation to take effect (one presumes to purge any CS buffers) as opposed to a delay after flushing to ensure the writes have landed before triggering invalidation. Testcase: igt/gem_tiled_fence_blits Signed-off-by: Chris Wilson Cc: stable@vger.kernel.org Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20181105094305.5767-1-chris@chris-wilson.co.uk (cherry picked from commit 55f99bf2a9c331838c981694bc872cd1ec4070b2) Signed-off-by: Joonas Lahtinen commit 3c5cdb17c3be76714dfd0d03e384f70579545614 Author: Taehee Yoo Date: Mon Nov 5 03:44:39 2018 +0900 netfilter: nf_conncount: fix unexpected permanent node of list. When list->count is 0, the list is deleted by GC. But list->count is never reached 0 because initial count value is 1 and it is increased when node is inserted. So that initial value of list->count should be 0. Originally GC always finds zero count list through deleting node and decreasing count. However, list may be left empty since node insertion may fail eg. allocaton problem. In order to solve this problem, GC routine also finds zero count list without deleting node. Fixes: cb2b36f5a97d ("netfilter: nf_conncount: Switch to plain list") Signed-off-by: Taehee Yoo Signed-off-by: Pablo Neira Ayuso commit 31568ec09ea02a050249921698c9729419539cce Author: Taehee Yoo Date: Mon Nov 5 03:44:11 2018 +0900 netfilter: nf_conncount: fix list_del corruption in conn_free nf_conncount_tuple is an element of nft_connlimit and that is deleted by conn_free(). Elements can be deleted by both GC routine and data path functions (nf_conncount_lookup, nf_conncount_add) and they call conn_free() to free elements. But conn_free() only protects lists, not each element. So that list_del corruption could occurred. The conn_free() doesn't check whether element is already deleted. In order to protect elements, dead flag is added. If an element is deleted, dead flag is set. The only conn_free() can delete elements so that both list lock and dead flag are enough to protect it. test commands: %nft add table ip filter %nft add chain ip filter input { type filter hook input priority 0\; } %nft add rule filter input meter test { ip id ct count over 2 } counter splat looks like: [ 1779.495778] list_del corruption, ffff8800b6e12008->prev is LIST_POISON2 (dead000000000200) [ 1779.505453] ------------[ cut here ]------------ [ 1779.506260] kernel BUG at lib/list_debug.c:50! [ 1779.515831] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI [ 1779.516772] CPU: 0 PID: 33 Comm: kworker/0:2 Not tainted 4.19.0-rc6+ #22 [ 1779.516772] Workqueue: events_power_efficient nft_rhash_gc [nf_tables_set] [ 1779.516772] RIP: 0010:__list_del_entry_valid+0xd8/0x150 [ 1779.516772] Code: 39 48 83 c4 08 b8 01 00 00 00 5b 5d c3 48 89 ea 48 c7 c7 00 c3 5b 98 e8 0f dc 40 ff 0f 0b 48 c7 c7 60 c3 5b 98 e8 01 dc 40 ff <0f> 0b 48 c7 c7 c0 c3 5b 98 e8 f3 db 40 ff 0f 0b 48 c7 c7 20 c4 5b [ 1779.516772] RSP: 0018:ffff880119127420 EFLAGS: 00010286 [ 1779.516772] RAX: 000000000000004e RBX: dead000000000200 RCX: 0000000000000000 [ 1779.516772] RDX: 000000000000004e RSI: 0000000000000008 RDI: ffffed0023224e7a [ 1779.516772] RBP: ffff88011934bc10 R08: ffffed002367cea9 R09: ffffed002367cea9 [ 1779.516772] R10: 0000000000000001 R11: ffffed002367cea8 R12: ffff8800b6e12008 [ 1779.516772] R13: ffff8800b6e12010 R14: ffff88011934bc20 R15: ffff8800b6e12008 [ 1779.516772] FS: 0000000000000000(0000) GS:ffff88011b200000(0000) knlGS:0000000000000000 [ 1779.516772] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1779.516772] CR2: 00007fc876534010 CR3: 000000010da16000 CR4: 00000000001006f0 [ 1779.516772] Call Trace: [ 1779.516772] conn_free+0x9f/0x2b0 [nf_conncount] [ 1779.516772] ? nf_ct_tmpl_alloc+0x2a0/0x2a0 [nf_conntrack] [ 1779.516772] ? nf_conncount_add+0x520/0x520 [nf_conncount] [ 1779.516772] ? do_raw_spin_trylock+0x1a0/0x1a0 [ 1779.516772] ? do_raw_spin_trylock+0x10/0x1a0 [ 1779.516772] find_or_evict+0xe5/0x150 [nf_conncount] [ 1779.516772] nf_conncount_gc_list+0x162/0x360 [nf_conncount] [ 1779.516772] ? nf_conncount_lookup+0xee0/0xee0 [nf_conncount] [ 1779.516772] ? _raw_spin_unlock_irqrestore+0x45/0x50 [ 1779.516772] ? trace_hardirqs_off+0x6b/0x220 [ 1779.516772] ? trace_hardirqs_on_caller+0x220/0x220 [ 1779.516772] nft_rhash_gc+0x16b/0x540 [nf_tables_set] [ ... ] Fixes: 5c789e131cbb ("netfilter: nf_conncount: Add list lock and gc worker, and RCU for init tree search") Signed-off-by: Taehee Yoo Signed-off-by: Pablo Neira Ayuso commit fd3e71a9f71e232181a225301a75936373636ccc Author: Taehee Yoo Date: Mon Nov 5 03:43:19 2018 +0900 netfilter: nf_conncount: use spin_lock_bh instead of spin_lock conn_free() holds lock with spin_lock() and it is called by both nf_conncount_lookup() and nf_conncount_gc_list(). nf_conncount_lookup() is called from bottom-half context and nf_conncount_gc_list() from process context. So that spin_lock() call is not safe. Hence conn_free() should use spin_lock_bh() instead of spin_lock(). test commands: %nft add table ip filter %nft add chain ip filter input { type filter hook input priority 0\; } %nft add rule filter input meter test { ip saddr ct count over 2 } \ counter splat looks like: [ 461.996507] ================================ [ 461.998999] WARNING: inconsistent lock state [ 461.998999] 4.19.0-rc6+ #22 Not tainted [ 461.998999] -------------------------------- [ 461.998999] inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. [ 461.998999] kworker/0:2/134 [HC0[0]:SC0[0]:HE1:SE1] takes: [ 461.998999] 00000000a71a559a (&(&list->list_lock)->rlock){+.?.}, at: conn_free+0x69/0x2b0 [nf_conncount] [ 461.998999] {IN-SOFTIRQ-W} state was registered at: [ 461.998999] _raw_spin_lock+0x30/0x70 [ 461.998999] nf_conncount_add+0x28a/0x520 [nf_conncount] [ 461.998999] nft_connlimit_eval+0x401/0x580 [nft_connlimit] [ 461.998999] nft_dynset_eval+0x32b/0x590 [nf_tables] [ 461.998999] nft_do_chain+0x497/0x1430 [nf_tables] [ 461.998999] nft_do_chain_ipv4+0x255/0x330 [nf_tables] [ 461.998999] nf_hook_slow+0xb1/0x160 [ ... ] [ 461.998999] other info that might help us debug this: [ 461.998999] Possible unsafe locking scenario: [ 461.998999] [ 461.998999] CPU0 [ 461.998999] ---- [ 461.998999] lock(&(&list->list_lock)->rlock); [ 461.998999] [ 461.998999] lock(&(&list->list_lock)->rlock); [ 461.998999] [ 461.998999] *** DEADLOCK *** [ 461.998999] [ ... ] Fixes: 5c789e131cbb ("netfilter: nf_conncount: Add list lock and gc worker, and RCU for init tree search") Signed-off-by: Taehee Yoo Signed-off-by: Pablo Neira Ayuso commit ab99be4683d9db33b100497d463274ebd23bd67e Author: Filippo Sironi Date: Mon Nov 12 12:26:30 2018 +0000 amd/iommu: Fix Guest Virtual APIC Log Tail Address Register This register should have been programmed with the physical address of the memory location containing the shadow tail pointer for the guest virtual APIC log instead of the base address. Fixes: 8bda0cfbdc1a ('iommu/amd: Detect and initialize guest vAPIC log') Signed-off-by: Filippo Sironi Signed-off-by: Wei Wang Signed-off-by: Suravee Suthikulpanit Signed-off-by: Joerg Roedel commit d99501b8575dc1248bacf1b58d2241cb4b265d49 Author: Takashi Iwai Date: Mon Nov 12 12:26:57 2018 +0100 ALSA: hda/ca0132 - Call pci_iounmap() instead of iounmap() We need to call pci_iounmap() instead of iounmap() for the regions obtained via pci_iomap() call for some archs that need special treatment. Fixes: aa31704fd81c ("ALSA: hda/ca0132: Add PCI region2 iomap for SBZ") Cc: Signed-off-by: Takashi Iwai commit 383fb3ee8024d596f488d2dbaf45e572897acbdb Author: Russell King Date: Thu Jul 19 12:21:31 2018 +0100 ARM: spectre-v2: per-CPU vtables to work around big.Little systems In big.Little systems, some CPUs require the Spectre workarounds in paths such as the context switch, but other CPUs do not. In order to handle these differences, we need per-CPU vtables. We are unable to use the kernel's per-CPU variables to support this as per-CPU is not initialised at times when we need access to the vtables, so we have to use an array indexed by logical CPU number. We use an array-of-pointers to avoid having function pointers in the kernel's read/write .data section. Reviewed-by: Julien Thierry Signed-off-by: Russell King commit 5df7a99bdd0de4a0480320264c44c04543c29d5a Author: Julien Thierry Date: Thu Nov 8 17:25:28 2018 +0100 ARM: 8810/1: vfp: Fix wrong assignement to ufp_exc In vfp_preserve_user_clear_hwstate, ufp_exc->fpinst2 gets assigned to itself. It should actually be hwstate->fpinst2 that gets assigned to the ufp_exc field. Fixes commit 3aa2df6ec2ca6bc143a65351cca4266d03a8bc41 ("ARM: 8791/1: vfp: use __copy_to_user() when saving VFP state"). Reported-by: David Binderman Signed-off-by: Julien Thierry Signed-off-by: Russell King commit e209950fdd065d2cc46e6338e47e52841b830cba Author: Russell King Date: Thu Jul 19 12:17:38 2018 +0100 ARM: add PROC_VTABLE and PROC_TABLE macros Allow the way we access members of the processor vtable to be changed at compile time. We will need to move to per-CPU vtables to fix the Spectre variant 2 issues on big.Little systems. However, we have a couple of calls that do not need the vtable treatment, and indeed cause a kernel warning due to the (later) use of smp_processor_id(), so also introduce the PROC_TABLE macro for these which always use CPU 0's function pointers. Reviewed-by: Julien Thierry Signed-off-by: Russell King commit 945aceb1db8885d3a35790cf2e810f681db52756 Author: Russell King Date: Thu Jul 19 12:43:03 2018 +0100 ARM: clean up per-processor check_bugs method call Call the per-processor type check_bugs() method in the same way as we do other per-processor functions - move the "processor." detail into proc-fns.h. Reviewed-by: Julien Thierry Signed-off-by: Russell King commit 65987a8553061515b5851b472081aedb9837a391 Author: Russell King Date: Thu Jul 19 11:59:56 2018 +0100 ARM: split out processor lookup Split out the lookup of the processor type and associated error handling from the rest of setup_processor() - we will need to use this in the secondary CPU bringup path for big.Little Spectre variant 2 mitigation. Reviewed-by: Julien Thierry Signed-off-by: Russell King commit 899a42f836678a595f7d2bc36a5a0c2b03d08cbc Author: Russell King Date: Thu Jul 19 11:42:36 2018 +0100 ARM: make lookup_processor_type() non-__init Move lookup_processor_type() out of the __init section so it is callable from (eg) the secondary startup code during hotplug. Reviewed-by: Julien Thierry Signed-off-by: Russell King commit 7243ec72b9024b1ae98ed571db559a7cf0c5a0f4 Author: Douglas Anderson Date: Fri Oct 12 14:36:32 2018 -0700 dt-bindings: phy-qcom-qmp: Fix several mistakes from prior commits Digging through the "phy-qcom-qmp" showed me many inconsistencies between the bindings and the reality of the driver. Let's fix them all. * In commit 2d66eab18375 ("dt-bindings: phy: qmp: Add support for QMP phy in IPQ8074") we probably should have explicitly listed that there are no clocks for this PHY and also added the reset names in alphabetical order. You can see that there are no clocks in the driver where "clk_list" is NULL. * In commit 8587b220f05e ("dt-bindings: phy-qcom-qmp: Update bindings for QMP V3 USB PHY") we probably should have listed the resets for this new PHY and also removed the "(Optional)" marking for the "cfg" reset since PHYs that need "cfg" really do need it. It's just that not all PHYs need it. * In commit 7f0802074120 ("dt-bindings: phy-qcom-qmp: Update bindings for sdm845") we forgot to update one instance of the string "qcom,qmp-v3-usb3-phy" to be "qcom,sdm845-qmp-usb3-phy". Let's fix that. We should also have added "qcom,sdm845-qmp-usb3-uni-phy" to the clock-names and reset-names lists. * In commit 99c7c7364b71 ("dt-bindings: phy-qcom-qmp: Add UFS phy compatible string for sdm845") we should have added the set of clocks and resets for "qcom,sdm845-qmp-ufs-phy". These were taken from the driver. * Cleanup the wording for what properties child nodes have to make it more obvious which types of PHYs need clocks and resets. This was sorta implicit in the "-names" description but I found myself confused. * As per the code not all "pcie qmp phys" have resets. Specifically note that the "has_lane_rst" property in the driver is false for "ipq8074-qmp-pcie-phy". Thus make it clear exactly which PHYs need child nodes with resets. Signed-off-by: Douglas Anderson Reviewed-by: Evan Green Reviewed-by: Rob Herring Signed-off-by: Kishon Vijay Abraham I commit f5fde094a7425ac062f22a94e8a711efa5074946 Author: Kunihiko Hayashi Date: Mon Oct 15 10:31:30 2018 +0900 phy: uniphier-pcie: Depend on HAS_IOMEM The driver uses devm_ioremap_resource() which is only available when CONFIG_HAS_IOMEM is set, so the driver depends on this option. Signed-off-by: Kunihiko Hayashi Signed-off-by: Kishon Vijay Abraham I commit cbed7545db7ae5907d7dc9d4002717d46cae29e9 Author: Tony Lindgren Date: Tue Nov 6 07:28:02 2018 -0800 drm/omap: dsi: Fix missing of_platform_depopulate() We're missing a call to of_platform_depopulate() on errors for dsi. Looks like dss is already doing this. Signed-off-by: Tony Lindgren Reviewed-by: Laurent Pinchart Reviewed-by: Sebastian Reichel Signed-off-by: Tomi Valkeinen Link: https://patchwork.freedesktop.org/patch/msgid/20181106152802.38599-1-tony@atomide.com commit 24ec84e854c68ceda59a26027114eb7f260f9411 Author: Laurent Pinchart Date: Sat Nov 10 13:16:54 2018 +0200 drm/omap: Move DISPC runtime PM handling to omapdrm The internal encoders (DSI, HDMI4, HDMI5 and VENC) runtime PM handlers attempt to manage the runtime PM state of the connected DISPC, based on the rationale that the DISPC providing data to the encoders requires ensuring that the display is active whenever the encoders are active. While the DISPC provides data to the encoders, it doesn't as such constitute a resource that encoders require in order to be taken out of suspend, contrary to for instance a functional clock or a power supply. Encoders registers can be accessed without the DISPC being active, and while the encoders will not output any video stream without being fed by the DISPC, the DISPC PM state doesn't influence the encoders PM state. For this reason the DISPC PM state is better managed from the omapdrm driver, in the CRTC enable and disable operations. This allows the encoders PM state to be handled separately from the DISPC, and in particular at times when the DISPC may not be available (for instance at probe due to the DSS probe being deferred, or at remove time du to the DISPC being already removed). Fixes: edb715dffdee ("drm/omap: dss: dsi: Move initialization code from bind to probe") Signed-off-by: Laurent Pinchart Reviewed-by: Sebastian Reichel Signed-off-by: Tomi Valkeinen Link: https://patchwork.freedesktop.org/patch/msgid/20181110111654.4387-5-laurent.pinchart@ideasonboard.com commit 350c03e880038bf60184500bab9025d3361c0b0e Author: Laurent Pinchart Date: Sat Nov 10 13:16:53 2018 +0200 drm/omap: dsi: Ensure the device is active during probe The probe function performs hardware access to read the number of supported data lanes from a configuration register and thus requires the device to be active. Ensure this by surrounding the access with dsi_runtime_get() and dsi_runtime_put() calls. Fixes: edb715dffdee ("drm/omap: dss: dsi: Move initialization code from bind to probe") Signed-off-by: Laurent Pinchart Acked-by: Tony Lindgren Reviewed-by: Sebastian Reichel Signed-off-by: Tomi Valkeinen Link: https://patchwork.freedesktop.org/patch/msgid/20181110111654.4387-4-laurent.pinchart@ideasonboard.com commit f8523b64d2d2f94bb429c15166d7601d39243c4d Author: Laurent Pinchart Date: Sat Nov 10 13:16:52 2018 +0200 drm/omap: hdmi4: Ensure the device is active during bind The bind function performs hardware access (in hdmi4_cec_init()) and thus requires the device to be active. Ensure this by surrounding the bind function by hdmi_runtime_get() and hdmi_runtime_put() calls. Fixes: 27d624527d99 ("drm/omap: dss: Acquire next dssdev at probe time") Signed-off-by: Laurent Pinchart Reviewed-by: Sebastian Reichel Signed-off-by: Tomi Valkeinen Link: https://patchwork.freedesktop.org/patch/msgid/20181110111654.4387-3-laurent.pinchart@ideasonboard.com commit e0c827aca0730b51f38081aa4e8ecf0912aab55f Author: Laurent Pinchart Date: Sat Nov 10 13:16:51 2018 +0200 drm/omap: Populate DSS children in omapdss driver The DSS DT node contains children that describe the DSS components (DISPC and internal encoders). Each of those components is handled by a platform driver, and thus needs to be backed by a platform device. The corresponding platform devices are created in mach-omap2 code by a call to of_platform_populate(). While this approach has worked so far, it doesn't model the hardware architecture very well, as it creates child devices before the parent is ready to handle them. This would be akin to creating I2C slaves before the I2C master is available. The task can be easily performed in the omapdss driver code instead, simplifying mach-omap2 code. We however can't remove the mach-omap2 code completely as the omap2fb driver still depends on it, but we can move it to the omap2fb-specific section, where it can stay until the omap2fb driver gets removed. This has the added benefit of not allowing DSS components to probe before the DSS itself, which led to runtime PM issues when the DSS probe is deferred. Fixes: 27d624527d99 ("drm/omap: dss: Acquire next dssdev at probe time") Signed-off-by: Laurent Pinchart Acked-by: Tony Lindgren Reviewed-by: Sebastian Reichel Signed-off-by: Tomi Valkeinen Link: https://patchwork.freedesktop.org/patch/msgid/20181110111654.4387-2-laurent.pinchart@ideasonboard.com commit d7d8bbb40a5b1f682ee6589e212934f4c6b8ad60 Author: Sven Eckelmann Date: Wed Nov 7 23:09:12 2018 +0100 batman-adv: Expand merged fragment buffer for full packet The complete size ("total_size") of the fragmented packet is stored in the fragment header and in the size of the fragment chain. When the fragments are ready for merge, the skbuff's tail of the first fragment is expanded to have enough room after the data pointer for at least total_size. This means that it gets expanded by total_size - first_skb->len. But this is ignoring the fact that after expanding the buffer, the fragment header is pulled by from this buffer. Assuming that the tailroom of the buffer was already 0, the buffer after the data pointer of the skbuff is now only total_size - len(fragment_header) large. When the merge function is then processing the remaining fragments, the code to copy the data over to the merged skbuff will cause an skb_over_panic when it tries to actually put enough data to fill the total_size bytes of the packet. The size of the skb_pull must therefore also be taken into account when the buffer's tailroom is expanded. Fixes: 610bfc6bc99b ("batman-adv: Receive fragmented packets and merge") Reported-by: Martin Weinelt Co-authored-by: Linus Lüssing Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich commit f4156f9656feac21f4de712fac94fae964c5d402 Author: Sven Eckelmann Date: Tue Oct 30 12:17:10 2018 +0100 batman-adv: Use explicit tvlv padding for ELP packets The announcement messages of batman-adv COMPAT_VERSION 15 have the possibility to announce additional information via a dynamic TVLV part. This part is optional for the ELP packets and currently not parsed by the Linux implementation. Still out-of-tree versions are using it to transport things like neighbor hashes to optimize the rebroadcast behavior. Since the ELP broadcast packets are smaller than the minimal ethernet packet, it often has to be padded. This is often done (as specified in RFC894) with octets of zero and thus work perfectly fine with the TVLV part (making it a zero length and thus empty). But not all ethernet compatible hardware seems to follow this advice. To avoid ambiguous situations when parsing the TVLV header, just force the 4 bytes (TVLV length + padding) after the required ELP header to zero. Fixes: d6f94d91f766 ("batman-adv: ELP - adding basic infrastructure") Reported-by: Linus Lüssing Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich commit 0fd791841a6d67af1155a9c3de54dea51220721e Author: Benson Leung Date: Thu Nov 8 15:59:21 2018 -0800 HID: input: Ignore battery reported by Symbol DS4308 The Motorola/Zebra Symbol DS4308-HD is a handheld USB barcode scanner which does not have a battery, but reports one anyway that always has capacity 2. Let's apply the IGNORE quirk to prevent it from being treated like a power supply so that userspaces don't get confused that this accessory is almost out of power and warn the user that they need to charge their wired barcode scanner. Reported here: https://bugs.chromium.org/p/chromium/issues/detail?id=804720 Signed-off-by: Benson Leung Reviewed-by: Benjamin Tissoires Signed-off-by: Benjamin Tissoires commit f3be657d96b0709c832b165501170f072882df3c Author: Hang Yuan Date: Tue Oct 30 13:12:23 2018 +0800 drm/i915/gvt: ensure gpu is powered before do i915_gem_gtt_insert i915_gem_gtt_insert may evict some vmas and access HW if ggtt vm space is not enough. So add mmio_hw_access_pre before invoke i915_gem_gtt_insert to avoid call trace like below in vgpu create/ destroy test. WARNING: CPU: 6 PID: 8720 at drivers/gpu/drm/i915/intel_drv.h:1768 assert_rpm_wakelock_held.part.2+0x27/0x30 [i915] RPM wakelock ref not held during HW access Call Trace: [] dump_stack+0x19/0x1b [] __warn+0xd8/0x100 [] warn_slowpath_fmt+0x5f/0x80 [] assert_rpm_wakelock_held.part.2+0x27/0x30 [i915] [] intel_runtime_pm_get_noresume+0x6f/0x80 [i915] [] i915_gem_request_alloc+0x2dd/0x3c0 [i915] [] i915_gem_switch_to_kernel_context+0xae/0x1d0 [i915] [] ggtt_flush+0x12/0x30 [i915] [] i915_gem_evict_something+0x25f/0x470 [i915] [] i915_gem_gtt_insert+0x15c/0x1c0 [i915] [] alloc_gm+0xa7/0x160 [i915] [] intel_vgpu_alloc_resource+0x1ad/0x410 [i915] [] intel_gvt_create_vgpu+0x16c/0x260 [i915] [] intel_vgpu_create+0x50/0x140 [kvmgt] [] mdev_device_create+0x1aa/0x2e0 [mdev] v2: use mmio_hw_access_pre/post Signed-off-by: Hang Yuan Signed-off-by: Zhenyu Wang commit def40774f63ad446aaf5c12e2185045979c06c75 Author: Xinyun Liu Date: Mon Oct 29 14:18:25 2018 +0800 drm/i915/gvt: not to touch undefined MOCS registers Some engines are not available for all Gens. eg, Gen11 introduced VCS3/VCS4/VECS2, and VCS2 is not supported on some Gen9 machines. So need to add check before access them. Signed-off-by: Xinyun Liu Signed-off-by: Yakui Zhao Signed-off-by: Zhenyu Wang commit 563785edfcef02b566e64fb5292c74c1600808aa Author: Takashi Iwai Date: Mon Nov 12 09:43:12 2018 +0100 ALSA: hda/realtek - Add quirk entry for HP Pavilion 15 HP Pavilion 15 (103c:820d) with ALC295 codec requires the quirk for the mute LED control over mic3 pin. Added the corresponding quirk entry. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=201653 Cc: Signed-off-by: Takashi Iwai commit 1e9c75fb9c47a75a9aec0cd17db5f6dc36b58e00 Author: Benjamin Coddington Date: Wed Oct 3 10:18:33 2018 -0400 mnt: fix __detach_mounts infinite loop Since commit ff17fa561a04 ("d_invalidate(): unhash immediately") immediately unhashes the dentry, we'll never return the mountpoint in lookup_mountpoint(), which can lead to an unbreakable loop in d_invalidate(). I have reports of NFS clients getting into this condition after the server removes an export of an existing mount created through follow_automount(), but I suspect there are various other ways to produce this problem if we hunt down users of d_invalidate(). For example, it is possible to get into this state by using XFS' d_invalidate() call in xfs_vn_unlink(): truncate -s 100m img{1,2} mkfs.xfs -q -n version=ci img1 mkfs.xfs -q -n version=ci img2 mkdir -p /mnt/xfs mount img1 /mnt/xfs mkdir /mnt/xfs/sub1 mount img2 /mnt/xfs/sub1 cat > /mnt/xfs/sub1/foo & umount -l /mnt/xfs/sub1 mount img2 /mnt/xfs/sub1 mount --make-private /mnt/xfs mkdir /mnt/xfs/sub2 mount --move /mnt/xfs/sub1 /mnt/xfs/sub2 rmdir /mnt/xfs/sub1 Fix this by moving the check for an unlinked dentry out of the detach_mounts() path. Fixes: ff17fa561a04 ("d_invalidate(): unhash immediately") Cc: stable@vger.kernel.org Reviewed-by: "Eric W. Biederman" Signed-off-by: Benjamin Coddington Signed-off-by: Eric W. Biederman commit 4d47d6407ac7b4b442a4e717488a3bb137398b6c Author: Kan Liang Date: Fri Oct 19 10:04:19 2018 -0700 perf/x86/intel/uncore: Support CoffeeLake 8th CBOX Coffee Lake has 8 core products which has 8 Cboxes. The 8th CBOX is mapped into different MSR space. Increase the num_boxes to 8 to handle the new products. It will not impact the previous platforms, SkyLake, KabyLake and earlier CoffeeLake. Because the num_boxes will be recalculated in uncore_cpu_init and doesn't exceed the x86_max_cores. Introduce a new box flag bit to indicate the 8th CBOX. Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Link: http://lkml.kernel.org/r/20181019170419.378-2-kan.liang@linux.intel.com Signed-off-by: Ingo Molnar commit c10a8de0d32e95b0b8c7c17b6dc09baea5a5a899 Author: Kan Liang Date: Fri Oct 19 10:04:18 2018 -0700 perf/x86/intel/uncore: Add more IMC PCI IDs for KabyLake and CoffeeLake CPUs KabyLake and CoffeeLake CPUs have the same client uncore events as SkyLake. Add the PCI IDs for the KabyLake Y, U, S processor lines and CoffeeLake U, H, S processor lines. Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Link: http://lkml.kernel.org/r/20181019170419.378-1-kan.liang@linux.intel.com Signed-off-by: Ingo Molnar commit c469933e772132aad040bd6a2adc8edf9ad6f825 Author: Patrick Bellasi Date: Mon Nov 5 14:53:58 2018 +0000 sched/fair: Fix cpu_util_wake() for 'execl' type workloads A ~10% regression has been reported for UnixBench's execl throughput test by Aaron Lu and Ye Xiaolong: https://lkml.org/lkml/2018/10/30/765 That test is pretty simple, it does a "recursive" execve() syscall on the same binary. Starting from the syscall, this sequence is possible: do_execve() do_execveat_common() __do_execve_file() sched_exec() select_task_rq_fair() <==| Task already enqueued find_idlest_cpu() find_idlest_group() capacity_spare_wake() <==| Functions not called from cpu_util_wake() | the wakeup path which means we can end up calling cpu_util_wake() not only from the "wakeup path", as its name would suggest. Indeed, the task doing an execve() syscall is already enqueued on the CPU we want to get the cpu_util_wake() for. The estimated utilization for a CPU computed in cpu_util_wake() was written under the assumption that function can be called only from the wakeup path. If instead the task is already enqueued, we end up with a utilization which does not remove the current task's contribution from the estimated utilization of the CPU. This will wrongly assume a reduced spare capacity on the current CPU and increase the chances to migrate the task on execve. The regression is tracked down to: commit d519329f72a6 ("sched/fair: Update util_est only on util_avg updates") because in that patch we turn on by default the UTIL_EST sched feature. However, the real issue is introduced by: commit f9be3e5961c5 ("sched/fair: Use util_est in LB and WU paths") Let's fix this by ensuring to always discount the task estimated utilization from the CPU's estimated utilization when the task is also the current one. The same benchmark of the bug report, executed on a dual socket 40 CPUs Intel(R) Xeon(R) CPU E5-2690 v2 @ 3.00GHz machine, reports these "Execl Throughput" figures (higher the better): mainline : 48136.5 lps mainline+fix : 55376.5 lps which correspond to a 15% speedup. Moreover, since {cpu_util,capacity_spare}_wake() are not really only used from the wakeup path, let's remove this ambiguity by using a better matching name: {cpu_util,capacity_spare}_without(). Since we are at that, let's also improve the existing documentation. Reported-by: Aaron Lu Reported-by: Ye Xiaolong Tested-by: Aaron Lu Signed-off-by: Patrick Bellasi Signed-off-by: Peter Zijlstra (Intel) Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Morten Rasmussen Cc: Peter Zijlstra Cc: Quentin Perret Cc: Steve Muckle Cc: Suren Baghdasaryan Cc: Thomas Gleixner Cc: Todd Kjos Cc: Vincent Guittot Fixes: f9be3e5961c5 (sched/fair: Use util_est in LB and WU paths) Link: https://lore.kernel.org/lkml/20181025093100.GB13236@e110439-lin/ Signed-off-by: Ingo Molnar commit d19f9130b814d33c03118493c17454f7d90075d1 Author: Elvira Khabirova Date: Sat Nov 10 04:22:09 2018 +0100 x86/ptrace: Fix documentation for tracehook_report_syscall_entry() tracehook_report_syscall_entry() is called not only if %TIF_SYSCALL_TRACE is set, but also if %TIF_SYSCALL_EMU is set, as appears from x86's entry code. Signed-off-by: Elvira Khabirova Cc: Borislav Petkov Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: ldv@altlinux.org Cc: oleg@redhat.com Cc: rostedt@goodmis.org Link: http://lkml.kernel.org/r/20181110042209.26333972@akathisia Signed-off-by: Ingo Molnar commit 2c7645b0f7d1014f2636393de7906c6bfd25939f Author: Michael Ellerman Date: Mon Nov 12 13:46:06 2018 +1100 selftests/powerpc: Fix wild_bctr test to work on ppc64 The selftest I recently added to test branching to an out-of-bounds NIP doesn't work on 64-bit big endian. It does fail but not in the right way. That is it SEGVs trying to load from the opd at BAD_NIP, but it never gets as far as branching to BAD_NIP. To fix it we need to create an opd which is reachable but which holds the bad address. Fixes: b7683fc66eba ("selftests/powerpc: Add a test of wild bctr") Signed-off-by: Michael Ellerman commit 43c6494fa1499912c8177e71450c0279041152a6 Author: Michael Ellerman Date: Tue Nov 6 23:37:58 2018 +1100 powerpc/io: Fix the IO workarounds code to work with Radix Back in 2006 Ben added some workarounds for a misbehaviour in the Spider IO bridge used on early Cell machines, see commit 014da7ff47b5 ("[POWERPC] Cell "Spider" MMIO workarounds"). Later these were made to be generic, ie. not tied specifically to Spider. The code stashes a token in the high bits (59-48) of virtual addresses used for IO (eg. returned from ioremap()). This works fine when using the Hash MMU, but when we're using the Radix MMU the bits used for the token overlap with some of the bits of the virtual address. This is because the maximum virtual address is larger with Radix, up to c00fffffffffffff, and in fact we use that high part of the address range for ioremap(), see RADIX_KERN_IO_START. As it happens the bits that are used overlap with the bits that differentiate an IO address vs a linear map address. If the resulting address lies outside the linear mapping we will crash (see below), if not we just corrupt memory. virtio-pci 0000:00:00.0: Using 64-bit direct DMA at offset 800000000000000 Unable to handle kernel paging request for data at address 0xc000000080000014 ... CFAR: c000000000626b98 DAR: c000000080000014 DSISR: 42000000 IRQMASK: 0 GPR00: c0000000006c54fc c00000003e523378 c0000000016de600 0000000000000000 GPR04: c00c000080000014 0000000000000007 0fffffff000affff 0000000000000030 ^^^^ ... NIP [c000000000626c5c] .iowrite8+0xec/0x100 LR [c0000000006c992c] .vp_reset+0x2c/0x90 Call Trace: .pci_bus_read_config_dword+0xc4/0x120 (unreliable) .register_virtio_device+0x13c/0x1c0 .virtio_pci_probe+0x148/0x1f0 .local_pci_probe+0x68/0x140 .pci_device_probe+0x164/0x220 .really_probe+0x274/0x3b0 .driver_probe_device+0x80/0x170 .__driver_attach+0x14c/0x150 .bus_for_each_dev+0xb8/0x130 .driver_attach+0x34/0x50 .bus_add_driver+0x178/0x2f0 .driver_register+0x90/0x1a0 .__pci_register_driver+0x6c/0x90 .virtio_pci_driver_init+0x2c/0x40 .do_one_initcall+0x64/0x280 .kernel_init_freeable+0x36c/0x474 .kernel_init+0x24/0x160 .ret_from_kernel_thread+0x58/0x7c This hasn't been a problem because CONFIG_PPC_IO_WORKAROUNDS which enables this code is usually not enabled. It is only enabled when it's selected by PPC_CELL_NATIVE which is only selected by PPC_IBM_CELL_BLADE and that in turn depends on BIG_ENDIAN. So in order to hit the bug you need to build a big endian kernel, with IBM Cell Blade support enabled, as well as Radix MMU support, and then boot that on Power9 using Radix MMU. Still we can fix the bug, so let's do that. We simply use fewer bits for the token, taking the union of the restrictions on the address from both Hash and Radix, we end up with 8 bits we can use for the token. The only user of the token is iowa_mem_find_bus() which only supports 8 token values, so 8 bits is plenty for that. Fixes: 566ca99af026 ("powerpc/mm/radix: Add dummy radix_enabled()") Signed-off-by: Michael Ellerman commit c8b00bb742dd036388f37d019dbb9db177f3e66c Author: Michael Ellerman Date: Thu Nov 1 16:21:05 2018 +1100 powerpc/mm/64s: Fix preempt warning in slb_allocate_kernel() With preempt enabled we see warnings in do_slb_fault(): BUG: using smp_processor_id() in preemptible [00000000] code: kworker/u33:0/98 futex hash table entries: 4096 (order: 3, 524288 bytes) caller is do_slb_fault+0x204/0x230 CPU: 5 PID: 98 Comm: kworker/u33:0 Not tainted 4.19.0-rc3-gcc-7.3.1-00022-g1936f094e164 #138 Call Trace: dump_stack+0xb4/0x104 (unreliable) check_preemption_disabled+0x148/0x150 do_slb_fault+0x204/0x230 data_access_slb_common+0x138/0x180 This is caused by the get_paca() in slb_allocate_kernel(), which includes a call to debug_smp_processor_id(). slb_allocate_kernel() can only be called from do_slb_fault(), and in that path interrupts are hard disabled and so we can't be preempted, but we can't update the preempt flags (in thread_info) because that could cause an SLB fault. So just use local_paca which is safe and doesn't cause the warning. Fixes: 48e7b7695745 ("powerpc/64s/hash: Convert SLB miss handlers to C") Signed-off-by: Michael Ellerman commit ccda4af0f4b92f7b4c308d3acc262f4a7e3affad Author: Linus Torvalds Date: Sun Nov 11 17:12:31 2018 -0600 Linux 4.20-rc2 commit 7a3765ed66d187071bbf56a8212f5d2bc2d2e2cc Merge: e12e00e388de 7236ead1b149 Author: Linus Torvalds Date: Sun Nov 11 17:09:48 2018 -0600 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: "One last pull request before heading to Vancouver for LPC, here we have: 1) Don't forget to free VSI contexts during ice driver unload, from Victor Raj. 2) Don't forget napi delete calls during device remove in ice driver, from Dave Ertman. 3) Don't request VLAN tag insertion of ibmvnic device when SKB doesn't have VLAN tags at all. 4) IPV4 frag handling code has to accomodate the situation where two threads try to insert the same fragment into the hash table at the same time. From Eric Dumazet. 5) Relatedly, don't flow separate on protocol ports for fragmented frames, also from Eric Dumazet. 6) Memory leaks in qed driver, from Denis Bolotin. 7) Correct valid MTU range in smsc95xx driver, from Stefan Wahren. 8) Validate cls_flower nested policies properly, from Jakub Kicinski. 9) Clearing of stats counters in mc88e6xxx driver doesn't retain important bits in the G1_STATS_OP register causing the chip to hang. Fix from Andrew Lunn" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (41 commits) act_mirred: clear skb->tstamp on redirect net: dsa: mv88e6xxx: Fix clearing of stats counters tipc: fix link re-establish failure net: sched: cls_flower: validate nested enc_opts_policy to avoid warning net: mvneta: correct typo flow_dissector: do not dissect l4 ports for fragments net: qualcomm: rmnet: Fix incorrect assignment of real_dev net: aquantia: allow rx checksum offload configuration net: aquantia: invalid checksumm offload implementation net: aquantia: fixed enable unicast on 32 macvlan net: aquantia: fix potential IOMMU fault after driver unbind net: aquantia: synchronized flow control between mac/phy net: smsc95xx: Fix MTU range net: stmmac: Fix RX packet size > 8191 qed: Fix potential memory corruption qed: Fix SPQ entries not returned to pool in error flows qed: Fix blocking/unlimited SPQ entries leak qed: Fix memory/entry leak in qed_init_sp_request() inet: frags: better deal with smp races net: hns3: bugfix for not checking return value ... commit e12e00e388dee1d2a86e9b90f79a69f9acd2c9b0 Merge: 63a42e1a5cb3 d5615e472d23 Author: Linus Torvalds Date: Sun Nov 11 16:57:55 2018 -0600 Merge tag 'kbuild-fixes-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - fix build errors in binrpm-pkg and bindeb-pkg targets - fix false positive matches in merge_config.sh - fix build version mismatch in deb-pkg target - fix dtbs_install handling in (bin)deb-pkg target - revert a commit that allows setlocalversion to write to source tree * tag 'kbuild-fixes-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: builddeb: Fix inclusion of dtbs in debian package Revert "scripts/setlocalversion: git: Make -dirty check more robust" kbuild: deb-pkg: fix too low build version number kconfig: merge_config: avoid false positive matches from comment lines kbuild: deb-pkg: fix bindeb-pkg breakage when O= is used kbuild: rpm-pkg: fix binrpm-pkg breakage when O= is used commit 63a42e1a5cb3d01eef2f370c11d8733a32f12f86 Merge: c140f8b072d1 d6fd0ae25c64 Author: Linus Torvalds Date: Sun Nov 11 16:54:38 2018 -0600 Merge tag 'for-4.20-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "Several fixes to recent release (4.19, fixes tagged for stable) and other fixes" * tag 'for-4.20-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: Btrfs: fix missing delayed iputs on unmount Btrfs: fix data corruption due to cloning of eof block Btrfs: fix infinite loop on inode eviction after deduplication of eof block Btrfs: fix deadlock on tree root leaf when finding free extent btrfs: avoid link error with CONFIG_NO_AUTO_INLINE btrfs: tree-checker: Fix misleading group system information Btrfs: fix missing data checksums after a ranged fsync (msync) btrfs: fix pinned underflow after transaction aborted Btrfs: fix cur_offset in the error case for nocow commit c140f8b072d16595c83d4d16a05693e72d9b1973 Merge: b6df7b6db1c1 eb6984fa4ce2 Author: Linus Torvalds Date: Sun Nov 11 16:53:02 2018 -0600 Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: "A large number of ext4 bug fixes, mostly buffer and memory leaks on error return cleanup paths" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: missing !bh check in ext4_xattr_inode_write() ext4: fix buffer leak in __ext4_read_dirblock() on error path ext4: fix buffer leak in ext4_expand_extra_isize_ea() on error path ext4: fix buffer leak in ext4_xattr_move_to_block() on error path ext4: release bs.bh before re-using in ext4_xattr_block_find() ext4: fix buffer leak in ext4_xattr_get_block() on error path ext4: fix possible leak of s_journal_flag_rwsem in error path ext4: fix possible leak of sbi->s_group_desc_leak in error path ext4: remove unneeded brelse call in ext4_xattr_inode_update_ref() ext4: avoid possible double brelse() in add_new_gdb() on error path ext4: avoid buffer leak in ext4_orphan_add() after prior errors ext4: avoid buffer leak on shutdown in ext4_mark_iloc_dirty() ext4: fix possible inode leak in the retry loop of ext4_resize_fs() ext4: fix missing cleanup if ext4_alloc_flex_bg_array() fails while resizing ext4: add missing brelse() update_backups()'s error path ext4: add missing brelse() add_new_gdb_meta_bg()'s error path ext4: add missing brelse() in set_flexbg_block_bitmap()'s error path ext4: avoid potential extra brelse in setup_new_flex_group_blocks() commit b6df7b6db1c1837fc9eada74ed561cbfe7746755 Merge: 655c6b977755 15035388439f Author: Linus Torvalds Date: Sun Nov 11 16:41:50 2018 -0600 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: "A set of x86 fixes: - Cure the LDT remapping to user space on 5 level paging which ended up in the KASLR space - Remove LDT mapping before freeing the LDT pages - Make NFIT MCE handling more robust - Unbreak the VSMP build by removing the dependency on paravirt ops - Support broken PIT emulation on Microsoft hyperV - Don't trace vmware_sched_clock() to avoid tracer recursion - Remove -pipe from KBUILD CFLAGS which breaks clang and is also slower on GCC - Trivial coding style and typo fixes" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/cpu/vmware: Do not trace vmware_sched_clock() x86/vsmp: Remove dependency on pv_irq_ops x86/ldt: Remove unused variable in map_ldt_struct() x86/ldt: Unmap PTEs for the slot before freeing LDT pages x86/mm: Move LDT remap out of KASLR region on 5-level paging acpi/nfit, x86/mce: Validate a MCE's address before using it acpi/nfit, x86/mce: Handle only uncorrectable machine checks x86/build: Remove -pipe from KBUILD_CFLAGS x86/hyper-v: Fix indentation in hv_do_fast_hypercall16() Documentation/x86: Fix typo in zero-page.txt x86/hyper-v: Enable PIT shutdown quirk clockevents/drivers/i8253: Add support for PIT shutdown quirk commit 655c6b977755594d104d2b87d3e896bd09fd34e8 Merge: 08b5278650d6 45fd80809144 Author: Linus Torvalds Date: Sun Nov 11 16:39:12 2018 -0600 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Thomas Gleixner: "A bunch of perf tooling fixes: - Make the Intel PT SQL viewer more robust - Make the Intel PT debug log more useful - Support weak groups in perf record so it's behaving the same way as perf stat - Display the LBR stats in callchain entries properly in perf top - Handle different PMu names with common prefix properlin in pert stat - Start syscall augmenting in perf trace. Preparation for architecture independent eBPF instrumentation of syscalls. - Fix build breakage in JVMTI perf lib - Fix arm64 tools build failure wrt smp_load_{acquire,release}" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf tools: Do not zero sample_id_all for group members perf tools: Fix undefined symbol scnprintf in libperf-jvmti.so perf beauty: Use SRCARCH, ARCH=x86_64 must map to "x86" to find the headers perf intel-pt: Add MTC and CYC timestamps to debug log perf intel-pt: Add more event information to debug log perf scripts python: exported-sql-viewer.py: Fix table find when table re-ordered perf scripts python: exported-sql-viewer.py: Add help window perf scripts python: exported-sql-viewer.py: Add Selected branches report perf scripts python: exported-sql-viewer.py: Fall back to /usr/local/lib/libxed.so perf top: Display the LBR stats in callchain entry perf stat: Handle different PMU names with common prefix perf record: Support weak groups perf evlist: Move perf_evsel__reset_weak_group into evlist perf augmented_syscalls: Start collecting pathnames in the BPF program perf trace: Fix setting of augmented payload when using eBPF + raw_syscalls perf trace: When augmenting raw_syscalls plug raw_syscalls:sys_exit too perf examples bpf: Start augmenting raw_syscalls:sys_{start,exit} tools headers barrier: Fix arm64 tools build failure wrt smp_load_{acquire,release} commit 08b5278650d6e9f61a210f88e3f418c87389df5b Merge: 024d4d4c0cf4 e6a2d72c1040 Author: Linus Torvalds Date: Sun Nov 11 16:37:41 2018 -0600 Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Thomas Gleixner: "Just the removal of a redundant call into the sched deadline overrun check" * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: posix-cpu-timers: Remove useless call to check_dl_overrun() commit 024d4d4c0cf486dee5240183125edbddc6cf2d55 Merge: 1acf93ca6c53 e1ff516a56ad Author: Linus Torvalds Date: Sun Nov 11 16:33:00 2018 -0600 Merge branch 'sched/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Thomas Gleixner: "Two small scheduler fixes: - Take hotplug lock in sched_init_smp(). Technically not really required, but lockdep will complain other. - Trivial comment fix in sched/fair" * 'sched/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/fair: Fix a comment in task_numa_fault() sched/core: Take the hotplug lock in sched_init_smp() commit 1acf93ca6c53144f5ffd408f1820ef5431656eb7 Merge: 0b002cdd5004 b987ffc18fb3 Author: Linus Torvalds Date: Sun Nov 11 16:18:10 2018 -0600 Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking build fix from Thomas Gleixner: "A single fix for a build fail with CONFIG_PROFILE_ALL_BRANCHES=y in the qspinlock code" * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/qspinlock: Fix compile error commit 0b002cdd5004c0205364b3be2cfa6aed05c61f42 Merge: e255aee5b66c f26621e60b35 Author: Linus Torvalds Date: Sun Nov 11 16:14:05 2018 -0600 Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull core fixes from Thomas Gleixner: "A couple of fixlets for the core: - Kernel doc function documentation fixes - Missing prototypes for weak watchdog functions" * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: resource/docs: Complete kernel-doc style function documentation watchdog/core: Add missing prototypes for weak functions resource/docs: Fix new kernel-doc warnings commit 5a96b2d38dc054c0bbcbcd585b116566cbd877fe Author: Ben Wolsieffer Date: Sat Nov 3 19:32:20 2018 -0400 staging: vchiq_arm: fix compat VCHIQ_IOC_AWAIT_COMPLETION The compatibility ioctl wrapper for VCHIQ_IOC_AWAIT_COMPLETION assumes that the native ioctl always uses a message buffer and decrements msgbufcount. Certain message types do not use a message buffer and in this case msgbufcount is not decremented, and completion->header for the message is NULL. Because the wrapper unconditionally decrements msgbufcount, the calling process may assume that a message buffer has been used even when it has not. This results in a memory leak in the userspace code that interfaces with this driver. When msgbufcount is decremented, the userspace code assumes that the buffer can be freed though the reference in completion->header, which cannot happen when the reference is NULL. This patch causes the wrapper to only decrement msgbufcount when the native ioctl decrements it. Note that we cannot simply copy the native ioctl's value of msgbufcount, because the wrapper only retrieves messages from the native ioctl one at a time, while userspace may request multiple messages. See https://github.com/raspberrypi/linux/pull/2703 for more discussion of this patch. Fixes: 5569a1260933 ("staging: vchiq_arm: Add compatibility wrappers for ioctls") Signed-off-by: Ben Wolsieffer Acked-by: Stefan Wahren Cc: stable Signed-off-by: Greg Kroah-Hartman commit cd56a5141331abfe218d744a3d66e1788135d482 Author: Colin Ian King Date: Sat Nov 10 23:28:06 2018 +0000 staging: mt7621-pinctrl: fix uninitialized variable ngroups Currently the for_each_node_with_property loop us incrementing variable ngroups however it was not initialized and hence will contain garbage. Fix this by initializing ngroups to zero. Detected with static analysis with cppcheck: drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c:89]: (error) Uninitialized variable: ngroups Fixes: e12a1a6e087b ("staging: mt7621-pinctrl: refactor rt2880_pinctrl_dt_node_to_map function") Signed-off-by: Colin Ian King Reviewed-by: Sergio Paracuellos Cc: stable Signed-off-by: Greg Kroah-Hartman commit a66d972465d15b1d89281258805eb8b47d66bd36 Author: Alexey Brodkin Date: Wed Oct 31 18:25:47 2018 +0300 devres: Align data[] to ARCH_KMALLOC_MINALIGN Initially we bumped into problem with 32-bit aligned atomic64_t on ARC, see [1]. And then during quite lengthly discussion Peter Z. mentioned ARCH_KMALLOC_MINALIGN which IMHO makes perfect sense. If allocation is done by plain kmalloc() obtained buffer will be ARCH_KMALLOC_MINALIGN aligned and then why buffer obtained via devm_kmalloc() should have any other alignment? This way we at least get the same behavior for both types of allocation. [1] http://lists.infradead.org/pipermail/linux-snps-arc/2018-July/004009.html [2] http://lists.infradead.org/pipermail/linux-snps-arc/2018-July/004036.html Signed-off-by: Alexey Brodkin Cc: Greg Kroah-Hartman Cc: Geert Uytterhoeven Cc: David Laight Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Vineet Gupta Cc: Will Deacon Cc: Greg KH Cc: # 4.8+ Signed-off-by: Greg Kroah-Hartman commit 7236ead1b14923f3ba35cd29cce13246be83f451 Author: Eric Dumazet Date: Sat Nov 10 16:22:29 2018 -0800 act_mirred: clear skb->tstamp on redirect If sch_fq is used at ingress, skbs that might have been timestamped by net_timestamp_set() if a packet capture is requesting timestamps could be delayed by arbitrary amount of time, since sch_fq time base is MONOTONIC. Fix this problem by moving code from sch_netem.c to act_mirred.c. Fixes: fb420d5d91c1 ("tcp/fq: move back to CLOCK_MONOTONIC") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit a9049ff9214da68df1179a7d5e36b43479abc9b8 Author: Andrew Lunn Date: Sun Nov 11 00:41:10 2018 +0100 net: dsa: mv88e6xxx: Fix clearing of stats counters The mv88e6161 would sometime fail to probe with a timeout waiting for the switch to complete an operation. This operation is supposed to clear the statistics counters. However, due to a read/modify/write, without the needed mask, the operation actually carried out was more random, with invalid parameters, resulting in the switch not responding. We need to preserve the histogram mode bits, so apply a mask to keep them. Reported-by: Chris Healy Fixes: 40cff8fca9e3 ("net: dsa: mv88e6xxx: Fix stats histogram mode") Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller commit 7ab412d33b4c7ff3e0148d3db25dd861edd1283d Author: Jon Maloy Date: Sat Nov 10 17:30:24 2018 -0500 tipc: fix link re-establish failure When a link failure is detected locally, the link is reset, the flag link->in_session is set to false, and a RESET_MSG with the 'stopping' bit set is sent to the peer. The purpose of this bit is to inform the peer that this endpoint just is going down, and that the peer should handle the reception of this particular RESET message as a local failure. This forces the peer to accept another RESET or ACTIVATE message from this endpoint before it can re-establish the link. This again is necessary to ensure that link session numbers are properly exchanged before the link comes up again. If a failure is detected locally at the same time at the peer endpoint this will do the same, which is also a correct behavior. However, when receiving such messages, the endpoints will not distinguish between 'stopping' RESETs and ordinary ones when it comes to updating session numbers. Both endpoints will copy the received session number and set their 'in_session' flags to true at the reception, while they are still expecting another RESET from the peer before they can go ahead and re-establish. This is contradictory, since, after applying the validation check referred to below, the 'in_session' flag will cause rejection of all such messages, and the link will never come up again. We now fix this by not only handling received RESET/STOPPING messages as a local failure, but also by omitting to set a new session number and the 'in_session' flag in such cases. Fixes: 7ea817f4e832 ("tipc: check session number before accepting link protocol messages") Signed-off-by: Jon Maloy Signed-off-by: David S. Miller commit 432798195bbce1f8cd33d1c0284d0538835e25fb Author: Dan Carpenter Date: Fri Oct 26 10:19:51 2018 +0300 uio: Fix an Oops on load I was trying to solve a double free but I introduced a more serious NULL dereference bug. The problem is that if there is an IRQ which triggers immediately, then we need "info->uio_dev" but it's not set yet. This patch puts the original initialization back to how it was and just sets info->uio_dev to NULL on the error path so it should solve both the Oops and the double free. Fixes: f019f07ecf6a ("uio: potential double frees if __uio_register_device() fails") Reported-by: Mathias Thore Signed-off-by: Dan Carpenter Cc: stable Tested-by: Mathias Thore Signed-off-by: Greg Kroah-Hartman commit 8bb0a88600f0267cfcc245d34f8c4abe8c282713 Author: Colin Ian King Date: Fri Oct 19 13:58:01 2018 +0100 test_firmware: fix error return getting clobbered In the case where eq->fw->size > PAGE_SIZE the error return rc is being set to EINVAL however this is being overwritten to rc = req->fw->size because the error exit path via label 'out' is not being taken. Fix this by adding the jump to the error exit path 'out'. Detected by CoverityScan, CID#1453465 ("Unused value") Fixes: c92316bf8e94 ("test_firmware: add batched firmware tests") Signed-off-by: Colin Ian King Signed-off-by: Greg Kroah-Hartman commit 0749aa25af82c690395a96e799cd2c6e54c459cf Author: Srinivas Kandagatla Date: Tue Nov 6 15:41:41 2018 +0000 nvmem: core: fix regression in of_nvmem_cell_get() NVMEM DT support seems to be totally broken after commit e888d445ac33 ("nvmem: resolve cells from DT at registration time") Fix this! Index used in of_nvmem_cell_get() to find cell is specific to consumer, It can not be used for searching the cell in provider. Use device_node instead of this to find the matching cell in device tree case. Fixes: e888d445ac33 ("nvmem: resolve cells from DT at registration time") Reported-by: Niklas Cassel Signed-off-by: Srinivas Kandagatla Tested-by: Niklas Cassel Signed-off-by: Greg Kroah-Hartman commit 7c97301285b62a41d6bceded7d964085fc8cc50f Author: Nathan Chancellor Date: Wed Oct 17 10:09:02 2018 -0700 misc: atmel-ssc: Fix section annotation on atmel_ssc_get_driver_data After building the kernel with Clang, the following section mismatch warning appears: WARNING: vmlinux.o(.text+0x3bf19a6): Section mismatch in reference from the function ssc_probe() to the function .init.text:atmel_ssc_get_driver_data() The function ssc_probe() references the function __init atmel_ssc_get_driver_data(). This is often because ssc_probe lacks a __init annotation or the annotation of atmel_ssc_get_driver_data is wrong. Remove __init from atmel_ssc_get_driver_data to get rid of the mismatch. Signed-off-by: Nathan Chancellor Cc: stable Signed-off-by: Greg Kroah-Hartman commit fee05f455ceb5c670cbe48e2f9454ebc4a388554 Author: Gustavo A. R. Silva Date: Tue Oct 16 12:59:44 2018 +0200 drivers/misc/sgi-gru: fix Spectre v1 vulnerability req.gid can be indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: vers/misc/sgi-gru/grukdump.c:200 gru_dump_chiplet_request() warn: potential spectre issue 'gru_base' [w] Fix this by sanitizing req.gid before calling macro GID_TO_GRU, which uses it to index gru_base. Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva Signed-off-by: Greg Kroah-Hartman commit e670de54c813b5bc3672dd1c67871dc60e9206f4 Author: Dexuan Cui Date: Thu Oct 18 05:09:30 2018 +0000 Drivers: hv: kvp: Fix the recent regression caused by incorrect clean-up In kvp_send_key(), we do need call process_ib_ipinfo() if message->kvp_hdr.operation is KVP_OP_GET_IP_INFO, because it turns out the userland hv_kvp_daemon needs the info of operation, adapter_id and addr_family. With the incorrect fc62c3b1977d, the host can't get the VM's IP via KVP. And, fc62c3b1977d added a "break;", but actually forgot to initialize the key_size/value in the case of KVP_OP_SET, so the default key_size of 0 is passed to the kvp daemon, and the pool files /var/lib/hyperv/.kvp_pool_* can't be updated. This patch effectively rolls back the previous fc62c3b1977d, and correctly fixes the "this statement may fall through" warnings. This patch is tested on WS 2012 R2 and 2016. Fixes: fc62c3b1977d ("Drivers: hv: kvp: Fix two "this statement may fall through" warnings") Signed-off-by: Dexuan Cui Cc: K. Y. Srinivasan Cc: Stephen Hemminger Signed-off-by: Haiyang Zhang Cc: Signed-off-by: K. Y. Srinivasan Signed-off-by: Greg Kroah-Hartman commit d5615e472d23e854e96192103b6ae7977e705f01 Author: Rob Herring Date: Wed Nov 7 08:36:46 2018 -0600 builddeb: Fix inclusion of dtbs in debian package Commit 37c8a5fafa3b ("kbuild: consolidate Devicetree dtb build rules") moved the location of 'dtbs_install' target which caused dtbs to not be installed when building debian package with 'bindeb-pkg' target. Update the builddeb script to use the same logic that determines if there's a 'dtbs_install' target which is presence of the arch dts directory. Also, use CONFIG_OF_EARLY_FLATTREE instead of CONFIG_OF as that's a better indication of whether we are building dtbs. This commit will also have the side effect of installing dtbs on any arch that has dts files. Previously, it was dependent on whether the arch defined 'dtbs_install'. Fixes: 37c8a5fafa3b ("kbuild: consolidate Devicetree dtb build rules") Reported-by: Nuno Gonçalves Signed-off-by: Rob Herring Signed-off-by: Masahiro Yamada commit 8ef14c2c41d962756d314f1d7dc972b0ea7a180f Author: Guenter Roeck Date: Tue Nov 6 10:10:38 2018 -0800 Revert "scripts/setlocalversion: git: Make -dirty check more robust" This reverts commit 6147b1cf19651c7de297e69108b141fb30aa2349. The reverted patch results in attempted write access to the source repository, even if that repository is mounted read-only. Output from "strace git status -uno --porcelain": getcwd("/tmp/linux-test", 129) = 16 open("/tmp/linux-test/.git/index.lock", O_RDWR|O_CREAT|O_EXCL|O_CLOEXEC, 0666) = -1 EROFS (Read-only file system) While git appears to be able to handle this situation, a monitored build environment (such as the one used for Chrome OS kernel builds) may detect it and bail out with an access violation error. On top of that, the attempted write access suggests that git _will_ write to the file even if a build output directory is specified. Users may have the reasonable expectation that the source repository remains untouched in that situation. Fixes: 6147b1cf19651 ("scripts/setlocalversion: git: Make -dirty check more robust" Cc: Genki Sky Signed-off-by: Guenter Roeck Reviewed-by: Brian Norris Signed-off-by: Masahiro Yamada commit bbcde0a7241261cd0ca8d8e6b94a4113a4b71443 Author: Masahiro Yamada Date: Tue Nov 6 13:18:05 2018 +0900 kbuild: deb-pkg: fix too low build version number Since commit b41d920acff8 ("kbuild: deb-pkg: split generating packaging and build"), the build version of the kernel contained in a deb package is too low by 1. Prior to the bad commit, the kernel was built first, then the number in .version file was read out, and written into the debian control file. Now, the debian control file is created before the kernel is actually compiled, which is causing the version number mismatch. Let the mkdebian script pass KBUILD_BUILD_VERSION=${revision} to require the build system to use the specified version number. Fixes: b41d920acff8 ("kbuild: deb-pkg: split generating packaging and build") Reported-by: Doug Smythies Signed-off-by: Masahiro Yamada Tested-by: Doug Smythies commit 6bbe4385d035c6fac56f840a59861a0310ce137b Author: Masahiro Yamada Date: Mon Nov 5 17:19:36 2018 +0900 kconfig: merge_config: avoid false positive matches from comment lines The current SED_CONFIG_EXP could match to comment lines in config fragment files, especially when CONFIG_PREFIX_ is empty. For example, Buildroot uses empty prefixing; starting symbols with BR2_ is just convention. Make the sed expression more robust against false positives from comment lines. The new sed expression matches to only valid patterns. Signed-off-by: Masahiro Yamada Reviewed-by: Petr Vorel Reviewed-by: Arnout Vandecappelle (Essensium/Mind) commit 97dc6c03c1b0a9af7aa26da7b0b266a762451f5f Merge: aeaf6a4b2d9e 3e452e636d00 Author: Rafael J. Wysocki Date: Sun Nov 11 00:02:37 2018 +0100 Merge branch 'pm-cpuidle' * pm-cpuidle: ARM: cpuidle: Convert to use cpuidle_register|unregister() ARM: cpuidle: Don't register the driver when back-end init returns -ENXIO commit e255aee5b66ce4af025e6f77122114c01303b861 Merge: 20ef6d06ef9a 641a41dbba21 Author: Linus Torvalds Date: Sat Nov 10 13:32:14 2018 -0600 Merge tag 'tty-4.20-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial fixes from Greg KH: "Here are some small tty fixes for 4.20-rc2 One of these missed the original 4.19-final release, I missed that I hadn't done a pull request for it as it was in linux-next and my branch for a long time, that's my fault. The others are small, fixing some reported issues and finally fixing the termios mess for alpha so that glibc has a chance to implement some missing functionality that has been pending for many years now. All of these have been in linux-next with no reported issues" * tag 'tty-4.20-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: sh-sci: Fix could not remove dev_attr_rx_fifo_timeout arch/alpha, termios: implement BOTHER, IBSHIFT and termios2 termios, tty/tty_baudrate.c: fix buffer overrun vt: fix broken display when running aptitude serial: sh-sci: Fix receive on SCIFA/SCIFB variants with DMA commit 20ef6d06ef9a31a33516637a80521b9fc7f1f849 Merge: 1de4f2ef216d 73b6f96cbc01 Author: Linus Torvalds Date: Sat Nov 10 13:29:47 2018 -0600 Merge tag 'drm-fixes-2018-11-11' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "drm: i915, amdgpu, sun4i, exynos and etnaviv fixes: - amdgpu has some display fixes, KFD ioctl fixes and a Vega20 bios interaction fix. - sun4i has some NULL checks added - i915 has a 32-bit system fix, LPE audio oops, and HDMI2.0 clock fixes. - Exynos has a 3 regression fixes (one frame counter, fbdev missing, dsi->panel check) - Etnaviv has a single fencing fix for GPU recovery" * tag 'drm-fixes-2018-11-11' of git://anongit.freedesktop.org/drm/drm: (39 commits) drm/amd/amdgpu/dm: Fix dm_dp_create_fake_mst_encoder() drm/amd/display: Drop reusing drm connector for MST drm/amd/display: Cleanup MST non-atomic code workaround drm/amd/powerplay: always use fast UCLK switching when UCLK DPM enabled drm/amd/powerplay: set a default fclk/gfxclk ratio drm/amdgpu/display/dce11: only enable FBC when selected drm/amdgpu/display/dm: handle FBC dc feature parameter drm/amdgpu/display/dc: add FBC to dc_config drm/amdgpu: add DC feature mask module parameter drm/amdgpu/display: check if fbc is available in set_static_screen_control (v2) drm/amdgpu/vega20: add CLK base offset drm/amd/display: Stop leaking planes drm/amd/display: Fix misleading buffer information Revert "drm/amd/display: set backlight level limit to 1" drm/amd: Update atom_smu_info_v3_3 structure drm/i915: Fix ilk+ watermarks when disabling pipes drm/sun4i: tcon: prevent tcon->panel dereference if NULL drm/sun4i: tcon: fix check of tcon->panel null pointer drm/i915: Don't oops during modeset shutdown after lpe audio deinit drm/i915: Mark pin flags as u64 ... commit 1de4f2ef216dade3b5bd5f5247c4c750a953f51c Merge: a1aa42f1d8c0 9c8e0a1b6835 Author: Linus Torvalds Date: Sat Nov 10 13:27:58 2018 -0600 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace Pull namespace fixes from Eric Biederman: "I believe all of these are simple obviously correct bug fixes. These fall into two groups: - Fixing the implementation of MNT_LOCKED which prevents lesser privileged users from seeing unders mounts created by more privileged users. - Fixing the extended uid and group mapping in user namespaces. As well as ensuring the code looks correct I have spot tested these changes as well and in my testing the fixes are working" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: mount: Prevent MNT_DETACH from disconnecting locked mounts mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts mount: Retest MNT_LOCKED in do_umount userns: also map extents in the reverse map to kernel IDs commit a1aa42f1d8c00a0767afee28d17caafd2a4dd8ff Merge: ab6e1f378f54 1aefa98b010e Author: Linus Torvalds Date: Sat Nov 10 13:25:55 2018 -0600 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "A small set of fixes for clk drivers. One to fix a DT refcount imbalance, two to mark some Amlogic clks as critical, and one final one that fixes a clk name for the Qualcomm driver merged this cycle" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: qcom: gcc: Fix board clock node name clk: meson: axg: mark fdiv2 and fdiv3 as critical clk: meson-gxbb: set fclk_div3 as CLK_IS_CRITICAL clk: fixed-factor: fix of_node_get-put imbalance commit 73b6f96cbc0162787bcbdac5f538167084c8d605 Merge: d10cf6da3112 63237f8748bd Author: Dave Airlie Date: Sun Nov 11 04:20:48 2018 +1000 Merge branch 'drm-fixes-4.20' of git://people.freedesktop.org/~agd5f/linux into drm-fixes Fixes for 4.20: - DC MST fixes - DC FBC fix - Vega20 updates to support the latest vbios - KFD type fixes for ioctl headers Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20181108035551.2904-1-alexander.deucher@amd.com commit d10cf6da31128f4678058e1ed77bcb8922d5e4b0 Merge: 7d588f90fb32 a8939766c75c Author: Dave Airlie Date: Sun Nov 11 04:19:52 2018 +1000 Merge tag 'drm-misc-fixes-2018-11-07' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes - sun4i: tcon->panel NULL deref protections (Giulio) Cc: Giulio Benetti Signed-off-by: Dave Airlie From: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20181107205051.GA27823@art_vandelay commit 7d588f90fb32aacdebd30481e5a38974ac68b689 Merge: d08f44b18ccb 214782da8fe8 Author: Dave Airlie Date: Sun Nov 11 04:14:22 2018 +1000 Merge tag 'drm-intel-fixes-2018-11-08' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes Bugzilla #108282 fixed: Avoid graphics corruption on 32-bit systems for Mesa 18.2.x Avoid OOPS on LPE audio deinit. Remove two unused W/As. Fix to correct HDMI 2.0 audio clock modes to spec. Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20181108134508.GA28466@jlahtine-desk.ger.corp.intel.com commit 63c82997f5c0f3e1b914af43d82f712a86bc5f3a Author: Jakub Kicinski Date: Fri Nov 9 21:06:26 2018 -0800 net: sched: cls_flower: validate nested enc_opts_policy to avoid warning TCA_FLOWER_KEY_ENC_OPTS and TCA_FLOWER_KEY_ENC_OPTS_MASK can only currently contain further nested attributes, which are parsed by hand, so the policy is never actually used resulting in a W=1 build warning: net/sched/cls_flower.c:492:1: warning: ‘enc_opts_policy’ defined but not used [-Wunused-const-variable=] enc_opts_policy[TCA_FLOWER_KEY_ENC_OPTS_MAX + 1] = { Add the validation anyway to avoid potential bugs when other attributes are added and to make the attribute structure slightly more clear. Validation will also set extact to point to bad attribute on error. Fixes: 0a6e77784f49 ("net/sched: allow flower to match tunnel options") Signed-off-by: Jakub Kicinski Acked-by: Simon Horman Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 2121db09630113e67b51ae78c18115f1858f648a Author: Dan Williams Date: Sat Nov 3 17:53:09 2018 -0700 Revert "acpi, nfit: Further restrict userspace ARS start requests" The following lockdep splat results from acquiring the init_mutex in acpi_nfit_clear_to_send(): WARNING: possible circular locking dependency detected lt-daxdev-error/7216 is trying to acquire lock: 00000000f694db15 (&acpi_desc->init_mutex){+.+.}, at: acpi_nfit_clear_to_send+0x27/0x80 [nfit] but task is already holding lock: 00000000182298f2 (&nvdimm_bus->reconfig_mutex){+.+.}, at: __nd_ioctl+0x457/0x610 [libnvdimm] which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&nvdimm_bus->reconfig_mutex){+.+.}: nvdimm_badblocks_populate+0x41/0x150 [libnvdimm] nd_region_notify+0x95/0xb0 [libnvdimm] nd_device_notify+0x40/0x50 [libnvdimm] ars_complete+0x7f/0xd0 [nfit] acpi_nfit_scrub+0xbb/0x410 [nfit] process_one_work+0x22b/0x5c0 worker_thread+0x3c/0x390 kthread+0x11e/0x140 ret_from_fork+0x3a/0x50 -> #0 (&acpi_desc->init_mutex){+.+.}: __mutex_lock+0x83/0x980 acpi_nfit_clear_to_send+0x27/0x80 [nfit] __nd_ioctl+0x474/0x610 [libnvdimm] nd_ioctl+0xa4/0xb0 [libnvdimm] do_vfs_ioctl+0xa5/0x6e0 ksys_ioctl+0x70/0x80 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x60/0x210 entry_SYSCALL_64_after_hwframe+0x49/0xbe New infrastructure is needed to be able to perform this check without acquiring the lock. Fixes: 594861215c83 ("acpi, nfit: Further restrict userspace ARS start") Cc: Dave Jiang Signed-off-by: Dan Williams commit 3fa58dcab50a0aa16817f16a8d38aee869eb3fb9 Author: Dan Williams Date: Thu Nov 1 00:30:22 2018 -0700 acpi, nfit: Fix ARS overflow continuation When the platform BIOS is unable to report all the media error records it requires the OS to restart the scrub at a prescribed location. The driver detects the overflow condition, but then fails to report it to the ARS state machine after reaping the records. Propagate -ENOSPC correctly to continue the ARS operation. Cc: Fixes: 1cf03c00e7c1 ("nfit: scrub and register regions in a workqueue") Reported-by: Jacek Zloch Reviewed-by: Dave Jiang Signed-off-by: Dan Williams commit de7b75d82f70c5469675b99ad632983c50b6f7e7 Author: Jens Axboe Date: Fri Nov 9 15:58:40 2018 -0700 floppy: fix race condition in __floppy_read_block_0() LKP recently reported a hang at bootup in the floppy code: [ 245.678853] INFO: task mount:580 blocked for more than 120 seconds. [ 245.679906] Tainted: G T 4.19.0-rc6-00172-ga9f38e1 #1 [ 245.680959] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 245.682181] mount D 6372 580 1 0x00000004 [ 245.683023] Call Trace: [ 245.683425] __schedule+0x2df/0x570 [ 245.683975] schedule+0x2d/0x80 [ 245.684476] schedule_timeout+0x19d/0x330 [ 245.685090] ? wait_for_common+0xa5/0x170 [ 245.685735] wait_for_common+0xac/0x170 [ 245.686339] ? do_sched_yield+0x90/0x90 [ 245.686935] wait_for_completion+0x12/0x20 [ 245.687571] __floppy_read_block_0+0xfb/0x150 [ 245.688244] ? floppy_resume+0x40/0x40 [ 245.688844] floppy_revalidate+0x20f/0x240 [ 245.689486] check_disk_change+0x43/0x60 [ 245.690087] floppy_open+0x1ea/0x360 [ 245.690653] __blkdev_get+0xb4/0x4d0 [ 245.691212] ? blkdev_get+0x1db/0x370 [ 245.691777] blkdev_get+0x1f3/0x370 [ 245.692351] ? path_put+0x15/0x20 [ 245.692871] ? lookup_bdev+0x4b/0x90 [ 245.693539] blkdev_get_by_path+0x3d/0x80 [ 245.694165] mount_bdev+0x2a/0x190 [ 245.694695] squashfs_mount+0x10/0x20 [ 245.695271] ? squashfs_alloc_inode+0x30/0x30 [ 245.695960] mount_fs+0xf/0x90 [ 245.696451] vfs_kern_mount+0x43/0x130 [ 245.697036] do_mount+0x187/0xc40 [ 245.697563] ? memdup_user+0x28/0x50 [ 245.698124] ksys_mount+0x60/0xc0 [ 245.698639] sys_mount+0x19/0x20 [ 245.699167] do_int80_syscall_32+0x61/0x130 [ 245.699813] entry_INT80_32+0xc7/0xc7 showing that we never complete that read request. The reason is that the completion setup is racy - it initializes the completion event AFTER submitting the IO, which means that the IO could complete before/during the init. If it does, we are passing garbage to complete() and we may sleep forever waiting for the event to occur. Fixes: 7b7b68bba5ef ("floppy: bail out in open() if drive is not responding to block0 read") Reviewed-by: Omar Sandoval Signed-off-by: Jens Axboe commit ab6e1f378f546b0caa616ac0fcc730725cc2d222 Merge: 35c55685fc80 3941552aec1e Author: Linus Torvalds Date: Sat Nov 10 08:58:48 2018 -0600 Merge tag 'for-linus-4.20a-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: "Several fixes, mostly for rather recent regressions when running under Xen" * tag 'for-linus-4.20a-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen: remove size limit of privcmd-buf mapping interface xen: fix xen_qlock_wait() x86/xen: fix pv boot xen-blkfront: fix kernel panic with negotiate_mq error path xen/grant-table: Fix incorrect gnttab_dma_free_pages() pr_debug message CONFIG_XEN_PV breaks xen_create_contiguous_region on ARM commit 35c55685fc807fb536067602418f4a12dde23987 Merge: d5335b3dfc61 24cc61d8cb5a Author: Linus Torvalds Date: Sat Nov 10 07:07:21 2018 -0600 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Fix occasional page fault during boot due to memblock resizing before the linear map is up. - Define NET_IP_ALIGN to 0 to improve the DMA performance on some platforms. - lib/raid6 test build fix. - .mailmap update for Punit Agrawal * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: memblock: don't permit memblock resizing until linear mapping is up arm64: mm: define NET_IP_ALIGN to 0 lib/raid6: Fix arm64 test build mailmap: Update email for Punit Agrawal commit c4b7d1ba7d263b74bb72e9325262a67139605cde Author: YueHaibing Date: Sat Nov 10 04:13:24 2018 +0000 sysv: return 'err' instead of 0 in __sysv_write_inode Fixes gcc '-Wunused-but-set-variable' warning: fs/sysv/inode.c: In function '__sysv_write_inode': fs/sysv/inode.c:239:6: warning: variable 'err' set but not used [-Wunused-but-set-variable] __sysv_write_inode should return 'err' instead of 0 Fixes: 05459ca81ac3 ("repair sysv_write_inode(), switch sysv to simple_fsync()") Signed-off-by: YueHaibing Signed-off-by: Al Viro commit d5335b3dfc614fbb4ce2b352177f38521ec3ecdd Merge: aa4330e15c26 247c554a14aa Author: Linus Torvalds Date: Sat Nov 10 06:57:34 2018 -0600 Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: "I2C has one bugfix (qcom-geni driver), one arch enablement (i2c-omap driver, no code change), and a new driver (nvidia-gpu) this time" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: usb: typec: ucsi: add support for Cypress CCGx i2c: nvidia-gpu: make pm_ops static i2c: add i2c bus driver for NVIDIA GPU i2c: qcom-geni: Fix runtime PM mismatch with child devices MAINTAINERS: Add entry for i2c-omap driver i2c: omap: Enable for ARCH_K3 dt-bindings: i2c: omap: Add new compatible for AM654 SoCs commit fbd1d5245372e48b494120a30fe0b34b304576c4 Author: Alexandre Belloni Date: Fri Nov 9 17:37:20 2018 +0100 net: mvneta: correct typo The reserved variable should be named reserved1. Signed-off-by: Alexandre Belloni Signed-off-by: David S. Miller commit 62230715fd2453b3ba948c9d83cfb3ada9169169 Author: 배석진 Date: Fri Nov 9 16:53:06 2018 -0800 flow_dissector: do not dissect l4 ports for fragments Only first fragment has the sport/dport information, not the following ones. If we want consistent hash for all fragments, we need to ignore ports even for first fragment. This bug is visible for IPv6 traffic, if incoming fragments do not have a flow label, since skb_get_hash() will give different results for first fragment and following ones. It is also visible if any routing rule wants dissection and sport or dport. See commit 5e5d6fed3741 ("ipv6: route: dissect flow in input path if fib rules need it") for details. [edumazet] rewrote the changelog completely. Fixes: 06635a35d13d ("flow_dissect: use programable dissector in skb_flow_dissect and friends") Signed-off-by: 배석진 Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit d02854dc1999ed3e7fd79ec700c64ac23ac0c458 Author: Subash Abhinov Kasiviswanathan Date: Fri Nov 9 18:56:27 2018 -0700 net: qualcomm: rmnet: Fix incorrect assignment of real_dev A null dereference was observed when a sysctl was being set from userspace and rmnet was stuck trying to complete some actions in the NETDEV_REGISTER callback. This is because the real_dev is set only after the device registration handler completes. sysctl call stack - <6> Unable to handle kernel NULL pointer dereference at virtual address 00000108 <2> pc : rmnet_vnd_get_iflink+0x1c/0x28 <2> lr : dev_get_iflink+0x2c/0x40 <2> rmnet_vnd_get_iflink+0x1c/0x28 <2> inet6_fill_ifinfo+0x15c/0x234 <2> inet6_ifinfo_notify+0x68/0xd4 <2> ndisc_ifinfo_sysctl_change+0x1b8/0x234 <2> proc_sys_call_handler+0xac/0x100 <2> proc_sys_write+0x3c/0x4c <2> __vfs_write+0x54/0x14c <2> vfs_write+0xcc/0x188 <2> SyS_write+0x60/0xc0 <2> el0_svc_naked+0x34/0x38 device register call stack - <2> notifier_call_chain+0x84/0xbc <2> raw_notifier_call_chain+0x38/0x48 <2> call_netdevice_notifiers_info+0x40/0x70 <2> call_netdevice_notifiers+0x38/0x60 <2> register_netdevice+0x29c/0x3d8 <2> rmnet_vnd_newlink+0x68/0xe8 <2> rmnet_newlink+0xa0/0x160 <2> rtnl_newlink+0x57c/0x6c8 <2> rtnetlink_rcv_msg+0x1dc/0x328 <2> netlink_rcv_skb+0xac/0x118 <2> rtnetlink_rcv+0x24/0x30 <2> netlink_unicast+0x158/0x1f0 <2> netlink_sendmsg+0x32c/0x338 <2> sock_sendmsg+0x44/0x60 <2> SyS_sendto+0x150/0x1ac <2> el0_svc_naked+0x34/0x38 Fixes: b752eff5be24 ("net: qualcomm: rmnet: Implement ndo_get_iflink") Signed-off-by: Sean Tranchetti Signed-off-by: Subash Abhinov Kasiviswanathan Signed-off-by: David S. Miller commit dd63c3e02b998a2c1270c4021a4e2e72753f2632 Merge: 85b18b0237ce bbb67a44baf9 Author: David S. Miller Date: Fri Nov 9 15:38:11 2018 -0800 Merge branch 'aquantia-fixes' Igor Russkikh says: ==================== net: aquantia: 2018-11 bugfixes The patchset fixes a number of bugs found in various areas after driver validation. ==================== Signed-off-by: David S. Miller commit bbb67a44baf973da734b9fd61cba4211da240751 Author: Dmitry Bogdanov Date: Fri Nov 9 11:54:03 2018 +0000 net: aquantia: allow rx checksum offload configuration RX Checksum offloads could not be configured and ignored netdev features flag for checksumming. Signed-off-by: Igor Russkikh Signed-off-by: Dmitry Bogdanov Signed-off-by: David S. Miller commit ad703c2b9127f9acdef697ec4755f6da4beaa266 Author: Dmitry Bogdanov Date: Fri Nov 9 11:54:01 2018 +0000 net: aquantia: invalid checksumm offload implementation Packets with marked invalid IP/UDP/TCP checksums were considered as good by the driver. The error was in a logic, processing offload bits in RX descriptor. Signed-off-by: Igor Russkikh Signed-off-by: Dmitry Bogdanov Signed-off-by: David S. Miller commit bfaa9f8553d5c20703781e63f4fc8cb4792f18fd Author: Igor Russkikh Date: Fri Nov 9 11:53:59 2018 +0000 net: aquantia: fixed enable unicast on 32 macvlan Fixed a condition mistake due to which macvlans unicast item number 32 was not added in the unicast filter. The consequence is that when exactly 32 macvlans are created on NIC, the last created macvlan receives no traffic because its MAC was not registered in HW. Fixes: 94b3b542303f ("net: aquantia: vlan unicast address list correct handling") Signed-off-by: Igor Russkikh Tested-by: Nikita Danilov Signed-off-by: David S. Miller commit 7a1bb49461b12b2e6332a4d054256835f45203f3 Author: Dmitry Bogdanov Date: Fri Nov 9 11:53:57 2018 +0000 net: aquantia: fix potential IOMMU fault after driver unbind IOMMU fault may occurr on unbind/bind or if_down/if_up sequence. Although driver disables the rings on down, this is not enough. Due to internal HW design, during subsequent initialization NIC sometimes may reuse RX descriptors cache and write to the host memory from the descriptor cache. That's get catched by IOMMU on host. This patch invalidates the descriptor cache in NIC on interface down to prevent writing to the cached descriptors and to the memory pointed in those descriptors. Signed-off-by: Dmitry Bogdanov Signed-off-by: Igor Russkikh Signed-off-by: David S. Miller commit 35e8e8b45d31bec34379dd36e7b71448e003efb2 Author: Igor Russkikh Date: Fri Nov 9 11:53:56 2018 +0000 net: aquantia: synchronized flow control between mac/phy Flow control statuses were not synchronized between blocks, that caused packets/link drop on some corner cases, when MAC sent PFC although Phy was not expecting these to come. Driver should readout the negotiated FC from phy and configure RX block accordigly. This is done on each link change event with information from FW. Fixes: 288551de45aa ("net: aquantia: Implement rx/tx flow control ethtools callback") Signed-off-by: Igor Russkikh Signed-off-by: David S. Miller commit 9134586715e389fe90d9d28cb37a668f374d686a Author: Bjorn Andersson Date: Mon Oct 29 22:45:54 2018 -0700 arm64: dts: qcom: msm8998: Reserve gpio ranges on MTP GPIOs 0 through 3 and 81 through 84 are configured to not be accessible from the application CPUs. Mark them as reserved to allow the MSM8998 MTP to boot after the introduction of 3edfb7bd76bd ("gpiolib: Show correct direction from the beginning"). Signed-off-by: Bjorn Andersson Reviewed-by: Jeffrey Hugo Signed-off-by: Andy Gross commit 5f8d3ab136d0ccb59c4d628d8f85e0d8f2761d07 Author: Bjorn Andersson Date: Fri Nov 2 14:45:32 2018 -0700 arm64: dts: sdm845-mtp: Reserve reserved gpios With the introduction of commit 3edfb7bd76bd ("gpiolib: Show correct direction from the beginning") the gpiolib will attempt to read the direction of all pins, which triggers a read from protected register regions. The pins 0 through 3 and 81 through 84 are protected, so mark these as reserved. Signed-off-by: Bjorn Andersson Reviewed-by: Stephen Boyd Reviewed-by: Linus Walleij Signed-off-by: Andy Gross commit aa4330e15c26c5ef8dd184f515c0655db8c6df3a Merge: dc5db2186550 89c38422e072 Author: Linus Torvalds Date: Fri Nov 9 16:41:58 2018 -0600 Merge tag 'devicetree-fixes-for-4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull Devicetree fixes from Rob Herring: - Add validation of NUMA distance map to prevent crashes with bad map - Fix setting of dma_mask * tag 'devicetree-fixes-for-4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: of, numa: Validate some distance map rules of/device: Really only set bus DMA mask when appropriate commit dc5db21865507d0d9f706bd97c4a85315d60d0c5 Merge: d757a3b01e72 34ffec60b27a Author: Linus Torvalds Date: Fri Nov 9 16:31:51 2018 -0600 Merge tag 'for-linus-20181109' of git://git.kernel.dk/linux-block Pull block layer fixes from Jens Axboe: - Two fixes for an ubd regression, one for missing locking, and one for a missing initialization of a field. The latter was an old latent bug, but it's now visible and triggers (Me, Anton Ivanov) - Set of NVMe fixes via Christoph, but applied manually due to a git tree mixup (Christoph, Sagi) - Fix for a discard split regression, in three patches (Ming) - Update libata git trees (Geert) - SPDX identifier for sata_rcar (Kuninori Morimoto) - Virtual boundary merge fix (Johannes) - Preemptively clear memory we are going to pass to userspace, in case the driver does a short read (Keith) * tag 'for-linus-20181109' of git://git.kernel.dk/linux-block: block: make sure writesame bio is aligned with logical block size block: cleanup __blkdev_issue_discard() block: make sure discard bio is aligned with logical block size Revert "nvmet-rdma: use a private workqueue for delete" nvme: make sure ns head inherits underlying device limits nvmet: don't try to add ns to p2p map unless it actually uses it sata_rcar: convert to SPDX identifiers ubd: fix missing initialization of io_req block: Clear kernel memory before copying to user MAINTAINERS: Fix remaining pointers to obsolete libata.git ubd: fix missing lock around request issue block: respect virtual boundary mask in bvecs commit d757a3b01e72368176c5ee580ea17f8c2d185cd7 Merge: 26eaed4671af 23c625ce3065 Author: Linus Torvalds Date: Fri Nov 9 16:26:18 2018 -0600 Merge tag 'ceph-for-4.20-rc2' of https://github.com/ceph/ceph-client Pull Ceph fixes from Ilya Dryomov: "Two CephFS fixes (copy_file_range and quota) and a small feature bit cleanup" * tag 'ceph-for-4.20-rc2' of https://github.com/ceph/ceph-client: libceph: assume argonaut on the server side ceph: quota: fix null pointer dereference in quota check ceph: add destination file data sync before doing any remote copy commit 26eaed4671af3c4108b266504aed1103fb68a378 Merge: 3541833fd1f2 d01501f85249 Author: Linus Torvalds Date: Fri Nov 9 16:21:24 2018 -0600 Merge tag 'mips_fixes_4.20_2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Paul Burton: "A couple of small MIPS fixes for 4.20: - Extend an array to avoid overruns on some Octeon hardware, fixing a bug introduced in 4.3. - Fix a coherent DMA regression for systems without cache-coherent DMA introduced in the 4.20 merge window" * tag 'mips_fixes_4.20_2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: Fix `dma_alloc_coherent' returning a non-coherent allocation MIPS: OCTEON: fix out of bounds array access on CN68XX commit 1aefa98b010e9cc7a07046cbcb1237ddad85b708 Author: Vinod Koul Date: Fri Nov 9 15:20:54 2018 +0530 clk: qcom: gcc: Fix board clock node name Device tree node name are not supposed to have "_" in them so fix the node name use of xo_board to xo-board Fixes: 652f1813c113 ("clk: qcom: gcc: Add global clock controller driver for QCS404") Signed-off-by: Vinod Koul Signed-off-by: Stephen Boyd commit 15035388439f892017d38b05214d3cda6578af64 Author: Steven Rostedt (VMware) Date: Fri Nov 9 15:22:07 2018 -0500 x86/cpu/vmware: Do not trace vmware_sched_clock() When running function tracing on a Linux guest running on VMware Workstation, the guest would crash. This is due to tracing of the sched_clock internal call of the VMware vmware_sched_clock(), which causes an infinite recursion within the tracing code (clock calls must not be traced). Make vmware_sched_clock() not traced by ftrace. Fixes: 80e9a4f21fd7c ("x86/vmware: Add paravirt sched clock") Reported-by: GwanYeong Kim Signed-off-by: Steven Rostedt (VMware) Signed-off-by: Borislav Petkov CC: Alok Kataria CC: GwanYeong Kim CC: "H. Peter Anvin" CC: Ingo Molnar Cc: stable@vger.kernel.org CC: Thomas Gleixner CC: virtualization@lists.linux-foundation.org CC: x86-ml Link: http://lkml.kernel.org/r/20181109152207.4d3e7d70@gandalf.local.home commit 247c554a14aa16ca08f4ed4d9eb39a2389f69d1d Author: Ajay Gupta Date: Fri Oct 26 09:36:59 2018 -0700 usb: typec: ucsi: add support for Cypress CCGx Latest NVIDIA GPU cards have a Cypress CCGx Type-C controller over I2C interface. This UCSI I2C driver uses I2C bus driver interface for communicating with Type-C controller. Signed-off-by: Ajay Gupta Acked-by: Heikki Krogerus Signed-off-by: Wolfram Sang commit 641a41dbba217ee5bd26abe6be77f8cead9cd00e Author: Yoshihiro Shimoda Date: Tue Oct 30 15:13:35 2018 +0900 serial: sh-sci: Fix could not remove dev_attr_rx_fifo_timeout This patch fixes an issue that the sci_remove() could not remove dev_attr_rx_fifo_timeout because uart_remove_one_port() set the port->port.type to PORT_UNKNOWN. Reported-by: Hiromitsu Yamasaki Fixes: 5d23188a473d ("serial: sh-sci: make RX FIFO parameters tunable via sysfs") Cc: # v4.11+ Signed-off-by: Yoshihiro Shimoda Reviewed-by: Ulrich Hecht Signed-off-by: Greg Kroah-Hartman commit 23d8003907d094f77cf959228e2248d6db819fa7 Author: Stanislav Lisovskiy Date: Fri Nov 9 11:00:12 2018 +0200 drm/dp_mst: Check if primary mstb is null Unfortunately drm_dp_get_mst_branch_device which is called from both drm_dp_mst_handle_down_rep and drm_dp_mst_handle_up_rep seem to rely on that mgr->mst_primary is not NULL, which seem to be wrong as it can be cleared with simultaneous mode set, if probing fails or in other case. mgr->lock mutex doesn't protect against that as it might just get assigned to NULL right before, not simultaneously. There are currently bugs 107738, 108616 bugs which crash in drm_dp_get_mst_branch_device, caused by this issue. v2: Refactored the code, as it was nicely noticed. Fixed Bugzilla bug numbers(second was 108616, but not 108816) and added links. [changed title and added stable cc] Signed-off-by: Lyude Paul Signed-off-by: Stanislav Lisovskiy Cc: stable@vger.kernel.org Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108616 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107738 Link: https://patchwork.freedesktop.org/patch/msgid/20181109090012.24438-1-stanislav.lisovskiy@intel.com commit caccdcc5dbec0dd9643fe1667893e78631a4d38e Author: Wolfram Sang Date: Fri Nov 9 17:54:38 2018 +0100 i2c: nvidia-gpu: make pm_ops static sparse rightfully says: warning: symbol 'gpu_i2c_driver_pm' was not declared. Should it be static? Signed-off-by: Wolfram Sang commit c71bcdcb42a7493348d3b45dee8139843bf45efc Author: Ajay Gupta Date: Fri Oct 26 09:36:58 2018 -0700 i2c: add i2c bus driver for NVIDIA GPU Latest NVIDIA GPU card has USB Type-C interface. There is a Type-C controller which can be accessed over I2C. This driver adds I2C bus driver to communicate with Type-C controller. I2C client driver will be part of USB Type-C UCSI driver. Signed-off-by: Ajay Gupta Reviewed-by: Andy Shevchenko [wsa: kept Makefile sorting] Signed-off-by: Wolfram Sang commit eb6984fa4ce2837dcb1f66720a600f31b0bb3739 Author: Vasily Averin Date: Fri Nov 9 11:34:40 2018 -0500 ext4: missing !bh check in ext4_xattr_inode_write() According to Ted Ts'o ext4_getblk() called in ext4_xattr_inode_write() should not return bh = NULL The only time that bh could be NULL, then, would be in the case of something really going wrong; a programming error elsewhere (perhaps a wild pointer dereference) or I/O error causing on-disk file system corruption (although that would be highly unlikely given that we had *just* allocated the blocks and so the metadata blocks in question probably would still be in the cache). Fixes: e50e5129f384 ("ext4: xattr-in-inode support") Signed-off-by: Vasily Averin Signed-off-by: Theodore Ts'o Cc: stable@kernel.org # 4.13 commit d788905f68fd4714c82936f6f7f1d3644d7ae7ef Author: Oleksij Rempel Date: Tue Sep 18 11:40:41 2018 +0200 can: flexcan: use can_rx_offload_queue_sorted() for flexcan_irq_bus_*() Currently, in case of bus error, driver will generate error message and put in the tail of the message queue. To avoid confusions, this change should place the bus related messages in proper order. Signed-off-by: Oleksij Rempel Cc: linux-stable Signed-off-by: Marc Kleine-Budde commit 4530ec36bb1e0d24f41c33229694adacda3d5d89 Author: Oleksij Rempel Date: Tue Sep 18 11:40:40 2018 +0200 can: rx-offload: rename can_rx_offload_irq_queue_err_skb() to can_rx_offload_queue_tail() This function has nothing todo with error. Signed-off-by: Oleksij Rempel Cc: linux-stable Signed-off-by: Marc Kleine-Budde commit ed72bc8bcb9277061e753faf300b20f97323761c Author: Oleksij Rempel Date: Tue Sep 18 11:40:39 2018 +0200 can: flexcan: handle tx-complete CAN frames via rx-offload infrastructure Current flexcan driver will put TX-ECHO in regular unsorted way, in this case TX-ECHO can come after the response to the same TXed message. In some cases, for example for J1939 stack, things will break. This patch is using new rx-offload API to put the messages just in the right place. Signed-off-by: Oleksij Rempel Cc: linux-stable Signed-off-by: Marc Kleine-Budde commit 11644a7659529730eaf2f166efaabe7c3dc7af8c Author: Cherian, George Date: Fri Nov 9 17:21:22 2018 +0200 xhci: Add quirk to workaround the errata seen on Cavium Thunder-X2 Soc Implement workaround for ThunderX2 Errata-129 (documented in CN99XX Known Issues" available at Cavium support site). As per ThunderX2errata-129, USB 2 device may come up as USB 1 if a connection to a USB 1 device is followed by another connection to a USB 2 device, the link will come up as USB 1 for the USB 2 device. Resolution: Reset the PHY after the USB 1 device is disconnected. The PHY reset sequence is done using private registers in XHCI register space. After the PHY is reset we check for the PLL lock status and retry the operation if it fails. From our tests, retrying 4 times is sufficient. Add a new quirk flag XHCI_RESET_PLL_ON_DISCONNECT to invoke the workaround in handle_xhci_port_status(). Cc: stable@vger.kernel.org Signed-off-by: George Cherian Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman commit a5baeaeabcca3244782a9b6382ebab6f8a58f583 Author: Aaron Ma Date: Fri Nov 9 17:21:21 2018 +0200 usb: xhci: fix timeout for transition from RExit to U0 This definition is used by msecs_to_jiffies in milliseconds. According to the comments, max rexit timeout should be 20ms. Align with the comments to properly calculate the delay. Verified on Sunrise Point-LP and Cannon Lake. Cc: stable@vger.kernel.org Signed-off-by: Aaron Ma Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman commit 958c0bd86075d4ef1c936998deefe1947e539240 Author: Aaron Ma Date: Fri Nov 9 17:21:20 2018 +0200 usb: xhci: fix uninitialized completion when USB3 port got wrong status Realtek USB3.0 Card Reader [0bda:0328] reports wrong port status on Cannon lake PCH USB3.1 xHCI [8086:a36d] after resume from S3, after clear port reset it works fine. Since this device is registered on USB3 roothub at boot, when port status reports not superspeed, xhci_get_port_status will call an uninitialized completion in bus_state[0]. Kernel will hang because of NULL pointer. Restrict the USB2 resume status check in USB2 roothub to fix hang issue. Cc: stable@vger.kernel.org Signed-off-by: Aaron Ma Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman commit d9193efba84fe4c4aa22a569fade5e6ca971f8af Author: Sandeep Singh Date: Fri Nov 9 17:21:19 2018 +0200 xhci: Add check for invalid byte size error when UAS devices are connected. Observed "TRB completion code (27)" error which corresponds to Stopped - Length Invalid error(xhci spec section 4.17.4) while connecting USB to SATA bridge. Looks like this case was not considered when the following patch[1] was committed. Hence adding this new check which can prevent the invalid byte size error. [1] ade2e3a xhci: handle transfer events without TRB pointer Cc: Signed-off-by: Sandeep Singh cc: Nehal Shah cc: Shyam Sundar S K Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman commit 1245374e9b8340fc255fd51b2015173a83050d03 Author: Mathias Nyman Date: Fri Nov 9 17:21:18 2018 +0200 xhci: handle port status events for removed USB3 hcd At xhci removal the USB3 hcd (shared_hcd) is removed before the primary USB2 hcd. Interrupts for port status changes may still occur for USB3 ports after the shared_hcd is freed, causing NULL pointer dereference. Check if xhci->shared_hcd is still valid before handing USB3 port events Cc: Reported-by: Peter Chen Tested-by: Jack Pham Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman commit f068090426ea8d72c408ebd42953a82a88e2282c Author: Mathias Nyman Date: Fri Nov 9 17:21:17 2018 +0200 xhci: Fix leaking USB3 shared_hcd at xhci removal Ensure that the shared_hcd pointer is valid when calling usb_put_hcd() The shared_hcd is removed and freed in xhci by first calling usb_remove_hcd(xhci->shared_hcd), and later usb_put_hcd(xhci->shared_hcd) Afer commit fe190ed0d602 ("xhci: Do not halt the host until both HCD have disconnected their devices.") the shared_hcd was never properly put as xhci->shared_hcd was set to NULL before usb_put_hcd(xhci->shared_hcd) was called. shared_hcd (USB3) is removed before primary hcd (USB2). While removing the primary hcd we might need to handle xhci interrupts to cleanly remove last USB2 devices, therefore we need to set xhci->shared_hcd to NULL before removing the primary hcd to let xhci interrupt handler know shared_hcd is no longer available. xhci-plat.c, xhci-histb.c and xhci-mtk first create both their hcd's before adding them. so to keep the correct reverse removal order use a temporary shared_hcd variable for them. For more details see commit 4ac53087d6d4 ("usb: xhci: plat: Create both HCDs before adding them") Fixes: fe190ed0d602 ("xhci: Do not halt the host until both HCD have disconnected their devices.") Cc: Joel Stanley Cc: Chunfeng Yun Cc: Thierry Reding Cc: Jianguo Sun Cc: Reported-by: Jack Pham Tested-by: Jack Pham Tested-by: Peter Chen Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman commit 8588eac3ff66e77fb681591714fd76da3a4da80d Author: Vignesh R Date: Thu Sep 27 10:31:46 2018 +0530 arm64: dts: ti: k3-am654: Fix wakeup_uart reg address cbass_wakeup interconnect which is the parent of wakeup_uart node defines address-cells=1 and size-cells=1, therefore fix up reg property of wakeup_uart node accordingly. Otherwise, this UART instance fails to probe if enabled. Fixes: 4201af2544b3 ("arm64: dts: ti: am654: Add uart nodes") Signed-off-by: Vignesh R Reviewed-by: Lokesh Vutla Signed-off-by: Tero Kristo commit 848bd3f3de9d44950c00eda6c115e8e9785440da Author: Stephen Boyd Date: Fri Nov 2 13:57:32 2018 -0700 i2c: qcom-geni: Fix runtime PM mismatch with child devices We need to enable runtime PM on this i2c controller before populating child devices with i2c_add_adapter(). Otherwise, if a child device uses runtime PM and stays runtime PM enabled we'll get the following warning at boot. Enabling runtime PM for inactive device (a98000.i2c) with active children [...] Call trace: pm_runtime_enable+0xd8/0xf8 geni_i2c_probe+0x440/0x460 platform_drv_probe+0x74/0xc8 [...] Let's move the runtime PM enabling and setup to before we add the adapter, so that this device can respond to runtime PM requests from children. Fixes: 37692de5d523 ("i2c: i2c-qcom-geni: Add bus driver for the Qualcomm GENI I2C controller") Signed-off-by: Stephen Boyd Reviewed-by: Douglas Anderson Signed-off-by: Wolfram Sang commit 350784e79230f85e9007c4c7d8b2259717d67a4d Author: Vignesh R Date: Fri Nov 9 16:44:12 2018 +0530 MAINTAINERS: Add entry for i2c-omap driver Add separate entry for i2c-omap and add my name as maintainer for this driver. Signed-off-by: Vignesh R Acked-by: Tony Lindgren Signed-off-by: Wolfram Sang commit 5b277402deac0691226a947df71c581686bd4020 Author: Vignesh R Date: Fri Nov 9 16:44:11 2018 +0530 i2c: omap: Enable for ARCH_K3 Allow I2C_OMAP to be built for K3 platforms. Signed-off-by: Vignesh R Reviewed-by: Grygorii Strashko Signed-off-by: Wolfram Sang commit ab214c48387aaaadcf8246b4b00d8b78286fde1b Author: Vignesh R Date: Fri Nov 9 16:44:10 2018 +0530 dt-bindings: i2c: omap: Add new compatible for AM654 SoCs AM654 SoCs have same I2C IP as OMAP SoCs. Add new compatible to handle AM654 SoCs. While at that reformat the existing compatible list for older SoCs to list one valid compatible per line. Signed-off-by: Vignesh R Reviewed-by: Rob Herring Reviewed-by: Grygorii Strashko Signed-off-by: Wolfram Sang commit 55059f2b7f868cd43b3ad30e28e18347e1b46ace Author: Oleksij Rempel Date: Tue Sep 18 11:40:38 2018 +0200 can: rx-offload: introduce can_rx_offload_get_echo_skb() and can_rx_offload_queue_sorted() functions Current CAN framework can't guarantee proper/chronological order of RX and TX-ECHO messages. To make this possible, drivers should use this functions instead of can_get_echo_skb(). Signed-off-by: Oleksij Rempel Cc: linux-stable Signed-off-by: Marc Kleine-Budde commit 7da11ba5c5066dadc2e96835a6233d56d7b7764a Author: Marc Kleine-Budde Date: Wed Oct 31 14:15:13 2018 +0100 can: dev: __can_get_echo_skb(): print error message, if trying to echo non existing skb Prior to echoing a successfully transmitted CAN frame (by calling can_get_echo_skb()), CAN drivers have to put the CAN frame (by calling can_put_echo_skb() in the transmit function). These put and get function take an index as parameter, which is used to identify the CAN frame. A driver calling can_get_echo_skb() with a index not pointing to a skb is a BUG, so add an appropriate error message. Cc: linux-stable Signed-off-by: Marc Kleine-Budde commit e7a6994d043a1e31d5b17706a22ce33d2a3e4cdc Author: Marc Kleine-Budde Date: Wed Oct 31 14:05:26 2018 +0100 can: dev: __can_get_echo_skb(): Don't crash the kernel if can_priv::echo_skb is accessed out of bounds If the "struct can_priv::echo_skb" is accessed out of bounds would lead to a kernel crash. Better print a sensible warning message instead and try to recover. Cc: linux-stable Signed-off-by: Marc Kleine-Budde commit 200f5c49f7a2cd694436bfc6cb0662b794c96736 Author: Marc Kleine-Budde Date: Wed Oct 31 11:08:21 2018 +0100 can: dev: __can_get_echo_skb(): replace struct can_frame by canfd_frame to access frame length This patch replaces the use of "struct can_frame::can_dlc" by "struct canfd_frame::len" to access the frame's length. As it is ensured that both structures have a compatible memory layout for this member this is no functional change. Futher, this compatibility is documented in a comment. Cc: linux-stable Signed-off-by: Marc Kleine-Budde commit a4310fa2f24687888ce80fdb0e88583561a23700 Author: Marc Kleine-Budde Date: Wed Oct 31 10:37:46 2018 +0100 can: dev: can_get_echo_skb(): factor out non sending code to __can_get_echo_skb() This patch factors out all non sending parts of can_get_echo_skb() into a seperate function __can_get_echo_skb(), so that it can be re-used in an upcoming patch. Cc: linux-stable Signed-off-by: Marc Kleine-Budde commit e05237f9da42ee52e73acea0bb082d788e111229 Author: Marc Kleine-Budde Date: Fri Nov 9 15:01:50 2018 +0100 can: flexcan: remove not needed struct flexcan_priv::tx_mb and struct flexcan_priv::tx_mb_idx The previous patch changes the TX path to always use the last mailbox regardless of the used offload scheme (rx-fifo or timestamp based). This means members "tx_mb" and "tx_mb_idx" of the struct flexcan_priv don't depend on the offload scheme, so replace them by compile time constants. Cc: linux-stable Signed-off-by: Marc Kleine-Budde commit cbffaf7aa09edbaea2bc7dc440c945297095e2fd Author: Alexander Stein Date: Thu Oct 11 17:01:25 2018 +0200 can: flexcan: Always use last mailbox for TX Essentially this patch moves the TX mailbox to position 63, regardless of timestamp based offloading or RX FIFO. So mainly the iflag register usage regarding TX has changed. The rest is consolidating RX FIFO and timestamp offloading as they now use both the same TX mailbox. The reason is a very annoying behavior regarding sending RTR frames when _not_ using RX FIFO: If a TX mailbox sent a RTR frame it becomes a RX mailbox. For that reason flexcan_irq disables the TX mailbox again. But if during the time the RTR was sent and the TX mailbox is disabled a new CAN frames is received, it is lost without notice. The reason is that so-called "Move-in" process starts from the lowest mailbox which happen to be a TX mailbox set to EMPTY. Steps to reproduce (I used an imx7d): 1. generate regular bursts of messages 2. send a RTR from flexcan with higher priority than burst messages every 1ms, e.g. cangen -I 0x100 -L 0 -g 1 -R can0 3. notice a lost message without notification after some seconds When running an iperf in parallel this problem is occurring even more frequently. Using filters is not possible as at least one single CAN-ID is allowed. Handling the TX MB during RX is also not possible as there is no race-free disable of RX MB. There is still a slight window when the described problem can occur. But for that all RX MB must be in use which is essentially next to an overrun. Still there will be no indication if it ever occurs. Signed-off-by: Alexander Stein Cc: linux-stable Signed-off-by: Marc Kleine-Budde commit 5178b7cd8e42448b1041716f124734eaaa36ca50 Author: Pankaj Bansal Date: Wed Aug 1 19:36:46 2018 +0530 can: flexcan: Unlock the MB unconditionally Unlock the MB irrespective of reception method being FIFO or timestamp based. It is optional but recommended to unlock Mailbox as soon as possible and make it available for reception. Reported-by: Alexander Stein Signed-off-by: Pankaj Bansal Cc: linux-stable Signed-off-by: Marc Kleine-Budde commit f164d0204b1156a7e0d8d1622c1a8d25752befec Author: Lukas Wunner Date: Sat Oct 27 10:36:54 2018 +0200 can: hi311x: Use level-triggered interrupt If the hi3110 shares the SPI bus with another traffic-intensive device and packets are received in high volume (by a separate machine sending with "cangen -g 0 -i -x"), reception stops after a few minutes and the counter in /proc/interrupts stops incrementing. Bus state is "active". Bringing the interface down and back up reconvenes the reception. The issue is not observed when the hi3110 is the sole device on the SPI bus. Using a level-triggered interrupt makes the issue go away and lets the hi3110 successfully receive 2 GByte over the course of 5 days while a ks8851 Ethernet chip on the same SPI bus handles 6 GByte of traffic. Unfortunately the hi3110 datasheet is mum on the trigger type. The pin description on page 3 only specifies the polarity (active high): http://www.holtic.com/documents/371-hi-3110_v-rev-kpdf.do Cc: Mathias Duckeck Cc: Akshay Bhat Cc: Casey Fitzpatrick Signed-off-by: Lukas Wunner Cc: linux-stable Signed-off-by: Marc Kleine-Budde commit 868b7c0f43e61f227bf3d7f7d6134bb3c67bb0e8 Author: Fabrizio Castro Date: Mon Sep 10 11:43:14 2018 +0100 dt-bindings: can: rcar_can: Add r8a774a1 support Document RZ/G2M (r8a774a1) SoC specific bindings. Signed-off-by: Fabrizio Castro Signed-off-by: Chris Paterson Reviewed-by: Biju Das Reviewed-by: Rob Herring Reviewed-by: Simon Horman Signed-off-by: Marc Kleine-Budde commit 68c8d209cd4337da4fa04c672f0b62bb735969bc Author: Fabrizio Castro Date: Mon Sep 10 11:43:13 2018 +0100 can: rcar_can: Fix erroneous registration Assigning 2 to "renesas,can-clock-select" tricks the driver into registering the CAN interface, even though we don't want that. This patch improves one of the checks to prevent that from happening. Fixes: 862e2b6af9413b43 ("can: rcar_can: support all input clocks") Signed-off-by: Fabrizio Castro Signed-off-by: Chris Paterson Reviewed-by: Simon Horman Signed-off-by: Marc Kleine-Budde commit 4f145f14f6b98b5aa0dd91bdae518b3f24f74b37 Author: Eugeniu Rosca Date: Mon Aug 20 16:49:10 2018 +0200 dt-bindings: can: rcar_can: document r8a77965 support Document the support for rcar_can on R8A77965 SoC devices. Add R8A77965 to the list of SoCs which require the "assigned-clocks" and "assigned-clock-rates" properties (thanks, Sergei). Signed-off-by: Eugeniu Rosca Reviewed-by: Simon Horman Reviewed-by: Kieran Bingham Reviewed-by: Rob Herring Signed-off-by: Marc Kleine-Budde commit ff1f19d56c200b35eb07cfa6668aa6dcac198cec Author: YueHaibing Date: Wed Aug 29 01:25:45 2018 +0000 can: ucan: remove duplicated include from ucan.c Remove duplicated include. Signed-off-by: YueHaibing Reviewed-by: Martin Elshuber Signed-off-by: Marc Kleine-Budde commit 207681fc5f3d5d398f106d1ae0080fc2373f707a Author: YueHaibing Date: Wed Aug 29 01:46:54 2018 +0000 can: ucan: remove set but not used variable 'udev' Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/can/usb/ucan.c: In function 'ucan_disconnect': drivers/net/can/usb/ucan.c:1578:21: warning: variable 'udev' set but not used [-Wunused-but-set-variable] struct usb_device *udev; Signed-off-by: YueHaibing Reviewed-by: Martin Elshuber Signed-off-by: Marc Kleine-Budde commit e13fb9b37cc00616b90df2d620f30345b5ada6ff Author: Jimmy Assarsson Date: Mon Aug 6 15:14:49 2018 +0200 can: kvaser_usb: Fix accessing freed memory in kvaser_usb_start_xmit() The call to can_put_echo_skb() may result in the skb being freed. The skb is later used in the call to dev->ops->dev_frame_to_cmd(). This is avoided by moving the call to can_put_echo_skb() after dev->ops->dev_frame_to_cmd(). Reported-by: Dan Carpenter Signed-off-by: Jimmy Assarsson Cc: linux-stable Signed-off-by: Marc Kleine-Budde commit 95217260649aa504eb5d4a0d50959ca4e67c8f96 Author: Jimmy Assarsson Date: Mon Aug 6 15:14:50 2018 +0200 can: kvaser_usb: Fix potential uninitialized variable use If alloc_can_err_skb() fails, cf is never initialized. Move assignment of cf inside check. Reported-by: Dan Carpenter Signed-off-by: Jimmy Assarsson Cc: linux-stable Signed-off-by: Marc Kleine-Budde commit a43608fa77213ad5ac5f75994254b9f65d57cfa0 Author: Oliver Hartkopp Date: Wed Oct 24 10:27:12 2018 +0200 can: raw: check for CAN FD capable netdev in raw_sendmsg() When the socket is CAN FD enabled it can handle CAN FD frame transmissions. Add an additional check in raw_sendmsg() as a CAN2.0 CAN driver (non CAN FD) should never see a CAN FD frame. Due to the commonly used can_dropped_invalid_skb() function the CAN 2.0 driver would drop that CAN FD frame anyway - but with this patch the user gets a proper -EINVAL return code. Signed-off-by: Oliver Hartkopp Cc: linux-stable Signed-off-by: Marc Kleine-Budde commit 3941552aec1e04d63999988a057ae09a1c56ebeb Author: Juergen Gross Date: Thu Nov 1 13:33:07 2018 +0100 xen: remove size limit of privcmd-buf mapping interface Currently the size of hypercall buffers allocated via /dev/xen/hypercall is limited to a default of 64 memory pages. For live migration of guests this might be too small as the page dirty bitmask needs to be sized according to the size of the guest. This means migrating a 8GB sized guest is already exhausting the default buffer size for the dirty bitmap. There is no sensible way to set a sane limit, so just remove it completely. The device node's usage is limited to root anyway, so there is no additional DOS scenario added by allowing unlimited buffers. While at it make the error path for the -ENOMEM case a little bit cleaner by setting n_pages to the number of successfully allocated pages instead of the target size. Fixes: c51b3c639e01f2 ("xen: add new hypercall buffer mapping device") Cc: #4.18 Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit d3132b3860f6cf35ff7609a76bbcdbb814bd027c Author: Juergen Gross Date: Thu Nov 8 08:35:06 2018 +0100 xen: fix xen_qlock_wait() Commit a856531951dc80 ("xen: make xen_qlock_wait() nestable") introduced a regression for Xen guests running fully virtualized (HVM or PVH mode). The Xen hypervisor wouldn't return from the poll hypercall with interrupts disabled in case of an interrupt (for PV guests it does). So instead of disabling interrupts in xen_qlock_wait() use a nesting counter to avoid calling xen_clear_irq_pending() in case xen_qlock_wait() is nested. Fixes: a856531951dc80 ("xen: make xen_qlock_wait() nestable") Cc: stable@vger.kernel.org Reported-by: Sander Eikelenboom Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Tested-by: Sander Eikelenboom Signed-off-by: Juergen Gross commit 278df5e5527b633f4882f1680ad58b62a7c07bfe Author: Vasily Khoruzhick Date: Thu Nov 8 20:31:35 2018 -0800 ASoC: sun8i-codec: fix crash on module removal drvdata is actually sun8i_codec, not snd_soc_card, so it crashes when calling snd_soc_card_get_drvdata(). Drop card and scodec vars anyway since we don't need to disable/unprepare clocks - it's already done by calling runtime_suspend() Drop clk_disable_unprepare() calls for the same reason. Fixes: 36c684936fae7 ("ASoC: Add sun8i digital audio codec") Signed-off-by: Vasily Khoruzhick Acked-by: Maxime Ripard Signed-off-by: Mark Brown commit ebacb81273599555a7a19f7754a1451206a5fc4f Author: Lukas Czerner Date: Fri Nov 9 14:51:46 2018 +0100 fuse: fix use-after-free in fuse_direct_IO() In async IO blocking case the additional reference to the io is taken for it to survive fuse_aio_complete(). In non blocking case this additional reference is not needed, however we still reference io to figure out whether to wait for completion or not. This is wrong and will lead to use-after-free. Fix it by storing blocking information in separate variable. This was spotted by KASAN when running generic/208 fstest. Signed-off-by: Lukas Czerner Reported-by: Zorro Lang Signed-off-by: Miklos Szeredi Fixes: 744742d692e3 ("fuse: Add reference counting for fuse_io_priv") Cc: # v4.6 commit 2d84a2d19b6150c6dbac1e6ebad9c82e4c123772 Author: Miklos Szeredi Date: Fri Nov 9 15:52:16 2018 +0100 fuse: fix possibly missed wake-up after abort In current fuse_drop_waiting() implementation it's possible that fuse_wait_aborted() will not be woken up in the unlikely case that fuse_abort_conn() + fuse_wait_aborted() runs in between checking fc->connected and calling atomic_dec(&fc->num_waiting). Do the atomic_dec_and_test() unconditionally, which also provides the necessary barrier against reordering with the fc->connected check. The explicit smp_mb() in fuse_wait_aborted() is not actually needed, since the spin_unlock() in fuse_abort_conn() provides the necessary RELEASE barrier after resetting fc->connected. However, this is not a performance sensitive path, and adding the explicit barrier makes it easier to document. Signed-off-by: Miklos Szeredi Fixes: b8f95e5d13f5 ("fuse: umount should wait for all requests") Cc: #v4.19 commit 7fabaf303458fcabb694999d6fa772cc13d4e217 Author: Miklos Szeredi Date: Fri Nov 9 15:52:16 2018 +0100 fuse: fix leaked notify reply fuse_request_send_notify_reply() may fail if the connection was reset for some reason (e.g. fs was unmounted). Don't leak request reference in this case. Besides leaking memory, this resulted in fc->num_waiting not being decremented and hence fuse_wait_aborted() left in a hanging and unkillable state. Fixes: 2d45ba381a74 ("fuse: add retrieve request") Fixes: b8f95e5d13f5 ("fuse: umount should wait for all requests") Reported-and-tested-by: syzbot+6339eda9cb4ebbc4c37b@syzkaller.appspotmail.com Signed-off-by: Miklos Szeredi Cc: #v2.6.36 commit 34ffec60b27aa81d04e274e71e4c6ef740f75fc7 Author: Ming Lei Date: Mon Oct 29 20:57:19 2018 +0800 block: make sure writesame bio is aligned with logical block size Obviously the created writesame bio has to be aligned with logical block size, and use bio_allowed_max_sectors() to retrieve this number. Cc: stable@vger.kernel.org Cc: Mike Snitzer Cc: Christoph Hellwig Cc: Xiao Ni Cc: Mariusz Dabrowski Fixes: b49a0871be31a745b2ef ("block: remove split code in blkdev_issue_{discard,write_same}") Tested-by: Rui Salvaterra Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit ba5d73851e71847ba7f7f4c27a1a6e1f5ab91c79 Author: Ming Lei Date: Mon Oct 29 20:57:18 2018 +0800 block: cleanup __blkdev_issue_discard() Cleanup __blkdev_issue_discard() a bit: - remove local variable of 'end_sect' - remove code block of 'fail' Cc: Mike Snitzer Cc: Christoph Hellwig Cc: Xiao Ni Cc: Mariusz Dabrowski Tested-by: Rui Salvaterra Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 1adfc5e4136f5967d591c399aff95b3b035f16b7 Author: Ming Lei Date: Mon Oct 29 20:57:17 2018 +0800 block: make sure discard bio is aligned with logical block size Obviously the created discard bio has to be aligned with logical block size. This patch introduces the helper of bio_allowed_max_sectors() for this purpose. Cc: stable@vger.kernel.org Cc: Mike Snitzer Cc: Christoph Hellwig Cc: Xiao Ni Cc: Mariusz Dabrowski Fixes: 744889b7cbb56a6 ("block: don't deal with discard limit in blkdev_issue_discard()") Fixes: a22c4d7e34402cc ("block: re-add discard_granularity and alignment checks") Reported-by: Rui Salvaterra Tested-by: Rui Salvaterra Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit d39aa4979219ca3d61c492f7460f1032b97b9ef2 Author: Christoph Hellwig Date: Wed Nov 7 09:20:25 2018 +0100 Revert "nvmet-rdma: use a private workqueue for delete" This reverts commit 2acf70ade79d26b97611a8df52eb22aa33814cd4. The commit never really fixed the intended issue and caused all kinds of other issues, including a use before initialization. Suggested-by: Sagi Grimberg Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 8f676b8508c250bbe255096522fdefb73f1ea0b9 Author: Sagi Grimberg Date: Fri Nov 2 11:22:13 2018 -0700 nvme: make sure ns head inherits underlying device limits Whenever we update ns_head info, we need to make sure it is still compatible with all underlying backing devices because although nvme multipath doesn't have any explicit use of these limits, other devices can still be stacked on top of it which may rely on the underlying limits. Start with unlimited stacking limits, and every info update iterate over siblings and adjust queue limits. Signed-off-by: Sagi Grimberg Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 21d3bbdd4c342f16eac8d70893e45cdfa3381a1e Author: Sagi Grimberg Date: Fri Nov 2 16:12:21 2018 -0700 nvmet: don't try to add ns to p2p map unless it actually uses it Even without CONFIG_P2PDMA this results in a error print: nvmet: no peer-to-peer memory is available that's supported by rxe0 and /dev/nullb0 Fixes: c6925093d0b2 ("nvmet: Optionally use PCI P2P memory") Signed-off-by: Sagi Grimberg Reviewed-by: Logan Gunthorpe Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 65766ee0bf7fe8b3be80e2e1c3ef54ad59b29476 Author: Takashi Iwai Date: Fri Nov 9 11:59:45 2018 +0100 ALSA: oss: Use kvzalloc() for local buffer allocations PCM OSS layer may allocate a few temporary buffers, one for the core read/write and another for the conversions via plugins. Currently both are allocated via vmalloc(). But as the allocation size is equivalent with the PCM period size, the required size might be quite small, depending on the application. This patch replaces these vmalloc() calls with kvzalloc() for covering small period sizes better. Also, we use "z"-alloc variant here for addressing the possible uninitialized access reported by syzkaller. Reported-by: syzbot+1cb36954e127c98dd037@syzkaller.appspotmail.com Cc: Signed-off-by: Takashi Iwai commit 8561fb31a1f9594e2807681f5c0721894e367f19 Author: Larry Finger Date: Thu Nov 8 23:30:09 2018 -0600 staging: rtl8723bs: Add missing return for cfg80211_rtw_get_station With Androidx86 8.1, wificond returns "failed to get nl80211_sta_info_tx_failed" and wificondControl returns "Invalid signal poll result from wificond". The fix is to OR sinfo->filled with BIT_ULL(NL80211_STA_INFO_TX_FAILED). This missing bit is apparently not needed with NetworkManager, but it does no harm in that case. Reported-and-Tested-by: youling257 Cc: linux-wireless@vger.kernel.org Cc: youling257 Signed-off-by: Larry Finger Cc: stable Signed-off-by: Greg Kroah-Hartman commit 13c45007e0a87e912da21223599583fdea677914 Author: Colin Ian King Date: Fri Nov 9 11:56:45 2018 +0000 staging: most: use format specifier "%s" in snprintf Passing string ch_data_type[i].name as the format specifier is potentially hazardous because it could (although very unlikely to) have a format specifier embedded in it causing issues when parsing the non-existent arguments to these. Follow best practice by using the "%s" format string for the string. Cleans up clang warning: format string is not a string literal (potentially insecure) [-Wformat-security] Fixes: e7f2b70fd3a9 ("staging: most: replace multiple if..else with table lookup") Signed-off-by: Colin Ian King Cc: stable Signed-off-by: Greg Kroah-Hartman commit 3541833fd1f264e7579e573a6586a1b665da37db Merge: 24ccea7e102d 0bb2ae1b26e1 Author: Linus Torvalds Date: Fri Nov 9 06:30:44 2018 -0600 Merge tag 's390-4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Martin Schwidefsky: - A fix for the pgtable_bytes misaccounting on s390. The patch changes common code part in regard to page table folding and adds extra checks to mm_[inc|dec]_nr_[pmds|puds]. - Add FORCE for all build targets using if_changed - Use non-loadable phdr for the .vmlinux.info section to avoid a segment overlap that confuses kexec - Cleanup the attribute definition for the diagnostic sampling - Increase stack size for CONFIG_KASAN=y builds - Export __node_distance to fix a build error - Correct return code of a PMU event init function - An update for the default configs * tag 's390-4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/perf: Change CPUM_CF return code in event init function s390: update defconfigs s390/mm: Fix ERROR: "__node_distance" undefined! s390/kasan: increase instrumented stack size to 64k s390/cpum_sf: Rework attribute definition for diagnostic sampling s390/mm: fix mis-accounting of pgtable_bytes mm: add mm_pxd_folded checks to pgtable_bytes accounting functions mm: introduce mm_[p4d|pud|pmd]_folded mm: make the __PAGETABLE_PxD_FOLDED defines non-empty s390: avoid vmlinux segments overlap s390/vdso: add missing FORCE to build targets s390/decompressor: add missing FORCE to build targets commit e7445ceddfc220c1aede6d42758a5acb8844e9c3 Author: Andreas Gruenbacher Date: Thu Nov 8 20:14:29 2018 +0000 gfs2: Fix metadata read-ahead during truncate (2) The previous attempt to fix for metadata read-ahead during truncate was incorrect: for files with a height > 2 (1006989312 bytes with a block size of 4096 bytes), read-ahead requests were not being issued for some of the indirect blocks discovered while walking the metadata tree, leading to significant slow-downs when deleting large files. Fix that. In addition, only issue read-ahead requests in the first pass through the meta-data tree, while deallocating data blocks. Fixes: c3ce5aa9b0 ("gfs2: Fix metadata read-ahead during truncate") Cc: stable@vger.kernel.org # v4.16+ Signed-off-by: Andreas Gruenbacher commit 10283ea525d30f2e99828978fd04d8427876a7ad Author: Andreas Gruenbacher Date: Mon Nov 5 22:57:24 2018 +0000 gfs2: Put bitmap buffers in put_super gfs2_put_super calls gfs2_clear_rgrpd to destroy the gfs2_rgrpd objects attached to the resource group glocks. That function should release the buffers attached to the gfs2_bitmap objects (bi_bh), but the call to gfs2_rgrp_brelse for doing that is missing. When gfs2_releasepage later runs across these buffers which are still referenced, it refuses to free them. This causes the pages the buffers are attached to to remain referenced as well. With enough mount/unmount cycles, the system will eventually run out of memory. Fix this by adding the missing call to gfs2_rgrp_brelse in gfs2_clear_rgrpd. (Also fix a gfs2_rgrp_relse -> gfs2_rgrp_brelse typo in a comment.) Fixes: 39b0f1e92908 ("GFS2: Don't brelse rgrp buffer_heads every allocation") Cc: stable@vger.kernel.org # v4.2+ Signed-off-by: Andreas Gruenbacher commit 595b0674ce781e38522097b18718ce3c3bffc1a1 Author: Andy Shevchenko Date: Mon Nov 5 18:33:34 2018 +0200 MAINTAINERS: Add tree link for Intel pin control driver Intel pin control driver gets its own tree. Update MAINTAINERS accordingly. Signed-off-by: Andy Shevchenko Acked-by: Mika Westerberg Signed-off-by: Linus Walleij commit a05a14049999598a3bb6fab12db6b768a0215522 Author: Vladimir Zapolskiy Date: Fri Nov 2 15:39:43 2018 +0200 gpio: don't free unallocated ida on gpiochip_add_data_with_key() error path The change corrects the error path in gpiochip_add_data_with_key() by avoiding to call ida_simple_remove(), if ida_simple_get() returns an error. Note that ida_simple_remove()/ida_free() throws a BUG(), if id argument is negative, it allows to easily check the correctness of the fix by fuzzing the return value from ida_simple_get(). Fixes: ff2b13592299 ("gpio: make the gpiochip a real device") Cc: stable@vger.kernel.org # v4.6+ Signed-off-by: Vladimir Zapolskiy Signed-off-by: Linus Walleij commit da85d8bfd1512461bcfb64929e8426cf340b3707 Author: Li Zhijian Date: Mon Nov 5 16:57:48 2018 +0800 kselftests/bpf: use ping6 as the default ipv6 ping binary when it exists At commit deee2cae27d1 ("kselftests/bpf: use ping6 as the default ipv6 ping binary if it exists"), it fixed similar issues for shell script, but it missed a same issue in the C code. Fixes: 371e4fcc9d96 ("selftests/bpf: cgroup local storage-based network counters") Reported-by: kernel test robot Signed-off-by: Li Zhijian CC: Philip Li Signed-off-by: Daniel Borkmann commit 9f4debe38415583086ce814798eeb864aeb39551 Author: Corentin Labbe Date: Sat Nov 3 14:56:01 2018 -0700 crypto: user - Zeroize whole structure given to user space For preventing uninitialized data to be given to user-space (and so leak potential useful data), the crypto_stat structure must be correctly initialized. Reported-by: Dan Carpenter Fixes: cac5818c25d0 ("crypto: user - Implement a generic crypto statistics") Signed-off-by: Corentin Labbe [EB: also fix it in crypto_reportstat_one()] [EB: use sizeof(var) rather than sizeof(type)] Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit f43f39958beb206b53292801e216d9b8a660f087 Author: Eric Biggers Date: Sat Nov 3 14:56:00 2018 -0700 crypto: user - fix leaking uninitialized memory to userspace All bytes of the NETLINK_CRYPTO report structures must be initialized, since they are copied to userspace. The change from strncpy() to strlcpy() broke this. As a minimal fix, change it back. Fixes: 4473710df1f8 ("crypto: user - Prepare for CRYPTO_MAX_ALG_NAME expansion") Cc: # v4.12+ Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit 508a1c4df085a547187eed346f1bfe5e381797f1 Author: Ard Biesheuvel Date: Thu Nov 8 23:55:16 2018 +0100 crypto: simd - correctly take reqsize of wrapped skcipher into account The simd wrapper's skcipher request context structure consists of a single subrequest whose size is taken from the subordinate skcipher. However, in simd_skcipher_init(), the reqsize that is retrieved is not from the subordinate skcipher but from the cryptd request structure, whose size is completely unrelated to the actual wrapped skcipher. Reported-by: Qian Cai Signed-off-by: Ard Biesheuvel Tested-by: Qian Cai Signed-off-by: Herbert Xu commit 0b0cf6af3f3151c26c27e8e51def5527091c3e69 Author: John Garry Date: Mon Nov 5 20:35:15 2018 +0800 crypto: hisilicon - Fix reference after free of memories on error path coccicheck currently warns of the following issues in the driver: drivers/crypto/hisilicon/sec/sec_algs.c:864:51-66: ERROR: reference preceded by free on line 812 drivers/crypto/hisilicon/sec/sec_algs.c:864:40-49: ERROR: reference preceded by free on line 813 drivers/crypto/hisilicon/sec/sec_algs.c:861:8-24: ERROR: reference preceded by free on line 814 drivers/crypto/hisilicon/sec/sec_algs.c:860:41-51: ERROR: reference preceded by free on line 815 drivers/crypto/hisilicon/sec/sec_algs.c:867:7-18: ERROR: reference preceded by free on line 816 It would appear than on certain error paths that we may attempt reference- after-free some memories. This patch fixes those issues. The solution doesn't look perfect, but having same memories free'd possibly from separate functions makes it tricky. Fixes: 915e4e8413da ("crypto: hisilicon - SEC security accelerator driver") Reviewed-by: Jonathan Cameron Cc: Signed-off-by: John Garry Signed-off-by: Herbert Xu commit 68a031d22c57b94870ba13513c9d93b8a8119ab2 Author: John Garry Date: Mon Nov 5 20:35:14 2018 +0800 crypto: hisilicon - Fix NULL dereference for same dst and src When the source and destination addresses for the cipher are the same, we will get a NULL dereference from accessing the split destination scatterlist memories, as shown: [ 56.565719] tcrypt: [ 56.565719] testing speed of async ecb(aes) (hisi_sec_aes_ecb) encryption [ 56.574683] tcrypt: test 0 (128 bit key, 16 byte blocks): [ 56.587585] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 56.596361] Mem abort info: [ 56.599151] ESR = 0x96000006 [ 56.602196] Exception class = DABT (current EL), IL = 32 bits [ 56.608105] SET = 0, FnV = 0 [ 56.611149] EA = 0, S1PTW = 0 [ 56.614280] Data abort info: [ 56.617151] ISV = 0, ISS = 0x00000006 [ 56.620976] CM = 0, WnR = 0 [ 56.623930] user pgtable: 4k pages, 48-bit VAs, pgdp = (____ptrval____) [ 56.630533] [0000000000000000] pgd=0000041fc7e4d003, pud=0000041fcd9bf003, pmd=0000000000000000 [ 56.639224] Internal error: Oops: 96000006 [#1] PREEMPT SMP [ 56.644782] Modules linked in: tcrypt(+) [ 56.648695] CPU: 21 PID: 2326 Comm: insmod Tainted: G W 4.19.0-rc6-00001-g3fabfb8-dirty #716 [ 56.658420] Hardware name: Huawei Taishan 2280 /D05, BIOS Hisilicon D05 IT17 Nemo 2.0 RC0 10/05/2018 [ 56.667537] pstate: 20000005 (nzCv daif -PAN -UAO) [ 56.672322] pc : sec_alg_skcipher_crypto+0x318/0x748 [ 56.677274] lr : sec_alg_skcipher_crypto+0x178/0x748 [ 56.682224] sp : ffff0000118e3840 [ 56.685525] x29: ffff0000118e3840 x28: ffff841fbb3f8118 [ 56.690825] x27: 0000000000000000 x26: 0000000000000000 [ 56.696125] x25: ffff841fbb3f8080 x24: ffff841fbadc0018 [ 56.701425] x23: ffff000009119000 x22: ffff841fbb24e280 [ 56.706724] x21: ffff841ff212e780 x20: ffff841ff212e700 [ 56.712023] x19: 0000000000000001 x18: ffffffffffffffff [ 56.717322] x17: 0000000000000000 x16: 0000000000000000 [ 56.722621] x15: ffff0000091196c8 x14: 72635f7265687069 [ 56.727920] x13: 636b735f676c615f x12: ffff000009119940 [ 56.733219] x11: 0000000000000000 x10: 00000000006080c0 [ 56.738519] x9 : 0000000000000000 x8 : ffff841fbb24e480 [ 56.743818] x7 : ffff841fbb24e500 x6 : ffff841ff00cdcc0 [ 56.749117] x5 : 0000000000000010 x4 : 0000000000000000 [ 56.754416] x3 : ffff841fbb24e380 x2 : ffff841fbb24e480 [ 56.759715] x1 : 0000000000000000 x0 : ffff000008f682c8 [ 56.765016] Process insmod (pid: 2326, stack limit = 0x(____ptrval____)) [ 56.771702] Call trace: [ 56.774136] sec_alg_skcipher_crypto+0x318/0x748 [ 56.778740] sec_alg_skcipher_encrypt+0x10/0x18 [ 56.783259] test_skcipher_speed+0x2a0/0x700 [tcrypt] [ 56.788298] do_test+0x18f8/0x48c8 [tcrypt] [ 56.792469] tcrypt_mod_init+0x60/0x1000 [tcrypt] [ 56.797161] do_one_initcall+0x5c/0x178 [ 56.800985] do_init_module+0x58/0x1b4 [ 56.804721] load_module+0x1da4/0x2150 [ 56.808456] __se_sys_init_module+0x14c/0x1e8 [ 56.812799] __arm64_sys_init_module+0x18/0x20 [ 56.817231] el0_svc_common+0x60/0xe8 [ 56.820880] el0_svc_handler+0x2c/0x80 [ 56.824615] el0_svc+0x8/0xc [ 56.827483] Code: a94c87a3 910b2000 f87b7842 f9004ba2 (b87b7821) [ 56.833564] ---[ end trace 0f63290590e93d94 ]--- Segmentation fault Fix this by only accessing these memories when we have different src and dst. Fixes: 915e4e8413da ("crypto: hisilicon - SEC security accelerator driver") Reviewed-by: Jonathan Cameron Cc: Signed-off-by: John Garry Signed-off-by: Herbert Xu commit 113f3aaa81bd56aba02659786ed65cbd9cb9a6fc Author: Sriram R Date: Fri Oct 19 14:42:59 2018 +0530 cfg80211: Prevent regulatory restore during STA disconnect in concurrent interfaces Currently when an AP and STA interfaces are active in the same or different radios, regulatory settings are restored whenever the STA disconnects. This restores all channel information including dfs states in all radios. For example, if an AP interface is active in one radio and STA in another, when radar is detected on the AP interface, the dfs state of the channel will be changed to UNAVAILABLE. But when the STA interface disconnects, this issues a regulatory disconnect hint which restores all regulatory settings in all the radios attached and thereby losing the stored dfs state on the other radio where the channel was marked as unavailable earlier. Hence prevent such regulatory restore whenever another active beaconing interface is present in the same or other radios. Signed-off-by: Sriram R Signed-off-by: Johannes Berg commit 03b738625b1e58f4ae2bddf04706ab85c677af2d Author: Johannes Berg Date: Tue Oct 30 09:17:45 2018 +0100 mac80211: fix CSA beacon allocation size If the FTM responder settings are changed simultaneously with the CSA beacon, the buffer size allocated isn't sufficient and we'll have a heap overrun. Fix this. While at it, also clean up the ftm_responder assignment, doing it only if ftm_responder is non-zero is valid as it's 0 to start with, but not really useful to understand the code. Fixes: bc847970f432 ("mac80211: support FTM responder configuration/statistics") Signed-off-by: Johannes Berg commit c177db2d0d5e751d52d3827b8cfdb6ef92a95a2d Author: Johannes Berg Date: Tue Oct 30 09:17:44 2018 +0100 cfg80211/mac80211: fix FTM settings across CSA When FTM is enabled, doing a CSA will unexpectedly lose it since the value of ftm_responder may be initialized to 0 instead of -1, so fix that. Fixes: 81e54d08d9d8 ("cfg80211: support FTM responder configuration/statistics") Signed-off-by: Johannes Berg commit 5c21e8100dfd57c806e833ae905e26efbb87840f Author: Ben Greear Date: Tue Oct 23 13:36:52 2018 -0700 mac80211: Clear beacon_int in ieee80211_do_stop This fixes stale beacon-int values that would keep a netdev from going up. To reproduce: Create two VAP on one radio. vap1 has beacon-int 100, start it. vap2 has beacon-int 240, start it (and it will fail because beacon-int mismatch). reconfigure vap2 to have beacon-int 100 and start it. It will fail because the stale beacon-int 240 will be used in the ifup path and hostapd never gets a chance to set the new beacon interval. Cc: stable@vger.kernel.org Signed-off-by: Ben Greear Signed-off-by: Johannes Berg commit c752cac9db1b0c469db7ba9d17af4ba708984db5 Author: Yan-Hsuan Chuang Date: Tue Oct 23 11:24:44 2018 +0800 mac80211: fix GFP_KERNEL under tasklet context cfg80211_sta_opmode_change_notify needs a gfp_t flag to hint the nl80211 stack when allocating new skb, but it is called under tasklet context here with GFP_KERNEL and kernel will yield a warning about it. Cc: stable@vger.kernel.org Fixes: ff84e7bfe176 ("mac80211: Add support to notify ht/vht opmode modification.") Signed-off-by: Yan-Hsuan Chuang ACKed-by: Larry Finger Signed-off-by: Johannes Berg commit 81c5dce2cd0bb0ecb61b6212410da5eb78cd8f79 Author: Sergey Matyukevich Date: Fri Oct 19 15:40:13 2018 +0000 cfg80211: add missing constraint for user-supplied VHT mask Do a logical vht_capa &= vht_capa_mask of user-supplied VHT mask with the driver-supplied mask of modifiable VHT capabilities. Fix whitespaces and comment typos. Signed-off-by: Sergey Matyukevich Signed-off-by: Johannes Berg commit a1881c9b8a1edef0a5ae1d5c1b61406fe3402114 Author: Vasyl Vavrychuk Date: Thu Oct 18 01:02:12 2018 +0300 mac80211_hwsim: Timer should be initialized before device registered Otherwise if network manager starts configuring Wi-Fi interface immidiatelly after getting notification of its creation, we will get NULL pointer dereference: BUG: unable to handle kernel NULL pointer dereference at (null) IP: [] hrtimer_active+0x28/0x50 ... Call Trace: [] ? hrtimer_try_to_cancel+0x27/0x110 [] ? hrtimer_cancel+0x15/0x20 [] ? mac80211_hwsim_config+0x140/0x1c0 [mac80211_hwsim] Cc: stable@vger.kernel.org Signed-off-by: Vasyl Vavrychuk Signed-off-by: Johannes Berg commit 33483a6b88e4c4c3fc50178b185da52c55288b95 Author: Wei Yongjun Date: Tue Oct 16 02:35:30 2018 +0000 mac80211: fix missing unlock on error in ieee80211_mark_sta_auth() Add the missing unlock before return from function ieee80211_mark_sta_auth() in the error handling case. Cc: stable@vger.kernel.org Fixes: fc107a933071 ("mac80211: Helper function for marking STA authenticated") Signed-off-by: Wei Yongjun [use result variable/label instead of duplicating] Signed-off-by: Johannes Berg commit 05cc09de4c017663a217630682041066f2f9a5cd Author: Alexey Khoroshilov Date: Fri Oct 5 23:22:06 2018 +0300 mac80211_hwsim: fix module init error paths for netlink There is no unregister netlink notifier and family on error paths in init_mac80211_hwsim(). Also there is an error path where hwsim_class is not destroyed. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Fixes: 62759361eb49 ("mac80211-hwsim: Provide multicast event for HWSIM_CMD_NEW_RADIO") Signed-off-by: Johannes Berg commit f98e46a251d04e1f9a7a14a7f2d166b34da525e5 Author: Quentin Monnet Date: Thu Nov 8 11:52:28 2018 +0000 tools: bpftool: update references to other man pages in documentation Update references to other bpftool man pages at the bottom of each manual page. Also reference the "bpf(2)" and "bpf-helpers(7)" man pages. References are sorted by number of man section, then by "prog-and-map-go-first", the other pages in alphabetical order. Signed-off-by: Quentin Monnet Reviewed-by: Jakub Kicinski Signed-off-by: Daniel Borkmann commit f120919f9905a2cad9dea792a28a11fb623f72c1 Author: Quentin Monnet Date: Thu Nov 8 11:52:27 2018 +0000 tools: bpftool: pass an argument to silence open_obj_pinned() Function open_obj_pinned() prints error messages when it fails to open a link in the BPF virtual file system. However, in some occasions it is not desirable to print an error, for example when we parse all links under the bpffs root, and the error is due to some paths actually being symbolic links. Example output: # ls -l /sys/fs/bpf/ lrwxrwxrwx 1 root root 0 Oct 18 19:00 ip -> /sys/fs/bpf/tc/ drwx------ 3 root root 0 Oct 18 19:00 tc lrwxrwxrwx 1 root root 0 Oct 18 19:00 xdp -> /sys/fs/bpf/tc/ # bpftool --bpffs prog show Error: bpf obj get (/sys/fs/bpf): Permission denied Error: bpf obj get (/sys/fs/bpf): Permission denied # strace -e bpf bpftool --bpffs prog show bpf(BPF_OBJ_GET, {pathname="/sys/fs/bpf/ip", bpf_fd=0}, 72) = -1 EACCES (Permission denied) Error: bpf obj get (/sys/fs/bpf): Permission denied bpf(BPF_OBJ_GET, {pathname="/sys/fs/bpf/xdp", bpf_fd=0}, 72) = -1 EACCES (Permission denied) Error: bpf obj get (/sys/fs/bpf): Permission denied ... To fix it, pass a bool as a second argument to the function, and prevent it from printing an error when the argument is set to true. Signed-off-by: Quentin Monnet Reviewed-by: Jakub Kicinski Signed-off-by: Daniel Borkmann commit a8bfd2bc29f3bf35c7b588b102662375b0184475 Author: Quentin Monnet Date: Thu Nov 8 11:52:26 2018 +0000 tools: bpftool: fix plain output and doc for --bpffs option Edit the documentation of the -f|--bpffs option to make it explicit that it dumps paths of pinned programs when bpftool is used to list the programs only, so that users do not believe they will see the name of the newly pinned program with "bpftool prog pin" or "bpftool prog load". Also fix the plain output: do not add a blank line after each program block, in order to remain consistent with what bpftool does when the option is not passed. Signed-off-by: Quentin Monnet Reviewed-by: Jakub Kicinski Signed-off-by: Daniel Borkmann commit 53909030aa29bffe1f8490df62176c2375135652 Author: Quentin Monnet Date: Thu Nov 8 11:52:25 2018 +0000 tools: bpftool: prevent infinite loop in get_fdinfo() Function getline() returns -1 on failure to read a line, thus creating an infinite loop in get_fdinfo() if the key is not found. Fix it by calling the function only as long as we get a strictly positive return value. Found by copying the code for a key which is not always present... Fixes: 71bb428fe2c1 ("tools: bpf: add bpftool") Signed-off-by: Quentin Monnet Reviewed-by: Jakub Kicinski Signed-off-by: Daniel Borkmann commit 49a249c387268882e8393dd1fafc51e3b21cb7a2 Author: Yonghong Song Date: Wed Nov 7 19:55:36 2018 -0800 tools/bpftool: copy a few net uapi headers to tools directory Commit f6f3bac08ff9 ("tools/bpf: bpftool: add net support") added certain networking support to bpftool. The implementation relies on a relatively recent uapi header file linux/tc_act/tc_bpf.h on the host which contains the marco definition of TCA_ACT_BPF_ID. Unfortunately, this is not the case for all distributions. See the email message below where rhel-7.2 does not have an up-to-date linux/tc_act/tc_bpf.h. https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1799211.html Further investigation found that linux/pkt_cls.h is also needed for macro TCA_BPF_TAG. This patch fixed the issue by copying linux/tc_act/tc_bpf.h and linux/pkt_cls.h from kernel include/uapi directory to tools/include/uapi directory so building the bpftool does not depend on host system for these files. Fixes: f6f3bac08ff9 ("tools/bpf: bpftool: add net support") Reported-by: kernel test robot Cc: Li Zhijian Signed-off-by: Yonghong Song Signed-off-by: Daniel Borkmann commit b13b8787c95c156b093305e9f006a6fb7d9119b1 Author: Andrey Ignatov Date: Wed Nov 7 13:36:07 2018 -0800 bpf: Fix IPv6 dport byte order in bpf_sk_lookup_udp Lookup functions in sk_lookup have different expectations about byte order of provided arguments. Specifically __inet_lookup, __udp4_lib_lookup and __udp6_lib_lookup expect dport to be in network byte order and do ntohs(dport) internally. At the same time __inet6_lookup expects dport to be in host byte order and correspondingly name the argument hnum. sk_lookup works correctly with __inet_lookup, __udp4_lib_lookup and __inet6_lookup with regard to dport. But in __udp6_lib_lookup case it uses host instead of expected network byte order. It makes result returned by bpf_sk_lookup_udp for IPv6 incorrect. The patch fixes byte order of dport passed to __udp6_lib_lookup. Originally sk_lookup properly handled UDPv6, but not TCPv6. 5ef0ae84f02a fixes TCPv6 but breaks UDPv6. Fixes: 5ef0ae84f02a ("bpf: Fix IPv6 dport byte-order in bpf_sk_lookup") Signed-off-by: Andrey Ignatov Acked-by: Joe Stringer Acked-by: Martin KaFai Lau Signed-off-by: Daniel Borkmann commit 1457d8cf7664f34c4ba534c1073821a559a2f6f9 Author: Juergen Gross Date: Wed Nov 7 18:01:00 2018 +0100 x86/xen: fix pv boot Commit 9da3f2b7405440 ("x86/fault: BUG() when uaccess helpers fault on kernel addresses") introduced a regression for booting Xen PV guests. Xen PV guests are using __put_user() and __get_user() for accessing the p2m map (physical to machine frame number map) as accesses might fail in case of not populated areas of the map. With above commit using __put_user() and __get_user() for accessing kernel pages is no longer valid. So replace the Xen hack by adding appropriate p2m access functions using the default fixup handler. Fixes: 9da3f2b7405440 ("x86/fault: BUG() when uaccess helpers fault on kernel addresses") Signed-off-by: Juergen Gross Reviewed-by: Andrew Cooper Signed-off-by: Juergen Gross commit 85b18b0237ce9986a81a1b9534b5e2ee116f5504 Author: Stefan Wahren Date: Thu Nov 8 20:38:26 2018 +0100 net: smsc95xx: Fix MTU range The commit f77f0aee4da4 ("net: use core MTU range checking in USB NIC drivers") introduce a common MTU handling for usbnet. But it's missing the necessary changes for smsc95xx. So set the MTU range accordingly. This patch has been tested on a Raspberry Pi 3. Fixes: f77f0aee4da4 ("net: use core MTU range checking in USB NIC drivers") Signed-off-by: Stefan Wahren Signed-off-by: David S. Miller commit 8137b6ef0ce469154e5cf19f8e7fe04d9a72ac5e Author: Thor Thayer Date: Thu Nov 8 11:42:14 2018 -0600 net: stmmac: Fix RX packet size > 8191 Ping problems with packets > 8191 as shown: PING 192.168.1.99 (192.168.1.99) 8150(8178) bytes of data. 8158 bytes from 192.168.1.99: icmp_seq=1 ttl=64 time=0.669 ms wrong data byte 8144 should be 0xd0 but was 0x0 16 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f %< ---------------snip-------------------------------------- 8112 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf 8144 0 0 0 0 d0 d1 ^^^^^^^ Notice the 4 bytes of 0 before the expected byte of d0. Databook notes that the RX buffer must be a multiple of 4/8/16 bytes [1]. Update the DMA Buffer size define to 8188 instead of 8192. Remove the -1 from the RX buffer size allocations and use the new DMA Buffer size directly. [1] Synopsys DesignWare Cores Ethernet MAC Universal v3.70a [section 8.4.2 - Table 8-24] Tested on SoCFPGA Stratix10 with ping sweep from 100 to 8300 byte packets. Fixes: 286a83721720 ("stmmac: add CHAINED descriptor mode support (V4)") Suggested-by: Jose Abreu Signed-off-by: Thor Thayer Signed-off-by: David S. Miller commit 81fe16e05308f34e8bf62206aec6aad95014e375 Merge: 0d5b9311baf2 fa5c448d98f0 Author: David S. Miller Date: Thu Nov 8 19:38:19 2018 -0800 Merge branch 'qed-Slowpath-Queue-bug-fixes' Denis Bolotin says: ==================== qed: Slowpath Queue bug fixes This patch series fixes several bugs in the SPQ mechanism. It deals with SPQ entries management, preventing resource leaks, memory corruptions and handles error cases throughout the driver. Please consider applying to net. ==================== Signed-off-by: David S. Miller commit fa5c448d98f0df660bfcad3dd5facc027ef84cd3 Author: Sagiv Ozeri Date: Thu Nov 8 16:46:11 2018 +0200 qed: Fix potential memory corruption A stuck ramrod should be deleted from the completion_pending list, otherwise it will be added again in the future and corrupt the list. Return error value to inform that ramrod is stuck and should be deleted. Signed-off-by: Sagiv Ozeri Signed-off-by: Denis Bolotin Signed-off-by: David S. Miller commit fb5e7438e7a3c8966e04ccb0760170e9e06f3699 Author: Denis Bolotin Date: Thu Nov 8 16:46:10 2018 +0200 qed: Fix SPQ entries not returned to pool in error flows qed_sp_destroy_request() API was added for SPQ users that need to free/return the entry they acquired in their error flows. Signed-off-by: Denis Bolotin Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit 2632f22ebd08da249c2017962a199a0cfb2324bf Author: Denis Bolotin Date: Thu Nov 8 16:46:09 2018 +0200 qed: Fix blocking/unlimited SPQ entries leak When there are no SPQ entries left in the free_pool, new entries are allocated and are added to the unlimited list. When an entry in the pool is available, the content is copied from the original entry, and the new entry is sent to the device. qed_spq_post() is not aware of that, so the additional entry is stored in the original entry as p_post_ent, which can later be returned to the pool. Signed-off-by: Denis Bolotin Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit 39477551df940ddb1339203817de04f5caaacf7a Author: Denis Bolotin Date: Thu Nov 8 16:46:08 2018 +0200 qed: Fix memory/entry leak in qed_init_sp_request() Free the allocated SPQ entry or return the acquired SPQ entry to the free list in error flows. Signed-off-by: Denis Bolotin Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller commit 0d5b9311baf27bb545f187f12ecfd558220c607d Author: Eric Dumazet Date: Thu Nov 8 17:34:27 2018 -0800 inet: frags: better deal with smp races Multiple cpus might attempt to insert a new fragment in rhashtable, if for example RPS is buggy, as reported by 배석진 in https://patchwork.ozlabs.org/patch/994601/ We use rhashtable_lookup_get_insert_key() instead of rhashtable_insert_fast() to let cpus losing the race free their own inet_frag_queue and use the one that was inserted by another cpu. Fixes: 648700f76b03 ("inet: frags: use rhashtables for reassembly units") Signed-off-by: Eric Dumazet Reported-by: 배석진 Signed-off-by: David S. Miller commit 8e4829c6f7470722c1f5a1dc5769ebe09ef036d6 Author: Wei Li Date: Thu Nov 8 09:08:29 2018 -0800 scsi: ufs: Fix hynix ufs bug with quirk on hi36xx SoC Hynix ufs has deviations on hi36xx platform which will result in ufs bursts transfer failures. To fix the problem, the Hynix device must set the register VS_DebugSaveConfigTime to 0x10, which will set time reference for SaveConfigTime is 250 ns. The time reference for SaveConfigTime is 40 ns by default. This patch is necessary to boot on HiKey960 boards that use Hynix UFS chips (H28U62301AMR model: hB8aL1). Cc: Vinayak Holikatti Cc: "James E.J. Bottomley" Cc: "Martin K. Petersen" Cc: linux-scsi@vger.kernel.org Signed-off-by: Wei Li Signed-off-by: Dmitry Shmidt [jstultz: Forward ported from older code, slight tweak to commit message] Signed-off-by: John Stultz Signed-off-by: Martin K. Petersen commit f2ffd4e5bc7b629b312be48fbe3c3a2afbd67e4a Author: Bill Kuzeja Date: Mon Nov 5 11:23:50 2018 -0500 scsi: qla2xxx: Timeouts occur on surprise removal of QLogic adapter When doing a surprise removal of an adapter, some in flight I/Os can get stuck and take a while to complete (they actually time out and are retried). We are not handling an early error exit from qla2xxx_eh_abort properly. Fixes: 45235022da99 ("scsi: qla2xxx: Fix driver unload by shutting down chip") Signed-off-by: Bill Kuzeja Reviewed-by: Laurence Oberman Acked-by: Himanshu Madhani Signed-off-by: Martin K. Petersen commit e12c225258f2584906765234ca6db4ad4c618192 Author: Huazhong Tan Date: Thu Nov 8 10:13:19 2018 +0800 net: hns3: bugfix for not checking return value hns3_reset_notify_init_enet() only return error early if the return value of hns3_restore_vlan() is not 0. This patch adds checking for the return value of hns3_restore_vlan. Fixes: 7fa6be4fd2f6 ("net: hns3: fix incorrect return value/type of some functions") Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 24ccea7e102de8cbc93ab3befb123bbd18532be9 Merge: 6a1ac56c23db 837514f7a4ca Author: Linus Torvalds Date: Thu Nov 8 17:55:01 2018 -0600 Merge tag 'xfs-4.20-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Darrick Wong: - fix incorrect dropping of error code from bmap - print buffer offsets instead of useless hashed pointers when dumping corrupt metadata - fix integer overflow in attribute verifier * tag 'xfs-4.20-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix overflow in xfs_attr3_leaf_verify xfs: print buffer offsets when dumping corrupt buffers xfs: Fix error code in 'xfs_ioc_getbmap()' commit 6a1ac56c23db741200d1618ef4c3fb2d31932431 Merge: d464572a80da 406e7f986b2e Author: Linus Torvalds Date: Thu Nov 8 17:49:04 2018 -0600 Merge tag 'led-fixes-for-4.20-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds Pull LED fixes from Jacek Anaszewski: "All three fixes are related to the newly added pattern trigger: - remove mutex_lock() from timer callback, which would trigger problems related to sleeping in atomic context, the removal is harmless since mutex protection turned out to be redundant in this case - fix pattern parsing to properly handle intervals with brightness == 0 - fix typos in the ABI documentation" * tag 'led-fixes-for-4.20-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds: Documentation: ABI: led-trigger-pattern: Fix typos leds: trigger: Fix sleeping function called from invalid context Fix pattern handling optimalization commit d464572a80da40e44a1810d85ea451a4b225cf6a Merge: b00d209241ff 5e93a125f521 Author: Linus Torvalds Date: Thu Nov 8 17:45:42 2018 -0600 Merge tag 'sound-4.20-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Two small regression fixes for HD-audio: one about vga_switcheroo and runtime PM, and another about Oops on some Thinkpads" * tag 'sound-4.20-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda - Fix incorrect clearance of thinkpad_acpi hooks vga_switcheroo: Fix missing gpu_bound call at audio client registration commit 89c38422e072bb453e3045b8f1b962a344c3edea Author: John Garry Date: Thu Nov 8 18:17:03 2018 +0800 of, numa: Validate some distance map rules Currently the NUMA distance map parsing does not validate the distance table for the distance-matrix rules 1-2 in [1]. However the arch NUMA code may enforce some of these rules, but not all. Such is the case for the arm64 port, which does not enforce the rule that the distance between separates nodes cannot equal LOCAL_DISTANCE. The patch adds the following rules validation: - distance of node to self equals LOCAL_DISTANCE - distance of separate nodes > LOCAL_DISTANCE This change avoids a yet-unresolved crash reported in [2]. A note on dealing with symmetrical distances between nodes: Validating symmetrical distances between nodes is difficult. If it were mandated in the bindings that every distance must be recorded in the table, then it would be easy. However, it isn't. In addition to this, it is also possible to record [b, a] distance only (and not [a, b]). So, when processing the table for [b, a], we cannot assert that current distance of [a, b] != [b, a] as invalid, as [a, b] distance may not be present in the table and current distance would be default at REMOTE_DISTANCE. As such, we maintain the policy that we overwrite distance [a, b] = [b, a] for b > a. This policy is different to kernel ACPI SLIT validation, which allows non-symmetrical distances (ACPI spec SLIT rules allow it). However, the distance debug message is dropped as it may be misleading (for a distance which is later overwritten). Some final notes on semantics: - It is implied that it is the responsibility of the arch NUMA code to reset the NUMA distance map for an error in distance map parsing. - It is the responsibility of the FW NUMA topology parsing (whether OF or ACPI) to enforce NUMA distance rules, and not arch NUMA code. [1] Documents/devicetree/bindings/numa.txt [2] https://www.spinics.net/lists/arm-kernel/msg683304.html Cc: stable@vger.kernel.org # 4.7 Signed-off-by: John Garry Acked-by: Will Deacon Signed-off-by: Rob Herring commit 6778be4e520959659b27a441c06a84c9cb009085 Author: Robin Murphy Date: Wed Nov 7 16:30:32 2018 +0000 of/device: Really only set bus DMA mask when appropriate of_dma_configure() was *supposed* to be following the same logic as acpi_dma_configure() and only setting bus_dma_mask if some range was specified by the firmware. However, it seems that subtlety got lost in the process of fitting it into the differently-shaped control flow, and as a result the force_dma==true case ends up always setting the bus mask to the 32-bit default, which is not what anyone wants. Make sure we only touch it if the DT actually said so. Fixes: 6c2fb2ea7636 ("of/device: Set bus DMA mask as appropriate") Reported-by: Aaro Koskinen Reported-by: Jean-Philippe Brucker Tested-by: Aaro Koskinen Tested-by: John Stultz Tested-by: Geert Uytterhoeven Tested-by: Robert Richter Signed-off-by: Robin Murphy Signed-off-by: Rob Herring commit d6ee1e7e9004d3d246cdfa14196989e0a9466c16 Author: Jerome Brunet Date: Thu Nov 8 10:31:23 2018 +0100 clk: meson: axg: mark fdiv2 and fdiv3 as critical Similar to gxbb and gxl platforms, axg SCPI Cortex-M co-processor uses the fdiv2 and fdiv3 to, among other things, provide the cpu clock. Until clock hand-off mechanism makes its way to CCF and the generic SCPI claims platform specific clocks, these clocks must be marked as critical to make sure they are never disabled when needed by the co-processor. Fixes: 05f814402d61 ("clk: meson: add fdiv clock gates") Signed-off-by: Jerome Brunet Acked-by: Neil Armstrong Signed-off-by: Stephen Boyd commit e2576c8bdfd462c34b8a46c0084e7c30b0851bf4 Author: Christian Hewitt Date: Tue Nov 6 00:08:20 2018 +0100 clk: meson-gxbb: set fclk_div3 as CLK_IS_CRITICAL On the Khadas VIM2 (GXM) and LePotato (GXL) board there are problems with reboot; e.g. a ~60 second delay between issuing reboot and the board power cycling (and in some OS configurations reboot will fail and require manual power cycling). Similar to 'commit c987ac6f1f088663b6dad39281071aeb31d450a8 ("clk: meson-gxbb: set fclk_div2 as CLK_IS_CRITICAL")' the SCPI Cortex-M4 Co-Processor seems to depend on FCLK_DIV3 being operational. Until commit 05f814402d6174369b3b29832cbb5eb5ed287059 ("clk: meson: add fdiv clock gates"), this clock was modeled and left on by the bootloader. We don't have precise documentation about the SCPI Co-Processor and its clock requirement so we are learning things the hard way. Marking this clock as critical solves the problem but it should not be viewed as final solution. Ideally, the SCPI driver should claim these clocks. We also depends on some clock hand-off mechanism making its way to CCF, to make sure the clock stays on between its registration and the SCPI driver probe. Fixes: 05f814402d61 ("clk: meson: add fdiv clock gates") Signed-off-by: Christian Hewitt Signed-off-by: Jerome Brunet Signed-off-by: Stephen Boyd commit 24cc61d8cb5a9232fadf21a830061853c1268fdd Author: Ard Biesheuvel Date: Wed Nov 7 15:16:06 2018 +0100 arm64: memblock: don't permit memblock resizing until linear mapping is up Bhupesh reports that having numerous memblock reservations at early boot may result in the following crash: Unable to handle kernel paging request at virtual address ffff80003ffe0000 ... Call trace: __memcpy+0x110/0x180 memblock_add_range+0x134/0x2e8 memblock_reserve+0x70/0xb8 memblock_alloc_base_nid+0x6c/0x88 __memblock_alloc_base+0x3c/0x4c memblock_alloc_base+0x28/0x4c memblock_alloc+0x2c/0x38 early_pgtable_alloc+0x20/0xb0 paging_init+0x28/0x7f8 This is caused by the fact that we permit memblock resizing before the linear mapping is up, and so the memblock_reserved() array is moved into memory that is not mapped yet. So let's ensure that this crash can no longer occur, by deferring to call to memblock_allow_resize() to after the linear mapping has been created. Reported-by: Bhupesh Sharma Acked-by: Will Deacon Tested-by: Marc Zyngier Signed-off-by: Ard Biesheuvel Signed-off-by: Catalin Marinas commit 3e452e636d006fa759a9914c044398869acba98f Author: Ulf Hansson Date: Thu Nov 1 11:15:58 2018 +0100 ARM: cpuidle: Convert to use cpuidle_register|unregister() The only reason that remains, to why the ARM cpuidle driver calls cpuidle_register_driver(), is to avoid printing an error message in case another driver already have been registered for the CPU. This seems a bit silly, but more importantly, if that is a common scenario, perhaps we should change cpuidle_register() accordingly instead. In either case, let's consolidate the code, by converting to use cpuidle_register|unregister(), which also avoids the unnecessary allocation of the struct cpuidle_device. Signed-off-by: Ulf Hansson Reviewed-by: Lorenzo Pieralisi Reviewed-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit 763f191af51f127cf8e69cd361f50bf6180768a5 Author: Ulf Hansson Date: Thu Nov 1 13:22:38 2018 +0100 ARM: cpuidle: Don't register the driver when back-end init returns -ENXIO There's no point to register the cpuidle driver for the current CPU, when the initialization of the arch specific back-end data fails by returning -ENXIO. Instead, let's re-order the sequence to its original flow, by first trying to initialize the back-end part and then act accordingly on the returned error code. Additionally, let's print the error message, no matter of what error code that was returned. Fixes: a0d46a3dfdc3 (ARM: cpuidle: Register per cpuidle device) Signed-off-by: Ulf Hansson Reviewed-by: Daniel Lezcano Cc: 4.19+ # v4.19+ Signed-off-by: Rafael J. Wysocki commit 26a4676faa1ad5d99317e0cd701e5d6f3e716b77 Author: Ard Biesheuvel Date: Wed Nov 7 18:10:38 2018 +0100 arm64: mm: define NET_IP_ALIGN to 0 On arm64, there is no need to add 2 bytes of padding to the start of each network buffer just to make the IP header appear 32-bit aligned. Since this might actually adversely affect DMA performance some platforms, let's override NET_IP_ALIGN to 0 to get rid of this padding. Acked-by: Ilias Apalodimas Tested-by: Ilias Apalodimas Acked-by: Mark Rutland Acked-by: Will Deacon Signed-off-by: Ard Biesheuvel Signed-off-by: Catalin Marinas commit aeaf6a4b2d9ed4373e39a64c1c10cb1d93dd6bd1 Author: Sudeep Holla Date: Wed Nov 7 17:40:58 2018 +0000 dt-bindings: cpufreq: remove stale arm_big_little_dt entry Most of the ARM platforms used v2 OPP bindings to support big-little configurations. This arm_big_little_dt binding is incomplete and was never used. Commit f174e49e4906 (cpufreq: remove unused arm_big_little_dt driver) removed the driver supporting this binding, but the binding was left unnoticed, so let's get rid of it now. Fixes: f174e49e4906 (cpufreq: remove unused arm_big_little_dt driver) Signed-off-by: Sudeep Holla Acked-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit 91e43395820baad80248987608216c35da9df65b Merge: eef3dc34a1e0 cec83ff1241e Author: Tony Lindgren Date: Thu Nov 8 09:32:24 2018 -0800 Merge branch 'fixes-dts' into omap-for-v4.20/fixes commit 017ce359a7187192df5222a00fa3c9055eb3736d Author: Arnd Bergmann Date: Fri Nov 2 12:06:43 2018 +0100 ACPI / PMIC: xpower: fix IOSF_MBI dependency We still get a link failure with IOSF_MBI=m when the xpower driver is built-in: drivers/acpi/pmic/intel_pmic_xpower.o: In function `intel_xpower_pmic_update_power': intel_pmic_xpower.c:(.text+0x4f2): undefined reference to `iosf_mbi_block_punit_i2c_access' intel_pmic_xpower.c:(.text+0x5e2): undefined reference to `iosf_mbi_unblock_punit_i2c_access' This makes the dependency stronger, so we can only build when IOSF_MBI is built-in. Fixes: 6a9b593d4b6f (ACPI / PMIC: xpower: Add depends on IOSF_MBI to Kconfig entry) Signed-off-by: Arnd Bergmann Signed-off-by: Rafael J. Wysocki commit cec83ff1241ec98113a19385ea9e9cfa9aa4125b Author: Janusz Krzysztofik Date: Wed Nov 7 22:30:31 2018 +0100 ARM: OMAP1: ams-delta: Fix possible use of uninitialized field While playing with initialization order of modem device, it has been discovered that under some circumstances (early console init, I believe) its .pm() callback may be called before the uart_port->private_data pointer is initialized from plat_serial8250_port->private_data, resulting in NULL pointer dereference. Fix it by checking for uninitialized pointer before using it in modem_pm(). Fixes: aabf31737a6a ("ARM: OMAP1: ams-delta: update the modem to use regulator API") Signed-off-by: Janusz Krzysztofik Signed-off-by: Tony Lindgren commit 419b194cdedc76d0d3cd5b0900db0fa8177c4a52 Author: Adam Ford Date: Sun Oct 28 15:34:21 2018 -0500 ARM: dts: am3517-som: Fix WL127x Wifi interrupt At the same time the AM3517 EVM was gaining WiFi support, separate patches were introduced to move the interrupt from HIGH to RISING. Because they overlapped, this was not done to the AM3517-EVM. This patch fixes Kernel 4.19+ Fixes: 6bf5e3410f19 ("ARM: dts: am3517-som: Add WL127x Wifi") Signed-off-by: Adam Ford Signed-off-by: Tony Lindgren commit 3d8b804bc528d3720ec0c39c212af92dafaf6e84 Author: Adam Ford Date: Sun Oct 28 15:29:27 2018 -0500 ARM: dts: logicpd-somlv: Fix interrupt on mmc3_dat1 The interrupt on mmc3_dat1 is wrong which prevents this from appearing in /proc/interrupts. Fixes: ab8dd3aed011 ("ARM: DTS: Add minimal Support for Logic PD DM3730 SOM-LV") #Kernel 4.9+ Signed-off-by: Adam Ford Signed-off-by: Tony Lindgren commit 6809564d64ff1301d44c13334cc0e8369e825a20 Author: Adam Ford Date: Sun Oct 28 15:28:32 2018 -0500 ARM: dts: LogicPD Torpedo: Fix mmc3_dat1 interrupt When the Torpedo was first introduced back at Kernel 4.2, the interrupt extended flag has been set incorrectly. It was subsequently moved, so this patch corrects Kernel 4.18+ Fixes: a38867305203 ("ARM: dts: Move move WiFi bindings to logicpd-torpedo-37xx-devkit") # v4.18+ Signed-off-by: Adam Ford Signed-off-by: Tony Lindgren commit e7f4ffffa972db4820c23ff9831a6a4f3f6d8cc5 Author: Adam Ford Date: Sun Oct 28 15:13:48 2018 -0500 ARM: dts: am3517: Fix pinmuxing for CD on MMC1 The MMC1 is active low, not active high. For some reason, this worked with different combination of U-Boot and kernels, but it's supposed to be active low and is currently broken. Fixes: cfaa856a2510 ("ARM: dts: am3517: Add pinmuxing, CD and WP for MMC1") #kernel 4.18+ Signed-off-by: Adam Ford Signed-off-by: Tony Lindgren commit 025911a5f4e36955498ed50806ad1b02f0f76288 Author: YueHaibing Date: Thu Nov 8 02:04:57 2018 +0000 SUNRPC: drop pointless static qualifier in xdr_get_next_encode_buffer() There is no need to have the '__be32 *p' variable static since new value always be assigned before use it. Signed-off-by: YueHaibing Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields commit 01310bb7c9c98752cc763b36532fab028e0f8f81 Author: Scott Mayhew Date: Thu Nov 8 11:11:36 2018 -0500 nfsd: COPY and CLONE operations require the saved filehandle to be set Make sure we have a saved filehandle, otherwise we'll oops with a null pointer dereference in nfs4_preprocess_stateid_op(). Signed-off-by: Scott Mayhew Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields commit 23c625ce3065e40c933a4239efb9b11f1194a343 Author: Ilya Dryomov Date: Thu Nov 8 14:55:21 2018 +0100 libceph: assume argonaut on the server side No one is running pre-argonaut. In addition one of the argonaut features (NOSRCADDR) has been required since day one (and a half, 2.6.34 vs 2.6.35) of the kernel client. Allow for the possibility of reusing these feature bits later. Signed-off-by: Ilya Dryomov Reviewed-by: Sage Weil commit 71f2cc64d027d712f29bf8d09d3e123302d5f245 Author: Luis Henriques Date: Mon Nov 5 19:00:52 2018 +0000 ceph: quota: fix null pointer dereference in quota check This patch fixes a possible null pointer dereference in check_quota_exceeded, detected by the static checker smatch, with the following warning:    fs/ceph/quota.c:240 check_quota_exceeded()     error: we previously assumed 'realm' could be null (see line 188) Fixes: b7a2921765cf ("ceph: quota: support for ceph.quota.max_files") Reported-by: Dan Carpenter Signed-off-by: Luis Henriques Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit c2c6d3ce0d9a1fae4472fc10755372d022a487a4 Author: Luis Henriques Date: Tue Oct 23 16:53:14 2018 +0000 ceph: add destination file data sync before doing any remote copy If we try to copy into a file that was just written, any data that is remote copied will be overwritten by our buffered writes once they are flushed.  When this happens, the call to invalidate_inode_pages2_range will also return a -EBUSY error. This patch fixes this by also sync'ing the destination file before starting any copy. Fixes: 503f82a9932d ("ceph: support copy_file_range file operation") Signed-off-by: Luis Henriques Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit b469e7e47c8a075cc08bcd1e85d4365134bdcdd5 Author: Amir Goldstein Date: Tue Oct 30 20:29:53 2018 +0200 fanotify: fix handling of events on child sub-directory When an event is reported on a sub-directory and the parent inode has a mark mask with FS_EVENT_ON_CHILD|FS_ISDIR, the event will be sent to fsnotify() even if the event type is not in the parent mark mask (e.g. FS_OPEN). Further more, if that event happened on a mount or a filesystem with a mount/sb mark that does have that event type in their mask, the "on child" event will be reported on the mount/sb mark. That is not desired, because user will get a duplicate event for the same action. Note that the event reported on the victim inode is never merged with the event reported on the parent inode, because of the check in should_merge(): old_fsn->inode == new_fsn->inode. Fix this by looking for a match of an actual event type (i.e. not just FS_ISDIR) in parent's inode mark mask and by not reporting an "on child" event to group if event type is only found on mount/sb marks. [backport hint: The bug seems to have always been in fanotify, but this patch will only apply cleanly to v4.19.y] Cc: # v4.19 Signed-off-by: Amir Goldstein Signed-off-by: Jan Kara commit bb39ba6a8deab70752b836a36c62205b1c65b559 Author: Kuninori Morimoto Date: Thu Nov 8 06:34:34 2018 +0000 sata_rcar: convert to SPDX identifiers This patch updates license to use SPDX-License-Identifier instead of verbose license text. Signed-off-by: Kuninori Morimoto Signed-off-by: Jens Axboe commit 0033dfd92a5646a78025e86f8df4d5b18181ba2c Author: Anton Ivanov Date: Thu Nov 8 13:07:23 2018 +0000 ubd: fix missing initialization of io_req The SYNC path doesn't initialize io_req->error, which can cause random errors. Before the conversion to blk-mq, we always completed requests with BLK_STS_OK status, but now we actually look at the error field and this issue becomes apparent. Signed-off-by: Anton Ivanov [axboe: fixed up commit message to explain what is actually going on] Signed-off-by: Jens Axboe commit d0ffb805b729322626639336986bc83fc2e60871 Author: H. Peter Anvin (Intel) Date: Mon Oct 22 09:19:05 2018 -0700 arch/alpha, termios: implement BOTHER, IBSHIFT and termios2 Alpha has had c_ispeed and c_ospeed, but still set speeds in c_cflags using arbitrary flags. Because BOTHER is not defined, the general Linux code doesn't allow setting arbitrary baud rates, and because CBAUDEX == 0, we can have an array overrun of the baud_rate[] table in drivers/tty/tty_baudrate.c if (c_cflags & CBAUD) == 037. Resolve both problems by #defining BOTHER to 037 on Alpha. However, userspace still needs to know if setting BOTHER is actually safe given legacy kernels (does anyone actually care about that on Alpha anymore?), so enable the TCGETS2/TCSETS*2 ioctls on Alpha, even though they use the same structure. Define struct termios2 just for compatibility; it is the exact same structure as struct termios. In a future patchset, this will be cleaned up so the uapi headers are usable from libc. Signed-off-by: H. Peter Anvin (Intel) Cc: Jiri Slaby Cc: Al Viro Cc: Richard Henderson Cc: Ivan Kokshaysky Cc: Matt Turner Cc: Thomas Gleixner Cc: Kate Stewart Cc: Philippe Ombredanne Cc: Eugene Syromiatnikov Cc: Cc: Cc: Johan Hovold Cc: Alan Cox Cc: Signed-off-by: Greg Kroah-Hartman commit b00d209241ff7ac336543f92ea764b9d6b03032a Merge: d50ffc585dbe 24efee412c75 Author: Linus Torvalds Date: Thu Nov 8 07:06:58 2018 -0500 Merge tag 'compiler-attributes-for-linus-v4.20-rc2' of https://github.com/ojeda/linux Pull compiler attribute fixlets from Miguel Ojeda: "Small improvements to Compiler Attributes: - Define asm_volatile_goto for non-gcc compilers (Nick Desaulniers) - Improve the explanation of compiler_attributes.h" * tag 'compiler-attributes-for-linus-v4.20-rc2' of https://github.com/ojeda/linux: Compiler Attributes: improve explanation of header include/linux/compiler*.h: define asm_volatile_goto commit d50ffc585dbec04fb1d219d5e8523fe6055e706f Merge: 85758777c2a2 98ee3fc7ef83 Author: Linus Torvalds Date: Thu Nov 8 07:04:29 2018 -0500 Merge tag 'mtd/fixes-for-4.20-rc2' of git://git.infradead.org/linux-mtd Pull MTD fixes from Boris Brezillon: "MTD changes: - Kill a VLA in sa1100 SPI NOR changes: - Make sure ->addr_width is restored when SFDP parsing fails - Propate errors happening in cqspi_direct_read_execute() NAND changes: - Fix kernel-doc mismatch - Fix nanddev_neraseblocks() to return the correct value - Avoid selection of BCH_CONST_PARAMS when some users require dynamic BCH settings" * tag 'mtd/fixes-for-4.20-rc2' of git://git.infradead.org/linux-mtd: mtd: nand: Fix nanddev_pos_next_page() kernel-doc header mtd: sa1100: avoid VLA in sa1100_setup_mtd mtd: spi-nor: Reset nor->addr_width when SFDP parsing failed mtd: spi-nor: cadence-quadspi: Return error code in cqspi_direct_read_execute() mtd: nand: Fix nanddev_neraseblocks() mtd: nand: drop kernel-doc notation for a deleted function parameter mtd: docg3: don't set conflicting BCH_CONST_PARAMS option commit 991a25194097006ec1e0d2e0814ff920e59e3465 Author: H. Peter Anvin Date: Mon Oct 22 09:19:04 2018 -0700 termios, tty/tty_baudrate.c: fix buffer overrun On architectures with CBAUDEX == 0 (Alpha and PowerPC), the code in tty_baudrate.c does not do any limit checking on the tty_baudrate[] array, and in fact a buffer overrun is possible on both architectures. Add a limit check to prevent that situation. This will be followed by a much bigger cleanup/simplification patch. Signed-off-by: H. Peter Anvin (Intel) Requested-by: Cc: Johan Hovold Cc: Jiri Slaby Cc: Al Viro Cc: Richard Henderson Cc: Ivan Kokshaysky Cc: Matt Turner Cc: Thomas Gleixner Cc: Kate Stewart Cc: Philippe Ombredanne Cc: Eugene Syromiatnikov Cc: Alan Cox Cc: stable Signed-off-by: Greg Kroah-Hartman commit 943210ba807ec50aafa2fa7b13bd6d36a478969b Author: Mikulas Patocka Date: Tue Oct 23 11:28:28 2018 -0400 vt: fix broken display when running aptitude If you run aptitude on framebuffer console, the display is corrupted. The corruption is caused by the commit d8ae7242. The patch adds "offset" to "start" when calling scr_memsetw, but it forgets to do the same addition on a subsequent call to do_update_region. Signed-off-by: Mikulas Patocka Fixes: d8ae72427187 ("vt: preserve unicode values corresponding to screen characters") Reviewed-by: Nicolas Pitre Cc: stable@vger.kernel.org # 4.19 Signed-off-by: Greg Kroah-Hartman commit e82e62e390d39c3819641cd721695702180d54fb Author: Sebastian Parschauer Date: Wed Nov 7 13:36:40 2018 +0100 HID: Add quirk for Microsoft PIXART OEM mouse The PixArt OEM mice are known for disconnecting every minute in runlevel 1 or 3 if they are not always polled. So add quirk ALWAYS_POLL for this one as well. References: https://www.spinics.net/lists/linux-usb/msg88965.html http://linet.gr.jp/~kojima/PlamoWeb/ML/htdocs/201808/msg00019.html Signed-off-by: Sebastian Parschauer CC: stable@vger.kernel.org Signed-off-by: Jiri Kosina commit e46daee53bb50bde38805f1823a182979724c229 Author: Kees Cook Date: Tue Oct 30 22:12:56 2018 +0100 ARM: 8806/1: kprobes: Fix false positive with FORTIFY_SOURCE The arm compiler internally interprets an inline assembly label as an unsigned long value, not a pointer. As a result, under CONFIG_FORTIFY_SOURCE, the address of a label has a size of 4 bytes, which was tripping the runtime checks. Instead, we can just cast the label (as done with the size calculations earlier). Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1639397 Reported-by: William Cohen Fixes: 6974f0c4555e ("include/linux/string.h: add the option of fortified string.h functions") Cc: stable@vger.kernel.org Acked-by: Laura Abbott Acked-by: Masami Hiramatsu Tested-by: William Cohen Signed-off-by: Kees Cook Signed-off-by: Russell King commit 24efee412c75843755da0ddd7bbc2db2ce9129f5 Author: Miguel Ojeda Date: Tue Nov 6 22:52:11 2018 +0100 Compiler Attributes: improve explanation of header Explain better what "optional" attributes are, and avoid calling them so to avoid confusion. Simply retain "Optional" as a word to look for in the comments. Moreover, add a couple sentences to explain a bit more the intention and the documentation links. Signed-off-by: Miguel Ojeda commit e5b78f2e349eef5d4fca5dc1cf5a3b4b2cc27abd Author: Geert Uytterhoeven Date: Wed Nov 7 14:18:50 2018 +0100 iommu/ipmmu-vmsa: Fix crash on early domain free If iommu_ops.add_device() fails, iommu_ops.domain_free() is still called, leading to a crash, as the domain was only partially initialized: ipmmu-vmsa e67b0000.mmu: Cannot accommodate DMA translation for IOMMU page tables sata_rcar ee300000.sata: Unable to initialize IPMMU context iommu: Failed to add device ee300000.sata to group 0: -22 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000038 ... Call trace: ipmmu_domain_free+0x1c/0xa0 iommu_group_release+0x48/0x68 kobject_put+0x74/0xe8 kobject_del.part.0+0x3c/0x50 kobject_put+0x60/0xe8 iommu_group_get_for_dev+0xa8/0x1f0 ipmmu_add_device+0x1c/0x40 of_iommu_configure+0x118/0x190 Fix this by checking if the domain's context already exists, before trying to destroy it. Signed-off-by: Geert Uytterhoeven Reviewed-by: Robin Murphy Fixes: d25a2a16f0889 ('iommu: Add driver for Renesas VMSA-compatible IPMMU') Signed-off-by: Joerg Roedel commit 9c8e0a1b683525464a2abe9fb4b54404a50ed2b4 Author: Eric W. Biederman Date: Thu Oct 25 12:05:11 2018 -0500 mount: Prevent MNT_DETACH from disconnecting locked mounts Timothy Baldwin wrote: > As per mount_namespaces(7) unprivileged users should not be able to look under mount points: > > Mounts that come as a single unit from more privileged mount are locked > together and may not be separated in a less privileged mount namespace. > > However they can: > > 1. Create a mount namespace. > 2. In the mount namespace open a file descriptor to the parent of a mount point. > 3. Destroy the mount namespace. > 4. Use the file descriptor to look under the mount point. > > I have reproduced this with Linux 4.16.18 and Linux 4.18-rc8. > > The setup: > > $ sudo sysctl kernel.unprivileged_userns_clone=1 > kernel.unprivileged_userns_clone = 1 > $ mkdir -p A/B/Secret > $ sudo mount -t tmpfs hide A/B > > > "Secret" is indeed hidden as expected: > > $ ls -lR A > A: > total 0 > drwxrwxrwt 2 root root 40 Feb 12 21:08 B > > A/B: > total 0 > > > The attack revealing "Secret": > > $ unshare -Umr sh -c "exec unshare -m ls -lR /proc/self/fd/4/ 4 /proc/self/fd/4/: > total 0 > drwxr-xr-x 3 root root 60 Feb 12 21:08 B > > /proc/self/fd/4/B: > total 0 > drwxr-xr-x 2 root root 40 Feb 12 21:08 Secret > > /proc/self/fd/4/B/Secret: > total 0 I tracked this down to put_mnt_ns running passing UMOUNT_SYNC and disconnecting all of the mounts in a mount namespace. Fix this by factoring drop_mounts out of drop_collected_mounts and passing 0 instead of UMOUNT_SYNC. There are two possible behavior differences that result from this. - No longer setting UMOUNT_SYNC will no longer set MNT_SYNC_UMOUNT on the vfsmounts being unmounted. This effects the lazy rcu walk by kicking the walk out of rcu mode and forcing it to be a non-lazy walk. - No longer disconnecting locked mounts will keep some mounts around longer as they stay because the are locked to other mounts. There are only two users of drop_collected mounts: audit_tree.c and put_mnt_ns. In audit_tree.c the mounts are private and there are no rcu lazy walks only calls to iterate_mounts. So the changes should have no effect except for a small timing effect as the connected mounts are disconnected. In put_mnt_ns there may be references from process outside the mount namespace to the mounts. So the mounts remaining connected will be the bug fix that is needed. That rcu walks are allowed to continue appears not to be a problem especially as the rcu walk change was about an implementation detail not about semantics. Cc: stable@vger.kernel.org Fixes: 5ff9d8a65ce8 ("vfs: Lock in place mounts from more privileged users") Reported-by: Timothy Baldwin Tested-by: Timothy Baldwin Signed-off-by: "Eric W. Biederman" commit 0bb2ae1b26e1fb7543ec7474cdd374ac4b88c4da Author: Thomas Richter Date: Mon Oct 29 08:11:33 2018 +0000 s390/perf: Change CPUM_CF return code in event init function The function perf_init_event() creates a new event and assignes it to a PMU. This a done in a loop over all existing PMUs. For each listed PMU the event init function is called and if this function does return any other error than -ENOENT, the loop is terminated the creation of the event fails. If the event is invalid, return -ENOENT to try other PMUs. Signed-off-by: Thomas Richter Reviewed-by: Hendrik Brueckner Signed-off-by: Martin Schwidefsky commit e6a2d72c10405b30ddba5af2e44a9d3d925a56d3 Author: Juri Lelli Date: Wed Nov 7 12:10:32 2018 +0100 posix-cpu-timers: Remove useless call to check_dl_overrun() check_dl_overrun() is used to send a SIGXCPU to users that asked to be informed when a SCHED_DEADLINE runtime overruns occur. The function is called by check_thread_timers() already, so the call in check_process_timers() is redundant/wrong (even though harmless). Remove it. Fixes: 34be39305a77 ("sched/deadline: Implement "runtime overrun signal" support") Signed-off-by: Juri Lelli Signed-off-by: Thomas Gleixner Reviewed-by: Daniel Bristot de Oliveira Reviewed-by: Steven Rostedt (VMware) Cc: linux-rt-users@vger.kernel.org Cc: mtk.manpages@gmail.com Cc: Mathieu Poirier Cc: Peter Zijlstra Cc: Luca Abeni Cc: Claudio Scordino Link: https://lkml.kernel.org/r/20181107111032.32291-1-juri.lelli@redhat.com commit b25ddb00bc1b96613edcb525f19203a7d1405fce Author: Michał Mirosław Date: Wed Nov 7 17:50:53 2018 +0100 qlcnic: remove assumption that vlan_tci != 0 VLAN.TCI == 0 is perfectly valid (802.1p), so allow it to be accelerated. Signed-off-by: Michał Mirosław Signed-off-by: David S. Miller commit e84b47941e15e6666afb8ee8b21d1c3fc1a013af Author: Michał Mirosław Date: Wed Nov 7 17:50:52 2018 +0100 ibmvnic: fix accelerated VLAN handling Don't request tag insertion when it isn't present in outgoing skb. Signed-off-by: Michał Mirosław Signed-off-by: David S. Miller commit df7342b240185d58d3d9665c0bbf0a0f5570ec29 Author: Eric W. Biederman Date: Thu Oct 25 09:04:18 2018 -0500 mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts Jonathan Calmels from NVIDIA reported that he's able to bypass the mount visibility security check in place in the Linux kernel by using a combination of the unbindable property along with the private mount propagation option to allow a unprivileged user to see a path which was purposefully hidden by the root user. Reproducer: # Hide a path to all users using a tmpfs root@castiana:~# mount -t tmpfs tmpfs /sys/devices/ root@castiana:~# # As an unprivileged user, unshare user namespace and mount namespace stgraber@castiana:~$ unshare -U -m -r # Confirm the path is still not accessible root@castiana:~# ls /sys/devices/ # Make /sys recursively unbindable and private root@castiana:~# mount --make-runbindable /sys root@castiana:~# mount --make-private /sys # Recursively bind-mount the rest of /sys over to /mnnt root@castiana:~# mount --rbind /sys/ /mnt # Access our hidden /sys/device as an unprivileged user root@castiana:~# ls /mnt/devices/ breakpoint cpu cstate_core cstate_pkg i915 intel_pt isa kprobe LNXSYSTM:00 msr pci0000:00 platform pnp0 power software system tracepoint uncore_arb uncore_cbox_0 uncore_cbox_1 uprobe virtual Solve this by teaching copy_tree to fail if a mount turns out to be both unbindable and locked. Cc: stable@vger.kernel.org Fixes: 5ff9d8a65ce8 ("vfs: Lock in place mounts from more privileged users") Reported-by: Jonathan Calmels Signed-off-by: "Eric W. Biederman" commit 25d202ed820ee347edec0bf3bf553544556bf64b Author: Eric W. Biederman Date: Mon Oct 22 10:21:38 2018 -0500 mount: Retest MNT_LOCKED in do_umount It was recently pointed out that the one instance of testing MNT_LOCKED outside of the namespace_sem is in ksys_umount. Fix that by adding a test inside of do_umount with namespace_sem and the mount_lock held. As it helps to fail fails the existing test is maintained with an additional comment pointing out that it may be racy because the locks are not held. Cc: stable@vger.kernel.org Reported-by: Al Viro Fixes: 5ff9d8a65ce8 ("vfs: Lock in place mounts from more privileged users") Signed-off-by: "Eric W. Biederman" commit b1870a6d3f398e869b4eb2a8297cc8a80899c80d Merge: 69e362985fcb 8f5365ebf7b1 Author: David S. Miller Date: Wed Nov 7 21:53:31 2018 -0800 Merge branch 'FDDI-defza-Fix-a-bunch-of-small-issues' Maciej W. Rozycki says: ==================== FDDI: defza: Fix a bunch of small issues Here is a bunch of small fixes addressing issues that I missed in my final round of testing. None of these affect run-time behaviour. One was actually found by the kbuild bot, which turned out to be more pedantic than my compiler. See individual change descriptions for details. ==================== Signed-off-by: David S. Miller commit 8f5365ebf7b17c35dddbb694b4f0ffd1293a947f Author: Maciej W. Rozycki Date: Wed Nov 7 12:07:10 2018 +0000 FDDI: defza: Make the driver version string constant The driver version string is obviously not meant to be changed at run time, so mark it `const'. Signed-off-by: Maciej W. Rozycki Signed-off-by: David S. Miller commit 04453b6b241913f85af013eec187bab776428af5 Author: Maciej W. Rozycki Date: Wed Nov 7 12:07:05 2018 +0000 FDDI: defza: Move SMT Tx data buffer declaration next to its skb Move the temporary data buffer used when tapping into the SMT Tx queue from the outer function level into the conditional block it's actually used in and its containing skb is also declared, making the structure of code better. Signed-off-by: Maciej W. Rozycki Signed-off-by: David S. Miller commit 5f5fae37dbcf37feae48c40d2580dbd67c5df131 Author: Maciej W. Rozycki Date: Wed Nov 7 12:06:59 2018 +0000 FDDI: defza: Add missing comment closing Fix: drivers/net/fddi/defza.h:238:1: warning: "/*" within comment [-Wcomment] by adding a missing comment closing. Signed-off-by: Maciej W. Rozycki Signed-off-by: David S. Miller commit 96ed82cc1f515a2329f93506129ab1de35429b89 Author: Maciej W. Rozycki Date: Wed Nov 7 12:06:52 2018 +0000 FDDI: defza: Fix SPDX annotation The SPDX annotation for this driver does not match the license text, which specifies GNU GPL 2 or later. Make the two match by correcting the SPDX tag. Signed-off-by: Maciej W. Rozycki Signed-off-by: David S. Miller commit d2f007dbe7e4c9583eea6eb04d60001e85c6f1bd Author: Jann Horn Date: Mon Nov 5 20:55:09 2018 +0100 userns: also map extents in the reverse map to kernel IDs The current logic first clones the extent array and sorts both copies, then maps the lower IDs of the forward mapping into the lower namespace, but doesn't map the lower IDs of the reverse mapping. This means that code in a nested user namespace with >5 extents will see incorrect IDs. It also breaks some access checks, like inode_owner_or_capable() and privileged_wrt_inode_uidgid(), so a process can incorrectly appear to be capable relative to an inode. To fix it, we have to make sure that the "lower_first" members of extents in both arrays are translated; and we have to make sure that the reverse map is sorted *after* the translation (since otherwise the translation can break the sorting). This is CVE-2018-18955. Fixes: 6397fac4915a ("userns: bump idmap limits to 340") Cc: stable@vger.kernel.org Signed-off-by: Jann Horn Tested-by: Eric W. Biederman Reviewed-by: Eric W. Biederman Signed-off-by: Eric W. Biederman commit de59fae0043f07de5d25e02ca360f7d57bfa5866 Author: Vasily Averin Date: Wed Nov 7 22:36:23 2018 -0500 ext4: fix buffer leak in __ext4_read_dirblock() on error path Fixes: dc6982ff4db1 ("ext4: refactor code to read directory blocks ...") Signed-off-by: Vasily Averin Signed-off-by: Theodore Ts'o Cc: stable@kernel.org # 3.9 commit 69e362985fcbbb0589fc3e910fab00e6cdcc17e7 Merge: 042cb5647815 d5596fd46770 Author: David S. Miller Date: Wed Nov 7 17:08:51 2018 -0800 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue Jeff Kirsher says: ==================== Intel Wired LAN Driver Updates 2018-11-07 This series contains fixes to igb, i40e and ice drivers. Anirudh fixes an issue during rebuild of the ice driver, where we need to set the carrier state, as well as start or stop the queues all based on the link status. Removed functions that were duplicating current functionality in the VSI rebuild/replay framework. Dave fixes a potential resource collision during the remove path, so add a check to see if we are in the middle of a reset. Fixed the remove path to ensure we call netif_napi_del() to free vectors before we set vsi->netdev to NULL. Akeem fixes an issue when the receive or transmit pause parameter is set, results in link loss on the interface. Fixed the spelling of "Enabling" in error message. Victor fixes potential memory leak by also freeing the related VSI contexts in the unload path. Md Fahad fixes a flag during port VLAN insertion, which was not being set properly. Brett fixes a transmit timeout during stress due to the hardware tail and software tail were incorrectly out of sync. Miroslav Lichvar fixes the igb PHC timecounter update interval to be sure the timecounter is updated in time. Chinh fixes the req_speeds variable to be u16 instead of u8 so that it can handle all the link speeds. Jake fixes i40e to add back the missing feature flags, which was causing IP-in-IP offloads to be reported as not supported. ==================== Signed-off-by: David S. Miller commit 63237f8748bdf46dccf79ef8f98f05e9fe799162 Author: Lyude Paul Date: Thu Nov 1 21:51:49 2018 -0400 drm/amd/amdgpu/dm: Fix dm_dp_create_fake_mst_encoder() [why] Removing connector reusage from DM to match the rest of the tree ended up revealing an issue that was surprisingly subtle. The original amdgpu code for DC that was submitted appears to have left a chunk in dm_dp_create_fake_mst_encoder() that tries to find a "master encoder", the likes of which isn't actually used or stored anywhere. It does so at the wrong time as well by trying to access parts of the drm_connector from the encoder init before it's actually been initialized. This results in a NULL pointer deref on MST hotplugs: [ 160.696613] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 [ 160.697234] PGD 0 P4D 0 [ 160.697814] Oops: 0010 [#1] SMP PTI [ 160.698430] CPU: 2 PID: 64 Comm: kworker/2:1 Kdump: loaded Tainted: G O 4.19.0Lyude-Test+ #2 [ 160.699020] Hardware name: HP HP ZBook 15 G4/8275, BIOS P70 Ver. 01.22 05/17/2018 [ 160.699672] Workqueue: events_long drm_dp_mst_link_probe_work [drm_kms_helper] [ 160.700322] RIP: 0010: (null) [ 160.700920] Code: Bad RIP value. [ 160.701541] RSP: 0018:ffffc9000029fc78 EFLAGS: 00010206 [ 160.702183] RAX: 0000000000000000 RBX: ffff8804440ed468 RCX: ffff8804440e9158 [ 160.702778] RDX: 0000000000000000 RSI: ffff8804556c5700 RDI: ffff8804440ed000 [ 160.703408] RBP: ffff880458e21800 R08: 0000000000000002 R09: 000000005fca0a25 [ 160.704002] R10: ffff88045a077a3d R11: ffff88045a077a3c R12: ffff8804440ed000 [ 160.704614] R13: ffff880458e21800 R14: ffff8804440e9000 R15: ffff8804440e9000 [ 160.705260] FS: 0000000000000000(0000) GS:ffff88045f280000(0000) knlGS:0000000000000000 [ 160.705854] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 160.706478] CR2: ffffffffffffffd6 CR3: 000000000200a001 CR4: 00000000003606e0 [ 160.707124] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 160.707724] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 160.708372] Call Trace: [ 160.708998] ? dm_dp_add_mst_connector+0xed/0x1d0 [amdgpu] [ 160.709625] ? drm_dp_add_port+0x2fa/0x470 [drm_kms_helper] [ 160.710284] ? wake_up_q+0x54/0x70 [ 160.710877] ? __mutex_unlock_slowpath.isra.18+0xb3/0x110 [ 160.711512] ? drm_dp_dpcd_access+0xe7/0x110 [drm_kms_helper] [ 160.712161] ? drm_dp_send_link_address+0x155/0x1e0 [drm_kms_helper] [ 160.712762] ? drm_dp_check_and_send_link_address+0xa3/0xd0 [drm_kms_helper] [ 160.713408] ? drm_dp_mst_link_probe_work+0x4b/0x80 [drm_kms_helper] [ 160.714013] ? process_one_work+0x1a1/0x3a0 [ 160.714667] ? worker_thread+0x30/0x380 [ 160.715326] ? wq_update_unbound_numa+0x10/0x10 [ 160.715939] ? kthread+0x112/0x130 [ 160.716591] ? kthread_create_worker_on_cpu+0x70/0x70 [ 160.717262] ? ret_from_fork+0x35/0x40 [ 160.717886] Modules linked in: amdgpu(O) vfat fat snd_hda_codec_generic joydev i915 chash gpu_sched ttm i2c_algo_bit drm_kms_helper snd_hda_codec_hdmi hp_wmi syscopyarea iTCO_wdt sysfillrect sparse_keymap sysimgblt fb_sys_fops snd_hda_intel usbhid wmi_bmof drm snd_hda_codec btusb snd_hda_core intel_rapl btrtl x86_pkg_temp_thermal btbcm btintel coretemp snd_pcm crc32_pclmul bluetooth psmouse snd_timer snd pcspkr i2c_i801 mei_me i2c_core soundcore mei tpm_tis wmi tpm_tis_core hp_accel ecdh_generic lis3lv02d tpm video rfkill acpi_pad input_polldev hp_wireless pcc_cpufreq crc32c_intel serio_raw tg3 xhci_pci xhci_hcd [last unloaded: amdgpu] [ 160.720141] CR2: 0000000000000000 Somehow the connector reusage DM was using for MST connectors managed to paper over this issue entirely; hence why this was never caught until now. [how] Since this code isn't used anywhere and seems useless anyway, we can just drop it entirely. This appears to fix the issue on my HP ZBook with an AMD WX4150. Signed-off-by: Lyude Paul Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit 0e6613e46fed29316f33acf86e1d1568288638b5 Author: Jerry (Fangzhi) Zuo Date: Tue Oct 30 14:37:16 2018 -0400 drm/amd/display: Drop reusing drm connector for MST [why] It is not safe to keep existing connector while entire topology has been removed. Could lead potential impact to uapi. Entirely unregister all the connectors on the topology, and use a new set of connectors when the topology is plugged back on. [How] Remove the drm connector entirely each time when the corresponding MST topology is gone. When hotunplug a connector (e.g., DP2) 1. Remove connector from userspace. 2. Drop it's reference. When hotplug back on: 1. Detect new topology, and create new connectors. 2. Notify userspace with sysfs hotplug event. 3. Reprobe new connectors, and reassign CRTC from old (e.g., DP2) to new (e.g., DP3) connector. Signed-off-by: Jerry (Fangzhi) Zuo Reviewed-by: Harry Wentland Reviewed-by: Lyude Paul Signed-off-by: Alex Deucher commit 8be17ac95f8451b51f636622d8d4b8674334f468 Author: Jerry (Fangzhi) Zuo Date: Tue Oct 30 14:28:49 2018 -0400 drm/amd/display: Cleanup MST non-atomic code workaround [why] It is not correct to touch aconnector within atomic_check. [How] It was added as workaround before, and no longer needed. Signed-off-by: Jerry (Fangzhi) Zuo Reviewed-by: Harry Wentland Reviewed-by: Lyude Paul Signed-off-by: Alex Deucher commit 108110a3ffa3483d743f3bff93917ba64dc8edd0 Author: Evan Quan Date: Wed Nov 7 09:16:07 2018 +0800 drm/amd/powerplay: always use fast UCLK switching when UCLK DPM enabled With UCLK DPM enabled, slow switching is not supported any more. Signed-off-by: Evan Quan Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit 3c7eda0b65ad279dd2f26908d2f4bd088da93996 Author: Evan Quan Date: Wed Oct 24 12:11:35 2018 +0800 drm/amd/powerplay: set a default fclk/gfxclk ratio Otherwise big gap between these two clocks may causes some hangs. Signed-off-by: Evan Quan Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit f3587d76da05f68098ddb1cb3c98cc6a9e8a402c Author: Keith Busch Date: Wed Nov 7 07:37:45 2018 -0700 block: Clear kernel memory before copying to user If the kernel allocates a bounce buffer for user read data, this memory needs to be cleared before copying it to the user, otherwise it may leak kernel memory to user space. Laurence Oberman Signed-off-by: Keith Busch Signed-off-by: Jens Axboe commit e31d36b0a453d581fb077fce6883811c5e14874d Author: Geert Uytterhoeven Date: Wed Nov 7 10:47:57 2018 +0100 MAINTAINERS: Fix remaining pointers to obsolete libata.git libata.git no longer exists. Replace the remaining pointers to it by pointers to the block tree, which is where all libata development happens now. Signed-off-by: Geert Uytterhoeven Signed-off-by: Jens Axboe commit 6961cd4d0fde97f1cdb798ba21cf124ecfa0bf95 Author: Jens Axboe Date: Wed Nov 7 14:34:05 2018 -0700 ubd: fix missing lock around request issue We need to hold the device lock (and disable interrupts) while writing new commands, or we could be interrupted while that is happening and read invalid requests in the completion path. Fixes: 4e6da0fe8058 ("um: Convert ubd driver to blk-mq") Tested-by: Richard Weinberger Signed-off-by: Jens Axboe commit cf3d02a185edf449d30465dae8d22a4979545829 Author: Sean Paul Date: Wed Nov 7 15:55:33 2018 -0500 drm: Fix htmldocs warnings in drm_fourcc.c Add a description for dev and remove the excess one for native. Fixes the following warnings: ../drivers/gpu/drm/drm_fourcc.c:112: warning: Function parameter or member 'dev' not described in 'drm_driver_legacy_fb_format' ../drivers/gpu/drm/drm_fourcc.c:112: warning: Excess function parameter 'native' description in 'drm_driver_legacy_fb_format' Fixes: 059b5eb5d955 ("drm: move native byte order quirk to new drm_driver_legacy_fb_format function") Cc: Gerd Hoffmann Cc: Daniel Vetter Reviewed-by: Daniel Vetter Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20181107205546.216088-1-sean@poorly.run commit 406e7f986b2e4499295351bcfff5c93b0d34022a Author: Geert Uytterhoeven Date: Wed Nov 7 14:45:24 2018 +0100 Documentation: ABI: led-trigger-pattern: Fix typos - Spelling s/brigntess/brightness/, - Double "use". Signed-off-by: Geert Uytterhoeven Acked-by: Pavel Machek Signed-off-by: Jacek Anaszewski commit 3a40cfe8ba3abba57af2c7e26aad2c6dd1681864 Author: Baolin Wang Date: Wed Nov 7 13:42:58 2018 +0800 leds: trigger: Fix sleeping function called from invalid context We will meet below issue due to mutex_lock() is called in interrupt context. The mutex lock is used to protect the pattern trigger data, but before changing new pattern trigger data (pattern values or repeat value) by users, we always cancel the timer firstly to clear previous patterns' performance. That means there is no race in pattern_trig_timer_function(), so we can drop the mutex lock in pattern_trig_timer_function() to avoid this issue. Moreover we can move the timer cancelling into mutex protection, since there is no deadlock risk if we remove the mutex lock in pattern_trig_timer_function(). BUG: sleeping function called from invalid context at kernel/locking/mutex.c:254 in_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper/1 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.20.0-rc1-koelsch-00841-ga338c8181013c1a9 #171 Hardware name: Generic R-Car Gen2 (Flattened Device Tree) [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [] (show_stack) from [] (dump_stack+0x7c/0x9c) [] (dump_stack) from [] (___might_sleep+0xf4/0x158) [] (___might_sleep) from [] (mutex_lock+0x18/0x60) [] (mutex_lock) from [] (pattern_trig_timer_function+0x1c/0x11c) [] (pattern_trig_timer_function) from [] (call_timer_fn+0x1c/0x90) [] (call_timer_fn) from [] (expire_timers+0x94/0xa4) [] (expire_timers) from [] (run_timer_softirq+0x108/0x15c) [] (run_timer_softirq) from [] (__do_softirq+0x1d4/0x258) [] (__do_softirq) from [] (irq_exit+0x64/0xc4) [] (irq_exit) from [] (__handle_domain_irq+0x80/0xb4) [] (__handle_domain_irq) from [] (gic_handle_irq+0x58/0x90) [] (gic_handle_irq) from [] (__irq_svc+0x58/0x74) Exception stack(0xeb483f60 to 0xeb483fa8) 3f60: 00000000 00000000 eb9afaa0 c0217e80 00000000 ffffe000 00000000 c0e06408 3f80: 00000002 c0e0647c c0c6a5f0 00000000 c0e04900 eb483fb0 c0207ea8 c0207e98 3fa0: 60020013 ffffffff [] (__irq_svc) from [] (arch_cpu_idle+0x1c/0x38) [] (arch_cpu_idle) from [] (do_idle+0x138/0x268) [] (do_idle) from [] (cpu_startup_entry+0x18/0x1c) [] (cpu_startup_entry) from [<402022ec>] (0x402022ec) Fixes: 5fd752b6b3a2 ("leds: core: Introduce LED pattern trigger") Signed-off-by: Baolin Wang Reported-by: Geert Uytterhoeven Tested-by: Geert Uytterhoeven Signed-off-by: Jacek Anaszewski commit df376b2ed51a2777c3398e038992f62523c0f932 Author: Johannes Thumshirn Date: Wed Nov 7 14:58:14 2018 +0100 block: respect virtual boundary mask in bvecs With drivers that are settting a virtual boundary constrain, we are seeing a lot of bio splitting and smaller I/Os being submitted to the driver. This happens because the bio gap detection code does not account cases where PAGE_SIZE - 1 is bigger than queue_virt_boundary() and thus will split the bio unnecessarily. Cc: Jan Kara Cc: Bart Van Assche Cc: Ming Lei Reviewed-by: Sagi Grimberg Signed-off-by: Johannes Thumshirn Acked-by: Keith Busch Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 85758777c2a227fd1541b6dd122a08ab79c347ce Merge: e09d51adfbb1 e3e61f01d755 Author: Linus Torvalds Date: Wed Nov 7 11:39:07 2018 -0800 Merge tag 'hwmon-for-v4.20-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - Remove bogus __init annotations in ibmpowernv driver - Fix double-free in error handling of __hwmon_device_register() * tag 'hwmon-for-v4.20-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (ibmpowernv) Remove bogus __init annotations hwmon: (core) Fix double-free in __hwmon_device_register() commit d6fd0ae25c6495674dc5a41a8d16bc8e0073276d Author: Omar Sandoval Date: Wed Oct 31 10:06:08 2018 -0700 Btrfs: fix missing delayed iputs on unmount There's a race between close_ctree() and cleaner_kthread(). close_ctree() sets btrfs_fs_closing(), and the cleaner stops when it sees it set, but this is racy; the cleaner might have already checked the bit and could be cleaning stuff. In particular, if it deletes unused block groups, it will create delayed iputs for the free space cache inodes. As of "btrfs: don't run delayed_iputs in commit", we're no longer running delayed iputs after a commit. Therefore, if the cleaner creates more delayed iputs after delayed iputs are run in btrfs_commit_super(), we will leak inodes on unmount and get a busy inode crash from the VFS. Fix it by parking the cleaner before we actually close anything. Then, any remaining delayed iputs will always be handled in btrfs_commit_super(). This also ensures that the commit in close_ctree() is really the last commit, so we can get rid of the commit in cleaner_kthread(). The fstest/generic/475 followed by 476 can trigger a crash that manifests as a slab corruption caused by accessing the freed kthread structure by a wake up function. Sample trace: [ 5657.077612] BUG: unable to handle kernel NULL pointer dereference at 00000000000000cc [ 5657.079432] PGD 1c57a067 P4D 1c57a067 PUD da10067 PMD 0 [ 5657.080661] Oops: 0000 [#1] PREEMPT SMP [ 5657.081592] CPU: 1 PID: 5157 Comm: fsstress Tainted: G W 4.19.0-rc8-default+ #323 [ 5657.083703] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.2-0-gf9626cc-prebuilt.qemu-project.org 04/01/2014 [ 5657.086577] RIP: 0010:shrink_page_list+0x2f9/0xe90 [ 5657.091937] RSP: 0018:ffffb5c745c8f728 EFLAGS: 00010287 [ 5657.092953] RAX: 0000000000000074 RBX: ffffb5c745c8f830 RCX: 0000000000000000 [ 5657.094590] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff9a8747fdf3d0 [ 5657.095987] RBP: ffffb5c745c8f9e0 R08: 0000000000000000 R09: 0000000000000000 [ 5657.097159] R10: ffff9a8747fdf5e8 R11: 0000000000000000 R12: ffffb5c745c8f788 [ 5657.098513] R13: ffff9a877f6ff2c0 R14: ffff9a877f6ff2c8 R15: dead000000000200 [ 5657.099689] FS: 00007f948d853b80(0000) GS:ffff9a877d600000(0000) knlGS:0000000000000000 [ 5657.101032] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5657.101953] CR2: 00000000000000cc CR3: 00000000684bd000 CR4: 00000000000006e0 [ 5657.103159] Call Trace: [ 5657.103776] shrink_inactive_list+0x194/0x410 [ 5657.104671] shrink_node_memcg.constprop.84+0x39a/0x6a0 [ 5657.105750] shrink_node+0x62/0x1c0 [ 5657.106529] try_to_free_pages+0x1a4/0x500 [ 5657.107408] __alloc_pages_slowpath+0x2c9/0xb20 [ 5657.108418] __alloc_pages_nodemask+0x268/0x2b0 [ 5657.109348] kmalloc_large_node+0x37/0x90 [ 5657.110205] __kmalloc_node+0x236/0x310 [ 5657.111014] kvmalloc_node+0x3e/0x70 Fixes: 30928e9baac2 ("btrfs: don't run delayed_iputs in commit") Signed-off-by: Omar Sandoval Reviewed-by: David Sterba [ add trace ] Signed-off-by: David Sterba commit d5596fd46770550873ab4c02bcb69f83d3d63f63 Author: Jacob Keller Date: Mon Oct 29 10:52:43 2018 -0700 i40e: enable NETIF_F_NTUPLE and NETIF_F_HW_TC at driver load The assignment of the feature flag NETIF_F_NTUPLE and NETIF_F_HW_TC occurs prior to the initial setup of the local hw_features variable. This means the features are set as user-changeable, but are not set in the currently active feature list. This results in the features being disabled at the driver's initial load. Move the assignment after the initial assignment of hw_features, and assign to the local variable. This ensures that NETIF_F_NTUPLE and NETIF_F_HW_TC are marked as user-changeable, and also enables them by default when the driver loads. Signed-off-by: Jacob Keller Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit ba766b8b99c30ad3c55ed8cf224d1185ecff1476 Author: Jacob Keller Date: Mon Oct 29 10:52:42 2018 -0700 i40e: restore NETIF_F_GSO_IPXIP[46] to netdev features Since commit bacd75cfac8a ("i40e/i40evf: Add capability exchange for outer checksum", 2017-04-06) the i40e driver has not reported support for IP-in-IP offloads. This likely occurred due to a bad rebase, as the commit extracts hw_enc_features into its own variable. As part of this change, it dropped the NETIF_F_FSO_IPXIP flags from the netdev->hw_enc_features. This was unfortunately not caught during code review. Fix this by adding back the missing feature flags. For reference, NETIF_F_GSO_IPXIP4 was added in commit 7e13318daa4a ("net: define gso types for IPx over IPv4 and IPv6", 2016-05-20), replacing NETIF_F_GSO_IPIP and NETIF_F_GSO_SIT. NETIF_F_GSO_IPXIP6 was added in commit bf2d1df39502 ("intel: Add support for IPv6 IP-in-IP offload", 2016-05-20). Signed-off-by: Jacob Keller Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit ffe498237b36ee42624e139b21efa05da4ff1f48 Author: Chinh T Cao Date: Mon Nov 5 12:18:35 2018 -0800 ice: Change req_speeds to be u16 Since the req_speeds field in struct ice_link_status is a u8, req_speeds & ICE_AQ_LINK_SPEED_40GB always returns 0. This was caught by a coverity scan. Fix this by changing req_speeds to be u16. Reported-by: Bruce Allan Signed-off-by: Chinh T Cao Signed-off-by: Anirudh Venkataramanan Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit e09d51adfbb110ee1d4af3571b8cb67b0f938756 Merge: ecb4d529f13d a89f84a56ec9 Author: Linus Torvalds Date: Wed Nov 7 09:13:34 2018 -0800 Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Olof Johansson: "A few more fixes that have come in, and one revert of a previous fix. I was a bit too trigger happy to enable PREEMPT on multi_v7_defconfig, and it ended up regressing at least BeagleBone XM boards. While we get that debugged for next merge window, let's disable it again. Beyond that: - Stratix change to fix multicast filtering - Minor DT fixes for Renesas and i.MX - Ethernet fix for a Renesas board (switching main interfaces) - Ethernet phy regulator fix for i.MX6SX" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: arm64: dts: stratix10: fix multicast filtering ARM: defconfig: Disable PREEMPT again on multi_v7 arm64: dts: renesas: condor: switch from EtherAVB to GEther dt-bindings: arm: Fix RZ/G2E part number arm64: dts: renesas: r8a7795: add missing dma-names on hscif2 ARM: dts: imx6sx-sdb: Fix enet phy regulator ARM: dts: fsl: Fix improperly quoted stdout-path values ARM: dts: imx6sll: fix typo for fsl,imx6sll-i2c node commit ecb4d529f13d610a4f0236a4c804f55d7582adab Merge: 8053e5b93eca aa9b760cec23 Author: Linus Torvalds Date: Wed Nov 7 09:05:58 2018 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - hid.git is moving towards group maintainership (where group is myself and Benjamin Tissoires), therefore this pull request updates MAINTAINERS accordingly - fix for hid-asus config dependency from Arnd Bergmann - two device-specific quirks for i2c-hid from Julian Sax and Kai-Heng Feng - other few small assorted fixes * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: fix up .raw_event() documentation HID: asus: fix build warning wiht CONFIG_ASUS_WMI disabled HID: i2c-hid: add Direkt-Tek DTLAPY133-1 to descriptor override HID: moving to group maintainership model HID: alps: allow incoming reports when only the trackstick is opened Revert "HID: add NOGET quirk for Eaton Ellipse MAX UPS" HID: i2c-hid: Add a small delay after sleep command for Raydium touchpanel HID: hiddev: fix potential Spectre v1 commit 53692ec074d00589c2cf1d6d17ca76ad0adce6ec Author: Vasily Averin Date: Wed Nov 7 11:14:35 2018 -0500 ext4: fix buffer leak in ext4_expand_extra_isize_ea() on error path Fixes: de05ca852679 ("ext4: move call to ext4_error() into ...") Signed-off-by: Vasily Averin Signed-off-by: Theodore Ts'o Cc: stable@kernel.org # 4.17 commit 9bde0afb7a906f1dabdba37162551565740b862d Author: Xulin Sun Date: Tue Nov 6 16:42:19 2018 +0800 rtc: pcf2127: fix a kmemleak caused in pcf2127_i2c_gather_write pcf2127_i2c_gather_write() allocates memory as local variable for i2c_master_send(), after finishing the master transfer, the allocated memory should be freed. The kmemleak is reported: unreferenced object 0xffff80231e7dba80 (size 64): comm "hwclock", pid 27762, jiffies 4296880075 (age 356.944s) hex dump (first 32 bytes): 03 00 12 03 19 02 11 13 00 80 98 18 00 00 ff ff ................ 00 50 00 00 00 00 00 00 02 00 00 00 00 00 00 00 .P.............. backtrace: [] create_object+0xf8/0x278 [] kmemleak_alloc+0x74/0xa0 [] __kmalloc+0x1ac/0x348 [] pcf2127_i2c_gather_write+0x54/0xf8 [] _regmap_raw_write+0x464/0x850 [] regmap_bulk_write+0x1a4/0x348 [] pcf2127_rtc_set_time+0xac/0xe8 [] rtc_set_time+0x80/0x138 [] rtc_dev_ioctl+0x398/0x610 [] do_vfs_ioctl+0xb0/0x848 [] SyS_ioctl+0x8c/0xa8 [] el0_svc_naked+0x34/0x38 [] 0xffffffffffffffff Signed-off-by: Xulin Sun Signed-off-by: Alexandre Belloni commit 7ce9a992ffde8ce93d5ae5767362a5c7389ae895 Author: Maciej W. Rozycki Date: Mon Nov 5 03:48:25 2018 +0000 rtc: hctosys: Add missing range error reporting Fix an issue with the 32-bit range error path in `rtc_hctosys' where no error code is set and consequently the successful preceding call result from `rtc_read_time' is propagated to `rtc_hctosys_ret'. This in turn makes any subsequent call to `hctosys_show' incorrectly report in sysfs that the system time has been set from this RTC while it has not. Set the error to ERANGE then if we can't express the result due to an overflow. Signed-off-by: Maciej W. Rozycki Fixes: b3a5ac42ab18 ("rtc: hctosys: Ensure system time doesn't overflow time_t") Cc: stable@vger.kernel.org # 4.17+ Signed-off-by: Alexandre Belloni commit fbb974ba693bbfb4e24a62181ef16d4e45febc37 Author: Hans de Goede Date: Tue Sep 4 16:51:29 2018 +0200 rtc: cmos: Do not export alarm rtc_ops when we do not support alarms When there is no IRQ configured for the RTC, the rtc-cmos code does not support alarms, all alarm rtc_ops fail with -EIO / -EINVAL. The rtc-core expects a rtc driver which does not support rtc alarms to not have alarm ops at all. Otherwise the wakealarm sysfs attr will read as empty rather then returning an error, making it impossible for userspace to find out beforehand if alarms are supported. A system without an IRQ for the RTC before this patch: [root@localhost ~]# cat /sys/class/rtc/rtc0/wakealarm [root@localhost ~]# After this patch: [root@localhost ~]# cat /sys/class/rtc/rtc0/wakealarm cat: /sys/class/rtc/rtc0/wakealarm: No such file or directory [root@localhost ~]# This fixes gnome-session + systemd trying to use suspend-then-hibernate, which causes systemd to abort the suspend when writing the RTC alarm fails. BugLink: https://github.com/systemd/systemd/issues/9988 Signed-off-by: Hans de Goede Signed-off-by: Alexandre Belloni commit 6bdc9977fcdedf47118d2caf7270a19f4b6d8a8f Author: Vasily Averin Date: Wed Nov 7 11:10:21 2018 -0500 ext4: fix buffer leak in ext4_xattr_move_to_block() on error path Fixes: 3f2571c1f91f ("ext4: factor out xattr moving") Fixes: 6dd4ee7cab7e ("ext4: Expand extra_inodes space per ...") Reviewed-by: Jan Kara Signed-off-by: Vasily Averin Signed-off-by: Theodore Ts'o Cc: stable@kernel.org # 2.6.23 commit a89f84a56ec95fd66b839bf9c545f8a59a4ffcd5 Merge: 9be66f55b131 fd5ba6ee3187 Author: Olof Johansson Date: Wed Nov 7 08:07:59 2018 -0800 Merge tag 'stratix10_dts_fix_for_v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into fixes ARM: dts: stratix10: fix multicast filtering On Stratix 10, the EMAC has 256 hash buckets for multicast filtering. This needs to be specified in DTS, otherwise the stmmac driver defaults to 64 buckets and initializes the filter incorrectly. As a result, e.g. valid IPv6 multicast traffic ends up being dropped. * tag 'stratix10_dts_fix_for_v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: arm64: dts: stratix10: fix multicast filtering Signed-off-by: Olof Johansson commit 45ae932d246f721e6584430017176cbcadfde610 Author: Vasily Averin Date: Wed Nov 7 11:07:01 2018 -0500 ext4: release bs.bh before re-using in ext4_xattr_block_find() bs.bh was taken in previous ext4_xattr_block_find() call, it should be released before re-using Fixes: 7e01c8e5420b ("ext3/4: fix uninitialized bs in ...") Signed-off-by: Vasily Averin Signed-off-by: Theodore Ts'o Cc: stable@kernel.org # 2.6.26 commit ecaaf408478b6fb4d9986f9b6652f3824e374f4c Author: Vasily Averin Date: Wed Nov 7 11:01:33 2018 -0500 ext4: fix buffer leak in ext4_xattr_get_block() on error path Fixes: dec214d00e0d ("ext4: xattr inode deduplication") Signed-off-by: Vasily Averin Signed-off-by: Theodore Ts'o Cc: stable@kernel.org # 4.13 commit 9be66f55b1319d71d492ac1e58a3c352e0b23070 Merge: 6ff6bc46c0a4 eab53fdfd60a Author: Olof Johansson Date: Wed Nov 7 07:59:33 2018 -0800 Merge tag 'renesas-fixes-for-v4.20' of https://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into fixes Renesas ARM Based SoC Fixes for v4.20 * R-Car V3H (r8a77980) based Condor board - Switch from EtherAVB to GEther to match offical boards * RZ/G2E (ra8774c0) SoC: correct documentation of part number * R-Car H3 (r8a7795) SoC: reinstate all DMA channels on HSCIF2 * tag 'renesas-fixes-for-v4.20' of https://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas: arm64: dts: renesas: condor: switch from EtherAVB to GEther dt-bindings: arm: Fix RZ/G2E part number arm64: dts: renesas: r8a7795: add missing dma-names on hscif2 Signed-off-by: Olof Johansson commit af18e35bfd01e6d65a5e3ef84ffe8b252d1628c5 Author: Vasily Averin Date: Wed Nov 7 10:56:28 2018 -0500 ext4: fix possible leak of s_journal_flag_rwsem in error path Fixes: c8585c6fcaf2 ("ext4: fix races between changing inode journal ...") Signed-off-by: Vasily Averin Signed-off-by: Theodore Ts'o Cc: stable@kernel.org # 4.7 commit f26621e60b35369bca9228bc936dc723b3e421af Author: Borislav Petkov Date: Mon Nov 5 10:33:07 2018 +0100 resource/docs: Complete kernel-doc style function documentation Add the missing kernel-doc style function parameters documentation. Signed-off-by: Borislav Petkov Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: akpm@linux-foundation.org Cc: linux-tip-commits@vger.kernel.org Cc: rdunlap@infradead.org Fixes: b69c2e20f6e4 ("resource: Clean it up a bit") Link: http://lkml.kernel.org/r/20181105093307.GA12445@zn.tnic Signed-off-by: Ingo Molnar commit 9e463084cdb22e0b56b2dfbc50461020409a5fd3 Author: Theodore Ts'o Date: Wed Nov 7 10:32:53 2018 -0500 ext4: fix possible leak of sbi->s_group_desc_leak in error path Fixes: bfe0a5f47ada ("ext4: add more mount time checks of the superblock") Reported-by: Vasily Averin Signed-off-by: Theodore Ts'o Cc: stable@kernel.org # 4.18 commit 943126417891372d56aa3fe46295cbf53db31370 Author: Srinivas Kandagatla Date: Tue Oct 16 10:57:48 2018 +0100 slimbus: ngd: remove unnecessary check SLIM_MSG_CLK_PAUSE_SEQ_FLG is never set in any of the slim core, so performing a check in ngd driver is totally unnecessary. Also this patch fixes warning about mc field overflow reported with CoverityScan. Making clk pause feature optional will be added to slim core in next development cycle. Reported-by: Colin Ian King Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver") Signed-off-by: Srinivas Kandagatla Signed-off-by: Greg Kroah-Hartman commit 214782da8fe8497b9af39095c784f3a633e377ec Merge: df5e31c204b3 5e7154ff5e8e Author: Joonas Lahtinen Date: Wed Nov 7 15:34:09 2018 +0200 Merge tag 'gvt-fixes-2018-11-07' of https://github.com/intel/gvt-linux into drm-intel-fixes gvt-fixes-2018-11-07 - Fix invalidate of old ggtt entry (Hang) - Fix partial ggtt entry update in any order (Hang) - Fix one mask setting for chicken reg (Xinyun) - Fix eDP warning in guest (Longhe) Signed-off-by: Joonas Lahtinen From: Zhenyu Wang Link: https://patchwork.freedesktop.org/patch/msgid/20181107023137.GO25194@zhen-hp.sh.intel.com commit e531efa1e92b888acce45785b3ae69278fa712c0 Author: Zhao Wei Liew Date: Thu Nov 1 01:32:46 2018 +0000 Documentation: cpufreq: Correct a typo Fix a typo in the admin-guide documentation for cpufreq. Signed-off-by: Zhao Wei Liew Acked-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit 6ef28a04d1ccf718eee069b72132ce4aa1e52ab9 Author: Anson Huang Date: Mon Nov 5 00:59:28 2018 +0000 cpufreq: imx6q: add return value check for voltage scale Add return value check for voltage scale when ARM clock rate change fail. Signed-off-by: Anson Huang Acked-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit 8d72ee3266f08fd3490011ee7b95ffc31e66fd6d Author: Viresh Kumar Date: Mon Oct 29 12:47:40 2018 +0530 Documentation: cpu-freq: Frequencies aren't always sorted The order in which the frequencies are displayed in cpufreq stats depends on the order in which the frequencies were sorted in the frequency table provided to cpufreq core by the cpufreq driver. They can be completely unsorted as well. The documentation's claim that the stats will be sorted in descending order is hence incorrect and here is an attempt to fix it. Reported-by: Pavel Signed-off-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit f6501f49199097b99e4e263644d88c90d1ec1060 Author: Mattias Jacobsson <2pi@mok.nu> Date: Sun Oct 21 11:25:37 2018 +0200 USB: misc: appledisplay: add 20" Apple Cinema Display Add another Apple Cinema Display to the list of supported displays Signed-off-by: Mattias Jacobsson <2pi@mok.nu> Cc: stable Signed-off-by: Greg Kroah-Hartman commit deefd24228a172d1b27d4a9adbfd2cdacd60ae64 Author: Kai-Heng Feng Date: Fri Oct 26 13:33:15 2018 +0800 USB: quirks: Add no-lpm quirk for Raydium touchscreens Raydium USB touchscreen fails to set config if LPM is enabled: [ 2.030658] usb 1-8: New USB device found, idVendor=2386, idProduct=3119 [ 2.030659] usb 1-8: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 2.030660] usb 1-8: Product: Raydium Touch System [ 2.030661] usb 1-8: Manufacturer: Raydium Corporation [ 7.132209] usb 1-8: can't set config #1, error -110 Same behavior can be observed on 2386:3114. Raydium claims the touchscreen supports LPM under Windows, so I used Microsoft USB Test Tools (MUTT) [1] to check its LPM status. MUTT shows that the LPM doesn't work under Windows, either. So let's just disable LPM for Raydium touchscreens. [1] https://docs.microsoft.com/en-us/windows-hardware/drivers/usbcon/usb-test-tools Signed-off-by: Kai-Heng Feng Cc: stable Signed-off-by: Greg Kroah-Hartman commit a77112577667cbda7c6292c52d909636aef31fd9 Author: Emmanuel Pescosta Date: Fri Oct 26 14:48:09 2018 +0200 usb: quirks: Add delay-init quirk for Corsair K70 LUX RGB Following on from this patch: https://lkml.org/lkml/2017/11/3/516, Corsair K70 LUX RGB keyboards also require the DELAY_INIT quirk to start correctly at boot. Dmesg output: usb 1-6: string descriptor 0 read error: -110 usb 1-6: New USB device found, idVendor=1b1c, idProduct=1b33 usb 1-6: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-6: can't set config #1, error -110 Signed-off-by: Emmanuel Pescosta Cc: stable Signed-off-by: Greg Kroah-Hartman commit 781f0766cc41a9dd2e5d118ef4b1d5d89430257b Author: Kai-Heng Feng Date: Fri Oct 19 16:14:50 2018 +0800 USB: Wait for extra delay time after USB_PORT_FEAT_RESET for quirky hub Devices connected under Terminus Technology Inc. Hub (1a40:0101) may fail to work after the system resumes from suspend: [ 206.063325] usb 3-2.4: reset full-speed USB device number 4 using xhci_hcd [ 206.143691] usb 3-2.4: device descriptor read/64, error -32 [ 206.351671] usb 3-2.4: device descriptor read/64, error -32 Info for this hub: T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=480 MxCh= 4 D: Ver= 2.00 Cls=09(hub ) Sub=00 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1a40 ProdID=0101 Rev=01.11 S: Product=USB 2.0 Hub C: #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=100mA I: If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub Some expirements indicate that the USB devices connected to the hub are innocent, it's the hub itself is to blame. The hub needs extra delay time after it resets its port. Hence wait for extra delay, if the device is connected to this quirky hub. Signed-off-by: Kai-Heng Feng Cc: stable Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit c948c6915b620f075496846df8d4487ee0c56121 Author: Larry Finger Date: Tue Nov 6 21:33:14 2018 -0600 staging: rtl8723bs: Fix incorrect sense of ether_addr_equal In commit b37f9e1c3801 ("staging: rtl8723bs: Fix lines too long in update_recvframe_attrib()."), the refactoring involved replacing two memcmp() calls with ether_addr_equal() calls. What the author missed is that memcmp() returns false when the two strings are equal, whereas ether_addr_equal() returns true when the two addresses are equal. One side effect of this error is that the strength of an unassociated AP was much stronger than the same AP after association. This bug is reported at bko#201611. Fixes: b37f9e1c3801 ("staging: rtl8723bs: Fix lines too long in update_recvframe_attrib().") Cc: Stable Cc: youling257 Cc: u.srikant.patnaik@gmail.com Reported-and-tested-by: youling257 Signed-off-by: Larry Finger Signed-off-by: Greg Kroah-Hartman commit 354e379684fcc70ab8d5450b4d57bd92b5294dfd Author: Sergio Paracuellos Date: Sat Oct 20 13:31:06 2018 +0200 staging: mt7621-dma: fix potentially dereferencing uninitialized 'tx_desc' Function 'mtk_hsdma_start_transfer' uses 'tx_desc' pointer which can be dereferenced before it is initializated. Initializate pointer before avoiding the problem. Fixes: 0853c7a53eb3 ("staging: mt7621-dma: ralink: add rt2880 dma engine") Reported-by: Dan Carpenter Signed-off-by: Sergio Paracuellos Cc: stable Signed-off-by: Greg Kroah-Hartman commit 4dc2a3cd27856531cf92762fea2eb9468efe552f Author: Spencer E. Olson Date: Wed Oct 24 08:33:40 2018 -0600 staging: comedi: clarify/unify macros for NI macro-defined terminals Uses a single macro to define multiple macros that represent a series of terminals for NI devices. This patch also redefines NI_MAX_COUNTERS as the maximum number of counters possible on NI devices (instead of the maximum index of the counters). This was a little confusing and caused a bug in commit 347e244884c3b ("staging: comedi: tio: implement global tio/ctr routing") when setting/reading registers for counter terminals. Fixes: 347e244884c3b ("staging: comedi: tio: implement global tio/ctr routing") Signed-off-by: Spencer E. Olson Reviewed-by: Ian Abbott Signed-off-by: Greg Kroah-Hartman commit b7c56d7bfe834904d9d332e0cfbf929b75976f8a Author: Colin Ian King Date: Fri Nov 2 19:01:26 2018 +0000 drivers: staging: cedrus: find ctx before dereferencing it ctx Currently if count is an invalid value the v4l2_info message will dereference a null ctx pointer to get the dev information. Fix this by finding ctx first and then checking for an invalid count, this way ctxt will be non-null hence avoiding the null pointer dereference. Detected by CoverityScan, CID#1475337 ("Explicit null dereferenced") Fixes: 50e761516f2b ("media: platform: Add Cedrus VPU decoder driver") Signed-off-by: Colin Ian King Acked-by: Maxime Ripard Signed-off-by: Greg Kroah-Hartman commit c3e43d8b958bd6849817393483e805d8638a8ab7 Author: Christophe JAILLET Date: Wed Oct 17 10:15:34 2018 +0200 staging: rtl8723bs: Fix the return value in case of error in 'rtw_wx_read32()' We return 0 unconditionally in 'rtw_wx_read32()'. However, 'ret' is set to some error codes in several error handling paths. Return 'ret' instead to propagate the error code. Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") Signed-off-by: Christophe JAILLET Signed-off-by: Greg Kroah-Hartman commit 9a1ec4eb6f3722a65a267bb7d14c371d73f66c5b Author: Spencer E. Olson Date: Wed Oct 24 08:46:59 2018 -0600 staging: comedi: ni_mio_common: scale ao INSN_CONFIG_GET_CMD_TIMING_CONSTRAINTS Fixes implementation of INSN_CONFIG_GET_CMD_TIMING_CONSTRAINTS for ni_mio devices. The previous patch should have used the channel information passed in to scale the result by the number of channels being used. Fixes: 51fd36738383 ("staging: comedi: ni_mio_common: implement INSN_CONFIG_GET_CMD_TIMING_CONSTRAINTS") Signed-off-by: Spencer E. Olson Reviewed-by: Ian Abbott Signed-off-by: Greg Kroah-Hartman commit 28c5bcf74fa07c25d5bd118d1271920f51ce2a98 Author: Scott Wood Date: Tue Nov 6 19:49:34 2018 -0600 KVM: PPC: Move and undef TRACE_INCLUDE_PATH/FILE TRACE_INCLUDE_PATH and TRACE_INCLUDE_FILE are used by , so like that #include, they should be outside #ifdef protection. They also need to be #undefed before defining, in case multiple trace headers are included by the same C file. This became the case on book3e after commit cf4a6085151a ("powerpc/mm: Add missing tracepoint for tlbie"), leading to the following build error: CC arch/powerpc/kvm/powerpc.o In file included from arch/powerpc/kvm/powerpc.c:51:0: arch/powerpc/kvm/trace.h:9:0: error: "TRACE_INCLUDE_PATH" redefined [-Werror] #define TRACE_INCLUDE_PATH . ^ In file included from arch/powerpc/kvm/../mm/mmu_decl.h:25:0, from arch/powerpc/kvm/powerpc.c:48: ./arch/powerpc/include/asm/trace.h:224:0: note: this is the location of the previous definition #define TRACE_INCLUDE_PATH asm ^ cc1: all warnings being treated as errors Reported-by: Christian Zigotzky Signed-off-by: Scott Wood Signed-off-by: Michael Ellerman commit 99b77fef3c6c69bb7664f1ac97a69d5b17968dae Author: Yishai Hadas Date: Wed Oct 31 12:20:28 2018 +0200 net/mlx5: Fix XRC SRQ umem valid bits Adapt XRC SRQ to the latest HW specification with fixed definition around umem valid bits. The previous definition relied on a bit which was taken for other purposes in legacy FW. Fixes: bd37197554eb ("net/mlx5: Update mlx5_ifc with DEVX UID bits") Signed-off-by: Yishai Hadas Reviewed-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky commit f635e48e866ee1a47d2d42ce012fdcc07bf55853 Author: Quinn Tran Date: Tue Nov 6 00:51:21 2018 -0800 scsi: qla2xxx: Initialize port speed to avoid setting lower speed This patch initializes port speed so that firmware does not set lower operating speed. Setting lower speed in firmware impacts WRITE perfomance. Fixes: 726b85487067 ("qla2xxx: Add framework for async fabric discovery") Cc: Signed-off-by: Quinn Tran Signed-off-by: Himanshu Madhani Tested-by: Laurence Oberman Reviewed-by: Ewan D. Milne Signed-off-by: Martin K. Petersen commit aca49ee041cbdd329c55d4dbcd6b3d4b9af240e4 Author: Martin K. Petersen Date: Mon Nov 5 22:49:47 2018 -0500 Revert "scsi: ufs: Disable blk-mq for now" This reverts commit d87161bea405e3260377026ca8a704a3f68bd67a. The issues that forced us to disable blk_mq for ufs have been resolved. Signed-off-by: Martin K. Petersen commit d08f44b18ccbe4de36282df6343dc098922d1159 Merge: d99de699ac03 989534cfcac8 Author: Dave Airlie Date: Wed Nov 7 09:32:53 2018 +1000 Merge tag 'exynos-drm-fixes-for-v4.20-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes Three regressions - Revert frame counter support . This patch fixes a issue which doesn't work extension and clone mode because some CRTC devices don't provide frame counter value properly. - Fix lack of fbdev on Rinato and trats boards. . This patch considers for connector to be registered by DSI after DRM device is registered, and also it makes fbdev initializaion to be done even if no connector at the moment. - Check for dsi->panel object correctly . This patch fixes checking for dsi->panel. of_drm_find_panel function returns panel object or error value so error value should be checked using IS_ERR macro. Signed-off-by: Dave Airlie From: Inki Dae Link: https://patchwork.freedesktop.org/patch/msgid/1541407733-7632-1-git-send-email-inki.dae@samsung.com commit d99de699ac034ff1b706496a33f49bd7e1e8ae30 Merge: 651022382c7f 6fce3a406108 Author: Dave Airlie Date: Wed Nov 7 09:32:22 2018 +1000 Merge branch 'etnaviv/fixes' of https://git.pengutronix.de/git/lst/linux into drm-fixes Single etnaviv fence fix for GPU recovery. Signed-off-by: Dave Airlie From: Lucas Stach Link: https://patchwork.freedesktop.org/patch/msgid/1541522424.2508.26.camel@pengutronix.de commit 1bfc204dc0e7a690ab8440e91bb7d1a324320fdc Author: Vasily Averin Date: Tue Nov 6 17:45:02 2018 -0500 ext4: remove unneeded brelse call in ext4_xattr_inode_update_ref() Signed-off-by: Vasily Averin Signed-off-by: Theodore Ts'o commit 4f32c38b4662312dd3c5f113d8bdd459887fb773 Author: Theodore Ts'o Date: Tue Nov 6 17:18:17 2018 -0500 ext4: avoid possible double brelse() in add_new_gdb() on error path Fixes: b40971426a83 ("ext4: add error checking to calls to ...") Reported-by: Vasily Averin Signed-off-by: Theodore Ts'o Cc: stable@kernel.org # 2.6.38 commit feaf264ce7f8d54582e2f66eb82dd9dd124c94f3 Author: Vasily Averin Date: Tue Nov 6 17:01:36 2018 -0500 ext4: avoid buffer leak in ext4_orphan_add() after prior errors Fixes: d745a8c20c1f ("ext4: reduce contention on s_orphan_lock") Fixes: 6e3617e579e0 ("ext4: Handle non empty on-disk orphan link") Cc: Dmitry Monakhov Signed-off-by: Vasily Averin Signed-off-by: Theodore Ts'o Cc: stable@kernel.org # 2.6.34 commit a6758309a005060b8297a538a457c88699cb2520 Author: Vasily Averin Date: Tue Nov 6 16:49:50 2018 -0500 ext4: avoid buffer leak on shutdown in ext4_mark_iloc_dirty() ext4_mark_iloc_dirty() callers expect that it releases iloc->bh even if it returns an error. Fixes: 0db1ff222d40 ("ext4: add shutdown bit and check for it") Signed-off-by: Vasily Averin Signed-off-by: Theodore Ts'o Cc: stable@kernel.org # 4.11 commit 5822e9539dc11721b53d74accd4c091b982011d0 Author: Alex Deucher Date: Fri Nov 2 10:54:27 2018 -0500 drm/amdgpu/display/dce11: only enable FBC when selected Causes a black screen on a Stoney laptop. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=108577 Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit 04b94af4e348acc52546b9b19c933575f26589a1 Author: Alex Deucher Date: Tue Nov 6 15:19:49 2018 -0500 drm/amdgpu/display/dm: handle FBC dc feature parameter Set the dc_config properly when the option is enabled. Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit ce2127c462d9d1c0832f088b23158420e87e71a0 Author: Alex Deucher Date: Tue Nov 6 15:10:37 2018 -0500 drm/amdgpu/display/dc: add FBC to dc_config Add FBC to the list of features that can be enabled from the DM. Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit 7875a22625aa7f11befba84bd1e669201032947d Author: Alex Deucher Date: Tue Nov 6 14:44:29 2018 -0500 drm/amdgpu: add DC feature mask module parameter Similar to ppfeaturemask. Allows you to selectively enable/disable DC features. Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit 689e7b34234e29e5168894b27b752a4e16ef08c4 Author: Alex Deucher Date: Fri Nov 2 10:51:50 2018 -0500 drm/amdgpu/display: check if fbc is available in set_static_screen_control (v2) The value is dependent on whether fbc is available. v2: only check if num_pipes is valid Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit 3426d66d3e74ab0ab264a85e0795a17e3dde1e71 Author: Alex Deucher Date: Tue Nov 6 11:19:00 2018 -0500 drm/amdgpu/vega20: add CLK base offset In case we need to access CLK registers. Acked-by: Harry Wentland Signed-off-by: Alex Deucher commit 02680efbb10be0d2c867fe722ae23d588f6bebef Author: Harry Wentland Date: Sun Oct 7 10:01:23 2018 -0400 drm/amd/display: Stop leaking planes [Why] drm_plane_cleanup does not free the plane. [How] Call drm_primary_helper_destroy which will also free the plane. Signed-off-by: Harry Wentland Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 8ed4ec32d5b1f04a641978322a38a8d7089553bb Author: Shaokun Zhang Date: Mon Nov 5 18:33:35 2018 +0800 drm/amd/display: Fix misleading buffer information RETIMER_REDRIVER_INFO shows the buffer as a decimal value with a '0x' prefix, which is somewhat misleading. Fix it to print hexadecimal, as was intended. Fixes: 2f14bc89("drm/amd/display: add retimer log for HWQ tuning use.") Cc: Charlene Liu Cc: Dmytro Laktyushkin Signed-off-by: Shaokun Zhang Reviewed-by: Leo Li Signed-off-by: Alex Deucher commit 63088da9472854408ae5d7c47bd011daf9e1a81b Author: Alex Deucher Date: Tue Nov 6 16:06:32 2018 -0500 Revert "drm/amd/display: set backlight level limit to 1" This reverts commit 0cafc82fae41531b0162150f9a97f2c74f97118f. This breaks some apps that assume 0 is minimum brightness. Revert for 4.20. This is fixed properly for drm-next/4.21 in: "drm/amd: Don't fail on backlight = 0" However, that patch depends on more extensive changes to the backlight interface which are too invasive for -fixes. Fixes: Bugzilla: https://bugs.freedesktop.org/108668 Signed-off-by: Alex Deucher commit db6aee62406d9fbb53315fcddd81f1dc271d49fa Author: Vasily Averin Date: Tue Nov 6 16:20:40 2018 -0500 ext4: fix possible inode leak in the retry loop of ext4_resize_fs() Fixes: 1c6bd7173d66 ("ext4: convert file system to meta_bg if needed ...") Signed-off-by: Vasily Averin Signed-off-by: Theodore Ts'o Cc: stable@kernel.org # 3.7 commit f348e2241fb73515d65b5d77dd9c174128a7fbf2 Author: Vasily Averin Date: Tue Nov 6 16:16:01 2018 -0500 ext4: fix missing cleanup if ext4_alloc_flex_bg_array() fails while resizing Fixes: 117fff10d7f1 ("ext4: grow the s_flex_groups array as needed ...") Signed-off-by: Vasily Averin Signed-off-by: Theodore Ts'o Cc: stable@kernel.org # 3.7 commit 81bd415c91eb966118d773dddf254aebf3022411 Author: Mathieu Malaterre Date: Wed Jun 6 21:42:32 2018 +0200 watchdog/core: Add missing prototypes for weak functions The split out of the hard lockup detector exposed two new weak functions, but no prototypes for them, which triggers the build warning: kernel/watchdog.c:109:12: warning: no previous prototype for ‘watchdog_nmi_enable’ [-Wmissing-prototypes] kernel/watchdog.c:115:13: warning: no previous prototype for ‘watchdog_nmi_disable’ [-Wmissing-prototypes] Add the prototypes. Fixes: 73ce0511c436 ("kernel/watchdog.c: move hardlockup detector to separate file") Signed-off-by: Mathieu Malaterre Signed-off-by: Thomas Gleixner Cc: Babu Moger Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20180606194232.17653-1-malat@debian.org commit 4c9b658eeaefedd402a59e858d8ac3bfdf6153e3 Author: Miroslav Lichvar Date: Fri Oct 26 19:13:00 2018 +0200 igb: shorten maximum PHC timecounter update interval The timecounter needs to be updated at least once per ~550 seconds in order to avoid a 40-bit SYSTIM timestamp to be misinterpreted as an old timestamp. Since commit 500462a9de65 ("timers: Switch to a non-cascading wheel"), scheduling of delayed work seems to be less accurate and a requested delay of 540 seconds may actually be longer than 550 seconds. Also, the PHC may be adjusted to run up to 6% faster than real time and the system clock up to 10% slower. Shorten the delay to 360 seconds to be sure the timecounter is updated in time. This fixes an issue with HW timestamps on 82580/I350/I354 being off by ~1100 seconds for few seconds every ~9 minutes. Cc: Thomas Gleixner Signed-off-by: Miroslav Lichvar Acked-by: Jacob Keller Acked-by: Richard Cochran Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher commit d944b46992f8e99b6bdc721e44b02e5ca294fa2b Author: Brett Creeley Date: Fri Oct 26 10:40:59 2018 -0700 ice: Fix the bytecount sent to netdev_tx_sent_queue Currently if the driver does a TSO offload the bytecount sent to netdev_tx_sent_queue will be incorrect. This is because in ice_tso we overwrite the initial value that we set in ice_tx_map. This creates a mismatch between the Tx and Tx clean flow. In the Tx clean flow we calculate the bytecount (called total_bytes) as we clean the descriptors so the value used in the Tx clean path is correct. Fix this by using += in ice_tso instead of =. This fixes the mismatch in bytecount mentioned above. Signed-off-by: Brett Creeley Signed-off-by: Anirudh Venkataramanan Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit c585ea42ec75e8d3afa278b7095d9f0dd6ee515b Author: Brett Creeley Date: Fri Oct 26 10:40:58 2018 -0700 ice: Fix tx_timeout in PF driver Prior to this commit the driver was running into tx_timeouts when a queue was stressed enough. This was happening because the HW tail and SW tail (NTU) were incorrectly out of sync. Consequently this was causing the HW head to collide with the HW tail, which to the hardware means that all descriptors posted for Tx have been processed. Due to the Tx logic used in the driver SW tail and HW tail are allowed to be out of sync. This is done as an optimization because it allows the driver to write HW tail as infrequently as possible, while still updating the SW tail index to keep track. However, there are situations where this results in the tail never getting updated, resulting in Tx timeouts. Tx HW tail write condition: if (netif_xmit_stopped(txring_txq(tx_ring) || !skb->xmit_more) writel(sw_tail, tx_ring->tail); An issue was found in the Tx logic that was causing the afore mentioned condition for updating HW tail to never happen, causing tx_timeouts. In ice_xmit_frame_ring we calculate how many descriptors we need for the Tx transaction based on the skb the kernel hands us. This is then passed into ice_maybe_stop_tx along with some extra padding to determine if we have enough descriptors available for this transaction. If we don't then we return -EBUSY to the stack, otherwise we move on and eventually prepare the Tx descriptors accordingly in ice_tx_map and set next_to_watch. In ice_tx_map we make another call to ice_maybe_stop_tx with a value of MAX_SKB_FRAGS + 4. The key here is that this value is possibly less than the value we sent in the first call to ice_maybe_stop_tx in ice_xmit_frame_ring. Now, if the number of unused descriptors is between MAX_SKB_FRAGS + 4 and the value used in the first call to ice_maybe_stop_tx in ice_xmit_frame_ring then we do not update the HW tail because of the "Tx HW tail write condition" above. This is because in ice_maybe_stop_tx we return success from ice_maybe_stop_tx instead of calling __ice_maybe_stop_tx and subsequently calling netif_stop_subqueue, which sets the __QUEUE_STATE_DEV_XOFF bit. This bit is then checked in the "Tx HW tail write condition" by calling netif_xmit_stopped and subsequently updating HW tail if the afore mentioned bit is set. In ice_clean_tx_irq, if next_to_watch is not NULL, we end up cleaning the descriptors that HW sets the DD bit on and we have the budget. The HW head will eventually run into the HW tail in response to the description in the paragraph above. The next time through ice_xmit_frame_ring we make the initial call to ice_maybe_stop_tx with another skb from the stack. This time we do not have enough descriptors available and we return NETDEV_TX_BUSY to the stack and end up setting next_to_watch to NULL. This is where we are stuck. In ice_clean_tx_irq we never clean anything because next_to_watch is always NULL and in ice_xmit_frame_ring we never update HW tail because we already return NETDEV_TX_BUSY to the stack and eventually we hit a tx_timeout. This issue was fixed by making sure that the second call to ice_maybe_stop_tx in ice_tx_map is passed a value that is >= the value that was used on the initial call to ice_maybe_stop_tx in ice_xmit_frame_ring. This was done by adding the following defines to make the logic more clear and to reduce the chance of mucking this up again: ICE_CACHE_LINE_BYTES 64 ICE_DESCS_PER_CACHE_LINE (ICE_CACHE_LINE_BYTES / \ sizeof(struct ice_tx_desc)) ICE_DESCS_FOR_CTX_DESC 1 ICE_DESCS_FOR_SKB_DATA_PTR 1 The ICE_CACHE_LINE_BYTES being 64 is an assumption being made so we don't have to figure this out on every pass through the Tx path. Instead I added a sanity check in ice_probe to verify cache line size and print a message if it's not 64 Bytes. This will make it easier to file issues if they are seen when the cache line size is not 64 Bytes when reading from the GLPCI_CNF2 register. Signed-off-by: Brett Creeley Signed-off-by: Anirudh Venkataramanan Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 25525b69bb44a628841492f44a5a8e74f34724f4 Author: Dave Ertman Date: Fri Oct 26 10:40:57 2018 -0700 ice: Fix napi delete calls for remove In the remove path, the vsi->netdev is being set to NULL before the call to free vectors. This is causing the netif_napi_del call to never be made. Add a call to ice_napi_del to the same location as the calls to unregister_netdev and just prior to them. This will use the reverse flow as the register and netif_napi_add calls. Signed-off-by: Dave Ertman Signed-off-by: Anirudh Venkataramanan Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 31082519c11b01fe1fb6dd512055f252812c1508 Author: Anirudh Venkataramanan Date: Fri Oct 26 10:40:56 2018 -0700 ice: Fix typo in error message Print should say "Enabling" instead of "Enaabling" Signed-off-by: Akeem G Abodunrin Signed-off-by: Anirudh Venkataramanan Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 58297dd133f64ea028e7d52dd00cd9ff8aa4479f Author: Md Fahad Iqbal Polash Date: Fri Oct 26 10:40:55 2018 -0700 ice: Fix flags for port VLAN According to the spec, whenever insert PVID field is set, the VLAN driver insertion mode should be set to 01b which isn't done currently. Fix it. Signed-off-by: Md Fahad Iqbal Polash Signed-off-by: Anirudh Venkataramanan Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 9ecd25c26810a61b9c3abc6c73de32dca6da96e1 Author: Anirudh Venkataramanan Date: Fri Oct 26 10:40:54 2018 -0700 ice: Remove duplicate addition of VLANs in replay path ice_restore_vlan and active_vlans were originally put in place to reprogram VLAN filters in the replay path. This is now done as part of the much broader VSI rebuild/replay framework. So remove both ice_restore_vlan and active_vlans Signed-off-by: Anirudh Venkataramanan Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 33e055fcc26909b1d66b5d1f334aee38356068d7 Author: Victor Raj Date: Fri Oct 26 10:40:53 2018 -0700 ice: Free VSI contexts during for unload In the unload path, all VSIs are freed. Also free the related VSI contexts to prevent memory leaks. Signed-off-by: Victor Raj Signed-off-by: Anirudh Venkataramanan Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 0f5d4c21a50716f8bd4e220544b82dca7408d113 Author: Akeem G Abodunrin Date: Fri Oct 26 10:40:52 2018 -0700 ice: Fix dead device link issue with flow control Setting Rx or Tx pause parameter currently results in link loss on the interface, requiring the platform/host to be cold power cycled. Fix it. Signed-off-by: Akeem G Abodunrin Signed-off-by: Anirudh Venkataramanan Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit afd9d4ab58db20029a75cf82f23b6a5641cd7d6f Author: Anirudh Venkataramanan Date: Fri Oct 26 10:40:51 2018 -0700 ice: Check for reset in progress during remove The remove path does not currently check to see if a reset is in progress before proceeding. This can cause a resource collision resulting in various types of errors. Check for reset in progress and wait for a reasonable amount of time before allowing the remove to progress. Signed-off-by: Dave Ertman Signed-off-by: Anirudh Venkataramanan Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit ce317dd9f809c8da9656c88761e30f0a82a8c2e6 Author: Anirudh Venkataramanan Date: Fri Oct 26 10:40:50 2018 -0700 ice: Set carrier state and start/stop queues in rebuild Set the carrier state post rebuild by querying the link status. Also start/stop queues based on link status. Signed-off-by: Anirudh Venkataramanan Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 86a484bda787d542d4a968bd7742bcf844c8adb2 Author: Leo Li Date: Tue Oct 30 15:09:08 2018 -0400 drm/amd: Update atom_smu_info_v3_3 structure Mainly adding the WAFL spread spectrum info, for adjusting display clocks when XGMI is enabled. Signed-off-by: Leo Li Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit a48777fdda7d13179979a889e1fb87655a783cc0 Author: Eial Czerwacki Date: Mon Nov 5 19:31:54 2018 +0200 x86/vsmp: Remove dependency on pv_irq_ops vSMP dependency on pv_irq_ops has been removed some years ago, but the code still deals with pv_irq_ops. In short, "cap & ctl & (1 << 4)" is always returning 0, so all PARAVIRT/PARAVIRT_XXL code related to that can be removed. However, the rest of the code depends on CONFIG_PCI, so fix it accordingly. Rename set_vsmp_pv_ops to set_vsmp_ctl as the original name does not make sense anymore. Signed-off-by: Eial Czerwacki Signed-off-by: Thomas Gleixner Acked-by: Shai Fultheim Cc: Juergen Gross Link: https://lkml.kernel.org/r/1541439114-28297-1-git-send-email-eial@scalemp.com commit b082f2dd80612015cd6d9d84e52099734ec9a0e1 Author: Kirill A. Shutemov Date: Fri Oct 26 15:28:56 2018 +0300 x86/ldt: Remove unused variable in map_ldt_struct() Splitting out the sanity check in map_ldt_struct() moved page table syncing into a separate function, which made the pgd variable unused. Remove it. [ tglx: Massaged changelog ] Fixes: 9bae3197e15d ("x86/ldt: Split out sanity check in map_ldt_struct()") Signed-off-by: Kirill A. Shutemov Signed-off-by: Thomas Gleixner Reviewed-by: Andy Lutomirski Cc: bp@alien8.de Cc: hpa@zytor.com Cc: dave.hansen@linux.intel.com Cc: peterz@infradead.org Cc: boris.ostrovsky@oracle.com Cc: jgross@suse.com Cc: bhe@redhat.com Cc: willy@infradead.org Cc: linux-mm@kvack.org Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181026122856.66224-4-kirill.shutemov@linux.intel.com commit a0e6e0831c516860fc7f9be1db6c081fe902ebcf Author: Kirill A. Shutemov Date: Fri Oct 26 15:28:55 2018 +0300 x86/ldt: Unmap PTEs for the slot before freeing LDT pages modify_ldt(2) leaves the old LDT mapped after switching over to the new one. The old LDT gets freed and the pages can be re-used. Leaving the mapping in place can have security implications. The mapping is present in the userspace page tables and Meltdown-like attacks can read these freed and possibly reused pages. It's relatively simple to fix: unmap the old LDT and flush TLB before freeing the old LDT memory. This further allows to avoid flushing the TLB in map_ldt_struct() as the slot is unmapped and flushed by unmap_ldt_struct() or has never been mapped at all. [ tglx: Massaged changelog and removed the needless line breaks ] Fixes: f55f0501cbf6 ("x86/pti: Put the LDT in its own PGD if PTI is on") Signed-off-by: Kirill A. Shutemov Signed-off-by: Thomas Gleixner Cc: bp@alien8.de Cc: hpa@zytor.com Cc: dave.hansen@linux.intel.com Cc: luto@kernel.org Cc: peterz@infradead.org Cc: boris.ostrovsky@oracle.com Cc: jgross@suse.com Cc: bhe@redhat.com Cc: willy@infradead.org Cc: linux-mm@kvack.org Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181026122856.66224-3-kirill.shutemov@linux.intel.com commit d52888aa2753e3063a9d3a0c9f72f94aa9809c15 Author: Kirill A. Shutemov Date: Fri Oct 26 15:28:54 2018 +0300 x86/mm: Move LDT remap out of KASLR region on 5-level paging On 5-level paging the LDT remap area is placed in the middle of the KASLR randomization region and it can overlap with the direct mapping, the vmalloc or the vmap area. The LDT mapping is per mm, so it cannot be moved into the P4D page table next to the CPU_ENTRY_AREA without complicating PGD table allocation for 5-level paging. The 4 PGD slot gap just before the direct mapping is reserved for hypervisors, so it cannot be used. Move the direct mapping one slot deeper and use the resulting gap for the LDT remap area. The resulting layout is the same for 4 and 5 level paging. [ tglx: Massaged changelog ] Fixes: f55f0501cbf6 ("x86/pti: Put the LDT in its own PGD if PTI is on") Signed-off-by: Kirill A. Shutemov Signed-off-by: Thomas Gleixner Reviewed-by: Andy Lutomirski Cc: bp@alien8.de Cc: hpa@zytor.com Cc: dave.hansen@linux.intel.com Cc: peterz@infradead.org Cc: boris.ostrovsky@oracle.com Cc: jgross@suse.com Cc: bhe@redhat.com Cc: willy@infradead.org Cc: linux-mm@kvack.org Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181026122856.66224-2-kirill.shutemov@linux.intel.com commit 042cb56478152b31c50bea8a784fc826891eb38e Author: Tao Ren Date: Mon Nov 5 14:35:40 2018 -0800 net: phy: Allow BCM54616S PHY to setup internal TX/RX clock delay This patch allows users to enable/disable internal TX and/or RX clock delay for BCM54616S PHYs so as to satisfy RGMII timing specifications. On a particular platform, whether TX and/or RX clock delay is required depends on how PHY connected to the MAC IP. This requirement can be specified through "phy-mode" property in the platform device tree. The patch is inspired by commit 733336262b28 ("net: phy: Allow BCM5481x PHYs to setup internal TX/RX clock delay"). Signed-off-by: Tao Ren Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 45fd808091449086f5bf83dff263ad081108020d Merge: 163c8d54a997 8e88c29b351e Author: Ingo Molnar Date: Tue Nov 6 20:03:11 2018 +0100 Merge tag 'perf-urgent-for-mingo-4.20-20181106' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent improvements and fixes from Arnaldo Carvalho de Melo: Intel PT SQL viewer: (Adrian Hunter) - Fall back to /usr/local/lib/libxed.so - Add Selected branches report - Add help window - Fix table find when table re-ordered Intel PT debug log (Adrian Hunter) - Add more event information - Add MTC and CYC timestamps perf record: (Andi Kleen) - Support weak groups, just like with 'perf stat' perf trace: (Arnaldo Carvalho de Melo) - Start augmenting raw_syscalls:{sys_enter,sys_exit}: goal is to have a generic, arch independent eBPF kernel component that is programmed with syscall table details, what to copy, how many bytes, pid, arg filters from the userspace via eBPF maps by the 'perf trace' tool that continues to use all its argument beautifiers, just taking advantage of the extra pointer contents. JVMTI: (Gustavo Romero) - Fix undefined symbol scnprintf in libperf-jvmti.so perf top: (Jin Yao) - Display the LBR stats in callchain entries perf stat: (Thomas Richter) - Handle different PMU names with common prefix arm64: Will (Deacon) - Fix arm64 tools build failure wrt smp_load_{acquire,release}. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit e8a308e5f47e545e0d41d0686c00f5f5217c5f61 Author: Vishal Verma Date: Thu Oct 25 18:37:29 2018 -0600 acpi/nfit, x86/mce: Validate a MCE's address before using it The NFIT machine check handler uses the physical address from the mce structure, and compares it against information in the ACPI NFIT table to determine whether that location lies on an NVDIMM. The mce->addr field however may not always be valid, and this is indicated by the MCI_STATUS_ADDRV bit in the status field. Export mce_usable_address() which already performs validation for the address, and use it in the NFIT handler. Fixes: 6839a6d96f4e ("nfit: do an ARS scrub on hitting a latent media error") Reported-by: Robert Elliott Signed-off-by: Vishal Verma Signed-off-by: Borislav Petkov CC: Arnd Bergmann Cc: Dan Williams CC: Dave Jiang CC: elliott@hpe.com CC: "H. Peter Anvin" CC: Ingo Molnar CC: Len Brown CC: linux-acpi@vger.kernel.org CC: linux-edac CC: linux-nvdimm@lists.01.org CC: Qiuxu Zhuo CC: "Rafael J. Wysocki" CC: Ross Zwisler CC: stable CC: Thomas Gleixner CC: Tony Luck CC: x86-ml CC: Yazen Ghannam Link: http://lkml.kernel.org/r/20181026003729.8420-2-vishal.l.verma@intel.com commit 5d96c9342c23ee1d084802dcf064caa67ecaa45b Author: Vishal Verma Date: Thu Oct 25 18:37:28 2018 -0600 acpi/nfit, x86/mce: Handle only uncorrectable machine checks The MCE handler for nfit devices is called for memory errors on a Non-Volatile DIMM and adds the error location to a 'badblocks' list. This list is used by the various NVDIMM drivers to avoid consuming known poison locations during IO. The MCE handler gets called for both corrected and uncorrectable errors. Until now, both kinds of errors have been added to the badblocks list. However, corrected memory errors indicate that the problem has already been fixed by hardware, and the resulting interrupt is merely a notification to Linux. As far as future accesses to that location are concerned, it is perfectly fine to use, and thus doesn't need to be included in the above badblocks list. Add a check in the nfit MCE handler to filter out corrected mce events, and only process uncorrectable errors. Fixes: 6839a6d96f4e ("nfit: do an ARS scrub on hitting a latent media error") Reported-by: Omar Avelar Signed-off-by: Vishal Verma Signed-off-by: Borislav Petkov CC: Arnd Bergmann CC: Dan Williams CC: Dave Jiang CC: elliott@hpe.com CC: "H. Peter Anvin" CC: Ingo Molnar CC: Len Brown CC: linux-acpi@vger.kernel.org CC: linux-edac CC: linux-nvdimm@lists.01.org CC: Qiuxu Zhuo CC: "Rafael J. Wysocki" CC: Ross Zwisler CC: stable CC: Thomas Gleixner CC: Tony Luck CC: x86-ml CC: Yazen Ghannam Link: http://lkml.kernel.org/r/20181026003729.8420-1-vishal.l.verma@intel.com commit 313a06e636808387822af24c507cba92703568b1 Author: Jeremy Linton Date: Mon Nov 5 18:14:41 2018 -0600 lib/raid6: Fix arm64 test build The lib/raid6/test fails to build the neon objects on arm64 because the correct machine type is 'aarch64'. Once this is correctly enabled, the neon recovery objects need to be added to the build. Reviewed-by: Ard Biesheuvel Signed-off-by: Jeremy Linton Signed-off-by: Catalin Marinas commit e14856f6cfbb1b96aa45a68f188b147b5bde76b4 Author: Srinivas Kandagatla Date: Tue Nov 6 11:38:57 2018 +0000 ASoC: qdsp6: q6afe-dai: Fix the dai widgets For some reason the dapm widgets are incorrectly defined from the start, Not sure how we ended up with such thing. Fix them now! Without this fix the backend dais are always powered up even if there is no active stream. Reported-by: Jimmy Cheng-Yi Chiang Reported-by: Rohit kumar Signed-off-by: Srinivas Kandagatla Signed-off-by: Mark Brown commit 9de57ff1566fd36a664c1b04a641e26fed472a9c Author: Srinivas Kandagatla Date: Tue Nov 6 11:38:56 2018 +0000 ASoC: qdsp6: q6asm-dai: Only add routing once. q6asm routing gets added multiple times as part of dai probe. Move this to q6routing routes which has those widgets defined, this also fixes the issue where these are added each time at dai probe. Signed-off-by: Srinivas Kandagatla Signed-off-by: Mark Brown commit b374e8686fc35ae124e62dc78725ea656ba1ef8a Author: Arnd Bergmann Date: Mon Nov 5 16:51:47 2018 +0100 mt76: fix building without CONFIG_LEDS_CLASS When CONFIG_LEDS_CLASS is disabled, or it is a loadable module while mt76 is built-in, we run into a link error: drivers/net/wireless/mediatek/mt76/mac80211.o: In function `mt76_register_device': mac80211.c:(.text+0xb78): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `devm_of_led_classdev_register' We don't really need a hard dependency here as the driver can presumably work just fine without LEDs, so this follows the iwlwifi example and adds a separate Kconfig option for the LED support, this will be available whenever it will link, and otherwise the respective code gets left out from the driver object. Fixes: 17f1de56df05 ("mt76: add common code shared between multiple chipsets") Signed-off-by: Arnd Bergmann Signed-off-by: Lorenzo Bianconi Signed-off-by: Kalle Valo commit 3401d42c7ea2d064d15c66698ff8eb96553179ce Author: Rafał Miłecki Date: Fri Oct 26 12:50:39 2018 +0200 brcmutil: really fix decoding channel info for 160 MHz bandwidth Previous commit /adding/ support for 160 MHz chanspecs was incomplete. It didn't set bandwidth info and didn't extract control channel info. As the result it was also using uninitialized "sb" var. This change has been tested for two chanspecs found to be reported by some devices/firmwares: 1) 60/160 (0xee32) Before: chnum:50 control_ch_num:36 After: chnum:50 control_ch_num:60 2) 120/160 (0xed72) Before: chnum:114 control_ch_num:100 After: chnum:114 control_ch_num:120 Fixes: 330994e8e8ec ("brcmfmac: fix for proper support of 160MHz bandwidth") Signed-off-by: Rafał Miłecki Signed-off-by: Kalle Valo commit b630806d7ce2051a3306fa6f1cfa31bc870d7c4b Author: John Stultz Date: Thu Oct 25 10:57:21 2018 -0700 wlcore: Fixup "Add support for optional wakeirq" After commit 3c83dd577c7f ("wlcore: Add support for optional wakeirq") landed upstream, I started seeing the following oops on my HiKey board: [ 1.870279] Unable to handle kernel read from unreadable memory at virtual address 0000000000000010 [ 1.870283] Mem abort info: [ 1.870287] ESR = 0x96000005 [ 1.870292] Exception class = DABT (current EL), IL = 32 bits [ 1.870296] SET = 0, FnV = 0 [ 1.870299] EA = 0, S1PTW = 0 [ 1.870302] Data abort info: [ 1.870306] ISV = 0, ISS = 0x00000005 [ 1.870309] CM = 0, WnR = 0 [ 1.870312] [0000000000000010] user address but active_mm is swapper [ 1.870318] Internal error: Oops: 96000005 [#1] PREEMPT SMP [ 1.870327] CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 4.19.0-05129-gb3d1e8e #48 [ 1.870331] Hardware name: HiKey Development Board (DT) [ 1.870350] Workqueue: events_freezable mmc_rescan [ 1.870358] pstate: 60400005 (nZCv daif +PAN -UAO) [ 1.870366] pc : wl1271_probe+0x210/0x350 [ 1.870371] lr : wl1271_probe+0x210/0x350 [ 1.870374] sp : ffffff80080739b0 [ 1.870377] x29: ffffff80080739b0 x28: 0000000000000000 [ 1.870384] x27: 0000000000000000 x26: 0000000000000000 [ 1.870391] x25: 0000000000000036 x24: ffffffc074ecb598 [ 1.870398] x23: ffffffc07ffdce78 x22: ffffffc0744ed808 [ 1.870404] x21: ffffffc074ecbb98 x20: ffffff8008ff9000 [ 1.870411] x19: ffffffc0744ed800 x18: ffffff8008ff9a48 [ 1.870418] x17: 0000000000000000 x16: 0000000000000000 [ 1.870425] x15: ffffffc074ecb503 x14: ffffffffffffffff [ 1.870431] x13: ffffffc074ecb502 x12: 0000000000000030 [ 1.870438] x11: 0101010101010101 x10: 0000000000000040 [ 1.870444] x9 : ffffffc075400248 x8 : ffffffc075400270 [ 1.870451] x7 : 0000000000000000 x6 : 0000000000000000 [ 1.870457] x5 : 0000000000000000 x4 : 0000000000000000 [ 1.870463] x3 : 0000000000000000 x2 : 0000000000000000 [ 1.870469] x1 : 0000000000000028 x0 : 0000000000000000 [ 1.870477] Process kworker/0:0 (pid: 5, stack limit = 0x(____ptrval____)) [ 1.870480] Call trace: [ 1.870485] wl1271_probe+0x210/0x350 [ 1.870491] sdio_bus_probe+0x100/0x128 [ 1.870500] really_probe+0x1a8/0x2b8 [ 1.870506] driver_probe_device+0x58/0x100 [ 1.870511] __device_attach_driver+0x94/0xd8 [ 1.870517] bus_for_each_drv+0x70/0xc8 [ 1.870522] __device_attach+0xe0/0x140 [ 1.870527] device_initial_probe+0x10/0x18 [ 1.870532] bus_probe_device+0x94/0xa0 [ 1.870537] device_add+0x374/0x5b8 [ 1.870542] sdio_add_func+0x60/0x88 [ 1.870546] mmc_attach_sdio+0x1b0/0x358 [ 1.870551] mmc_rescan+0x2cc/0x390 [ 1.870558] process_one_work+0x12c/0x320 [ 1.870563] worker_thread+0x48/0x458 [ 1.870569] kthread+0xf8/0x128 [ 1.870575] ret_from_fork+0x10/0x18 [ 1.870583] Code: 92400c21 b2760021 a90687a2 97e95bf9 (f9400803) [ 1.870587] ---[ end trace 1e15f81d3c139ca9 ]--- It seems since we don't have a wakeirq value in the dts, the wakeirq value in wl1271_probe() is zero, which then causes trouble in irqd_get_trigger_type(irq_get_irq_data(wakeirq)). This patch tries to address this by checking if wakeirq is zero, and not trying to add it to the resources if that is the case. Fixes: 3c83dd577c7f ("wlcore: Add support for optional wakeirq") Cc: Tony Lindgren Cc: Kalle Valo Cc: Eyal Reizer Cc: Anders Roxell Cc: linux-wireless@vger.kernel.org Acked-by: Tony Lindgren Signed-off-by: John Stultz Tested-by: Anders Roxell Signed-off-by: Kalle Valo commit 461cf036057477805a8a391e5fd0f5264a5e56a8 Author: Dan Carpenter Date: Fri Oct 19 23:08:43 2018 +0300 ath9k: Fix a locking bug in ath9k_add_interface() We tried to revert commit d9c52fd17cb4 ("ath9k: fix tx99 with monitor mode interface") but accidentally missed part of the locking change. The lock has to be held earlier so that we're holding it when we do "sc->tx99_vif = vif;" and also there in the current code there is a stray unlock before we have taken the lock. Fixes: 6df0580be8bc ("ath9k: add back support for using active monitor interfaces for tx99") Signed-off-by: Dan Carpenter Signed-off-by: Kalle Valo commit 98ee3fc7ef8395f8b7a379e6608aee91efc66d48 Author: Boris Brezillon Date: Tue Nov 6 17:25:37 2018 +0100 mtd: nand: Fix nanddev_pos_next_page() kernel-doc header Function name is wrong in the kernel-doc header. Fixes: 9c3736a3de21 ("mtd: nand: Add core infrastructure to deal with NAND devices") Signed-off-by: Boris Brezillon Reviewed-by: Miquel Raynal commit f98e8a572bddbf27032114127d2fcc78fa5e6a9d Author: Ricardo Ribalda Delgado Date: Thu Nov 1 14:15:49 2018 +0100 clk: fixed-factor: fix of_node_get-put imbalance When the fixed factor clock is created by devicetree, of_clk_add_provider is called. Add a call to of_clk_del_provider in the remove function to balance it out. Reported-by: Alan Tull Fixes: 971451b3b15d ("clk: fixed-factor: Convert into a module platform driver") Signed-off-by: Ricardo Ribalda Delgado Signed-off-by: Stephen Boyd commit df5e31c204b34e8d9e5ec33f5b28e960c4f25e14 Author: Ville Syrjälä Date: Thu Oct 25 16:05:36 2018 +0300 drm/i915: Fix ilk+ watermarks when disabling pipes We're no longer programming any watermarks when we're disabling a pipe. That means ilk_wm_merge() & co. will keep considering the any pipe that is getting disabled as still enabled. Thus we either get no LP1+ watermakrs (ilk-ivb), or we get suboptimal ones (hsw-bdw). This seems to have been broken by commit b6b178a77210 ("drm/i915: Calculate ironlake intermediate watermarks correctly, v2."). Before that we apparently had some difference between the intermediate and optimal watermarks and so we would program the optiomal ones. Now intermediate and optimal are identical for disabled pipes and so we don't program either. Fix this by programming the intermediate watermarks even for disabled pipes. We were already doing that for skl+. We'll leave out gmch platforms for now since those do the merging in a different manner and should work as is. We'll want to unify this eventually, but play it safe for now and just put in a FIXME. Cc: stable@vger.kernel.org Cc: Matt Roper Cc: Maarten Lankhorst Fixes: b6b178a77210 ("drm/i915: Calculate ironlake intermediate watermarks correctly, v2.") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20181025130536.29024-1-ville.syrjala@linux.intel.com Reviewed-by: Maarten Lankhorst #irc (cherry picked from commit a748faea3bfd7fd1d1485bc1c426c7d460cc6503) Signed-off-by: Joonas Lahtinen commit 8053e5b93eca9b011f7b79bb019bf1eeaaf96c4b Merge: 4581aa96475b ee474b81fe5a Author: Linus Torvalds Date: Tue Nov 6 08:12:10 2018 -0800 Merge tag 'trace-v4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fix from Steven Rostedt: "Masami found a slight bug in his code where he transposed the arguments of a call to strpbrk. The reason this wasn't detected in our tests is that the only way this would transpire is when a kprobe event with a symbol offset is attached to a function that belongs to a module that isn't loaded yet. When the kprobe trace event is added, the offset would be truncated after it was parsed, and when the module is loaded, it would use the symbol without the offset (as the nul character added by the parsing would not be replaced with the original character)" * tag 'trace-v4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing/kprobes: Fix strpbrk() argument order commit 4581aa96475b792de4b1206a12830339b65ec246 Merge: a13511dfa836 6282e916f774 Author: Linus Torvalds Date: Tue Nov 6 08:10:01 2018 -0800 Merge branch 'spectre' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM fix from Russell King: "Ard spotted a typo in one of the assembly files which leads to a kernel oops when that code path is executed. Fix this" * 'spectre' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 8809/1: proc-v7: fix Thumb annotation of cpu_v7_hvc_switch_mm commit a8939766c75c06b5a0ab691ecbba9347e4e520cf Author: Giulio Benetti Date: Fri Oct 5 23:59:51 2018 +0200 drm/sun4i: tcon: prevent tcon->panel dereference if NULL If tcon->panel pointer is NULL, trying to dereference from it (i.e. tcon->panel->connector) will cause a null pointer dereference. Add tcon->panel null pointer check before calling sun4i_tcon0_mode_set_dithering(). Signed-off-by: Giulio Benetti Fixes: f11adcecbd5f ("drm/sun4i: tcon: Add dithering support for RGB565/RGB666 LCD panels") Reviewed-by: Chen-Yu Tsai Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20181005215951.99003-2-giulio.benetti@micronovasrl.com commit 7f4cedd882f7cae83177066c2b239ef457ce4a42 Author: Giulio Benetti Date: Fri Oct 5 23:59:50 2018 +0200 drm/sun4i: tcon: fix check of tcon->panel null pointer Since tcon->panel is a pointer returned by of_drm_find_panel() need to check if it is not NULL, hence a valid pointer. IS_ERR() instead checks return error values, not NULL pointers. Substitute "if (!IS_ERR(tcon->panel))" with "if (tcon->panel)". Signed-off-by: Giulio Benetti Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20181005215951.99003-1-giulio.benetti@micronovasrl.com commit dbc4ca339c8dbdd8652ce57c16bf5ef45ee4307e Author: Jiri Olsa Date: Tue Oct 16 17:06:09 2018 +0200 tools cpupower: Override CFLAGS assignments So user could specify outside CFLAGS values. Cc: Thomas Renninger Cc: Shuah Khan Signed-off-by: Jiri Olsa Acked-by: Thomas Renninger Signed-off-by: Shuah Khan (Samsung OSG) commit 4bf3bd0f15a9c81064c0b430d04d221ffcc503cc Author: Jiri Olsa Date: Tue Oct 16 17:06:08 2018 +0200 tools cpupower debug: Allow to use outside build flags Adding CFLAGS and LDFLAGS to be used during the build. Cc: Thomas Renninger Cc: Shuah Khan Signed-off-by: Jiri Olsa Acked-by: Thomas Renninger Signed-off-by: Shuah Khan (Samsung OSG) commit 9de9aa45e9bd67232e000cca42ceb134b8ae51b6 Author: Konstantin Khlebnikov Date: Tue Oct 16 11:56:26 2018 +0300 tools/power/cpupower: fix compilation with STATIC=true Rename duplicate sysfs_read_file into cpupower_read_sysfs and fix linking. Signed-off-by: Konstantin Khlebnikov Acked-by: Thomas Renninger Cc: Signed-off-by: Shuah Khan (Samsung OSG) commit 837514f7a4ca4aca06aec5caa5ff56d33ef06976 Author: Dave Chinner Date: Tue Nov 6 07:50:50 2018 -0800 xfs: fix overflow in xfs_attr3_leaf_verify generic/070 on 64k block size filesystems is failing with a verifier corruption on writeback or an attribute leaf block: [ 94.973083] XFS (pmem0): Metadata corruption detected at xfs_attr3_leaf_verify+0x246/0x260, xfs_attr3_leaf block 0x811480 [ 94.975623] XFS (pmem0): Unmount and run xfs_repair [ 94.976720] XFS (pmem0): First 128 bytes of corrupted metadata buffer: [ 94.978270] 000000004b2e7b45: 00 00 00 00 00 00 00 00 3b ee 00 00 00 00 00 00 ........;....... [ 94.980268] 000000006b1db90b: 00 00 00 00 00 81 14 80 00 00 00 00 00 00 00 00 ................ [ 94.982251] 00000000433f2407: 22 7b 5c 82 2d 5c 47 4c bb 31 1c 37 fa a9 ce d6 "{\.-\GL.1.7.... [ 94.984157] 0000000010dc7dfb: 00 00 00 00 00 81 04 8a 00 0a 18 e8 dd 94 01 00 ................ [ 94.986215] 00000000d5a19229: 00 a0 dc f4 fe 98 01 68 f0 d8 07 e0 00 00 00 00 .......h........ [ 94.988171] 00000000521df36c: 0c 2d 32 e2 fe 20 01 00 0c 2d 58 65 fe 0c 01 00 .-2.. ...-Xe.... [ 94.990162] 000000008477ae06: 0c 2d 5b 66 fe 8c 01 00 0c 2d 71 35 fe 7c 01 00 .-[f.....-q5.|.. [ 94.992139] 00000000a4a6bca6: 0c 2d 72 37 fc d4 01 00 0c 2d d8 b8 f0 90 01 00 .-r7.....-...... [ 94.994789] XFS (pmem0): xfs_do_force_shutdown(0x8) called from line 1453 of file fs/xfs/xfs_buf.c. Return address = ffffffff815365f3 This is failing this check: end = ichdr.freemap[i].base + ichdr.freemap[i].size; if (end < ichdr.freemap[i].base) >>>>> return __this_address; if (end > mp->m_attr_geo->blksize) return __this_address; And from the buffer output above, the freemap array is: freemap[0].base = 0x00a0 freemap[0].size = 0xdcf4 end = 0xdd94 freemap[1].base = 0xfe98 freemap[1].size = 0x0168 end = 0x10000 freemap[2].base = 0xf0d8 freemap[2].size = 0x07e0 end = 0xf8b8 These all look valid - the block size is 0x10000 and so from the last check in the above verifier fragment we know that the end of freemap[1] is valid. The problem is that end is declared as: uint16_t end; And (uint16_t)0x10000 = 0. So we have a verifier bug here, not a corruption. Fix the verifier to use uint32_t types for the check and hence avoid the overflow. Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=201577 Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit bdec055bb9f262964c4f5cb330dab26646c345c6 Author: Darrick J. Wong Date: Tue Nov 6 07:50:50 2018 -0800 xfs: print buffer offsets when dumping corrupt buffers Use DUMP_PREFIX_OFFSET when printing hex dumps of corrupt buffers because modern Linux now prints a 32-bit hash of our 64-bit pointer when using DUMP_PREFIX_ADDRESS: 00000000b4bb4297: 00 00 00 00 00 00 00 00 3b ee 00 00 00 00 00 00 ........;....... 00000005ec77e26: 00 00 00 00 02 d0 5a 00 00 00 00 00 00 00 00 00 ......Z......... 000000015938018: 21 98 e8 b4 fd de 4c 07 bc ea 3c e5 ae b4 7c 48 !.....L...<...|H This is totally worthless for a sequential dump since we probably only care about tracking the buffer offsets and afaik there's no way to recover the actual pointer from the hashed value. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit 132bf6723749f7219c399831eeb286dbbb985429 Author: Christophe JAILLET Date: Tue Nov 6 07:50:50 2018 -0800 xfs: Fix error code in 'xfs_ioc_getbmap()' In this function, once 'buf' has been allocated, we unconditionally return 0. However, 'error' is set to some error codes in several error handling paths. Before commit 232b51948b99 ("xfs: simplify the xfs_getbmap interface") this was not an issue because all error paths were returning directly, but now that some cleanup at the end may be needed, we must propagate the error code. Fixes: 232b51948b99 ("xfs: simplify the xfs_getbmap interface") Signed-off-by: Christophe JAILLET Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 19ed3e2dd8549c1a34914e8dad01b64e7837645a Author: Lu Baolu Date: Mon Nov 5 10:18:58 2018 +0800 iommu/vt-d: Fix NULL pointer dereference in prq_event_thread() When handling page request without pasid event, go to "no_pasid" branch instead of "bad_req". Otherwise, a NULL pointer deference will happen there. Cc: Ashok Raj Cc: Jacob Pan Cc: Sohil Mehta Signed-off-by: Lu Baolu Fixes: a222a7f0bb6c9 'iommu/vt-d: Implement page request handling' Signed-off-by: Joerg Roedel commit a13511dfa836c8305a737436eed3ba9a8e74a826 Merge: 163c8d54a997 a422757e8c32 Author: Linus Torvalds Date: Tue Nov 6 07:44:04 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Handle errors mid-stream of an all dump, from Alexey Kodanev. 2) Fix build of openvswitch with certain combinations of netfilter options, from Arnd Bergmann. 3) Fix interactions between GSO and BQL, from Eric Dumazet. 4) Don't put a '/' in RTL8201F's sysfs file name, from Holger Hoffstätte. 5) S390 qeth driver fixes from Julian Wiedmann. 6) Allow ipv6 link local addresses for netconsole when both source and destination are link local, from Matwey V. Kornilov. 7) Fix the BPF program address seen in /proc/kallsyms, from Song Liu. 8) Initialize mutex before use in dsa microchip driver, from Tristram Ha. 9) Out-of-bounds access in hns3, from Yunsheng Lin. 10) Various netfilter fixes from Stefano Brivio, Jozsef Kadlecsik, Jiri Slaby, Florian Westphal, Eric Westbrook, Andrey Ryabinin, and Pablo Neira Ayuso. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (50 commits) net: alx: make alx_drv_name static net: bpfilter: fix iptables failure if bpfilter_umh is disabled sock_diag: fix autoloading of the raw_diag module net: core: netpoll: Enable netconsole IPv6 link local address ipv6: properly check return value in inet6_dump_all() rtnetlink: restore handling of dumpit return value in rtnl_dump_all() net/ipv6: Move anycast init/cleanup functions out of CONFIG_PROC_FS bonding/802.3ad: fix link_failure_count tracking net: phy: realtek: fix RTL8201F sysfs name sctp: define SCTP_SS_DEFAULT for Stream schedulers sctp: fix strchange_flags name for Stream Change Event mlxsw: spectrum: Fix IP2ME CPU policer configuration openvswitch: fix linking without CONFIG_NF_CONNTRACK_LABELS qed: fix link config error handling net: hns3: Fix for out-of-bounds access when setting pfc back pressure net/mlx4_en: use __netdev_tx_sent_queue() net: do not abort bulk send on BQL status net: bql: add __netdev_tx_sent_queue() s390/qeth: report 25Gbit link speed s390/qeth: sanitize ARP requests ... commit ac765f83f1397646c11092a032d4f62c3d478b81 Author: Filipe Manana Date: Mon Nov 5 11:14:17 2018 +0000 Btrfs: fix data corruption due to cloning of eof block We currently allow cloning a range from a file which includes the last block of the file even if the file's size is not aligned to the block size. This is fine and useful when the destination file has the same size, but when it does not and the range ends somewhere in the middle of the destination file, it leads to corruption because the bytes between the EOF and the end of the block have undefined data (when there is support for discard/trimming they have a value of 0x00). Example: $ mkfs.btrfs -f /dev/sdb $ mount /dev/sdb /mnt $ export foo_size=$((256 * 1024 + 100)) $ xfs_io -f -c "pwrite -S 0x3c 0 $foo_size" /mnt/foo $ xfs_io -f -c "pwrite -S 0xb5 0 1M" /mnt/bar $ xfs_io -c "reflink /mnt/foo 0 512K $foo_size" /mnt/bar $ od -A d -t x1 /mnt/bar 0000000 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 * 0524288 3c 3c 3c 3c 3c 3c 3c 3c 3c 3c 3c 3c 3c 3c 3c 3c * 0786528 3c 3c 3c 3c 00 00 00 00 00 00 00 00 00 00 00 00 0786544 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 0790528 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 b5 * 1048576 The bytes in the range from 786532 (512Kb + 256Kb + 100 bytes) to 790527 (512Kb + 256Kb + 4Kb - 1) got corrupted, having now a value of 0x00 instead of 0xb5. This is similar to the problem we had for deduplication that got recently fixed by commit de02b9f6bb65 ("Btrfs: fix data corruption when deduplicating between different files"). Fix this by not allowing such operations to be performed and return the errno -EINVAL to user space. This is what XFS is doing as well at the VFS level. This change however now makes us return -EINVAL instead of -EOPNOTSUPP for cases where the source range maps to an inline extent and the destination range's end is smaller then the destination file's size, since the detection of inline extents is done during the actual process of dropping file extent items (at __btrfs_drop_extents()). Returning the -EINVAL error is done early on and solely based on the input parameters (offsets and length) and destination file's size. This makes us consistent with XFS and anyone else supporting cloning since this case is now checked at a higher level in the VFS and is where the -EINVAL will be returned from starting with kernel 4.20 (the VFS changed was introduced in 4.20-rc1 by commit 07d19dc9fbe9 ("vfs: avoid problematic remapping requests into partial EOF block"). So this change is more geared towards stable kernels, as it's unlikely the new VFS checks get removed intentionally. A test case for fstests follows soon, as well as an update to filter existing tests that expect -EOPNOTSUPP to accept -EINVAL as well. CC: # 4.4+ Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 11023d3f5fdf89bba5e1142127701ca6e6014587 Author: Filipe Manana Date: Mon Nov 5 11:14:05 2018 +0000 Btrfs: fix infinite loop on inode eviction after deduplication of eof block If we attempt to deduplicate the last block of a file A into the middle of a file B, and file A's size is not a multiple of the block size, we end rounding the deduplication length to 0 bytes, to avoid the data corruption issue fixed by commit de02b9f6bb65 ("Btrfs: fix data corruption when deduplicating between different files"). However a length of zero will cause the insertion of an extent state with a start value greater (by 1) then the end value, leading to a corrupt extent state that will trigger a warning and cause chaos such as an infinite loop during inode eviction. Example trace: [96049.833585] ------------[ cut here ]------------ [96049.833714] WARNING: CPU: 0 PID: 24448 at fs/btrfs/extent_io.c:436 insert_state+0x101/0x120 [btrfs] [96049.833767] CPU: 0 PID: 24448 Comm: xfs_io Not tainted 4.19.0-rc7-btrfs-next-39 #1 [96049.833768] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.2-0-gf9626ccb91-prebuilt.qemu-project.org 04/01/2014 [96049.833780] RIP: 0010:insert_state+0x101/0x120 [btrfs] [96049.833783] RSP: 0018:ffffafd2c3707af0 EFLAGS: 00010282 [96049.833785] RAX: 0000000000000000 RBX: 000000000004dfff RCX: 0000000000000006 [96049.833786] RDX: 0000000000000007 RSI: ffff99045c143230 RDI: ffff99047b2168a0 [96049.833787] RBP: ffff990457851cd0 R08: 0000000000000001 R09: 0000000000000000 [96049.833787] R10: ffffafd2c3707ab8 R11: 0000000000000000 R12: ffff9903b93b12c8 [96049.833788] R13: 000000000004e000 R14: ffffafd2c3707b80 R15: ffffafd2c3707b78 [96049.833790] FS: 00007f5c14e7d700(0000) GS:ffff99047b200000(0000) knlGS:0000000000000000 [96049.833791] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [96049.833792] CR2: 00007f5c146abff8 CR3: 0000000115f4c004 CR4: 00000000003606f0 [96049.833795] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [96049.833796] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [96049.833796] Call Trace: [96049.833809] __set_extent_bit+0x46c/0x6a0 [btrfs] [96049.833823] lock_extent_bits+0x6b/0x210 [btrfs] [96049.833831] ? _raw_spin_unlock+0x24/0x30 [96049.833841] ? test_range_bit+0xdf/0x130 [btrfs] [96049.833853] lock_extent_range+0x8e/0x150 [btrfs] [96049.833864] btrfs_double_extent_lock+0x78/0xb0 [btrfs] [96049.833875] btrfs_extent_same_range+0x14e/0x550 [btrfs] [96049.833885] ? rcu_read_lock_sched_held+0x3f/0x70 [96049.833890] ? __kmalloc_node+0x2b0/0x2f0 [96049.833899] ? btrfs_dedupe_file_range+0x19a/0x280 [btrfs] [96049.833909] btrfs_dedupe_file_range+0x270/0x280 [btrfs] [96049.833916] vfs_dedupe_file_range_one+0xd9/0xe0 [96049.833919] vfs_dedupe_file_range+0x131/0x1b0 [96049.833924] do_vfs_ioctl+0x272/0x6e0 [96049.833927] ? __fget+0x113/0x200 [96049.833931] ksys_ioctl+0x70/0x80 [96049.833933] __x64_sys_ioctl+0x16/0x20 [96049.833937] do_syscall_64+0x60/0x1b0 [96049.833939] entry_SYSCALL_64_after_hwframe+0x49/0xbe [96049.833941] RIP: 0033:0x7f5c1478ddd7 [96049.833943] RSP: 002b:00007ffe15b196a8 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 [96049.833945] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5c1478ddd7 [96049.833946] RDX: 00005625ece322d0 RSI: 00000000c0189436 RDI: 0000000000000004 [96049.833947] RBP: 0000000000000000 R08: 00007f5c14a46f48 R09: 0000000000000040 [96049.833948] R10: 0000000000000541 R11: 0000000000000202 R12: 0000000000000000 [96049.833949] R13: 0000000000000000 R14: 0000000000000004 R15: 00005625ece322d0 [96049.833954] irq event stamp: 6196 [96049.833956] hardirqs last enabled at (6195): [] console_unlock+0x503/0x640 [96049.833958] hardirqs last disabled at (6196): [] trace_hardirqs_off_thunk+0x1a/0x1c [96049.833959] softirqs last enabled at (6114): [] __do_softirq+0x370/0x421 [96049.833964] softirqs last disabled at (6095): [] irq_exit+0xcd/0xe0 [96049.833965] ---[ end trace db7b05f01b7fa10c ]--- [96049.935816] R13: 0000000000000000 R14: 00005562e5259240 R15: 00007ffff092b910 [96049.935822] irq event stamp: 6584 [96049.935823] hardirqs last enabled at (6583): [] console_unlock+0x503/0x640 [96049.935825] hardirqs last disabled at (6584): [] trace_hardirqs_off_thunk+0x1a/0x1c [96049.935827] softirqs last enabled at (6328): [] __do_softirq+0x370/0x421 [96049.935828] softirqs last disabled at (6313): [] irq_exit+0xcd/0xe0 [96049.935829] ---[ end trace db7b05f01b7fa123 ]--- [96049.935840] ------------[ cut here ]------------ [96049.936065] WARNING: CPU: 1 PID: 24463 at fs/btrfs/extent_io.c:436 insert_state+0x101/0x120 [btrfs] [96049.936107] CPU: 1 PID: 24463 Comm: umount Tainted: G W 4.19.0-rc7-btrfs-next-39 #1 [96049.936108] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.2-0-gf9626ccb91-prebuilt.qemu-project.org 04/01/2014 [96049.936117] RIP: 0010:insert_state+0x101/0x120 [btrfs] [96049.936119] RSP: 0018:ffffafd2c3637bc0 EFLAGS: 00010282 [96049.936120] RAX: 0000000000000000 RBX: 000000000004dfff RCX: 0000000000000006 [96049.936121] RDX: 0000000000000007 RSI: ffff990445cf88e0 RDI: ffff99047b2968a0 [96049.936122] RBP: ffff990457851cd0 R08: 0000000000000001 R09: 0000000000000000 [96049.936123] R10: ffffafd2c3637b88 R11: 0000000000000000 R12: ffff9904574301e8 [96049.936124] R13: 000000000004e000 R14: ffffafd2c3637c50 R15: ffffafd2c3637c48 [96049.936125] FS: 00007fe4b87e72c0(0000) GS:ffff99047b280000(0000) knlGS:0000000000000000 [96049.936126] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [96049.936128] CR2: 00005562e52618d8 CR3: 00000001151c8005 CR4: 00000000003606e0 [96049.936129] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [96049.936131] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [96049.936131] Call Trace: [96049.936141] __set_extent_bit+0x46c/0x6a0 [btrfs] [96049.936154] lock_extent_bits+0x6b/0x210 [btrfs] [96049.936167] btrfs_evict_inode+0x1e1/0x5a0 [btrfs] [96049.936172] evict+0xbf/0x1c0 [96049.936174] dispose_list+0x51/0x80 [96049.936176] evict_inodes+0x193/0x1c0 [96049.936180] generic_shutdown_super+0x3f/0x110 [96049.936182] kill_anon_super+0xe/0x30 [96049.936189] btrfs_kill_super+0x13/0x100 [btrfs] [96049.936191] deactivate_locked_super+0x3a/0x70 [96049.936193] cleanup_mnt+0x3b/0x80 [96049.936195] task_work_run+0x93/0xc0 [96049.936198] exit_to_usermode_loop+0xfa/0x100 [96049.936201] do_syscall_64+0x17f/0x1b0 [96049.936202] entry_SYSCALL_64_after_hwframe+0x49/0xbe [96049.936204] RIP: 0033:0x7fe4b80cfb37 [96049.936206] RSP: 002b:00007ffff092b688 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [96049.936207] RAX: 0000000000000000 RBX: 00005562e5259060 RCX: 00007fe4b80cfb37 [96049.936208] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 00005562e525faa0 [96049.936209] RBP: 00005562e525faa0 R08: 00005562e525f770 R09: 0000000000000015 [96049.936210] R10: 00000000000006b4 R11: 0000000000000246 R12: 00007fe4b85d1e64 [96049.936211] R13: 0000000000000000 R14: 00005562e5259240 R15: 00007ffff092b910 [96049.936211] R13: 0000000000000000 R14: 00005562e5259240 R15: 00007ffff092b910 [96049.936216] irq event stamp: 6616 [96049.936219] hardirqs last enabled at (6615): [] console_unlock+0x503/0x640 [96049.936219] hardirqs last disabled at (6616): [] trace_hardirqs_off_thunk+0x1a/0x1c [96049.936222] softirqs last enabled at (6328): [] __do_softirq+0x370/0x421 [96049.936222] softirqs last disabled at (6313): [] irq_exit+0xcd/0xe0 [96049.936223] ---[ end trace db7b05f01b7fa124 ]--- The second stack trace, from inode eviction, is repeated forever due to the infinite loop during eviction. This is the same type of problem fixed way back in 2015 by commit 113e8283869b ("Btrfs: fix inode eviction infinite loop after extent_same ioctl") and commit ccccf3d67294 ("Btrfs: fix inode eviction infinite loop after cloning into it"). So fix this by returning immediately if the deduplication range length gets rounded down to 0 bytes, as there is nothing that needs to be done in such case. Example reproducer: $ mkfs.btrfs -f /dev/sdb $ mount /dev/sdb /mnt $ xfs_io -f -c "pwrite -S 0xe6 0 100" /mnt/foo $ xfs_io -f -c "pwrite -S 0xe6 0 1M" /mnt/bar # Unmount the filesystem and mount it again so that we start without any # extent state records when we ask for the deduplication. $ umount /mnt $ mount /dev/sdb /mnt $ xfs_io -c "dedupe /mnt/foo 0 500K 100" /mnt/bar # This unmount triggers the infinite loop. $ umount /mnt A test case for fstests will follow soon. Fixes: de02b9f6bb65 ("Btrfs: fix data corruption when deduplicating between different files") CC: # 4.19+ Reviewed-by: Nikolay Borisov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 4222ea7100c0e37adace2790c8822758bbeee179 Author: Filipe Manana Date: Wed Oct 24 10:13:03 2018 +0100 Btrfs: fix deadlock on tree root leaf when finding free extent When we are writing out a free space cache, during the transaction commit phase, we can end up in a deadlock which results in a stack trace like the following: schedule+0x28/0x80 btrfs_tree_read_lock+0x8e/0x120 [btrfs] ? finish_wait+0x80/0x80 btrfs_read_lock_root_node+0x2f/0x40 [btrfs] btrfs_search_slot+0xf6/0x9f0 [btrfs] ? evict_refill_and_join+0xd0/0xd0 [btrfs] ? inode_insert5+0x119/0x190 btrfs_lookup_inode+0x3a/0xc0 [btrfs] ? kmem_cache_alloc+0x166/0x1d0 btrfs_iget+0x113/0x690 [btrfs] __lookup_free_space_inode+0xd8/0x150 [btrfs] lookup_free_space_inode+0x5b/0xb0 [btrfs] load_free_space_cache+0x7c/0x170 [btrfs] ? cache_block_group+0x72/0x3b0 [btrfs] cache_block_group+0x1b3/0x3b0 [btrfs] ? finish_wait+0x80/0x80 find_free_extent+0x799/0x1010 [btrfs] btrfs_reserve_extent+0x9b/0x180 [btrfs] btrfs_alloc_tree_block+0x1b3/0x4f0 [btrfs] __btrfs_cow_block+0x11d/0x500 [btrfs] btrfs_cow_block+0xdc/0x180 [btrfs] btrfs_search_slot+0x3bd/0x9f0 [btrfs] btrfs_lookup_inode+0x3a/0xc0 [btrfs] ? kmem_cache_alloc+0x166/0x1d0 btrfs_update_inode_item+0x46/0x100 [btrfs] cache_save_setup+0xe4/0x3a0 [btrfs] btrfs_start_dirty_block_groups+0x1be/0x480 [btrfs] btrfs_commit_transaction+0xcb/0x8b0 [btrfs] At cache_save_setup() we need to update the inode item of a block group's cache which is located in the tree root (fs_info->tree_root), which means that it may result in COWing a leaf from that tree. If that happens we need to find a free metadata extent and while looking for one, if we find a block group which was not cached yet we attempt to load its cache by calling cache_block_group(). However this function will try to load the inode of the free space cache, which requires finding the matching inode item in the tree root - if that inode item is located in the same leaf as the inode item of the space cache we are updating at cache_save_setup(), we end up in a deadlock, since we try to obtain a read lock on the same extent buffer that we previously write locked. So fix this by using the tree root's commit root when searching for a block group's free space cache inode item when we are attempting to load a free space cache. This is safe since block groups once loaded stay in memory forever, as well as their caches, so after they are first loaded we will never need to read their inode items again. For new block groups, once they are created they get their ->cached field set to BTRFS_CACHE_FINISHED meaning we will not need to read their inode item. Reported-by: Andrew Nelson Link: https://lore.kernel.org/linux-btrfs/CAPTELenq9x5KOWuQ+fa7h1r3nsJG8vyiTH8+ifjURc_duHh2Wg@mail.gmail.com/ Fixes: 9d66e233c704 ("Btrfs: load free space cache if it exists") Tested-by: Andrew Nelson Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 7e17916b35797396f681a3270245fd29c1e4c250 Author: Arnd Bergmann Date: Sat Nov 3 16:39:28 2018 +0100 btrfs: avoid link error with CONFIG_NO_AUTO_INLINE Note: this patch fixes a problem in a feature outside of btrfs ("kernel hacking: add a config option to disable compiler auto-inlining") and is applied ahead of time due to cross-subsystem dependencies. On 32-bit ARM with gcc-8, I see a link error with the addition of the CONFIG_NO_AUTO_INLINE option: fs/btrfs/super.o: In function `btrfs_statfs': super.c:(.text+0x67b8): undefined reference to `__aeabi_uldivmod' super.c:(.text+0x67fc): undefined reference to `__aeabi_uldivmod' super.c:(.text+0x6858): undefined reference to `__aeabi_uldivmod' super.c:(.text+0x6920): undefined reference to `__aeabi_uldivmod' super.c:(.text+0x693c): undefined reference to `__aeabi_uldivmod' fs/btrfs/super.o:super.c:(.text+0x6958): more undefined references to `__aeabi_uldivmod' follow So far this is the only file that shows the behavior, so I'd propose to just work around it by marking the functions as 'static inline' that normally get inlined here. The reference to __aeabi_uldivmod comes from a div_u64() which has an optimization for a constant division that uses a straight '/' operator when the result should be known to the compiler. My interpretation is that as we turn off inlining, gcc still expects the result to be constant but fails to use that constant value. Link: https://lkml.kernel.org/r/20181103153941.1881966-1-arnd@arndb.de Reviewed-by: Nikolay Borisov Reviewed-by: Changbin Du Signed-off-by: Arnd Bergmann [ add the note ] Signed-off-by: David Sterba commit 761333f2f50ccc887aa9957ae829300262c0d15b Author: Shaokun Zhang Date: Mon Nov 5 18:49:09 2018 +0800 btrfs: tree-checker: Fix misleading group system information block_group_err shows the group system as a decimal value with a '0x' prefix, which is somewhat misleading. Fix it to print hexadecimal, as was intended. Fixes: fce466eab7ac6 ("btrfs: tree-checker: Verify block_group_item") CC: stable@vger.kernel.org # 4.19+ Reviewed-by: Nikolay Borisov Reviewed-by: Qu Wenruo Signed-off-by: Shaokun Zhang Reviewed-by: David Sterba Signed-off-by: David Sterba commit 008c6753f7e070c77c70d708a6bf0255b4381763 Author: Filipe Manana Date: Mon Oct 29 09:42:06 2018 +0000 Btrfs: fix missing data checksums after a ranged fsync (msync) Recently we got a massive simplification for fsync, where for the fast path we no longer log new extents while their respective ordered extents are still running. However that simplification introduced a subtle regression for the case where we use a ranged fsync (msync). Consider the following example: CPU 0 CPU 1 mmap write to range [2Mb, 4Mb[ mmap write to range [512Kb, 1Mb[ msync range [512K, 1Mb[ --> triggers fast fsync (BTRFS_INODE_NEEDS_FULL_SYNC not set) --> creates extent map A for this range and adds it to list of modified extents --> starts ordered extent A for this range --> waits for it to complete writeback triggered for range [2Mb, 4Mb[ --> create extent map B and adds it to the list of modified extents --> creates ordered extent B --> start looking for and logging modified extents --> logs extent maps A and B --> finds checksums for extent A in the csum tree, but not for extent B fsync (msync) finishes --> ordered extent B finishes and its checksums are added to the csum tree After replaying the log, we have the extent covering the range [2Mb, 4Mb[ but do not have the data checksum items covering that file range. This happens because at the very beginning of an fsync (btrfs_sync_file()) we start and wait for IO in the given range [512Kb, 1Mb[ and therefore wait for any ordered extents in that range to complete before we start logging the extents. However if right before we start logging the extent in our range [512Kb, 1Mb[, writeback is started for any other dirty range, such as the range [2Mb, 4Mb[ due to memory pressure or a concurrent fsync or msync (btrfs_sync_file() starts writeback before acquiring the inode's lock), an ordered extent is created for that other range and a new extent map is created to represent that range and added to the inode's list of modified extents. That means that we will see that other extent in that list when collecting extents for logging (done at btrfs_log_changed_extents()) and log the extent before the respective ordered extent finishes - namely before the checksum items are added to the checksums tree, which is where log_extent_csums() looks for the checksums, therefore making us log an extent without logging its checksums. Before that massive simplification of fsync, this wasn't a problem because besides looking for checkums in the checksums tree, we also looked for them in any ordered extent still running. The consequence of data checksums missing for a file range is that users attempting to read the affected file range will get -EIO errors and dmesg reports the following: [10188.358136] BTRFS info (device sdc): no csum found for inode 297 start 57344 [10188.359278] BTRFS warning (device sdc): csum failed root 5 ino 297 off 57344 csum 0x98f94189 expected csum 0x00000000 mirror 1 So fix this by skipping extents outside of our logging range at btrfs_log_changed_extents() and leaving them on the list of modified extents so that any subsequent ranged fsync may collect them if needed. Also, if we find a hole extent outside of the range still log it, just to prevent having gaps between extent items after replaying the log, otherwise fsck will complain when we are not using the NO_HOLES feature (fstest btrfs/056 triggers such case). Fixes: e7175a692765 ("btrfs: remove the wait ordered logic in the log_one_extent path") CC: stable@vger.kernel.org # 4.19+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit fcd5e74288f7d36991b1f0fb96b8c57079645e38 Author: Lu Fengqi Date: Wed Oct 24 20:24:03 2018 +0800 btrfs: fix pinned underflow after transaction aborted When running generic/475, we may get the following warning in dmesg: [ 6902.102154] WARNING: CPU: 3 PID: 18013 at fs/btrfs/extent-tree.c:9776 btrfs_free_block_groups+0x2af/0x3b0 [btrfs] [ 6902.109160] CPU: 3 PID: 18013 Comm: umount Tainted: G W O 4.19.0-rc8+ #8 [ 6902.110971] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 [ 6902.112857] RIP: 0010:btrfs_free_block_groups+0x2af/0x3b0 [btrfs] [ 6902.118921] RSP: 0018:ffffc9000459bdb0 EFLAGS: 00010286 [ 6902.120315] RAX: ffff880175050bb0 RBX: ffff8801124a8000 RCX: 0000000000170007 [ 6902.121969] RDX: 0000000000000002 RSI: 0000000000170007 RDI: ffffffff8125fb74 [ 6902.123716] RBP: ffff880175055d10 R08: 0000000000000000 R09: 0000000000000000 [ 6902.125417] R10: 0000000000000000 R11: 0000000000000000 R12: ffff880175055d88 [ 6902.127129] R13: ffff880175050bb0 R14: 0000000000000000 R15: dead000000000100 [ 6902.129060] FS: 00007f4507223780(0000) GS:ffff88017ba00000(0000) knlGS:0000000000000000 [ 6902.130996] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6902.132558] CR2: 00005623599cac78 CR3: 000000014b700001 CR4: 00000000003606e0 [ 6902.134270] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 6902.135981] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 6902.137836] Call Trace: [ 6902.138939] close_ctree+0x171/0x330 [btrfs] [ 6902.140181] ? kthread_stop+0x146/0x1f0 [ 6902.141277] generic_shutdown_super+0x6c/0x100 [ 6902.142517] kill_anon_super+0x14/0x30 [ 6902.143554] btrfs_kill_super+0x13/0x100 [btrfs] [ 6902.144790] deactivate_locked_super+0x2f/0x70 [ 6902.146014] cleanup_mnt+0x3b/0x70 [ 6902.147020] task_work_run+0x9e/0xd0 [ 6902.148036] do_syscall_64+0x470/0x600 [ 6902.149142] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 6902.150375] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 6902.151640] RIP: 0033:0x7f45077a6a7b [ 6902.157324] RSP: 002b:00007ffd589f3e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 6902.159187] RAX: 0000000000000000 RBX: 000055e8eec732b0 RCX: 00007f45077a6a7b [ 6902.160834] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000055e8eec73490 [ 6902.162526] RBP: 0000000000000000 R08: 000055e8eec734b0 R09: 00007ffd589f26c0 [ 6902.164141] R10: 0000000000000000 R11: 0000000000000246 R12: 000055e8eec73490 [ 6902.165815] R13: 00007f4507ac61a4 R14: 0000000000000000 R15: 00007ffd589f40d8 [ 6902.167553] irq event stamp: 0 [ 6902.168998] hardirqs last enabled at (0): [<0000000000000000>] (null) [ 6902.170731] hardirqs last disabled at (0): [] copy_process.part.55+0x3b0/0x1f00 [ 6902.172773] softirqs last enabled at (0): [] copy_process.part.55+0x3b0/0x1f00 [ 6902.174671] softirqs last disabled at (0): [<0000000000000000>] (null) [ 6902.176407] ---[ end trace 463138c2986b275c ]--- [ 6902.177636] BTRFS info (device dm-3): space_info 4 has 273465344 free, is not full [ 6902.179453] BTRFS info (device dm-3): space_info total=276824064, used=4685824, pinned=18446744073708158976, reserved=0, may_use=0, readonly=65536 In the above line there's "pinned=18446744073708158976" which is an unsigned u64 value of -1392640, an obvious underflow. When transaction_kthread is running cleanup_transaction(), another fsstress is running btrfs_commit_transaction(). The btrfs_finish_extent_commit() may get the same range as btrfs_destroy_pinned_extent() got, which causes the pinned underflow. Fixes: d4b450cd4b33 ("Btrfs: fix race between transaction commit and empty block group removal") CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Josef Bacik Signed-off-by: Lu Fengqi Reviewed-by: David Sterba Signed-off-by: David Sterba commit 506481b20e818db40b6198815904ecd2d6daee64 Author: Robbie Ko Date: Tue Oct 30 18:04:04 2018 +0800 Btrfs: fix cur_offset in the error case for nocow When the cow_file_range fails, the related resources are unlocked according to the range [start..end), so the unlock cannot be repeated in run_delalloc_nocow. In some cases (e.g. cur_offset <= end && cow_start != -1), cur_offset is not updated correctly, so move the cur_offset update before cow_file_range. kernel BUG at mm/page-writeback.c:2663! Internal error: Oops - BUG: 0 [#1] SMP CPU: 3 PID: 31525 Comm: kworker/u8:7 Tainted: P O Hardware name: Realtek_RTD1296 (DT) Workqueue: writeback wb_workfn (flush-btrfs-1) task: ffffffc076db3380 ti: ffffffc02e9ac000 task.ti: ffffffc02e9ac000 PC is at clear_page_dirty_for_io+0x1bc/0x1e8 LR is at clear_page_dirty_for_io+0x14/0x1e8 pc : [] lr : [] pstate: 40000145 sp : ffffffc02e9af4f0 Process kworker/u8:7 (pid: 31525, stack limit = 0xffffffc02e9ac020) Call trace: [] clear_page_dirty_for_io+0x1bc/0x1e8 [] extent_clear_unlock_delalloc+0x1e4/0x210 [btrfs] [] run_delalloc_nocow+0x3b8/0x948 [btrfs] [] run_delalloc_range+0x250/0x3a8 [btrfs] [] writepage_delalloc.isra.21+0xbc/0x1d8 [btrfs] [] __extent_writepage+0xe8/0x248 [btrfs] [] extent_write_cache_pages.isra.17+0x164/0x378 [btrfs] [] extent_writepages+0x48/0x68 [btrfs] [] btrfs_writepages+0x20/0x30 [btrfs] [] do_writepages+0x30/0x88 [] __writeback_single_inode+0x34/0x198 [] writeback_sb_inodes+0x184/0x3c0 [] __writeback_inodes_wb+0x6c/0xc0 [] wb_writeback+0x1b8/0x1c0 [] wb_workfn+0x150/0x250 [] process_one_work+0x1dc/0x388 [] worker_thread+0x130/0x500 [] kthread+0x10c/0x110 [] ret_from_fork+0x10/0x40 Code: d503201f a9025bb5 a90363b7 f90023b9 (d4210000) CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Filipe Manana Signed-off-by: Robbie Ko Signed-off-by: David Sterba commit 5e93a125f521efd00d71af31c2a301f3d46af48c Author: Takashi Iwai Date: Mon Nov 5 12:28:07 2018 +0100 ALSA: hda - Fix incorrect clearance of thinkpad_acpi hooks Since the commit c647f806b8c2 ("ALSA: hda - Allow multiple ADCs for mic mute LED controls") we allow enabling the mic mute LED with multiple ADCs. The commit changed the function return value to be zero or a negative error, while this change was overlooked in the thinkpad_acpi helper code where it still expects a positive return value for success. This eventually leads to a NULL dereference on a system that has only a mic mute LED. This patch corrects the return value check in the corresponding code as well. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=201621 Fixes: c647f806b8c2 ("ALSA: hda - Allow multiple ADCs for mic mute LED controls") Cc: Signed-off-by: Takashi Iwai commit 6a8915d0f8cf323e1beb792a33095cf652db4056 Author: Ville Syrjälä Date: Mon Nov 5 21:46:04 2018 +0200 drm/i915: Don't oops during modeset shutdown after lpe audio deinit We deinit the lpe audio device before we call drm_atomic_helper_shutdown(), which means the platform device may already be gone when it comes time to shut down the crtc. As we don't know when the last reference to the platform device gets dropped by the audio driver we can't assume that the device and its data are still around when turning off the crtc. Mark the platform device as gone as soon as we do the audio deinit. Cc: stable@vger.kernel.org Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20181105194604.6994-1-ville.syrjala@linux.intel.com Reviewed-by: Chris Wilson (cherry picked from commit f45a7977d1140c11f334e01a9f77177ed68e3bfa) Signed-off-by: Joonas Lahtinen commit 0014868b9c3c1dda1de6711cf58c3486fb422d07 Author: Chris Wilson Date: Fri Nov 2 16:12:09 2018 +0000 drm/i915: Mark pin flags as u64 Since the flags are being used to operate on a u64 variable, they too need to be marked as such so that the inverses are full width (and not zero extended on 32b kernels and bdw+). Reported-by: Sergii Romantsov Signed-off-by: Chris Wilson Cc: stable@vger.kernel.org Reviewed-by: Lionel Landwerlin Reviewed-by: Michal Wajdeczko Link: https://patchwork.freedesktop.org/patch/msgid/20181102161232.17742-2-chris@chris-wilson.co.uk (cherry picked from commit 83b466b1dc5f0b4d33f0a901e8b00197a8f3582d) Signed-off-by: Joonas Lahtinen commit e528c2affcf216b3d02b22004895cb678769629b Author: Manasi Navare Date: Tue Oct 23 12:12:47 2018 -0700 drm/i915/icl: Fix the macros for DFLEXDPMLE register bits This patch fixes the macros used for defining the DFLEXDPMLE register bit fields. This accounts for changes in the spec. Fixes: a2bc69a1a9d6 ("drm/i915/icl: Add register definition for DFLEXDPMLE") Cc: Animesh Manna Cc: Paulo Zanoni Cc: Jose Roberto de Souza Cc: # v4.19+ Signed-off-by: Manasi Navare Reviewed-by: José Roberto de Souza Link: https://patchwork.freedesktop.org/patch/msgid/20181023191248.26418-1-manasi.d.navare@intel.com (cherry picked from commit b4335ec0a3ee6229a570755f8fb95dc8a7c694f2) Signed-off-by: Joonas Lahtinen commit f42f343887016330b321dd40eebc68c7292e4f1b Author: Ville Syrjälä Date: Mon Oct 29 16:00:31 2018 +0200 drm/i915: Fix error handling for the NV12 fb dimensions check Let's not leak obj->framebuffer_references when we decide that the framebuffer domensions are not suitable for NV12. Cc: stable@vger.kernel.org Cc: Maarten Lankhorst Cc: Vidya Srinivas Fixes: e44134f2673c ("drm/i915: Add NV12 support to intel_framebuffer_init") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20181029140031.11765-1-ville.syrjala@linux.intel.com Reviewed-by: Matt Roper (cherry picked from commit 3b90946fcb6f13b65888c380461793a9dea9d1f4) Signed-off-by: Joonas Lahtinen commit 76271ef2638ca8e4bf2884cad664a34be0d5a42b Author: Dhinakaran Pandiyan Date: Fri Oct 5 11:56:42 2018 -0700 drm/i915: Fix VIDEO_DIP_CTL bit shifts The shifts for VSC_SELECT bits are wrong, fix it. Good thing is the definitions are unused. v2: Moves definitions in another patch (Manasi) Cc: Manasi Navare Cc: Anusha Srivatsa Cc: Rodrigo Vivi Fixes: 7af2be6d54d4 ("drm/i915/icl: Add VIDEO_DIP registers") Signed-off-by: Dhinakaran Pandiyan Reviewed-by: Manasi Navare Link: https://patchwork.freedesktop.org/patch/msgid/20181005185643.31660-1-dhinakaran.pandiyan@intel.com (cherry picked from commit 09209662618f9fdc38b8d4da39040c8829fd2d57) Signed-off-by: Joonas Lahtinen commit 2c2f6e30d5f29691e3563d334ce208d3a1907f49 Author: Rodrigo Vivi Date: Thu Oct 25 17:56:36 2018 -0700 drm/i915/glk: Remove 99% limitation. While checking the opportunity to add a display_gen check to allow glk and cnl to be on same bucket I noticed these FIXME cases here. So I got the confirmation from HW architect that we actually never needed this workaround. "GLK supports 2 pixel per clock, so pixel clock can be up to 2 * cdclk." So, this reverts commit 97f55ca5b662 ("drm/i915/glk: limit pixel clock to 99% of cdclk workaround") Fixes: 97f55ca5b662 ("drm/i915/glk: limit pixel clock to 99% of cdclk workaround") Cc: Ville Syrjälä Cc: Madhav Chauhan Cc: Jani Nikula Cc: Clinton Taylor Cc: Arthur J Runyan Signed-off-by: Rodrigo Vivi Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20181026005636.22274-1-rodrigo.vivi@intel.com (cherry picked from commit 42882336e62aab00278114392a16374f272a0c99) Signed-off-by: Joonas Lahtinen commit 085603287452fc96376ed4888bf29f8c095d2b40 Author: Chris Wilson Date: Thu Oct 25 10:18:23 2018 +0100 drm/i915: Compare user's 64b GTT offset even on 32b Beware mixing unsigned long constants and 64b values, as on 32b the constant will be zero extended and discard the high 32b when used as a mask! Reported-by: Sergii Romantsov Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108282 Signed-off-by: Chris Wilson Cc: Joonas Lahtinen Cc: stable@vger.kernel.org Reviewed-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20181025091823.20571-2-chris@chris-wilson.co.uk (cherry picked from commit 6fc4e48f9ed46e9adff236a0c350074aafa3b7fa) Signed-off-by: Joonas Lahtinen commit c58281056a8b26d5d9dc15c19859a7880835ef44 Author: Chris Wilson Date: Thu Oct 25 10:18:22 2018 +0100 drm/i915: Mark up GTT sizes as u64 Since we use a 64b virtual GTT irrespective of the system, we want to ensure that the GTT computations remains 64b even on 32b systems, including treatment of huge virtual pages. No code generation changes on 64b: Reported-by: Sergii Romantsov Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108282 Signed-off-by: Chris Wilson Cc: Joonas Lahtinen Cc: stable@vger.kernel.org Reviewed-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20181025091823.20571-1-chris@chris-wilson.co.uk (cherry picked from commit 9125963a9494253fa5a29cc1b4169885d2be7042) Signed-off-by: Joonas Lahtinen commit 6503493145cba4413ecd3d4d153faeef4a1e9b85 Author: Clint Taylor Date: Thu Oct 25 11:52:00 2018 -0700 drm/i915/hdmi: Add HDMI 2.0 audio clock recovery N values HDMI 2.0 594Mhz modes were incorrectly selecting 25.200Mhz Automatic N value mode instead of HDMI specification values. V2: Fix 88.2 Hz N value Cc: Jani Nikula Cc: stable@vger.kernel.org Signed-off-by: Clint Taylor Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/1540493521-1746-2-git-send-email-clinton.a.taylor@intel.com (cherry picked from commit 5a400aa3c562c4a726b4da286e63c96db905ade1) Signed-off-by: Joonas Lahtinen commit 18354b422ce4ce1124277dfe8f4f094bae0102ad Author: Ville Syrjälä Date: Tue Oct 23 21:21:02 2018 +0300 drm/i915: Don't apply the 16Gb DIMM wm latency w/a to BXT/GLK The 16Gb DIMM w/a is not applicable to BXT or GLK. Limit it to the appropriate platforms. This was especially harsh on GLK since we don't even try to read the DIMM information on that platforms, hence valid_dimm was always false and thus we always tried to apply the w/a. Furthermore the w/a pushed the level 0 latency above the level 1 latency, which doesn't really make sense. v2: Do the check when populating is_16gb_dimm (Mahesh) Cc: Mahesh Kumar Cc: Maarten Lankhorst Fixes: 86b592876cb6 ("drm/i915: Implement 16GB dimm wa for latency level-0") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20181023182102.31549-1-ville.syrjala@linux.intel.com Reviewed-by: Rodrigo Vivi Reviewed-by: Mahesh Kumar (cherry picked from commit 5d6f36b27d2764f3dc940606ee6b7ec5c669af3e) Signed-off-by: Joonas Lahtinen commit 8bd66d147c88bd441178c7b4c774ae5a185f19b8 Author: ndesaulniers@google.com Date: Wed Oct 31 12:39:01 2018 -0700 include/linux/compiler*.h: define asm_volatile_goto asm_volatile_goto should also be defined for other compilers that support asm goto. Fixes commit 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h mutually exclusive"). Signed-off-by: Nick Desaulniers Signed-off-by: Miguel Ojeda commit aa9b760cec2385ad408bb2e346c7f6dc1be69a79 Author: Linus Walleij Date: Sun Nov 4 11:32:47 2018 +0100 HID: fix up .raw_event() documentation The documentation for the .raw_event() callback says that if the driver return 1, there will be no further processing of the event, but this is not true, the actual code in hid-core.c looks like this: if (hdrv && hdrv->raw_event && hid_match_report(hid, report)) { ret = hdrv->raw_event(hid, report, data, size); if (ret < 0) goto unlock; } ret = hid_report_raw_event(hid, type, data, size, interrupt); The only return value that has any effect on the processing is a negative error. Correct this as it seems to confuse people: I found bogus code in the Razer out-of-tree driver attempting to return 1 here. Signed-off-by: Linus Walleij Signed-off-by: Jiri Kosina commit 3fc202e81db70bf60beb9296eefd4e48d6304607 Author: Arnd Bergmann Date: Fri Nov 2 16:14:32 2018 +0100 HID: asus: fix build warning wiht CONFIG_ASUS_WMI disabled asus_wmi_evaluate_method() is an empty dummy function when CONFIG_ASUS_WMI is disabled, or not reachable from a built-in device driver. This leads to a theoretical evaluation of an uninitialized variable that the compiler complains about, failing to check that the hardcoded return value makes this an unreachable code path: In file included from include/linux/printk.h:336, from include/linux/kernel.h:14, from include/linux/list.h:9, from include/linux/dmi.h:5, from drivers/hid/hid-asus.c:29: drivers/hid/hid-asus.c: In function 'asus_input_configured': include/linux/dynamic_debug.h:135:3: error: 'value' may be used uninitialized in this function [-Werror=maybe-uninitialized] __dynamic_dev_dbg(&descriptor, dev, fmt, \ ^~~~~~~~~~~~~~~~~ drivers/hid/hid-asus.c:359:6: note: 'value' was declared here u32 value; ^~~~~ With an extra IS_ENABLED() check, the warning goes away. Fixes: 3b692c55e58d ("HID: asus: only support backlight when it's not driven by WMI") Signed-off-by: Arnd Bergmann Acked-by: Geert Uytterhoeven Signed-off-by: Jiri Kosina commit 0c7244209588630a9b45e52490ef1390e04499a6 Merge: 399474e4c110 eb7046e9bf46 Author: Jiri Kosina Date: Tue Nov 6 13:57:02 2018 +0100 Merge branch 'master' into for-4.20/upstream-fixes Pull in a merge commit that brought in 3b692c55e58d ("HID: asus: only support backlight when it's not driven by WMI") so that fixup could be applied on top of it. commit 4e26f692e2e2aa4d7d6ddb3c4d3dec17f45d6495 Author: Sakari Ailus Date: Wed Oct 10 04:04:18 2018 -0400 media: ipu3-cio2: Use cio2_queues_exit The ipu3-cio2 driver has a function to tear down video devices as well as the associated video buffer queues. Use it. Signed-off-by: Sakari Ailus Tested-by: Bingbu Cao Reviewed-by: Bingbu Cao Signed-off-by: Mauro Carvalho Chehab commit 32388d6ef7cffc7d8291b67f8dfa26acd45217fd Author: Sakari Ailus Date: Wed Oct 10 04:01:05 2018 -0400 media: ipu3-cio2: Unregister device nodes first, then release resources While there are issues related to object lifetime management, unregister the media device first, followed immediately by other device nodes when the driver is being unbound. Only then the resources needed by the driver may be released. This is slightly safer. Signed-off-by: Sakari Ailus Tested-by: Bingbu Cao Reviewed-by: Bingbu Cao Signed-off-by: Mauro Carvalho Chehab commit 30efae3d789cd0714ef795545a46749236e29558 Author: Sakari Ailus Date: Tue Oct 9 07:49:49 2018 -0400 media: omap3isp: Unregister media device as first While there are issues related to object lifetime management, unregister the media device first when the driver is being unbound. This is slightly safer. Signed-off-by: Sakari Ailus Reviewed-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit 003aedaed65d4f71f3f122ea1e079c648bab113e Author: Sakari Ailus Date: Tue Oct 9 07:29:14 2018 -0400 media: docs: Document metadata format in struct v4l2_format The format fields in struct v4l2_format were otherwise documented but the meta field was missing. Document it. Reported-by: Hans Verkuil Signed-off-by: Sakari Ailus Acked-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 92539d3eda2c090b382699bbb896d4b54e9bdece Author: Sakari Ailus Date: Mon Nov 5 09:35:44 2018 -0500 media: v4l: event: Add subscription to list before calling "add" operation Patch ad608fbcf166 changed how events were subscribed to address an issue elsewhere. As a side effect of that change, the "add" callback was called before the event subscription was added to the list of subscribed events, causing the first event queued by the add callback (and possibly other events arriving soon afterwards) to be lost. Fix this by adding the subscription to the list before calling the "add" callback, and clean up afterwards if that fails. Fixes: ad608fbcf166 ("media: v4l: event: Prevent freeing event subscriptions while accessed") Reported-by: Dave Stevenson Signed-off-by: Sakari Ailus Tested-by: Dave Stevenson Reviewed-by: Hans Verkuil Tested-by: Hans Verkuil Cc: stable@vger.kernel.org (for 4.14 and up) Signed-off-by: Mauro Carvalho Chehab commit b50b769bcbc24d68d95870d87354ec45fa0f07bb Author: Mauro Carvalho Chehab Date: Tue Nov 6 05:54:48 2018 -0500 media: dm365_ipipeif: better annotate a fall though Shut up this warning: drivers/staging/media/davinci_vpfe/dm365_ipipeif.c: In function 'ipipeif_hw_setup': drivers/staging/media/davinci_vpfe/dm365_ipipeif.c:298:3: warning: this statement may fall through [-Wimplicit-fallthrough=] switch (isif_port_if) { ^~~~~~ drivers/staging/media/davinci_vpfe/dm365_ipipeif.c:314:2: note: here case IPIPEIF_SDRAM_YUV: ^~~~ By annotating a fall though case at the right place. Acked-by: Hans Verkuil Acked-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 8e88c29b351ed4e09dd63f825f1c8260b0cb0ab3 Author: Jiri Olsa Date: Sun Sep 23 17:04:20 2018 +0200 perf tools: Do not zero sample_id_all for group members Andi reported following malfunction: # perf record -e '{ref-cycles,cycles}:S' -a sleep 1 # perf script non matching sample_id_all That's because we disable sample_id_all bit for non-sampling group members. We can't do that, because it needs to be the same over the whole event list. This patch keeps it untouched again. Reported-by: Andi Kleen Tested-by: Andi Kleen Signed-off-by: Jiri Olsa Cc: Alexander Shishkin Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/20180923150420.27327-1-jolsa@kernel.org Fixes: e9add8bac6c6 ("perf evsel: Disable write_backward for leader sampling group events") Signed-off-by: Arnaldo Carvalho de Melo commit ca92e173ab34a4f7fc4128bd372bd96f1af6f507 Author: Benjamin Poirier Date: Mon Nov 5 17:00:53 2018 +0900 xfrm: Fix bucket count reported to userspace sadhcnt is reported by `ip -s xfrm state count` as "buckets count", not the hash mask. Fixes: 28d8909bc790 ("[XFRM]: Export SAD info.") Signed-off-by: Benjamin Poirier Signed-off-by: Steffen Klassert commit 86d4d068df573a8c2105554624796c086d6bec3d Author: John David Anglin Date: Tue Nov 6 12:00:01 2018 +0100 parisc: Revert "Release spinlocks using ordered store" This reverts commit d27dfa13b9f77ae7e6ed09d70a0426ed26c1a8f9. Unfortunately, this patch needs to be reverted. We need the full sync barrier and not the limited barrier provided by using an ordered store. The sync ensures that all accesses and cache purge instructions that follow the sync are performed after all such instructions prior the sync instruction have completed executing. The patch breaks the rwlock implementation in glibc. This caused the test-lock application in the libprelude testsuite to hang. With the change reverted, the test runs correctly and the libprelude package builds successfully. Signed-off-by: John David Anglin Signed-off-by: Helge Deller commit 6282e916f774e37845c65d1eae9f8c649004f033 Author: Ard Biesheuvel Date: Mon Nov 5 14:54:56 2018 +0100 ARM: 8809/1: proc-v7: fix Thumb annotation of cpu_v7_hvc_switch_mm Due to what appears to be a copy/paste error, the opening ENTRY() of cpu_v7_hvc_switch_mm() lacks a matching ENDPROC(), and instead, the one for cpu_v7_smc_switch_mm() is duplicated. Given that it is ENDPROC() that emits the Thumb annotation, the cpu_v7_hvc_switch_mm() routine will be called in ARM mode on a Thumb2 kernel, resulting in the following splat: Internal error: Oops - undefined instruction: 0 [#1] SMP THUMB2 Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.18.0-rc1-00030-g4d28ad89189d-dirty #488 Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 PC is at cpu_v7_hvc_switch_mm+0x12/0x18 LR is at flush_old_exec+0x31b/0x570 pc : [] lr : [] psr: 00000013 sp : ee899e50 ip : 00000000 fp : 00000001 r10: eda28f34 r9 : eda31800 r8 : c12470e0 r7 : eda1fc00 r6 : eda53000 r5 : 00000000 r4 : ee88c000 r3 : c0316eec r2 : 00000001 r1 : eda53000 r0 : 6da6c000 Flags: nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Note the 'ISA ARM' in the last line. Fix this by using the correct name in ENDPROC(). Cc: Fixes: 10115105cb3a ("ARM: spectre-v2: add firmware based hardening") Reviewed-by: Dave Martin Acked-by: Marc Zyngier Signed-off-by: Ard Biesheuvel Signed-off-by: Russell King commit ef86eaf97acd6d82cd3fd40f997b1c8c4895a443 Author: Ezequiel Garcia Date: Thu Oct 18 14:54:29 2018 -0400 media: Rename vb2_m2m_request_queue -> v4l2_m2m_request_queue To be consistent with the rest of the mem2mem helpers, rename vb2_m2m_request_queue to v4l2_m2m_request_queue. This is just a cosmetic change. Signed-off-by: Ezequiel Garcia Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 2efaf6ebb34fe66c613e94c6e97ae95879455bc3 Author: Hans Verkuil Date: Thu Oct 11 06:38:27 2018 -0400 media: cec: increase debug level for 'queue full' The "transmit queue full" message doesn't warrant debug level 1 since it is already clear from the error code what's going on. Bump to level 2. Signed-off-by: Hans Verkuil Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 55623b4169056d7bb493d1c6f715991f8db67302 Author: Hans Verkuil Date: Wed Oct 10 07:12:15 2018 -0400 media: cec: check for non-OK/NACK conditions while claiming a LA During the configuration phase of a CEC adapter it is trying to claim a free logical address by polling. However, the code doesn't check if there were errors other than OK or NACK, those are just treated as if the poll was NACKed. Instead check for such errors and retry the poll. And if the problem persists then don't claim this LA since there is something weird going on. Signed-off-by: Hans Verkuil Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 7cf7b2e977abf3f992036939e35a8eab60013aff Author: Hans Verkuil Date: Wed Oct 10 03:03:43 2018 -0400 media: vicodec: lower minimum height to 360 Lower the minimum height to 360 to be consistent with the webcam input of vivid. The 480 was rather arbitrary but it made it harder to use vivid as a source for encoding since the default resolution when you load vivid is 640x360. Signed-off-by: Hans Verkuil Reviewed-by: Kieran Bingham Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 0ede1794b9667d9cd35d1ac27f2eeff52d5733d5 Author: Nathan Chancellor Date: Mon Oct 8 18:11:28 2018 -0400 media: tc358743: Remove unnecessary self assignment Clang warns when a variable is assigned to itself. drivers/media/i2c/tc358743.c:1921:7: warning: explicitly assigning value of variable of type 'int' to itself [-Wself-assign] ret = ret; ~~~ ^ ~~~ 1 warning generated. Signed-off-by: Nathan Chancellor Reviewed-by: Kieran Bingham Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 215237a5e436f72e8ee5b53243acf88a16e3ac01 Merge: df18bfd35bbf 651022382c7f Author: Mauro Carvalho Chehab Date: Tue Nov 6 05:11:16 2018 -0500 Merge tag 'v4.20-rc1' into patchwork Linux 4.20-rc1 * tag 'v4.20-rc1': (836 commits) Linux 4.20-rc1 sched/topology: Fix off by one bug memory_hotplug: cond_resched in __remove_pages bfs: add sanity check at bfs_fill_super() kernel/sysctl.c: remove duplicated include kernel/kexec_file.c: remove some duplicated includes mm, thp: consolidate THP gfp handling into alloc_hugepage_direct_gfpmask ocfs2: fix clusters leak in ocfs2_defrag_extent() ocfs2: dlmglue: clean up timestamp handling ocfs2: don't put and assigning null to bh allocated outside ocfs2: fix a misuse a of brelse after failing ocfs2_check_dir_entry ocfs2: don't use iocb when EIOCBQUEUED returns ocfs2: without quota support, avoid calling quota recovery ocfs2: remove ocfs2_is_o2cb_active() mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings include/linux/notifier.h: SRCU: fix ctags mm: handle no memcg case in memcg_kmem_charge() properly ARM: dts: stm32: update HASH1 dmas property on stm32mp157c ARM: orion: avoid VLA in orion_mpp_conf iov_iter: Fix 9p virtio breakage ... commit df18bfd35bbf7cb1a420b5beede1de29343793b3 Author: Arnd Bergmann Date: Fri Nov 2 07:09:07 2018 -0400 media: v4l: fix uapi mpeg slice params definition We get a headers_check warning about the newly defined ioctl command structures: ./usr/include/linux/v4l2-controls.h:1105: found __[us]{8,16,32,64} type without #include This is resolved by including linux/types.h, as suggested by the warning, but there is another problem: Three of the four structures have an odd number of __u8 headers, but are aligned to 32 bit in the v4l2_ctrl_mpeg2_slice_params, so we get an implicit padding byte for each one. To solve that, let's add explicit padding that can be set to zero and verified in the kernel. Fixes: c27bb30e7b6d ("media: v4l: Add definitions for MPEG-2 slice format and metadata") Signed-off-by: Arnd Bergmann Signed-off-by: Mauro Carvalho Chehab commit ba26cd7d58dcc50e25c8f02b5376c05046b181dc Author: Boris Brezillon Date: Mon Nov 5 08:58:35 2018 +0100 mtd: sa1100: avoid VLA in sa1100_setup_mtd Enabling -Wvla found another variable-length array with randconfig testing: drivers/mtd/maps/sa1100-flash.c: In function 'sa1100_setup_mtd': drivers/mtd/maps/sa1100-flash.c:224:10: error: ISO C90 forbids variable length array 'cdev' [-Werror=vla] Dynamically allocate the cdev array passed to mtd_concat_create() instead of using a VLA. Reported-by: Arnd Bergmann Signed-off-by: Boris Brezillon Cc: Kees Cook Cc: Olof Johansson commit 6cc4a0863c9709c512280c64e698d68443ac8053 Author: Manjunath Patil Date: Tue Oct 30 09:49:21 2018 -0700 xen-blkfront: fix kernel panic with negotiate_mq error path info->nr_rings isn't adjusted in case of ENOMEM error from negotiate_mq(). This leads to kernel panic in error path. Typical call stack involving panic - #8 page_fault at ffffffff8175936f [exception RIP: blkif_free_ring+33] RIP: ffffffffa0149491 RSP: ffff8804f7673c08 RFLAGS: 00010292 ... #9 blkif_free at ffffffffa0149aaa [xen_blkfront] #10 talk_to_blkback at ffffffffa014c8cd [xen_blkfront] #11 blkback_changed at ffffffffa014ea8b [xen_blkfront] #12 xenbus_otherend_changed at ffffffff81424670 #13 backend_changed at ffffffff81426dc3 #14 xenwatch_thread at ffffffff81422f29 #15 kthread at ffffffff810abe6a #16 ret_from_fork at ffffffff81754078 Cc: stable@vger.kernel.org Fixes: 7ed8ce1c5fc7 ("xen-blkfront: move negotiate_mq to cover all cases of new VBDs") Signed-off-by: Manjunath Patil Acked-by: Roger Pau Monné Signed-off-by: Juergen Gross commit d9cccfa7c4d1d9ef967ec9308df7304a18609b30 Author: Liam Merwick Date: Fri Nov 2 14:04:23 2018 +0000 xen/grant-table: Fix incorrect gnttab_dma_free_pages() pr_debug message If a call to xenmem_reservation_increase() in gnttab_dma_free_pages() fails it triggers a message "Failed to decrease reservation..." which should be "Failed to increase reservation..." Fixes: 9bdc7304f536 ('xen/grant-table: Allow allocating buffers suitable for DMA') Reported-by: Ross Philipson Signed-off-by: Liam Merwick Reviewed-by: Mark Kanda Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross commit 9586d569a369dc585a3e191dcabd72748e3c9c5c Author: Michael Ellerman Date: Tue Nov 6 19:25:38 2018 +1100 powerpc/mm/64s: Only use slbfee on CPUs that support it The slbfee instruction was only added in ISA 2.05 (Power6), it's not supported on older CPUs. We don't have a CPU feature for that ISA version though, so just use the ISA 2.06 feature flag. Fixes: e15a4fea4dee ("powerpc/64s/hash: Add some SLB debugging tests") Signed-off-by: Michael Ellerman commit 08e6a3434e2125e4b21d0d3f84678d427345bc0d Author: Michael Ellerman Date: Tue Nov 6 19:25:18 2018 +1100 powerpc/mm/64s: Use PPC_SLBFEE macro Old toolchains don't know about slbfee and break the build, eg: {standard input}:37: Error: Unrecognized opcode: `slbfee.' Fix it by using the macro version. We need to add an underscore version that takes raw register numbers from the inline asm, rather than our Rx macros. Fixes: e15a4fea4dee ("powerpc/64s/hash: Add some SLB debugging tests") Signed-off-by: Michael Ellerman commit 0ae790683fc28bb718d74f87cdf753c6445fe28d Author: Michael Ellerman Date: Tue Nov 6 19:23:28 2018 +1100 powerpc/mm/64s: Consolidate SLB assertions The code for assert_slb_exists() and assert_slb_notexists() is almost identical, except for the polarity of the WARN_ON(). In a future patch we'll need to modify this code, so consolidate it now into a single function. Signed-off-by: Michael Ellerman commit ba3a51ac32ebcf8d0a54b37f1af268ad8a31c52f Author: Thinh Nguyen Date: Thu Aug 2 20:17:16 2018 -0700 usb: dwc3: gadget: Properly check last unaligned/zero chain TRB Current check for the last extra TRB for zero and unaligned transfers does not account for isoc OUT. The last TRB of the Buffer Descriptor for isoc OUT transfers will be retired with HWO=0. As a result, we won't return early. The req->remaining will be updated to include the BUFSIZ count of the extra TRB, and the actual number of transferred bytes calculation will be wrong. To fix this, check whether it's a short or zero packet and the last TRB chain bit to return early. Fixes: c6267a51639b ("usb: dwc3: gadget: align transfers to wMaxPacketSize") Cc: Signed-off-by: Thinh Nguyen Signed-off-by: Felipe Balbi commit 08fd9a82fda86529bb2f2af3c2f7cb657b4d3066 Author: Andy Shevchenko Date: Mon Aug 27 18:30:16 2018 +0300 usb: dwc3: core: Clean up ULPI device If dwc3_core_init_mode() fails with deferred probe, next probe fails on sysfs with sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:11.0/dwc3.0.auto/dwc3.0.auto.ulpi' To avoid this failure, clean up ULPI device. Cc: Signed-off-by: Andy Shevchenko Signed-off-by: Felipe Balbi commit 96edebd6bb995f2acb7694bed6e01bf6f5a7b634 Author: Finn Thain Date: Wed Oct 24 18:45:33 2018 +1100 scsi: NCR5380: Return false instead of NULL I overlooked this statement when I recently converted the function result type from struct scsi_cmnd * to bool. No change to object code. Signed-off-by: Finn Thain Signed-off-by: Martin K. Petersen commit 0d52e642c0ccd7a877a58b6ec23552eb35e7170c Author: Masanari Iida Date: Sun Oct 28 14:05:48 2018 +0900 scsi: qla2xxx: Fix a typo in MODULE_PARM_DESC This patch fixes a spelling typo in MODULE_PARM_DESC of ql2xplogiabsentdevice. Signed-off-by: Masanari Iida Signed-off-by: Martin K. Petersen commit e34ff8edcae89922d187425ab0b82e6a039aa371 Author: YueHaibing Date: Fri Oct 26 15:07:31 2018 +0800 scsi: hisi_sas: Remove set but not used variable 'dq_list' Fixes gcc '-Wunused-but-set-variable' warning: drivers/scsi/hisi_sas/hisi_sas_v1_hw.c: In function 'start_delivery_v1_hw': drivers/scsi/hisi_sas/hisi_sas_v1_hw.c:907:20: warning: variable 'dq_list' set but not used [-Wunused-but-set-variable] drivers/scsi/hisi_sas/hisi_sas_v2_hw.c: In function 'start_delivery_v2_hw': drivers/scsi/hisi_sas/hisi_sas_v2_hw.c:1671:20: warning: variable 'dq_list' set but not used [-Wunused-but-set-variable] drivers/scsi/hisi_sas/hisi_sas_v3_hw.c: In function 'start_delivery_v3_hw': drivers/scsi/hisi_sas/hisi_sas_v3_hw.c:889:20: warning: variable 'dq_list' set but not used [-Wunused-but-set-variable] It never used since introduction in commit fa222db0b036 ("scsi: hisi_sas: Don't lock DQ for complete task sending") Signed-off-by: YueHaibing Acked-by: John Garry Signed-off-by: Martin K. Petersen commit a3ecf48248a393438e77e569a0047e968e0ec6c6 Author: Arnd Bergmann Date: Fri Nov 2 16:47:23 2018 +0100 scsi: myrs: only build on little-endian platforms Reading throught the new driver, I noticed that this cannot work on big-endian CPUs, and the old DAC960 had exactly the same behavior. To document this for the future, add a Kconfig dependency that prevents it from being included in big-endian kernels. Since the hardware is really old and we never had a working driver on it for big-endian platforms, it's unlikely to make a difference to users. Signed-off-by: Arnd Bergmann Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen commit 77409c4cdc44560e1b3b839e62d7f73478199680 Author: Arnd Bergmann Date: Fri Nov 2 16:44:13 2018 +0100 scsi: myrs: avoid stack overflow warning Putting a 1024 byte data structure on the stack is generally a bad idea. On 32-bit systems, it also triggers a compile-time warning when building with -Og: drivers/scsi/myrs.c: In function 'myrs_get_ctlr_info': drivers/scsi/myrs.c:212:1: error: the frame size of 1028 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] We only really need three members of the structure, so just read them manually here instead of copying the entire structure. Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)") Signed-off-by: Arnd Bergmann Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen commit f8d294324598ec85bea2779512e48c94cbe4d7c6 Author: Arnd Bergmann Date: Fri Nov 2 16:35:48 2018 +0100 scsi: lpfc: fix remoteport access The addition of a spinlock in lpfc_debugfs_nodelist_data() introduced a bug that lets us not skip NULL pointers correctly, as noticed by gcc-8: drivers/scsi/lpfc/lpfc_debugfs.c: In function 'lpfc_debugfs_nodelist_data.constprop': drivers/scsi/lpfc/lpfc_debugfs.c:728:13: error: 'nrport' may be used uninitialized in this function [-Werror=maybe-uninitialized] if (nrport->port_role & FC_PORT_ROLE_NVME_INITIATOR) This changes the logic back to what it was, while keeping the added spinlock. Fixes: 9e210178267b ("scsi: lpfc: Synchronize access to remoteport via rport") Signed-off-by: Arnd Bergmann Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit f8f4adc1c1661686f492cf27817844a3d0517aff Author: Arnd Bergmann Date: Fri Nov 2 16:34:49 2018 +0100 scsi: myrb: fix sprintf buffer overflow warning gcc warns that the 12 byte fw_version field might not be long enough to contain the generated firmware name string: drivers/scsi/myrb.c: In function 'myrb_get_hba_config': drivers/scsi/myrb.c:1052:38: error: '%02d' directive writing between 2 and 3 bytes into a region of size between 2 and 5 [-Werror=format-overflow=] sprintf(cb->fw_version, "%d.%02d-%c-%02d", ^~~~ drivers/scsi/myrb.c:1052:26: note: directive argument in the range [0, 255] sprintf(cb->fw_version, "%d.%02d-%c-%02d", ^~~~~~~~~~~~~~~~~ drivers/scsi/myrb.c:1052:2: note: 'sprintf' output between 10 and 14 bytes into a destination of size 12 sprintf(cb->fw_version, "%d.%02d-%c-%02d", ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ enquiry2->fw.major_version, ~~~~~~~~~~~~~~~~~~~~~~~~~~~ enquiry2->fw.minor_version, ~~~~~~~~~~~~~~~~~~~~~~~~~~~ enquiry2->fw.firmware_type, ~~~~~~~~~~~~~~~~~~~~~~~~~~~ enquiry2->fw.turn_id); ~~~~~~~~~~~~~~~~~~~~~ I have not checked whether there are appropriate range checks before the sprintf, but there is a range check after it that will bail out in case of out of range version numbers. This means we can simply use snprintf() instead of sprintf() to limit the output buffer size, and it will work correctly. Fixes: 081ff398c56c ("scsi: myrb: Add Mylex RAID controller (block interface)") Signed-off-by: Arnd Bergmann Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen commit 5841734fa6f997e57e8c29cbb6409bd74a6949e8 Author: Bart Van Assche Date: Mon Nov 5 16:44:59 2018 -0800 scsi: target/core: Avoid that a kernel oops is triggered when COMPARE AND WRITE fails Fixes: aa73237dcb2d ("scsi: target/core: Always call transport_complete_callback() upon failure") Reviewed-by: David Disseldorp Cc: Nicholas Bellinger Cc: Mike Christie Cc: Christoph Hellwig Cc: Hannes Reinecke Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit a422757e8c323ae12163fa74bc21c41606a233df Merge: 713119315741 f393808dc641 Author: David S. Miller Date: Mon Nov 5 17:19:25 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains the first batch of Netfilter fixes for your net tree: 1) Fix splat with IPv6 defragmenting locally generated fragments, from Florian Westphal. 2) Fix Incorrect check for missing attribute in nft_osf. 3) Missing INT_MIN & INT_MAX definition for netfilter bridge uapi header, from Jiri Slaby. 4) Revert map lookup in nft_numgen, this is already possible with the existing infrastructure without this extension. 5) Fix wrong listing of set reference counter, make counter synchronous again, from Stefano Brivio. 6) Fix CIDR 0 in hash:net,port,net, from Eric Westbrook. 7) Fix allocation failure with large set, use kvcalloc(). From Andrey Ryabinin. 8) No need to disable BH when fetch ip set comment, patch from Jozsef Kadlecsik. 9) Sanity check for valid sysfs entry in xt_IDLETIMER, from Taehee Yoo. 10) Fix suspicious rcu usage via ip_set() macro at netlink dump, from Jozsef Kadlecsik. 11) Fix setting default timeout via nfnetlink_cttimeout, this comes with preparation patch to add nf_{tcp,udp,...}_pernet() helper. 12) Allow ebtables table nat to be of filter type via nft_compat. From Florian Westphal. 13) Incorrect calculation of next bucket in early_drop, do no bump hash value, update bucket counter instead. From Vasily Khoruzhick. ==================== Signed-off-by: David S. Miller commit 7131193157414ac3167d7b2f2feb4c42b415d6c5 Author: Rasmus Villemoes Date: Mon Nov 5 18:52:21 2018 +0100 net: alx: make alx_drv_name static alx_drv_name is not used outside main.c, so there's no reason for it to have external linkage. Signed-off-by: Rasmus Villemoes Signed-off-by: David S. Miller commit 97adaddaa6db7a8af81b9b11e30cbe3628cd6700 Author: Taehee Yoo Date: Mon Nov 5 22:31:41 2018 +0900 net: bpfilter: fix iptables failure if bpfilter_umh is disabled When iptables command is executed, ip_{set/get}sockopt() try to upload bpfilter.ko if bpfilter is enabled. if it couldn't find bpfilter.ko, command is failed. bpfilter.ko is generated if CONFIG_BPFILTER_UMH is enabled. ip_{set/get}sockopt() only checks CONFIG_BPFILTER. So that if CONFIG_BPFILTER is enabled and CONFIG_BPFILTER_UMH is disabled, iptables command is always failed. test config: CONFIG_BPFILTER=y # CONFIG_BPFILTER_UMH is not set test command: %iptables -L iptables: No chain/target/match by that name. Fixes: d2ba09c17a06 ("net: add skeleton of bpfilter kernel module") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller commit c34c1287778b080ed692c0a46a8e345206cc29e6 Author: Andrei Vagin Date: Sun Nov 4 22:37:15 2018 -0800 sock_diag: fix autoloading of the raw_diag module IPPROTO_RAW isn't registred as an inet protocol, so inet_protos[protocol] is always NULL for it. Cc: Cyrill Gorcunov Cc: Xin Long Fixes: bf2ae2e4bf93 ("sock_diag: request _diag module only when the family or proto has been registered") Signed-off-by: Andrei Vagin Reviewed-by: Cyrill Gorcunov Signed-off-by: David S. Miller commit d016b4a3562b745fd9fa387a47d8de62ccd7e241 Author: Matwey V. Kornilov Date: Fri Nov 2 21:19:36 2018 +0300 net: core: netpoll: Enable netconsole IPv6 link local address There is no reason to discard using source link local address when remote netconsole IPv6 address is set to be link local one. The patch allows administrators to use IPv6 netconsole without explicitly configuring source address: netconsole=@/,@fe80::5054:ff:fe2f:6012/ Signed-off-by: Matwey V. Kornilov Signed-off-by: David S. Miller commit e22d0bfa09a56e427a1a950ccb85621c86b343a4 Author: Alexey Kodanev Date: Fri Nov 2 19:11:05 2018 +0300 ipv6: properly check return value in inet6_dump_all() Make sure we call fib6_dump_end() if it happens that skb->len is zero. rtnl_dump_all() can reset cb->args on the next loop iteration there. Fixes: 08e814c9e8eb ("net/ipv6: Bail early if user only wants cloned entries") Fixes: ae677bbb4441 ("net: Don't return invalid table id error when dumping all families") Signed-off-by: Alexey Kodanev Signed-off-by: David S. Miller commit 5e1acb4afacc6229946c3d2b7ffc422b53fb2448 Author: Alexey Kodanev Date: Fri Nov 2 19:11:04 2018 +0300 rtnetlink: restore handling of dumpit return value in rtnl_dump_all() For non-zero return from dumpit() we should break the loop in rtnl_dump_all() and return the result. Otherwise, e.g., we could get the memory leak in inet6_dump_fib() [1]. The pointer to the allocated struct fib6_walker there (saved in cb->args) can be lost, reset on the next iteration. Fix it by partially restoring the previous behavior before commit c63586dc9b3e ("net: rtnl_dump_all needs to propagate error from dumpit function"). The returned error from dumpit() is still passed further. [1]: unreferenced object 0xffff88001322a200 (size 96): comm "sshd", pid 1484, jiffies 4296032768 (age 1432.542s) hex dump (first 32 bytes): 00 01 00 00 00 00 ad de 00 02 00 00 00 00 ad de ................ 18 09 41 36 00 88 ff ff 18 09 41 36 00 88 ff ff ..A6......A6.... backtrace: [<0000000095846b39>] kmem_cache_alloc_trace+0x151/0x220 [<000000007d12709f>] inet6_dump_fib+0x68d/0x940 [<000000002775a316>] rtnl_dump_all+0x1d9/0x2d0 [<00000000d7cd302b>] netlink_dump+0x945/0x11a0 [<000000002f43485f>] __netlink_dump_start+0x55d/0x800 [<00000000f76bbeec>] rtnetlink_rcv_msg+0x4fa/0xa00 [<000000009b5761f3>] netlink_rcv_skb+0x29c/0x420 [<0000000087a1dae1>] rtnetlink_rcv+0x15/0x20 [<00000000691b703b>] netlink_unicast+0x4e3/0x6c0 [<00000000b5be0204>] netlink_sendmsg+0x7f2/0xba0 [<0000000096d2aa60>] sock_sendmsg+0xba/0xf0 [<000000008c1b786f>] __sys_sendto+0x1e4/0x330 [<0000000019587b3f>] __x64_sys_sendto+0xe1/0x1a0 [<00000000071f4d56>] do_syscall_64+0x9f/0x300 [<000000002737577f>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [<0000000057587684>] 0xffffffffffffffff Fixes: c63586dc9b3e ("net: rtnl_dump_all needs to propagate error from dumpit function") Signed-off-by: Alexey Kodanev Signed-off-by: David S. Miller commit 90c31cb9a8115a1183daed9a714eea4be0687931 Author: Boris Brezillon Date: Fri Oct 19 11:02:22 2018 +0200 mtd: spi-nor: Reset nor->addr_width when SFDP parsing failed Commit 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI NOR flash memories") removed the 'nor->addr_width = 0;' statement when spi_nor_parse_sfdp() returns an error, thus leaving ->addr_width in an undefined state which can cause trouble when spi_nor_scan() checks its value. Reported-by: Cyrille Pitchen Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI NOR flash memories") Signed-off-by: Boris Brezillon Reviewed-by: Tudor Ambarus commit 91d7b67000c6e9bd605624079fee5a084238ad92 Author: Christophe JAILLET Date: Tue Oct 16 09:13:46 2018 +0200 mtd: spi-nor: cadence-quadspi: Return error code in cqspi_direct_read_execute() We return 0 unconditionally in 'cqspi_direct_read_execute()'. However, 'ret' is set to some error codes in several error handling paths. Return 'ret' instead to propagate the error code. Fixes: ffa639e069fb ("mtd: spi-nor: cadence-quadspi: Add DMA support for direct mode reads") Cc: Signed-off-by: Christophe JAILLET Signed-off-by: Boris Brezillon commit 0773495b1f5f1c5e23551843f87b5ff37e7af8f7 Author: Max Filippov Date: Sun Nov 4 01:46:00 2018 -0700 xtensa: make sure bFLT stack is 16 byte aligned Xtensa ABI requires stack alignment to be at least 16. In noMMU configuration ARCH_SLAB_MINALIGN is used to align stack. Make it at least 16. This fixes the following runtime error in noMMU configuration, caused by interaction between insufficiently aligned stack and alloca function, that results in corruption of on-stack variable in the libc function glob: Caught unhandled exception in 'sh' (pid = 47, pc = 0x02d05d65) - should not happen EXCCAUSE is 15 Cc: stable@vger.kernel.org Signed-off-by: Max Filippov commit 804dfaf01bcc9daa4298c608ba9018abf616ec48 Author: Matthew Wilcox Date: Mon Nov 5 16:37:15 2018 -0500 XArray: Fix Documentation Minor fixes. Signed-off-by: Matthew Wilcox commit d9c480435add8257f9069941f0e6196647f6d746 Author: Matthew Wilcox Date: Mon Nov 5 16:15:56 2018 -0500 XArray: Handle NULL pointers differently for allocation For allocating XArrays, it makes sense to distinguish beteen erasing an entry and storing NULL. Storing NULL keeps the index allocated with a NULL pointer associated with it while xa_erase() frees the index. Some existing IDR users rely on this ability. Signed-off-by: Matthew Wilcox commit 611f318637daa5710a1d7a0e7dc6cda23914094a Author: Matthew Wilcox Date: Mon Nov 5 15:56:17 2018 -0500 XArray: Unify xa_store and __xa_store Saves around 115 bytes on a tinyconfig build and reduces the amount of code duplication in the XArray implementation. Signed-off-by: Matthew Wilcox commit 84e5acb76dacb8ebd648a86a53907ce0dd616534 Author: Matthew Wilcox Date: Fri Oct 26 14:41:29 2018 -0400 XArray: Add xa_store_bh() and xa_store_irq() These convenience wrappers disable interrupts while taking the spinlock. A number of drivers would otherwise have to open-code these functions. Signed-off-by: Matthew Wilcox commit 9c16bb88905456a9b1299338041f05fa7699971b Author: Matthew Wilcox Date: Mon Nov 5 15:48:49 2018 -0500 XArray: Turn xa_erase into an exported function Make xa_erase() take the spinlock and then call __xa_erase(), but make it out of line since it's such a common function. Signed-off-by: Matthew Wilcox commit c5beb07e7a06b24f4f27304f6282b5dbd929543b Author: Matthew Wilcox Date: Wed Oct 31 14:39:28 2018 -0400 XArray: Unify xa_cmpxchg and __xa_cmpxchg xa_cmpxchg() was one of the largest functions in the xarray implementation. By turning it into a wrapper and having the callers take the lock (like several other functions), we save 160 bytes on a tinyconfig build and reduce the duplication in xarray.c. Signed-off-by: Matthew Wilcox commit 4c0608f4a0e76dfb82d3accd20081f4bf47ed143 Author: Matthew Wilcox Date: Tue Oct 30 09:45:55 2018 -0400 XArray: Regularise xa_reserve The xa_reserve() function was a little unusual in that it attempted to be callable for all kinds of locking scenarios. Make it look like the other APIs with __xa_reserve, xa_reserve_bh and xa_reserve_irq variants. Signed-off-by: Matthew Wilcox commit 6915ed86cca6a0b422e8ada05ec7009d2074b88a Author: Jeff Barnhill <0xeffeff@gmail.com> Date: Mon Nov 5 20:36:45 2018 +0000 net/ipv6: Move anycast init/cleanup functions out of CONFIG_PROC_FS Move the anycast.c init and cleanup functions which were inadvertently added inside the CONFIG_PROC_FS definition. Fixes: 2384d02520ff ("net/ipv6: Add anycast addresses to a global hashtable") Signed-off-by: Jeff Barnhill <0xeffeff@gmail.com> Signed-off-by: David S. Miller commit 8e7f91719db36440d63de37331367be9700ca0c7 Author: Dmitry V. Levin Date: Thu Nov 1 14:03:28 2018 +0300 uapi: fix more linux/kfd_ioctl.h userspace compilation errors Consistently use types provided by via to fix struct kfd_ioctl_get_queue_wave_state_args userspace compilation errors. Fixes: 5df099e8bc83f ("drm/amdkfd: Add wavefront context save state retrieval ioctl") Signed-off-by: Dmitry V. Levin Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit aba118389a6fb2ad7958de0f37b5869852bd38cf Author: Dmitry V. Levin Date: Thu Nov 1 14:03:08 2018 +0300 uapi: fix linux/kfd_ioctl.h userspace compilation errors Consistently use types provided by via to fix the following linux/kfd_ioctl.h userspace compilation errors: /usr/include/linux/kfd_ioctl.h:250:2: error: unknown type name 'uint32_t' uint32_t reset_type; /usr/include/linux/kfd_ioctl.h:251:2: error: unknown type name 'uint32_t' uint32_t reset_cause; /usr/include/linux/kfd_ioctl.h:252:2: error: unknown type name 'uint32_t' uint32_t memory_lost; /usr/include/linux/kfd_ioctl.h:253:2: error: unknown type name 'uint32_t' uint32_t gpu_id; Fixes: 0c119abad7f0d ("drm/amd: Add kfd ioctl defines for hw_exception event") Cc: # v4.19 Signed-off-by: Dmitry V. Levin Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit fe2b51145c9ffd5a49013fe180e42e92ef0e6df9 Author: Matthew Wilcox Date: Mon Dec 4 19:33:30 2017 -0500 nilfs2: Use xa_erase_irq This code simply opencoded xa_erase_irq(). Signed-off-by: Matthew Wilcox commit 9ee5a3b7eeb190eb413e0fac3246022bd1baa05d Author: Matthew Wilcox Date: Thu Nov 1 22:52:06 2018 -0400 XArray: Export __xa_foo to non-GPL modules Without this, it's not possible to use static inlines like xa_store_bh() and xa_erase_irq(). Signed-off-by: Matthew Wilcox commit 8229706e03e4147f3e22d1de0d30630cde6d18a9 Author: Matthew Wilcox Date: Thu Nov 1 16:55:19 2018 -0400 XArray: Fix xa_for_each with a single element at 0 The following sequence of calls would result in an infinite loop in xa_find_after(): xa_store(xa, 0, x, GFP_KERNEL); index = 0; xa_for_each(xa, entry, index, ULONG_MAX, XA_PRESENT) { } xa_find_after() was confusing the situation where we found no entry in the tree with finding a multiorder entry, so it would look for the successor entry forever. Just check for this case explicitly. Includes a few new checks in the test suite to be sure this doesn't reappear. Signed-off-by: Matthew Wilcox commit af31b04b67f4fd7f639fd465a507c154c46fc9fb Author: Masayoshi Mizuma Date: Tue Oct 30 21:50:25 2018 -0400 tools/testing/nvdimm: Fix the array size for dimm devices. KASAN reports following global out of bounds access while nfit_test is being loaded. The out of bound access happens the following reference to dimm_fail_cmd_flags[dimm]. 'dimm' is over than the index value, NUM_DCR (==5). static int override_return_code(int dimm, unsigned int func, int rc) { if ((1 << func) & dimm_fail_cmd_flags[dimm]) { dimm_fail_cmd_flags[] definition: static unsigned long dimm_fail_cmd_flags[NUM_DCR]; 'dimm' is the return value of get_dimm(), and get_dimm() returns the index of handle[] array. The handle[] has 7 index. Let's use ARRAY_SIZE(handle) as the array size. KASAN report: ================================================================== BUG: KASAN: global-out-of-bounds in nfit_test_ctl+0x47bb/0x55b0 [nfit_test] Read of size 8 at addr ffffffffc10cbbe8 by task kworker/u41:0/8 ... Call Trace: dump_stack+0xea/0x1b0 ? dump_stack_print_info.cold.0+0x1b/0x1b ? kmsg_dump_rewind_nolock+0xd9/0xd9 print_address_description+0x65/0x22e ? nfit_test_ctl+0x47bb/0x55b0 [nfit_test] kasan_report.cold.6+0x92/0x1a6 nfit_test_ctl+0x47bb/0x55b0 [nfit_test] ... The buggy address belongs to the variable: dimm_fail_cmd_flags+0x28/0xffffffffffffa440 [nfit_test] ================================================================== Fixes: 39611e83a28c ("tools/testing/nvdimm: Make DSM failure code injection...") Signed-off-by: Masayoshi Mizuma Signed-off-by: Dan Williams commit 6ac2226229d931153331a93d90655a3de05b9290 Author: Gustavo Romero Date: Thu Nov 1 20:13:21 2018 -0400 perf tools: Fix undefined symbol scnprintf in libperf-jvmti.so Currently jvmti agent can not be used because function scnprintf is not present in the agent libperf-jvmti.so. As a result the JVM when using such agent to record JITed code profiling information will fail on looking up scnprintf: java: symbol lookup error: lib/libperf-jvmti.so: undefined symbol: scnprintf This commit fixes that by reverting to the use of snprintf, that can be looked up, instead of scnprintf, adding a proper check for the returned value in order to print a better error message when the jitdump file pathname is too long. Checking the returned value also helps to comply with some recent gcc versions, like gcc8, which will fail due to truncated writing checks related to the -Werror=format-truncation= flag. Signed-off-by: Gustavo Romero Acked-by: Jiri Olsa LPU-Reference: 1541117601-18937-2-git-send-email-gromero@linux.vnet.ibm.com Link: https://lkml.kernel.org/n/tip-mvpxxxy7wnzaj74cq75muw3f@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit fd5ba6ee3187617287fb9cb187e3d6b3631210a3 Author: Aaro Koskinen Date: Fri Nov 2 21:10:48 2018 +0200 arm64: dts: stratix10: fix multicast filtering On Stratix 10, the EMAC has 256 hash buckets for multicast filtering. This needs to be specified in DTS, otherwise the stmmac driver defaults to 64 buckets and initializes the filter incorrectly. As a result, e.g. valid IPv6 multicast traffic ends up being dropped. Fixes: 78cd6a9d8e15 ("arm64: dts: Add base stratix 10 dtsi") Cc: stable@vger.kernel.org Signed-off-by: Aaro Koskinen Signed-off-by: Dinh Nguyen commit e2c39f36c354a06c6e9d32d4fdf8660b41803d82 Author: Arnaldo Carvalho de Melo Date: Mon Nov 5 15:46:51 2018 -0300 perf beauty: Use SRCARCH, ARCH=x86_64 must map to "x86" to find the headers Guenter reported that using ARCH=x86_64 to build perf has regressed: $ make -C tools/perf O=/tmp/build/perf ARCH=x86_64 make: Entering directory '/home/acme/git/perf/tools/perf' BUILD: Doing 'make -j4' parallel build HOSTCC /tmp/build/perf/fixdep.o HOSTLD /tmp/build/perf/fixdep-in.o LINK /tmp/build/perf/fixdep Auto-detecting system features: ... dwarf: [ on ] ... bpf: [ on ] GEN /tmp/build/perf/common-cmds.h make[2]: *** No rule to make target '/home/acme/git/perf/tools/arch/x86_64/include/uapi/asm//mman.h', needed by '/tmp/build/perf/trace/beauty/generated/mmap_flags_array.c'. Stop. make[2]: *** Waiting for unfinished jobs.... PERF_VERSION = 4.19.gf6c23e3 make[1]: *** [Makefile.perf:207: sub-make] Error 2 make: *** [Makefile:70: all] Error 2 make: Leaving directory '/home/acme/git/perf/tools/perf' $ This is because we must use $(SRCARCH) where we were using $(ARCH), so that, just like the top level Makefile, we get this done: # Additional ARCH settings for x86 ifeq ($(ARCH),i386) SRCARCH := x86 endif ifeq ($(ARCH),x86_64) SRCARCH := x86 endif Which is done in tools/scripts/Makefile.arch, so switch to use $(SRCARCH). Reported-by: Guenter Roeck Cc: Adrian Hunter Cc: Clark Williams Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Fixes: fbd7458db757 ("perf beauty: Wire up the mmap flags table generator to the Makefile") Link: https://lkml.kernel.org/r/20181105184612.GD7077@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 7900f06c3feedbe74d79f28a0d062dbf11fd10bf Author: Jon Mason Date: Wed Sep 19 11:31:40 2018 -0400 MAINTAINERS: Remove self from Broadcom SoCs I'm leaving Broadcom, and will no longer have access to hardware and documentation necessary to be effective in a maintainership role. Signed-off-by: Jon Mason Signed-off-by: Florian Fainelli commit d01501f85249848a2497968d46dd46d5c6fe32e6 Author: Maciej W. Rozycki Date: Thu Nov 1 07:54:24 2018 +0000 MIPS: Fix `dma_alloc_coherent' returning a non-coherent allocation Fix a MIPS `dma_alloc_coherent' regression from commit bc3ec75de545 ("dma-mapping: merge direct and noncoherent ops") that causes a cached allocation to be returned on noncoherent cache systems. This is due to an inverted check now used in the MIPS implementation of `arch_dma_alloc' on the result from `dma_direct_alloc_pages' before doing the cached-to-uncached mapping of the allocation address obtained. The mapping has to be done for a non-NULL rather than NULL result, because a NULL result means the allocation has failed. Invert the check for correct operation then. Signed-off-by: Maciej W. Rozycki Signed-off-by: Paul Burton Reviewed-by: Christoph Hellwig Fixes: bc3ec75de545 ("dma-mapping: merge direct and noncoherent ops") Patchwork: https://patchwork.linux-mips.org/patch/20965/ commit c0fae7e2452b90c31edd2d25eb3baf0c76b400ca Author: Aaro Koskinen Date: Sat Oct 27 01:46:34 2018 +0300 MIPS: OCTEON: fix out of bounds array access on CN68XX The maximum number of interfaces is returned by cvmx_helper_get_number_of_interfaces(), and the value is used to access interface_port_count[]. When CN68XX support was added, we forgot to increase the array size. Fix that. Fixes: 2c8c3f0201333 ("MIPS: Octeon: Support additional interfaces on CN68XX") Signed-off-by: Aaro Koskinen Signed-off-by: Paul Burton Patchwork: https://patchwork.linux-mips.org/patch/20949/ Cc: Ralf Baechle Cc: linux-mips@linux-mips.org Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org # v4.3+ commit f6c23e3b55cb93f32a724f41af8d38888bc2ab6b Author: Adrian Hunter Date: Mon Nov 5 09:35:05 2018 +0200 perf intel-pt: Add MTC and CYC timestamps to debug log One cause of decoding errors is un-synchronized side-band data. Timestamps are needed to debug such cases. TSC packet timestamps are logged. Log also MTC and CYC timestamps. Signed-off-by: Adrian Hunter Link: http://lkml.kernel.org/r/20181105073505.8129-3-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 93f8be2799515e01647c5a9b0d17a90a00ebcf82 Author: Adrian Hunter Date: Mon Nov 5 09:35:04 2018 +0200 perf intel-pt: Add more event information to debug log More event information is useful for debugging, especially MMAP events. Signed-off-by: Adrian Hunter Link: http://lkml.kernel.org/r/20181105073505.8129-2-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 35fa1cee21e34f43db928d022610707d5a234faf Author: Adrian Hunter Date: Sun Nov 4 17:12:38 2018 +0200 perf scripts python: exported-sql-viewer.py: Fix table find when table re-ordered Table rows can be re-ordered by selecting a column to sort by. After re-ordering, the "find" operation was highlighting the wrong row, fix it. Signed-off-by: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20181104151238.15947-5-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 65b24292e8f34df22a16bf7c47823325ac247572 Author: Adrian Hunter Date: Sun Nov 4 17:12:37 2018 +0200 perf scripts python: exported-sql-viewer.py: Add help window Add a window to display help. It is also possible to display the help only, by using the option "--help-only" instead of a database name. Signed-off-by: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20181104151238.15947-4-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 210cf1f96185f0c6383df8b6030e3d2945e1b41a Author: Adrian Hunter Date: Sun Nov 4 17:12:36 2018 +0200 perf scripts python: exported-sql-viewer.py: Add Selected branches report Fetching data from the database can be slow. Add a report that provides the ability to select a subset of branches. Signed-off-by: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20181104151238.15947-3-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 5ed4419d47f8ba6bbccd8e3203276b3c39a792b7 Author: Adrian Hunter Date: Sun Nov 4 17:12:35 2018 +0200 perf scripts python: exported-sql-viewer.py: Fall back to /usr/local/lib/libxed.so Fall back to /usr/local/lib/libxed.so to cater for distributions that do not have /usr/local/lib in the library path by default. Signed-off-by: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20181104151238.15947-2-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 590ac60d8aa929bd21e35cd95a7d8720d00eb4f3 Author: Jin Yao Date: Wed Oct 31 19:06:35 2018 +0800 perf top: Display the LBR stats in callchain entry 'perf report' has supported the displaying of LBR stats (such as cycles, predicted%) in callchain entry. For example: $ perf report --branch-history --stdio --1.01%--intel_idle mwait.h:29 intel_idle cpufeature.h:164 (cycles:5) intel_idle cpufeature.h:164 (predicted:76.4%) intel_idle mwait.h:102 (cycles:41) intel_idle current.h:15 While 'perf top' doesn't support that. For example: $ perf top -a -b --call-graph branch - 13.86% 0.23% [kernel] [k] __x86_indirect_thunk_rax - 13.65% __x86_indirect_thunk_rax + 1.69% do_syscall_64 + 1.68% do_select + 1.41% ktime_get + 0.70% __schedule + 0.62% do_sys_poll 0.58% __x86_indirect_thunk_rax Actually it's very easy to enable this feature in 'perf top'. With this patch, the result is: $ perf top -a -b --call-graph branch $ - 13.58% 0.00% [kernel] [k] __x86_indirect_thunk_rax $ - 13.57% __x86_indirect_thunk_rax (predicted:93.9%) $ + 1.78% do_select (cycles:2) $ + 1.68% perf_pmu_disable.part.99 (cycles:1) $ + 1.45% ___sys_recvmsg (cycles:25) $ + 0.81% unix_stream_sendmsg (cycles:18) $ + 0.80% ktime_get (cycles:400) $ 0.58% pick_next_task_fair (cycles:47) $ + 0.56% i915_request_retire (cycles:2) $ + 0.52% do_sys_poll (cycles:4) Signed-off-by: Jin Yao Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Andi Kleen Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/1540983995-20462-1-git-send-email-yao.jin@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit ea1fa48c055f833eb25f0c33188feecb7002ada5 Author: Thomas Richter Date: Tue Oct 23 17:16:16 2018 +0200 perf stat: Handle different PMU names with common prefix On s390 the CPU Measurement Facility for counters now supports 2 PMUs named cpum_cf (CPU Measurement Facility for counters) and cpum_cf_diag (CPU Measurement Facility for diagnostic counters) for one and the same CPU. Running command [root@s35lp76 perf]# ./perf stat -e tx_c_tend \ -- ~/mytests/cf-tx-events 1 Measuring transactions TX_C_TABORT_NO_SPECIAL: 0 expected:0 TX_C_TABORT_SPECIAL: 0 expected:0 TX_C_TEND: 1 expected:1 TX_NC_TABORT: 11 expected:11 TX_NC_TEND: 1 expected:1 Performance counter stats for '/root/mytests/cf-tx-events 1': 2 tx_c_tend 0.002120091 seconds time elapsed 0.000121000 seconds user 0.002127000 seconds sys [root@s35lp76 perf]# displays output which is unexpected (and wrong): 2 tx_c_tend The test program definitely triggers only one transaction, as shown in line 'TX_C_TEND: 1 expected:1'. This is caused by the following call sequence: pmu_lookup() scans and installs a PMU. +--> pmu_aliases() parses all aliases in directory ...//events/* which are file names. +--> pmu_aliases_parse() Read each file in directory and create an new alias entry. This is done with +--> perf_pmu__new_alias() and +--> __perf_pmu__new_alias() which also check for identical alias names. After pmu_aliases() returns, a complete list of event names for this pmu has been created. Now function pmu_add_cpu_aliases() is called to add the events listed in the json | files to the alias list of the cpu. +--> perf_pmu__find_map() Returns a pointer to the json events. Now function pmu_add_cpu_aliases() scans through all events listed in the JSON files for this CPU. Each json event pmu name is compared with the current PMU being built up and if they mismatch, the json event is added to the current PMUs alias list. To avoid duplicate entries the following comparison is done: if (!is_arm_pmu_core(name)) { pname = pe->pmu ? pe->pmu : "cpu"; if (strncmp(pname, name, strlen(pname))) continue; } The culprit is the strncmp() function. Using current s390 PMU naming, the first PMU is 'cpum_cf' and a long list of events is added, among them 'tx_c_tend' When the second PMU named 'cpum_cf_diag' is added, only one event named 'CF_DIAG' is added by the pmu_aliases() function. Now function pmu_add_cpu_aliases() is invoked for PMU 'cpum_cf_diag'. Since the CPUID string is the same for both PMUs, json file events for PMU named 'cpum_cf' are added to the PMU 'cpm_cf_diag' This happens because the strncmp() actually compares: strncmp("cpum_cf", "cpum_cf_diag", 6); The first parameter is the pmu name taken from the event in the json file. The second parameter is the pmu name of the PMU currently being built. They are different, but the length of the compare only tests the common prefix and this returns 0(true) when it should return false. Now all events for PMU cpum_cf are added to the alias list for pmu cpum_cf_diag. Later on in function parse_events_add_pmu() the event 'tx_c_end' is searched in all available PMUs and found twice, adding it two times to the evsel_list global variable which is the root of all events. This results in a counter value of 2 instead of 1. Output with this patch: [root@s35lp76 perf]# ./perf stat -e tx_c_tend \ -- ~/mytests/cf-tx-events 1 Measuring transactions TX_C_TABORT_NO_SPECIAL: 0 expected:0 TX_C_TABORT_SPECIAL: 0 expected:0 TX_C_TEND: 1 expected:1 TX_NC_TABORT: 11 expected:11 TX_NC_TEND: 1 expected:1 Performance counter stats for '/root/mytests/cf-tx-events 1': 1 tx_c_tend 0.001815365 seconds time elapsed 0.000123000 seconds user 0.001756000 seconds sys [root@s35lp76 perf]# Signed-off-by: Thomas Richter Reviewed-by: Hendrik Brueckner Reviewed-by: Sebastien Boisvert Cc: Heiko Carstens Cc: Kan Liang Cc: Martin Schwidefsky Cc: stable@vger.kernel.org Fixes: 292c34c10249 ("perf pmu: Fix core PMU alias list for X86 platform") Link: http://lkml.kernel.org/r/20181023151616.78193-1-tmricht@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit cf99ad1424c54fc84b84d3a3deb57a48c340c30a Author: Andi Kleen Date: Mon Oct 1 12:59:27 2018 -0700 perf record: Support weak groups Implement a weak group fallback for 'perf record', similar to the existing 'perf stat' support. This allows to use groups that might be longer than the available counters without failing. Before: $ perf record -e '{cycles,cache-misses,cache-references,cpu_clk_unhalted.thread,cycles,cycles,cycles}' -a sleep 1 Error: The sys_perf_event_open() syscall returned with 22 (Invalid argument) for event (cycles). /bin/dmesg | grep -i perf may provide additional information. After: $ ./perf record -e '{cycles,cache-misses,cache-references,cpu_clk_unhalted.thread,cycles,cycles,cycles}:W' -a sleep 1 WARNING: No sample_id_all support, falling back to unordered processing [ perf record: Woken up 3 times to write data ] [ perf record: Captured and wrote 8.136 MB perf.data (134069 samples) ] Signed-off-by: Andi Kleen Acked-by: Jiri Olsa Link: http://lkml.kernel.org/r/20181001195927.14211-2-andi@firstfloor.org Signed-off-by: Arnaldo Carvalho de Melo commit c3537fc251503af18085b8f84126d13743663970 Author: Andi Kleen Date: Mon Oct 1 12:59:26 2018 -0700 perf evlist: Move perf_evsel__reset_weak_group into evlist - Move the function from builtin-stat to evlist for reuse - Rename to evlist to match purpose better - Pass the evlist as first argument. - No functional changes Signed-off-by: Andi Kleen Acked-by: Jiri Olsa Link: http://lkml.kernel.org/r/20181001195927.14211-1-andi@firstfloor.org Signed-off-by: Arnaldo Carvalho de Melo commit 6fce3a406108ee6c8a61e2a33e52e9198a626ea0 Author: Lucas Stach Date: Thu Oct 4 11:37:00 2018 +0200 drm/etnaviv: fix bogus fence complete check in timeout handler The GPU hardware fences and the job out-fences are on different timelines so it's wrong to compare them. Fix this by only looking at the out-fence. Cc: Fixes: 2c83a726d6fb (drm/etnaviv: bring back progress check in job timeout handler) Signed-off-by: Lucas Stach commit 5d7a5bcb67c70cbc904057ef52d3fcfeb24420bb Author: Frank Sorenson Date: Tue Oct 30 15:10:40 2018 -0500 sunrpc: correct the computation for page_ptr when truncating When truncating the encode buffer, the page_ptr is getting advanced, causing the next page to be skipped while encoding. The page is still included in the response, so the response contains a page of bogus data. We need to adjust the page_ptr backwards to ensure we encode the next page into the correct place. We saw this triggered when concurrent directory modifications caused nfsd4_encode_direct_fattr() to return nfserr_noent, and the resulting call to xdr_truncate_encode() corrupted the READDIR reply. Signed-off-by: Frank Sorenson Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields commit 02826a6ba301b72461c3706e1cc66d5571cd327e Author: Masahiro Yamada Date: Mon Nov 5 16:52:34 2018 +0900 kbuild: deb-pkg: fix bindeb-pkg breakage when O= is used Ard Biesheuvel reports bindeb-pkg with O= option is broken in the following way: ... LD [M] sound/soc/rockchip/snd-soc-rk3399-gru-sound.ko LD [M] sound/soc/rockchip/snd-soc-rockchip-pcm.ko LD [M] sound/soc/rockchip/snd-soc-rockchip-rt5645.ko LD [M] sound/soc/rockchip/snd-soc-rockchip-spdif.ko LD [M] sound/soc/sh/rcar/snd-soc-rcar.ko fakeroot -u debian/rules binary make KERNELRELEASE=4.19.0-12677-g19beffaf7a99-dirty ARCH=arm64 KBUILD_SRC= intdeb-pkg /bin/bash /home/ard/linux/scripts/package/builddeb Makefile:600: include/config/auto.conf: No such file or directory *** *** Configuration file ".config" not found! *** *** Please run some configurator (e.g. "make oldconfig" or *** "make menuconfig" or "make xconfig"). *** make[12]: *** [syncconfig] Error 1 make[11]: *** [syncconfig] Error 2 make[10]: *** [include/config/auto.conf] Error 2 make[9]: *** [__sub-make] Error 2 ... Prior to commit 80463f1b7bf9 ("kbuild: add --include-dir flag only for out-of-tree build"), both srctree and objtree were added to --include-dir redundantly, and the wrong code '$MAKE image_name' was working by relying on that. Now, the potential issue that had previously been hidden just showed up. '$MAKE image_name' recurses to the generated $(objtree)/Makefile and ends up with running in srctree, which is incorrect. It should be invoked with '-f $srctree/Makefile' (or KBUILD_SRC=) to be executed in objtree. Fixes: 80463f1b7bf9 ("kbuild: add --include-dir flag only for out-of-tree build") Reported-by: Ard Biesheuvel Signed-off-by: Masahiro Yamada Tested-by: Ard Biesheuvel commit 21b42eb46834f6245a55ac77bdf3e14c034e2864 Author: Masahiro Yamada Date: Mon Nov 5 16:51:49 2018 +0900 kbuild: rpm-pkg: fix binrpm-pkg breakage when O= is used Zhenzhong Duan reported that running 'make O=/build/kernel binrpm-pkg' failed with the following errors: Running 'make O=/build/kernel binrpm-pkg' failed with below two errors. Makefile:600: include/config/auto.conf: No such file or directory + cp make -C /mnt/root/kernel O=/build/kernel image_name make -f /mnt/root/kernel/Makefile ... cp: invalid option -- 'C' Try 'cp --help' for more information. Prior to commit 80463f1b7bf9 ("kbuild: add --include-dir flag only for out-of-tree build"), both srctree and objtree were added to --include-dir redundantly, and the wrong code 'make image_name' was working by relying on that. Now, the potential issue that had previously been hidden just showed up. 'make image_name' recurses to the generated $(objtree)/Makefile and ends up with running in srctree, which is incorrect. It should be invoked with '-f $srctree/Makefile' (or KBUILD_SRC=) to be executed in objtree. Fixes: 80463f1b7bf9 ("kbuild: add --include-dir flag only for out-of-tree build") Reported-by: Zhenzhong Duan Signed-off-by: Masahiro Yamada commit 163c8d54a997153ee1a1e07fcac087492ad85b37 Author: Martin Schwidefsky Date: Mon Nov 5 07:36:28 2018 +0100 compiler: remove __no_sanitize_address_or_inline again The __no_sanitize_address_or_inline and __no_kasan_or_inline defines are almost identical. The only difference is that __no_kasan_or_inline does not have the 'notrace' attribute. To be able to replace __no_sanitize_address_or_inline with the older definition, add 'notrace' to __no_kasan_or_inline and change to two users of __no_sanitize_address_or_inline in the s390 code. The 'notrace' option is necessary for e.g. the __load_psw_mask function in arch/s390/include/asm/processor.h. Without the option it is possible to trace __load_psw_mask which leads to kernel stack overflow. Signed-off-by: Martin Schwidefsky Pointed-out-by: Andrey Ryabinin Acked-by: Steven Rostedt (VMware) Signed-off-by: Linus Torvalds commit 437e88ab8f9e2ad90576ab74c4cf8f527bbf51cd Author: Nathan Chancellor Date: Tue Oct 23 16:11:25 2018 -0700 x86/build: Remove -pipe from KBUILD_CFLAGS Commit 77b0bf55bc67 ("kbuild/Makefile: Prepare for using macros in inline assembly code to work around asm() related GCC inlining bugs") added -Wa,- to KBUILD_CFLAGS, which breaks compiling with Clang (hangs indefinitely at compiling init/main.o). This happens because while Clang accepts -pipe (and has it documented in its list of supported flags), it silently ignores it after this 2010 commit (thanks to Nick Desaulniers for tracking this down), meaning that gas just infinitely waits for stdin and never receives it. https://github.com/llvm-mirror/clang/commit/c19a12dc3d441bec62eed55e312b76c12d6d9022 Initially, I had suggested just add -Wa,- to KBUILD_CFLAGS when GCC was being used but that was before realizing it is because Clang doesn't do anything with -pipe. H. Peter Anvin suggested checking to see if -pipe gives us any gains out of GCC. Turns out it might actually be hurting: With -pipe: real 3m40.813s real 3m44.449s real 3m39.648s Without -pipe: real 3m38.492s real 3m38.335s real 3m38.975s The issue of -Wa,- being passed along to gas without -pipe being supported should still probably be fixed on the LLVM side (open issue: https://bugs.llvm.org/show_bug.cgi?id=39410) but this is not as much of a workaround anymore since it helps both GCC and Clang. Suggested-by: H. Peter Anvin Signed-off-by: Nathan Chancellor Signed-off-by: Thomas Gleixner Tested-by: Nick Desaulniers Reviewed-by: Nadav Amit Reviewed-by: Nick Desaulniers Cc: Borislav Petkov Cc: Kees Cook Cc: Masahiro Yamada Link: https://github.com/ClangBuiltLinux/linux/issues/213 Link: https://lkml.kernel.org/r/20181023231125.27976-1-natechancellor@gmail.com commit b42967dcac1d4f5b059ec25568136462bcb051fe Author: Yi Wang Date: Mon Oct 29 15:17:31 2018 +0800 x86/hyper-v: Fix indentation in hv_do_fast_hypercall16() Remove the surplus TAB in hv_do_fast_hypercall16(). Signed-off-by: Yi Wang Signed-off-by: Thomas Gleixner Cc: kys@microsoft.com Cc: haiyangz@microsoft.com Cc: sthemmin@microsoft.com Cc: bp@alien8.de Cc: hpa@zytor.com Cc: devel@linuxdriverproject.org Cc: zhong.weidong@zte.com.cn Link: https://lkml.kernel.org/r/1540797451-2792-1-git-send-email-wang.yi59@zte.com.cn commit 79ef68c7e1f665578e005b454480b6eca60edabe Author: Arnaldo Carvalho de Melo Date: Mon Nov 5 12:23:40 2018 -0300 perf augmented_syscalls: Start collecting pathnames in the BPF program This is the start of having the raw_syscalls:sys_enter BPF handler collecting pointer arguments, namely pathnames, and with two syscalls that have that pointer in different arguments, "open" as it as its first argument, "openat" as the second. With this in place the existing beautifiers in 'perf trace' works, those args are shown instead of just the pointer that comes with the syscalls tracepoints. This also serves to show and document pitfalls in the process of using just that place in the kernel (raw_syscalls:sys_enter) plus tables provided by userspace to collect syscall pointer arguments. One is the need to use a barrier, as suggested by Edward, to avoid clang optimizations that make the kernel BPF verifier to refuse loading our pointer contents collector. The end result should be a generic eBPF program that works in all architectures, with the differences amongst archs resolved by the userspace component, 'perf trace', that should get all its tables created automatically from the kernel components where they are defined, via string table constructors for things not expressed in BTF/DWARF (enums, structs, etc), and otherwise using those observability files (BTF). Cc: Adrian Hunter Cc: Alexei Starovoitov Cc: Daniel Borkmann Cc: David Ahern Cc: Edward Cree Cc: Jiri Olsa Cc: Martin KaFai Lau Cc: Namhyung Kim Cc: Wang Nan Cc: Yonghong Song Link: https://lkml.kernel.org/n/tip-37dz54pmotgpnwg9tb6zuk9j@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit ee474b81fe5aa5dc0faae920bf66240fbf55f891 Author: Masami Hiramatsu Date: Thu Nov 1 23:29:28 2018 +0900 tracing/kprobes: Fix strpbrk() argument order Fix strpbrk()'s argument order, it must pass acceptable string in 2nd argument. Note that this can cause a kernel panic where it recovers backup character to code->data. Link: http://lkml.kernel.org/r/154108256792.2604.1816052586385217811.stgit@devbox Fixes: a6682814f371 ("tracing/kprobes: Allow kprobe-events to record module symbol") Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 6ff6bc46c0a4f44e7d0b5ca88c33f2b1eb55d519 Merge: f55275bcc729 1ad9fb750a10 Author: Olof Johansson Date: Mon Nov 5 06:39:40 2018 -0800 Merge tag 'imx-fixes-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into fixes i.MX fixes for 4.20: - Add boot-on and always-on for imx6sx-sdb phy regulator to fix enet resume problem, which is exposed by commit ("regulator: fixed: Convert to use GPIO descriptor only"). - Fix improperly quoted stdout-path values for imx53-ppd and vf610m4-colibri board. - Fix the typo of compatible string "fs,imx6sll-i2c" which should be "fsl,imx6sll-i2c". * tag 'imx-fixes-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: ARM: dts: imx6sx-sdb: Fix enet phy regulator ARM: dts: fsl: Fix improperly quoted stdout-path values ARM: dts: imx6sll: fix typo for fsl,imx6sll-i2c node Signed-off-by: Olof Johansson commit f55275bcc72948056387041abe9fce1c54300adc Author: Olof Johansson Date: Mon Nov 5 06:34:09 2018 -0800 ARM: defconfig: Disable PREEMPT again on multi_v7 I should have let this soak for a while in linux-next, since we have at least one board that hit a regression from it. Revert from 4.20-rc, and we'll queue it for next merge window once regression is fixed. This reverts commit 513eb98595522bc0cb83831a9daee1d5738e66f1. Signed-off-by: Olof Johansson commit 02522ad77fb7619615720147dc5da18024cad577 Author: Heiko Carstens Date: Fri Nov 2 13:09:08 2018 +0100 s390: update defconfigs Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit eab53fdfd60a84b0cc514d4f1f5d79226c76df01 Author: Sergei Shtylyov Date: Thu Oct 18 19:48:53 2018 +0300 arm64: dts: renesas: condor: switch from EtherAVB to GEther The "official" Condor boards have always been wired to mount NFS via GEther, not EtherAVB -- the boards resoldered for EtherAVB were local to Cogent Embedded, so we've been having an unpleasant situation where a "normal" Condor board still can't mount NFS (unless an EtherAVB PHY extension board is plugged in). Switch from EtherAVB to GEther at last! Fixes: 8091788f3d38 ("arm64: dts: renesas: condor: add EtherAVB support") Signed-off-by: Sergei Shtylyov Signed-off-by: Simon Horman commit 058ad7b6aa5204d3af878415c7b946748ab34f7a Author: Fabrizio Castro Date: Thu Oct 4 09:53:10 2018 +0100 dt-bindings: arm: Fix RZ/G2E part number Fix RZ/G2E part number from its description. Signed-off-by: Fabrizio Castro Reviewed-by: Biju Das Reviewed-by: Rob Herring Signed-off-by: Simon Horman commit aab7a2414ba0d5c3d0571a90031b535adba7146a Author: Kuninori Morimoto Date: Fri Sep 28 02:38:36 2018 +0000 arm64: dts: renesas: r8a7795: add missing dma-names on hscif2 hscif2 has 4 dmas, but has only 2 dma-names. This patch add missing dma-names. Signed-off-by: Kuninori Morimoto Reviewed-by: Geert Uytterhoeven Fixes: e0f0bda79337701a ("arm64: dts: renesas: r8a7795: sort subnodes of the soc node") Signed-off-by: Simon Horman commit fc09ab7a767394f9ecdad84ea6e85d68b83c8e21 Author: Takashi Iwai Date: Mon Nov 5 11:52:50 2018 +0100 vga_switcheroo: Fix missing gpu_bound call at audio client registration The commit 37a3a98ef601 ("ALSA: hda - Enable runtime PM only for discrete GPU") added a new ops gpu_bound to be called when GPU gets bound. The patch overlooked, however, that vga_switcheroo_enable() is called only once at GPU is bound. When an audio client is registered after that point, it would miss the gpu_bound call. This leads to the unexpected lack of runtime PM in HD-audio side. For addressing that regression, just call gpu_bound callback manually at vga_switcheroo_register_audio_client() when the GPU was already bound. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=201615 Fixes: 37a3a98ef601 ("ALSA: hda - Enable runtime PM only for discrete GPU") Cc: Reviewed-by: Lukas Wunner Signed-off-by: Takashi Iwai commit 112b57fa737445b2361be332ce8cc0fd3e2b994e Author: Rohit kumar Date: Thu Nov 1 17:21:07 2018 +0530 ASoC: qdsp6: q6afe: Fix wrong MI2S SD line mask SD line mask for MI2S starts from BIT 0 instead of BIT 1. Fix all bit mask for MI2S SD lines. Signed-off-by: Rohit kumar Signed-off-by: Mark Brown commit a182ecd3809c8d5a2da80c520f3602e301c5317e Author: Hans de Goede Date: Wed Oct 31 15:22:25 2018 +0100 ASoC: intel: cht_bsw_max98090_ti: Add quirk for boards using pmc_plt_clk_0 Some boards such as the Swanky model Chromebooks use pmc_plt_clk_0 for the mclk instead of pmc_plt_clk_3. This commit adds a DMI based quirk for this. This fixing audio no longer working on these devices after commit 648e921888ad ("clk: x86: Stop marking clocks as CLK_IS_CRITICAL") that commit fixes us unnecessary keeping unused clocks on, but in case of the Swanky that was breaking audio support since we were not using the right clock in the cht_bsw_max98090_ti machine driver. Cc: stable@vger.kernel.org Fixes: 648e921888ad ("clk: x86: Stop marking clocks as CLK_IS_CRITICAL") Reported-and-tested-by: Dean Wallace Signed-off-by: Hans de Goede Signed-off-by: Mark Brown commit 2f5d94123ce3c12a1e15802e6d5ee98f304ccb71 Author: Vasily Khoruzhick Date: Fri Nov 2 21:26:51 2018 -0700 ASoC: sunxi: rename SND_SUNXI_ADDA_PR_REGMAP to SND_SUN8I_ADDA_PR_REGMAP SND_SUN50I_CODEC_ANALOG selects SND_SUNXI_ADDA_PR_REGMAP which is leftover of renaming SND_SUNXI_ADDA_PR_REGMAP to SND_SUN8I_ADDA_PR_REGMAP. Replace it with SND_SUN8I_ADDA_PR_REGMAP to fix possible link errors for some configurations: sound/soc/sunxi/sun50i-codec-analog.o: In function `sun50i_codec_analog_probe': sun50i-codec-analog.c:(.text+0x62): undefined reference to `sun8i_adda_pr_regmap_init' Fixes: 42371f327df0 ("ASoC: sunxi: Add new driver for Allwinner A64 codec's analog path controls") Signed-off-by: Vasily Khoruzhick Reviewed-by: Andre Przywara Signed-off-by: Mark Brown commit 4920b1f7676d55dcebdf55f2b0431a328acb4abe Author: Punit Agrawal Date: Fri Nov 2 16:57:52 2018 +0000 mailmap: Update email for Punit Agrawal As I'll no longer be working with Arm, add a mailmap entry so any mail directed towards me reaches the appropriate mailbox. Acked-by: Will Deacon Signed-off-by: Punit Agrawal Signed-off-by: Catalin Marinas commit a1705f02704cd8a24d434bfd0141ee8142ad277a Author: Jerome Brunet Date: Mon Oct 29 16:13:40 2018 +0100 pinctrl: meson: fix meson8b ao pull register bits AO pull register definition is inverted between pull (up/down) and pull enable. Fixing this allows to properly apply bias setting through pinconf Fixes: 0fefcb6876d0 ("pinctrl: Add support for Meson8b") Signed-off-by: Jerome Brunet Signed-off-by: Linus Walleij commit e91b162d2868672d06010f34aa83d408db13d3c6 Author: Jerome Brunet Date: Mon Oct 29 16:13:39 2018 +0100 pinctrl: meson: fix meson8 ao pull register bits AO pull register definition is inverted between pull (up/down) and pull enable. Fixing this allows to properly apply bias setting through pinconf Fixes: 6ac730951104 ("pinctrl: add driver for Amlogic Meson SoCs") Signed-off-by: Jerome Brunet Signed-off-by: Linus Walleij commit ed3a2b74f3eb34c84c8377353f4730f05acdfd05 Author: Jerome Brunet Date: Mon Oct 29 16:13:38 2018 +0100 pinctrl: meson: fix gxl ao pull register bits AO pull register definition is inverted between pull (up/down) and pull enable. Fixing this allows to properly apply bias setting through pinconf Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions") Signed-off-by: Jerome Brunet Signed-off-by: Linus Walleij commit 4bc51e1e350cd4707ce6e551a93eae26d40b9889 Author: Jerome Brunet Date: Mon Oct 29 16:13:37 2018 +0100 pinctrl: meson: fix gxbb ao pull register bits AO pull register definition is inverted between pull (up/down) and pull enable. Fixing this allows to properly apply bias setting through pinconf Fixes: 468c234f9ed7 ("pinctrl: amlogic: Add support for Amlogic Meson GXBB SoC") Signed-off-by: Jerome Brunet Signed-off-by: Linus Walleij commit e39f9dd8206ad66992ac0e6218ef1ba746f2cce9 Author: Jerome Brunet Date: Tue Oct 23 18:03:19 2018 +0200 pinctrl: meson: fix pinconf bias disable If a bias is enabled on a pin of an Amlogic SoC, calling .pin_config_set() with PIN_CONFIG_BIAS_DISABLE will not disable the bias. Instead it will force a pull-down bias on the pin. Instead of the pull type register bank, the driver should access the pull enable register bank. Fixes: 6ac730951104 ("pinctrl: add driver for Amlogic Meson SoCs") Signed-off-by: Jerome Brunet Acked-by: Neil Armstrong Signed-off-by: Linus Walleij commit d098093ba06eb032057d1aca1c2e45889e099d00 Author: Boris Brezillon Date: Sun Oct 28 12:29:55 2018 +0100 mtd: nand: Fix nanddev_neraseblocks() nanddev_neraseblocks() currently returns the number pages per LUN instead of the total number of eraseblocks. Fixes: 9c3736a3de21 ("mtd: nand: Add core infrastructure to deal with NAND devices") Cc: Signed-off-by: Boris Brezillon Reviewed-by: Miquel Raynal commit ce97e2bb6687d3af675ecf2e836a9122def53578 Author: Randy Dunlap Date: Sun Nov 4 18:38:35 2018 -0800 mtd: nand: drop kernel-doc notation for a deleted function parameter Remove kernel-doc notation for a deleted function parameter to prevent a kernel-doc warning: ../drivers/mtd/nand/raw/nand_base.c:603: warning: Excess function parameter 'mtd' description in 'panic_nand_wait' Fixes: f1d46942e823 ("mtd: rawnand: Pass a nand_chip object to chip->waitfunc()") Signed-off-by: Randy Dunlap Cc: Boris Brezillon Cc: Miquel Raynal Cc: Richard Weinberger Reviewed-by: Miquel Raynal Signed-off-by: Boris Brezillon commit be2e1c9dcf76886a83fb1c433a316e26d4ca2550 Author: Arnd Bergmann Date: Thu Oct 11 13:06:16 2018 +0200 mtd: docg3: don't set conflicting BCH_CONST_PARAMS option I noticed during the creation of another bugfix that the BCH_CONST_PARAMS option that is set by DOCG3 breaks setting variable parameters for any other users of the BCH library code. The only other user we have today is the MTD_NAND software BCH implementation (most flash controllers use hardware BCH these days and are not affected). I considered removing BCH_CONST_PARAMS entirely because of the inherent conflict, but according to the description in lib/bch.c there is a significant performance benefit in keeping it. To avoid the immediate problem of the conflict between MTD_NAND_BCH and DOCG3, this only sets the constant parameters if MTD_NAND_BCH is disabled, which should fix the problem for all cases that are affected. This should also work for all stable kernels. Note that there is only one machine that actually seems to use the DOCG3 driver (arch/arm/mach-pxa/mioa701.c), so most users should have the driver disabled, but it almost certainly shows up if we wanted to test random kernels on machines that use software BCH in MTD. Fixes: d13d19ece39f ("mtd: docg3: add ECC correction code") Cc: stable@vger.kernel.org Cc: Robert Jarzmik Signed-off-by: Arnd Bergmann Signed-off-by: Boris Brezillon commit defeea5ee23d9cdd296801a0a9ea885c037ff9c9 Author: Bartosz Golaszewski Date: Wed Oct 24 17:38:43 2018 +0200 MAINTAINERS: add myself as co-maintainer of gpiolib As discussed with Linus Walleij - I'm adding myself as the co-maintainer. Cc: Benoît Cousson Cc: Kevin Hilman Cc: Michael Turquette Signed-off-by: Bartosz Golaszewski Acked-by: Michael Turquette Signed-off-by: Linus Walleij commit 989534cfcac89f927fa46b1e0861d92ffbd2c7e4 Author: Andrzej Hajda Date: Fri Oct 26 12:13:28 2018 +0200 drm/exynos/fbdev: do not skip fbdev init if there are no connectors Since connectors can be created dynamically, fbdev should be initialized even if there are no connectors at the moment. Otherwise fbdev will not be created even after connector's appearance. The patch fixes lack of fbdev on rinato and trats boards. Fixes: 6afb7721e2a0 ("drm/exynos: move connector creation to attach callback") Reported-by: Marek Szyprowski Signed-off-by: Andrzej Hajda Tested-by: Marek Szyprowski Signed-off-by: Inki Dae commit deee3284cba3145a4ee03cbe8541d7a3bfc499e2 Author: Andrzej Hajda Date: Fri Oct 26 12:40:03 2018 +0200 drm/exynos/dsi: register connector if it is created after drm bind DSI device can be attached after DRM device is registered. In such case newly created connector must be registered by exynos_dsi. The patch fixes exynos_drm on rinato and trats boards. Fixes: 6afb7721e2a0 ("drm/exynos: move connector creation to attach callback") Reported-by: Marek Szyprowski Signed-off-by: Andrzej Hajda Tested-by: Marek Szyprowski Signed-off-by: Inki Dae commit 6ca469e22a30992b4478d2ab88737c70667c1e00 Author: Inki Dae Date: Fri Oct 5 11:50:20 2018 +0900 Revert "drm/exynos/decon5433: implement frame counter" This reverts commit 0586feba322e1de05075700eb4b835c8b683e62b This patch makes it to need get_vblank_counter callback in crtc to get frame counter from decon driver. However, drm_dev->max_vblank_count is a member unique to vendor's DRM driver but in case of ARM DRM, some CRTC devices don't provide the frame counter value. As a result, this patch made extension and clone mode not working. Instead of this patch, we may need separated max_vblank_count which belongs to each CRTC device, or need to implement frame counter emulation for them who don't support HW frame counter. Signed-off-by: Inki Dae commit 8727b230f665cadb9349a915c60e6abb18fb083c Author: Dan Carpenter Date: Sat Oct 13 13:21:40 2018 +0300 drm/exynos: checking for NULL instead of IS_ERR() The of_drm_find_panel() function returns error pointers and never NULL but we the driver assumes that ->panel is NULL when it's not present. Fixes: 6afb7721e2a0 ("drm/exynos: move connector creation to attach callback") Signed-off-by: Dan Carpenter Signed-off-by: Inki Dae commit 13682e524167cbd7e2a26c5e91bec765f0f96273 Author: Daniel Lezcano Date: Wed Oct 17 11:18:30 2018 +0200 arm64: dts: rockchip: remove vdd_log from rock960 to fix a stability issues When the performance governor is set as default, the rock960 hangs around one minute after booting, whatever the activity is (idle, key pressed, loaded, ...). Based on the commit log found at https://patchwork.kernel.org/patch/10092377/ "vdd_log has no consumer and therefore will not be set to a specific voltage. Still the PWM output pin gets configured and thence the vdd_log output voltage will changed from it's default. Depending on the idle state of the PWM this will slightly over or undervoltage the logic supply of the RK3399 and cause instability with GbE (undervoltage) and PCIe (overvoltage). Since the default value set by a voltage divider is the correct supply voltage and we don't need to change it during runtime we remove the rail from the devicetree completely so the PWM pin will not be configured." After removing the vdd-log from the rock960's specific DT, the board does no longer hang and shows a stable behavior. Apply the same change for the rock960 by removing the vdd-log from the DT. Fixes: 874846f1fccd ("arm64: dts: rockchip: add 96boards RK3399 Ficus board") Cc: stable@vger.kernel.org Tested-by: Manivannan Sadhasivam Signed-off-by: Daniel Lezcano Signed-off-by: Heiko Stuebner commit b068621a53f92f42400581d69ad0e84c56620b0a Author: Randy Dunlap Date: Sun Nov 4 14:03:56 2018 -0800 Documentation/x86: Fix typo in zero-page.txt Signed-off-by: Randy Dunlap Cc: Jonathan Corbet Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-doc@vger.kernel.org Link: http://lkml.kernel.org/r/f259b21b-1f2b-f215-00d2-23388bed2530@infradead.org Signed-off-by: Ingo Molnar commit f75d651587f719a813ebbbfeee570e6570731d55 Author: Randy Dunlap Date: Sun Nov 4 18:40:14 2018 -0800 resource/docs: Fix new kernel-doc warnings The first group of warnings is caused by a "/**" kernel-doc notation marker but the function comments are not in kernel-doc format. Also add another error return value here. ../kernel/resource.c:337: warning: Function parameter or member 'start' not described in 'find_next_iomem_res' ../kernel/resource.c:337: warning: Function parameter or member 'end' not described in 'find_next_iomem_res' ../kernel/resource.c:337: warning: Function parameter or member 'flags' not described in 'find_next_iomem_res' ../kernel/resource.c:337: warning: Function parameter or member 'desc' not described in 'find_next_iomem_res' ../kernel/resource.c:337: warning: Function parameter or member 'first_lvl' not described in 'find_next_iomem_res' ../kernel/resource.c:337: warning: Function parameter or member 'res' not described in 'find_next_iomem_res' Add the missing function parameter documentation for the other warnings: ../kernel/resource.c:409: warning: Function parameter or member 'arg' not described in 'walk_iomem_res_desc' ../kernel/resource.c:409: warning: Function parameter or member 'func' not described in 'walk_iomem_res_desc' Signed-off-by: Randy Dunlap Cc: Andrew Morton Cc: Borislav Petkov Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Fixes: b69c2e20f6e4 ("resource: Clean it up a bit") Link: http://lkml.kernel.org/r/dda2e4d8-bedd-3167-20fe-8c7d2d35b354@infradead.org Signed-off-by: Ingo Molnar commit e1ff516a56ad56c476b47795d3811eef79d25fbe Author: Yi Wang Date: Mon Nov 5 08:50:13 2018 +0800 sched/fair: Fix a comment in task_numa_fault() Duplicated 'case it'. Signed-off-by: Yi Wang Reviewed-by: Xi Xu Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: zhong.weidong@zte.com.cn Link: http://lkml.kernel.org/r/1541379013-11352-1-git-send-email-wang.yi59@zte.com.cn Signed-off-by: Ingo Molnar commit 3182215dd0b2120fb942ed88430cfb7c12d583e0 Author: Alistair Popple Date: Tue Oct 30 22:02:03 2018 +1100 powerpc/powernv/npu: Remove NPU DMA ops The NPU IOMMU is setup to mirror the parent PCIe device IOMMU setup. Therefore it does not make sense to call dma operations such as dma_map_page(), etc. directly on these devices. The existing dma_ops simply print a warning if they are ever called, however this is unnecessary and the warnings are likely to go unnoticed. It is instead simpler to remove these operations and let the generic DMA code print warnings (eg. via a NULL pointer deref) in cases of buggy drivers attempting dma operations on NVLink devices. Signed-off-by: Alistair Popple Signed-off-by: Michael Ellerman commit 1ad9fb750a104f51851c092edd7b3553f0218428 Author: Leonard Crestez Date: Mon Oct 8 15:28:01 2018 +0000 ARM: dts: imx6sx-sdb: Fix enet phy regulator Bindings for "fixed-regulator" only explicitly support "gpio" property, not "gpios". Fix by correcting the property name. The enet PHYs on imx6sx-sdb needs to be explicitly reset after a power cycle, this can be handled by the phy-reset-gpios property. Sadly this is not handled on suspend: the fec driver turns phy-supply off but doesn't assert phy-reset-gpios again on resume. Since additional phy-level work is required to support powering off the phy in suspend fix the problem by just marking the regulator as "boot-on" "always-on" so that it's never turned off. This behavior is equivalent to older releases. Keep the phy-reset-gpios property on fec anyway because it is a correct description of board design. This issue was exposed by commit efdfeb079cc3 ("regulator: fixed: Convert to use GPIO descriptor only") which causes the "gpios" property to also be parsed. Before that commit the "gpios" property had no effect, PHY reset was only handled in the the bootloader. This fixes linux-next boot failures previously reported here: https://lore.kernel.org/patchwork/patch/982437/#1177900 https://lore.kernel.org/patchwork/patch/994091/#1178304 Signed-off-by: Leonard Crestez Signed-off-by: Shawn Guo commit 1af6ab3bac8458fc2e92ad7bb97b62de4a1fddef Author: Rob Herring Date: Tue Oct 30 20:02:30 2018 -0500 ARM: dts: fsl: Fix improperly quoted stdout-path values A quoted label reference doesn't expand to the node path and is taken as a literal string. Dropping the quotes can fix this unless the baudrate string is appended in which case we have to use the alias. At least on VF610, the problem was masked by setting the console in bootargs. Use the alias syntax with baudrate parameter so we can drop setting the console in bootargs. Cc: Shawn Guo Cc: Sascha Hauer Cc: Pengutronix Kernel Team Cc: NXP Linux Team Cc: Mark Rutland Reviewed-by: Fabio Estevam Reviewed-by: Stefan Agner Signed-off-by: Rob Herring Signed-off-by: Shawn Guo commit 438ad09af5581b7024850b5dbb6353c7f2f7d8a9 Author: Oleksij Rempel Date: Thu Oct 18 13:26:13 2018 +0200 ARM: dts: imx6sll: fix typo for fsl,imx6sll-i2c node Fix the type of compatible string "fs,imx6sll-i2c" which should be "fsl,imx6sll-i2c". Signed-off-by: Oleksij Rempel Acked-by: Uwe Kleine-König Signed-off-by: Shawn Guo commit ea53abfab960909d622ca37bcfb8e1c5378d21cc Author: Jarod Wilson Date: Sun Nov 4 14:59:46 2018 -0500 bonding/802.3ad: fix link_failure_count tracking Commit 4d2c0cda07448ea6980f00102dc3964eb25e241c set slave->link to BOND_LINK_DOWN for 802.3ad bonds whenever invalid speed/duplex values were read, to fix a problem with slaves getting into weird states, but in the process, broke tracking of link failures, as going straight to BOND_LINK_DOWN when a link is indeed down (cable pulled, switch rebooted) means we broke out of bond_miimon_inspect()'s BOND_LINK_DOWN case because !link_state was already true, we never incremented commit, and never got a chance to call bond_miimon_commit(), where slave->link_failure_count would be incremented. I believe the simple fix here is to mark the slave as BOND_LINK_FAIL, and let bond_miimon_inspect() transition the link from _FAIL to either _UP or _DOWN, and in the latter case, we now get proper incrementing of link_failure_count again. Fixes: 4d2c0cda0744 ("bonding: speed/duplex update at NETDEV_UP event") CC: Mahesh Bandewar CC: David S. Miller CC: netdev@vger.kernel.org CC: stable@vger.kernel.org Signed-off-by: Jarod Wilson Signed-off-by: David S. Miller commit 0432e833191ad4d17b7fc2364941f91dad51db1a Author: Holger Hoffstätte Date: Sun Nov 4 19:02:42 2018 +0100 net: phy: realtek: fix RTL8201F sysfs name Since 4.19 the following error in sysfs has appeared when using the r8169 NIC driver: $cd /sys/module/realtek/drivers $ls -l ls: cannot access 'mdio_bus:RTL8201F 10/100Mbps Ethernet': No such file or directory [..garbled dir entries follow..] Apparently the forward slash in "10/100Mbps Ethernet" is interpreted as directory separator that leads nowhere, and was introduced in commit 513588dd44b ("net: phy: realtek: add RTL8201F phy-id and functions"). Fix this by removing the offending slash in the driver name. Other drivers in net/phy seem to have the same problem, but I cannot test/verify them. Fixes: 513588dd44b ("net: phy: realtek: add RTL8201F phy-id and functions") Signed-off-by: Holger Hoffstätte Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit e3e61f01d755188cb6c2dcf5a244b9c0937c258e Author: Geert Uytterhoeven Date: Sun Oct 28 18:16:51 2018 +0100 hwmon: (ibmpowernv) Remove bogus __init annotations If gcc decides not to inline make_sensor_label(): WARNING: vmlinux.o(.text+0x4df549c): Section mismatch in reference from the function .create_device_attrs() to the function .init.text:.make_sensor_label() The function .create_device_attrs() references the function __init .make_sensor_label(). This is often because .create_device_attrs lacks a __init annotation or the annotation of .make_sensor_label is wrong. As .probe() can be called after freeing of __init memory, all __init annotiations in the driver are bogus, and should be removed. Signed-off-by: Geert Uytterhoeven Signed-off-by: Guenter Roeck commit 74e3512731bd5c9673176425a76a7cc5efa8ddb6 Author: Dmitry Osipenko Date: Wed Oct 24 22:37:13 2018 +0300 hwmon: (core) Fix double-free in __hwmon_device_register() Fix double-free that happens when thermal zone setup fails, see KASAN log below. ================================================================== BUG: KASAN: double-free or invalid-free in __hwmon_device_register+0x5dc/0xa7c CPU: 0 PID: 132 Comm: kworker/0:2 Tainted: G B 4.19.0-rc8-next-20181016-00042-gb52cd80401e9-dirty #41 Hardware name: NVIDIA Tegra SoC (Flattened Device Tree) Workqueue: events deferred_probe_work_func Backtrace: [] (dump_backtrace) from [] (show_stack+0x20/0x24) [] (show_stack) from [] (dump_stack+0x9c/0xb0) [] (dump_stack) from [] (print_address_description+0x68/0x250) [] (print_address_description) from [] (kasan_report_invalid_free+0x68/0x88) [] (kasan_report_invalid_free) from [] (__kasan_slab_free+0x1f4/0x200) [] (__kasan_slab_free) from [] (kasan_slab_free+0x14/0x18) [] (kasan_slab_free) from [] (kfree+0x90/0x294) [] (kfree) from [] (__hwmon_device_register+0x5dc/0xa7c) [] (__hwmon_device_register) from [] (hwmon_device_register_with_info+0xa0/0xa8) [] (hwmon_device_register_with_info) from [] (devm_hwmon_device_register_with_info+0x74/0xb4) [] (devm_hwmon_device_register_with_info) from [] (lm90_probe+0x414/0x578) [] (lm90_probe) from [] (i2c_device_probe+0x35c/0x384) [] (i2c_device_probe) from [] (really_probe+0x290/0x3e4) [] (really_probe) from [] (driver_probe_device+0x80/0x1c4) [] (driver_probe_device) from [] (__device_attach_driver+0x104/0x11c) [] (__device_attach_driver) from [] (bus_for_each_drv+0xa4/0xc8) [] (bus_for_each_drv) from [] (__device_attach+0xf0/0x15c) [] (__device_attach) from [] (device_initial_probe+0x1c/0x20) [] (device_initial_probe) from [] (bus_probe_device+0xdc/0xec) [] (bus_probe_device) from [] (deferred_probe_work_func+0xa8/0xd4) [] (deferred_probe_work_func) from [] (process_one_work+0x3dc/0x96c) [] (process_one_work) from [] (worker_thread+0x4ec/0x8bc) [] (worker_thread) from [] (kthread+0x230/0x240) [] (kthread) from [] (ret_from_fork+0x14/0x38) Exception stack(0xcf743fb0 to 0xcf743ff8) 3fa0: 00000000 00000000 00000000 00000000 3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 3fe0: 00000000 00000000 00000000 00000000 00000013 00000000 Allocated by task 132: kasan_kmalloc.part.1+0x58/0xf4 kasan_kmalloc+0x90/0xa4 kmem_cache_alloc_trace+0x90/0x2a0 __hwmon_device_register+0xbc/0xa7c hwmon_device_register_with_info+0xa0/0xa8 devm_hwmon_device_register_with_info+0x74/0xb4 lm90_probe+0x414/0x578 i2c_device_probe+0x35c/0x384 really_probe+0x290/0x3e4 driver_probe_device+0x80/0x1c4 __device_attach_driver+0x104/0x11c bus_for_each_drv+0xa4/0xc8 __device_attach+0xf0/0x15c device_initial_probe+0x1c/0x20 bus_probe_device+0xdc/0xec deferred_probe_work_func+0xa8/0xd4 process_one_work+0x3dc/0x96c worker_thread+0x4ec/0x8bc kthread+0x230/0x240 ret_from_fork+0x14/0x38 (null) Freed by task 132: __kasan_slab_free+0x12c/0x200 kasan_slab_free+0x14/0x18 kfree+0x90/0x294 hwmon_dev_release+0x1c/0x20 device_release+0x4c/0xe8 kobject_put+0xac/0x11c device_unregister+0x2c/0x30 __hwmon_device_register+0xa58/0xa7c hwmon_device_register_with_info+0xa0/0xa8 devm_hwmon_device_register_with_info+0x74/0xb4 lm90_probe+0x414/0x578 i2c_device_probe+0x35c/0x384 really_probe+0x290/0x3e4 driver_probe_device+0x80/0x1c4 __device_attach_driver+0x104/0x11c bus_for_each_drv+0xa4/0xc8 __device_attach+0xf0/0x15c device_initial_probe+0x1c/0x20 bus_probe_device+0xdc/0xec deferred_probe_work_func+0xa8/0xd4 process_one_work+0x3dc/0x96c worker_thread+0x4ec/0x8bc kthread+0x230/0x240 ret_from_fork+0x14/0x38 (null) Cc: # v4.15+ Fixes: 47c332deb8e8 ("hwmon: Deal with errors from the thermal subsystem") Signed-off-by: Dmitry Osipenko Signed-off-by: Guenter Roeck commit 651022382c7f8da46cb4872a545ee1da6d097d2a Author: Linus Torvalds Date: Sun Nov 4 15:37:52 2018 -0800 Linux 4.20-rc1 commit 42bd06e93d108a3ee5b8b4eaa350ec81853cb217 Merge: 4710e78940d8 84db119f5a83 Author: Linus Torvalds Date: Sun Nov 4 14:46:04 2018 -0800 Merge tag 'tags/upstream-4.20-rc1' of git://git.infradead.org/linux-ubifs Pull UBIFS updates from Richard Weinberger: - Full filesystem authentication feature, UBIFS is now able to have the whole filesystem structure authenticated plus user data encrypted and authenticated. - Minor cleanups * tag 'tags/upstream-4.20-rc1' of git://git.infradead.org/linux-ubifs: (26 commits) ubifs: Remove unneeded semicolon Documentation: ubifs: Add authentication whitepaper ubifs: Enable authentication support ubifs: Do not update inode size in-place in authenticated mode ubifs: Add hashes and HMACs to default filesystem ubifs: authentication: Authenticate super block node ubifs: Create hash for default LPT ubfis: authentication: Authenticate master node ubifs: authentication: Authenticate LPT ubifs: Authenticate replayed journal ubifs: Add auth nodes to garbage collector journal head ubifs: Add authentication nodes to journal ubifs: authentication: Add hashes to index nodes ubifs: Add hashes to the tree node cache ubifs: Create functions to embed a HMAC in a node ubifs: Add helper functions for authentication support ubifs: Add separate functions to init/crc a node ubifs: Format changes for authentication support ubifs: Store read superblock node ubifs: Drop write_node ... commit 4710e78940d8d957f24b8f085f961f1279f8fbff Merge: 35e745244268 d3787af289c8 Author: Linus Torvalds Date: Sun Nov 4 08:20:09 2018 -0800 Merge tag 'nfs-for-4.20-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client bugfixes from Trond Myklebust: "Highlights include: Bugfix: - Fix build issues on architectures that don't provide 64-bit cmpxchg Cleanups: - Fix a spelling mistake" * tag 'nfs-for-4.20-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: NFS: fix spelling mistake, EACCESS -> EACCES SUNRPC: Use atomic(64)_t for seq_send(64) commit 35e7452442687d7bd70f042ddfa92f89311b039c Merge: 04578e8441c5 bff9a1076adf Author: Linus Torvalds Date: Sun Nov 4 08:15:15 2018 -0800 Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull more timer updates from Thomas Gleixner: "A set of commits for the new C-SKY architecture timers" * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: dt-bindings: timer: gx6605s SOC timer clocksource/drivers/c-sky: Add gx6605s SOC system timer dt-bindings: timer: C-SKY Multi-processor timer clocksource/drivers/c-sky: Add C-SKY SMP timer commit 04578e8441c5420259a71eff9fede535858bfc6a Merge: 71e56028173b a662315d8ad9 Author: Linus Torvalds Date: Sun Nov 4 08:12:44 2018 -0800 Merge tag 'ntb-4.20' of git://github.com/jonmason/ntb Pull NTB updates from Jon Mason: "Fairly minor changes and bug fixes: NTB IDT thermal changes and hook into hwmon, ntb_netdev clean-up of private struct, and a few bug fixes" * tag 'ntb-4.20' of git://github.com/jonmason/ntb: ntb: idt: Alter the driver info comments ntb: idt: Discard temperature sensor IRQ handler ntb: idt: Add basic hwmon sysfs interface ntb: idt: Alter temperature read method ntb_netdev: Simplify remove with client device drvdata NTB: transport: Try harder to alloc an aligned MW buffer ntb: ntb_transport: Mark expected switch fall-throughs ntb: idt: Set PCIe bus address to BARLIMITx NTB: ntb_hw_idt: replace IS_ERR_OR_NULL with regular NULL checks ntb: intel: fix return value for ndev_vec_mask() ntb_netdev: fix sleep time mismatch commit 1de72c706488b7be664a601cf3843bd01e327e58 Author: Michael Kelley Date: Sun Nov 4 03:48:57 2018 +0000 x86/hyper-v: Enable PIT shutdown quirk Hyper-V emulation of the PIT has a quirk such that the normal PIT shutdown path doesn't work, because clearing the counter register restarts the timer. Disable the counter clearing on PIT shutdown. Signed-off-by: Michael Kelley Signed-off-by: Thomas Gleixner Cc: "gregkh@linuxfoundation.org" Cc: "devel@linuxdriverproject.org" Cc: "daniel.lezcano@linaro.org" Cc: "virtualization@lists.linux-foundation.org" Cc: "jgross@suse.com" Cc: "akataria@vmware.com" Cc: "olaf@aepfle.de" Cc: "apw@canonical.com" Cc: vkuznets Cc: "jasowang@redhat.com" Cc: "marcelo.cerri@canonical.com" Cc: KY Srinivasan Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/1541303219-11142-3-git-send-email-mikelley@microsoft.com commit 35b69a420bfb56b7b74cb635ea903db05e357bec Author: Michael Kelley Date: Sun Nov 4 03:48:54 2018 +0000 clockevents/drivers/i8253: Add support for PIT shutdown quirk Add support for platforms where pit_shutdown() doesn't work because of a quirk in the PIT emulation. On these platforms setting the counter register to zero causes the PIT to start running again, negating the shutdown. Provide a global variable that controls whether the counter register is zero'ed, which platform specific code can override. Signed-off-by: Michael Kelley Signed-off-by: Thomas Gleixner Cc: "gregkh@linuxfoundation.org" Cc: "devel@linuxdriverproject.org" Cc: "daniel.lezcano@linaro.org" Cc: "virtualization@lists.linux-foundation.org" Cc: "jgross@suse.com" Cc: "akataria@vmware.com" Cc: "olaf@aepfle.de" Cc: "apw@canonical.com" Cc: vkuznets Cc: "jasowang@redhat.com" Cc: "marcelo.cerri@canonical.com" Cc: KY Srinivasan Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/1541303219-11142-2-git-send-email-mikelley@microsoft.com commit 12480e3b16982c4026de10dd8155823219cd6391 Author: Xin Long Date: Sat Nov 3 14:01:31 2018 +0800 sctp: define SCTP_SS_DEFAULT for Stream schedulers According to rfc8260#section-4.3.2, SCTP_SS_DEFAULT is required to defined as SCTP_SS_FCFS or SCTP_SS_RR. SCTP_SS_FCFS is used for SCTP_SS_DEFAULT's value in this patch. Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations") Reported-by: Jianwen Ji Signed-off-by: Xin Long Signed-off-by: David S. Miller commit fd82d61ba142f0b83463e47064bf5460aac57b6e Author: Xin Long Date: Sat Nov 3 13:59:45 2018 +0800 sctp: fix strchange_flags name for Stream Change Event As defined in rfc6525#section-6.1.3, SCTP_STREAM_CHANGE_DENIED and SCTP_STREAM_CHANGE_FAILED should be used instead of SCTP_ASSOC_CHANGE_DENIED and SCTP_ASSOC_CHANGE_FAILED. To keep the compatibility, fix it by adding two macros. Fixes: b444153fb5a6 ("sctp: add support for generating add stream change event notification") Reported-by: Jianwen Ji Signed-off-by: Xin Long Signed-off-by: David S. Miller commit 1e2d3c4929b68ce9491ec317846634306a9eeaa4 Merge: 96801552f846 28c2fae726bf Author: David S. Miller Date: Sat Nov 3 19:33:35 2018 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2018-11-03 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) Fix BPF prog kallsyms and bpf_prog_get_info_by_fd() jited address export to not use page start but actual start instead to work correctly with profiling e.g. finding hot instructions from stack traces. Also fix latter with regards to dumping address and jited len for !multi prog, from Song. 2) Fix bpf_prog_get_info_by_fd() for !root to zero info.nr_jited_func_lens instead of leaving the user provided length, from Daniel. ==================== Signed-off-by: David S. Miller commit 96801552f846460fe9ac10f1b189602992f004e1 Author: Shalom Toledo Date: Fri Nov 2 19:49:15 2018 +0000 mlxsw: spectrum: Fix IP2ME CPU policer configuration The CPU policer used to police packets being trapped via a local route (IP2ME) was incorrectly configured to police based on bytes per second instead of packets per second. Change the policer to police based on packets per second and avoid packet loss under certain circumstances. Fixes: 9148e7cf73ce ("mlxsw: spectrum: Add policers for trap groups") Signed-off-by: Shalom Toledo Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit a277d516de5f498c91d91189717ef7e01102ad27 Author: Arnd Bergmann Date: Fri Nov 2 16:36:55 2018 +0100 openvswitch: fix linking without CONFIG_NF_CONNTRACK_LABELS When CONFIG_CC_OPTIMIZE_FOR_DEBUGGING is enabled, the compiler fails to optimize out a dead code path, which leads to a link failure: net/openvswitch/conntrack.o: In function `ovs_ct_set_labels': conntrack.c:(.text+0x2e60): undefined reference to `nf_connlabels_replace' In this configuration, we can take a shortcut, and completely remove the contrack label code. This may also help the regular optimization. Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller commit 92619210529a6b77b2cbedbadba3ff5eaa6e28ed Author: Arnd Bergmann Date: Fri Nov 2 16:36:24 2018 +0100 qed: fix link config error handling gcc-8 notices that qed_mcp_get_transceiver_data() may fail to return a result to the caller: drivers/net/ethernet/qlogic/qed/qed_mcp.c: In function 'qed_mcp_trans_speed_mask': drivers/net/ethernet/qlogic/qed/qed_mcp.c:1955:2: error: 'transceiver_type' may be used uninitialized in this function [-Werror=maybe-uninitialized] When an error is returned by qed_mcp_get_transceiver_data(), we should propagate that to the caller of qed_mcp_trans_speed_mask() rather than continuing with uninitialized data. Fixes: c56a8be7e7aa ("qed: Add supported link and advertise link to display in ethtool.") Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller commit 71e56028173bc84f01456a5679d8be9d681b49f1 Merge: 601a88077cf6 993f0b0510da Author: Linus Torvalds Date: Sat Nov 3 18:37:09 2018 -0700 Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: "A memory (under-)allocation fix and a comment fix" * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/topology: Fix off by one bug sched/rt: Update comment in pick_next_task_rt() commit 601a88077cf6e5c85a776cf27f643e5d563b29fb Merge: 01897f3e05ed 23a12ddee1ce Author: Linus Torvalds Date: Sat Nov 3 18:25:17 2018 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "A number of fixes and some late updates: - make in_compat_syscall() behavior on x86-32 similar to other platforms, this touches a number of generic files but is not intended to impact non-x86 platforms. - objtool fixes - PAT preemption fix - paravirt fixes/cleanups - cpufeatures updates for new instructions - earlyprintk quirk - make microcode version in sysfs world-readable (it is already world-readable in procfs) - minor cleanups and fixes" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: compat: Cleanup in_compat_syscall() callers x86/compat: Adjust in_compat_syscall() to generic code under !COMPAT objtool: Support GCC 9 cold subfunction naming scheme x86/numa_emulation: Fix uniform-split numa emulation x86/paravirt: Remove unused _paravirt_ident_32 x86/mm/pat: Disable preemption around __flush_tlb_all() x86/paravirt: Remove GPL from pv_ops export x86/traps: Use format string with panic() call x86: Clean up 'sizeof x' => 'sizeof(x)' x86/cpufeatures: Enumerate MOVDIR64B instruction x86/cpufeatures: Enumerate MOVDIRI instruction x86/earlyprintk: Add a force option for pciserial device objtool: Support per-function rodata sections x86/microcode: Make revision and processor flags world-readable commit 01897f3e05ede4d66c0f9df465fde1d67a1d733f Merge: e9ebc2151f88 29995d296e3e Author: Linus Torvalds Date: Sat Nov 3 18:13:43 2018 -0700 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf updates and fixes from Ingo Molnar: "These are almost all tooling updates: 'perf top', 'perf trace' and 'perf script' fixes and updates, an UAPI header sync with the merge window versions, license marker updates, much improved Sparc support from David Miller, and a number of fixes" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (66 commits) perf intel-pt/bts: Calculate cpumode for synthesized samples perf intel-pt: Insert callchain context into synthesized callchains perf tools: Don't clone maps from parent when synthesizing forks perf top: Start display thread earlier tools headers uapi: Update linux/if_link.h header copy tools headers uapi: Update linux/netlink.h header copy tools headers: Sync the various kvm.h header copies tools include uapi: Update linux/mmap.h copy perf trace beauty: Use the mmap flags table generated from headers perf beauty: Wire up the mmap flags table generator to the Makefile perf beauty: Add a generator for MAP_ mmap's flag constants tools include uapi: Update asound.h copy tools arch uapi: Update asm-generic/unistd.h and arm64 unistd.h copies tools include uapi: Update linux/fs.h copy perf callchain: Honour the ordering of PERF_CONTEXT_{USER,KERNEL,etc} perf cs-etm: Correct CPU mode for samples perf unwind: Take pgoff into account when reporting elf to libdwfl perf top: Do not use overwrite mode by default perf top: Allow disabling the overwrite mode perf trace: Beautify mount's first pathname arg ... commit e9ebc2151f88600e726e51e5f7ca9c33ad53b35f Merge: d2ff0ff2c23f 3424243e39e8 Author: Linus Torvalds Date: Sat Nov 3 18:12:09 2018 -0700 Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Ingo Molnar: "An irqchip driver fix and a memory (over-)allocation fix" * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/irq-mvebu-sei: Fix a NULL vs IS_ERR() bug in probe function irq/matrix: Fix memory overallocation commit 40fa3780bac2b654edf23f6b13f4e2dd550aea10 Author: Valentin Schneider Date: Tue Oct 23 14:37:31 2018 +0100 sched/core: Take the hotplug lock in sched_init_smp() When running on linux-next (8c60c36d0b8c ("Add linux-next specific files for 20181019")) + CONFIG_PROVE_LOCKING=y on a big.LITTLE system (e.g. Juno or HiKey960), we get the following report: [ 0.748225] Call trace: [ 0.750685] lockdep_assert_cpus_held+0x30/0x40 [ 0.755236] static_key_enable_cpuslocked+0x20/0xc8 [ 0.760137] build_sched_domains+0x1034/0x1108 [ 0.764601] sched_init_domains+0x68/0x90 [ 0.768628] sched_init_smp+0x30/0x80 [ 0.772309] kernel_init_freeable+0x278/0x51c [ 0.776685] kernel_init+0x10/0x108 [ 0.780190] ret_from_fork+0x10/0x18 The static_key in question is 'sched_asym_cpucapacity' introduced by commit: df054e8445a4 ("sched/topology: Add static_key for asymmetric CPU capacity optimizations") In this particular case, we enable it because smp_prepare_cpus() will end up fetching the capacity-dmips-mhz entry from the devicetree, so we already have some asymmetry detected when entering sched_init_smp(). This didn't get detected in tip/sched/core because we were missing: commit cb538267ea1e ("jump_label/lockdep: Assert we hold the hotplug lock for _cpuslocked() operations") Calls to build_sched_domains() post sched_init_smp() will hold the hotplug lock, it just so happens that this very first call is a special case. As stated by a comment in sched_init_smp(), "There's no userspace yet to cause hotplug operations" so this is a harmless warning. However, to both respect the semantics of underlying callees and make lockdep happy, take the hotplug lock in sched_init_smp(). This also satisfies the comment atop sched_init_domains() that says "Callers must hold the hotplug lock". Reported-by: Sudeep Holla Tested-by: Sudeep Holla Signed-off-by: Valentin Schneider Signed-off-by: Peter Zijlstra (Intel) Cc: Dietmar.Eggemann@arm.com Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: morten.rasmussen@arm.com Cc: quentin.perret@arm.com Link: http://lkml.kernel.org/r/1540301851-3048-1-git-send-email-valentin.schneider@arm.com Signed-off-by: Ingo Molnar commit b987ffc18fb3b3b76b059aa9e372dbee26f7c4f2 Author: Peter Zijlstra Date: Fri Nov 2 14:26:53 2018 +0100 x86/qspinlock: Fix compile error With a compiler that has asm-goto but not asm-cc-output and CONFIG_PROFILE_ALL_BRANCHES=y we get a compiler error: arch/x86/include/asm/rmwcc.h:23:17: error: jump into statement expression Fix this by writing the if() as a boolean multiplication instead. Reported-by: kbuild test robot Signed-off-by: Peter Zijlstra (Intel) Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Will Deacon Cc: linux-kernel@vger.kernel.org Fixes: 7aa54be29765 ("locking/qspinlock, x86: Provide liveness guarantee") Signed-off-by: Ingo Molnar commit 993f0b0510dad98b4e6e39506834dab0d13fd539 Author: Peter Zijlstra Date: Fri Nov 2 14:22:25 2018 +0100 sched/topology: Fix off by one bug With the addition of the NUMA identity level, we increased @level by one and will run off the end of the array in the distance sort loop. Fixed: 051f3ca02e46 ("sched/topology: Introduce NUMA identity node sched domain") Signed-off-by: Peter Zijlstra (Intel) Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar commit 23a12ddee1ce28065b71f14ccc695b5a0c8a64ff Merge: 98f76206b335 bcb6fb5da77c Author: Ingo Molnar Date: Sat Nov 3 23:42:16 2018 +0100 Merge branch 'core/urgent' into x86/urgent, to pick up objtool fix Signed-off-by: Ingo Molnar commit e8ccbb7d2f53c62e14b889faaa3f6f809b657278 Author: Yunsheng Lin Date: Fri Nov 2 17:47:48 2018 +0800 net: hns3: Fix for out-of-bounds access when setting pfc back pressure The vport should be initialized to hdev->vport for each bp group, otherwise it will cause out-of-bounds access and bp setting not correct problem. [ 35.254124] BUG: KASAN: slab-out-of-bounds in hclge_pause_setup_hw+0x2a0/0x3f8 [hclge] [ 35.254126] Read of size 2 at addr ffff803b6651581a by task kworker/0:1/14 [ 35.254132] CPU: 0 PID: 14 Comm: kworker/0:1 Not tainted 4.19.0-rc7-hulk+ #85 [ 35.254133] Hardware name: Huawei D06/D06, BIOS Hisilicon D06 UEFI RC0 - B052 (V0.52) 09/14/2018 [ 35.254141] Workqueue: events work_for_cpu_fn [ 35.254144] Call trace: [ 35.254147] dump_backtrace+0x0/0x2f0 [ 35.254149] show_stack+0x24/0x30 [ 35.254154] dump_stack+0x110/0x184 [ 35.254157] print_address_description+0x168/0x2b0 [ 35.254160] kasan_report+0x184/0x310 [ 35.254162] __asan_load2+0x7c/0xa0 [ 35.254170] hclge_pause_setup_hw+0x2a0/0x3f8 [hclge] [ 35.254177] hclge_tm_init_hw+0x794/0x9f0 [hclge] [ 35.254184] hclge_tm_schd_init+0x48/0x58 [hclge] [ 35.254191] hclge_init_ae_dev+0x778/0x1168 [hclge] [ 35.254196] hnae3_register_ae_dev+0x14c/0x298 [hnae3] [ 35.254206] hns3_probe+0x88/0xa8 [hns3] [ 35.254210] local_pci_probe+0x7c/0xf0 [ 35.254212] work_for_cpu_fn+0x34/0x50 [ 35.254214] process_one_work+0x4d4/0xa38 [ 35.254216] worker_thread+0x55c/0x8d8 [ 35.254219] kthread+0x1b0/0x1b8 [ 35.254222] ret_from_fork+0x10/0x1c [ 35.254224] The buggy address belongs to the page: [ 35.254228] page:ffff7e00ed994400 count:1 mapcount:0 mapping:0000000000000000 index:0x0 compound_mapcount: 0 [ 35.273835] flags: 0xfffff8000008000(head) [ 35.282007] raw: 0fffff8000008000 dead000000000100 dead000000000200 0000000000000000 [ 35.282010] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 35.282012] page dumped because: kasan: bad access detected [ 35.282014] Memory state around the buggy address: [ 35.282017] ffff803b66515700: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 35.282019] ffff803b66515780: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 35.282021] >ffff803b66515800: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 35.282022] ^ [ 35.282024] ffff803b66515880: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 35.282026] ffff803b66515900: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 35.282028] ================================================================== [ 35.282029] Disabling lock debugging due to kernel taint [ 35.282747] hclge driver initialization finished. Fixes: 67bf2541f4b9 ("net: hns3: Fixes the back pressure setting when sriov is enabled") Signed-off-by: Yunsheng Lin Signed-off-by: David S. Miller commit cb53fd54e340ce54d2bc2397cd0b70c712642f98 Merge: b8a5d06ae234 c29734443511 Author: David S. Miller Date: Sat Nov 3 15:40:01 2018 -0700 Merge branch 'net-bql-better-deal-with-GSO' Eric Dumazet says: ==================== net: bql: better deal with GSO While BQL bulk dequeue works well for TSO packets, it is not very efficient as soon as GSO is involved. On a GSO only workload (UDP or TCP), this patch series can save about 8 % of cpu cycles on a 40Gbit mlx4 NIC, by keeping optimal batching, and avoiding expensive doorbells, qdisc requeues and reschedules. This patch series : - Add __netdev_tx_sent_queue() so that drivers can implement efficient BQL and xmit_more support. - Implement a work around in dev_hard_start_xmit() for drivers not using __netdev_tx_sent_queue() - changes mlx4 to use __netdev_tx_sent_queue() v2: Tariq and Willem feedback addressed. added __netdev_tx_sent_queue() (Willem suggestion) ==================== Signed-off-by: David S. Miller commit c29734443511aa3c53844e1941805fc761aa80ba Author: Eric Dumazet Date: Wed Oct 31 08:39:14 2018 -0700 net/mlx4_en: use __netdev_tx_sent_queue() doorbell only depends on xmit_more and netif_tx_queue_stopped() Using __netdev_tx_sent_queue() avoids messing with BQL stop flag, and is more generic. This patch increases performance on GSO workload by keeping doorbells to the minimum required. Signed-off-by: Eric Dumazet Cc: Tariq Toukan Reviewed-by: Tariq Toukan Signed-off-by: David S. Miller commit fe60faa5063822f2d555f4f326c7dd72a60929bf Author: Eric Dumazet Date: Wed Oct 31 08:39:13 2018 -0700 net: do not abort bulk send on BQL status Before calling dev_hard_start_xmit(), upper layers tried to cook optimal skb list based on BQL budget. Problem is that GSO packets can end up comsuming more than the BQL budget. Breaking the loop is not useful, since requeued packets are ahead of any packets still in the qdisc. It is also more expensive, since next TX completion will push these packets later, while skbs are not in cpu caches. It is also a behavior difference with TSO packets, that can break the BQL limit by a large amount. Note that drivers should use __netdev_tx_sent_queue() in order to have optimal xmit_more support, and avoid useless atomic operations as shown in the following patch. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 3e59020abf0f88182730527ee5b862e786eb485a Author: Eric Dumazet Date: Wed Oct 31 08:39:12 2018 -0700 net: bql: add __netdev_tx_sent_queue() When qdisc_run() tries to use BQL budget to bulk-dequeue a batch of packets, GSO can later transform this list in another list of skbs, and each skb is sent to device ndo_start_xmit(), one at a time, with skb->xmit_more being set to one but for last skb. Problem is that very often, BQL limit is hit in the middle of the packet train, forcing dev_hard_start_xmit() to stop the bulk send and requeue the end of the list. BQL role is to avoid head of line blocking, making sure a qdisc can deliver high priority packets before low priority ones. But there is no way requeued packets can be bypassed by fresh packets in the qdisc. Aborting the bulk send increases TX softirqs, and hot cache lines (after skb_segment()) are wasted. Note that for TSO packets, we never split a packet in the middle because of BQL limit being hit. Drivers should be able to update BQL counters without flipping/caring about BQL status, if the current skb has xmit_more set. Upper layers are ultimately responsible to stop sending another packet train when BQL limit is hit. Code template in a driver might look like the following : send_doorbell = __netdev_tx_sent_queue(tx_queue, nr_bytes, skb->xmit_more); Note that __netdev_tx_sent_queue() use is not mandatory, since following patch will change dev_hard_start_xmit() to not care about BQL status. But it is highly recommended so that xmit_more full benefits can be reached (less doorbells sent, and less atomic operations as well) Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit ea0abbb648452cdb6e1734b702b6330a7448fcf8 Author: Vasily Averin Date: Sat Nov 3 17:11:19 2018 -0400 ext4: add missing brelse() update_backups()'s error path Fixes: ac27a0ec112a ("ext4: initial copy of files from ext3") Signed-off-by: Vasily Averin Signed-off-by: Theodore Ts'o Cc: stable@kernel.org # 2.6.19 commit 61a9c11e5e7a0dab5381afa5d9d4dd5ebf18f7a0 Author: Vasily Averin Date: Sat Nov 3 16:50:08 2018 -0400 ext4: add missing brelse() add_new_gdb_meta_bg()'s error path Fixes: 01f795f9e0d6 ("ext4: add online resizing support for meta_bg ...") Signed-off-by: Vasily Averin Signed-off-by: Theodore Ts'o Cc: stable@kernel.org # 3.7 commit cea5794122125bf67559906a0762186cf417099c Author: Vasily Averin Date: Sat Nov 3 16:22:10 2018 -0400 ext4: add missing brelse() in set_flexbg_block_bitmap()'s error path Fixes: 33afdcc5402d ("ext4: add a function which sets up group blocks ...") Cc: stable@kernel.org # 3.3 Signed-off-by: Vasily Averin Signed-off-by: Theodore Ts'o commit 9e4028935cca3f9ef9b6a90df9da6f1f94853536 Author: Vasily Averin Date: Sat Nov 3 16:13:17 2018 -0400 ext4: avoid potential extra brelse in setup_new_flex_group_blocks() Currently bh is set to NULL only during first iteration of for cycle, then this pointer is not cleared after end of using. Therefore rollback after errors can lead to extra brelse(bh) call, decrements bh counter and later trigger an unexpected warning in __brelse() Patch moves brelse() calls in body of cycle to exclude requirement of brelse() call in rollback. Fixes: 33afdcc5402d ("ext4: add a function which sets up group blocks ...") Signed-off-by: Vasily Averin Signed-off-by: Theodore Ts'o Cc: stable@kernel.org # 3.3+ commit d2ff0ff2c23f1bacd35073bf50e6c18298a8d530 Merge: 83650fd58a93 8008cc78d3d6 Author: Linus Torvalds Date: Sat Nov 3 12:13:57 2018 -0700 Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Olof Johansson: "A few fixes who have come in near or during the merge window: - Removal of a VLA usage in Marvell mpp platform code - Enable some IPMI options for ARM64 servers by default, helps testing - Enable PREEMPT on 32-bit ARMv7 defconfig - Minor fix for stm32 DT (removal of an unused DMA property) - Bugfix for TI OMAP1-based ams-delta (-EINVAL -> IRQ_NOTCONNECTED)" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: ARM: dts: stm32: update HASH1 dmas property on stm32mp157c ARM: orion: avoid VLA in orion_mpp_conf ARM: defconfig: Update multi_v7 to use PREEMPT arm64: defconfig: Enable some IPMI configs soc: ti: QMSS: Fix usage of irq_set_affinity_hint ARM: OMAP1: ams-delta: Fix impossible .irq < 0 commit 83650fd58a934fad5b7735fea96905ef986c0821 Merge: 3308a383ce99 966866892cf8 Author: Linus Torvalds Date: Sat Nov 3 10:55:23 2018 -0700 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull more arm64 updates from Catalin Marinas: - fix W+X page (mark RO) allocated by the arm64 kprobes code - Makefile fix for .i files in out of tree modules * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: kprobe: make page to RO mode when allocate it arm64: kdump: fix small typo arm64: makefile fix build of .i file in external module case commit 3308a383ce99f739a3fa47dbd8564ab517562b51 Merge: 9a12efc5e01a f62717551b2b Author: Linus Torvalds Date: Sat Nov 3 10:53:33 2018 -0700 Merge tag 'dma-mapping-4.20-2' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping fix from Christoph Hellwig: "Avoid compile warnings on non-default arm64 configs" * tag 'dma-mapping-4.20-2' of git://git.infradead.org/users/hch/dma-mapping: arm64: fix warnings without CONFIG_IOMMU_DMA commit 9a12efc5e01ac1dbad089f22e5d0e6f817970c3c Merge: 169447287bfb 995167420797 Author: Linus Torvalds Date: Sat Nov 3 10:47:33 2018 -0700 Merge tag 'kbuild-v4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild updates from Masahiro Yamada: - clean-up leftovers in Kconfig files - remove stale oldnoconfig and silentoldconfig targets - remove unneeded cc-fullversion and cc-name variables - improve merge_config script to allow overriding option prefix * tag 'kbuild-v4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: remove cc-name variable kbuild: replace cc-name test with CONFIG_CC_IS_CLANG merge_config.sh: Allow to define config prefix kbuild: remove unused cc-fullversion variable kconfig: remove silentoldconfig target kconfig: remove oldnoconfig target powerpc: PCI_MSI needs PCI powerpc: remove CONFIG_MCA leftovers powerpc: remove CONFIG_PCI_QSPAN scsi: aha152x: rename the PCMCIA define commit 169447287bfb0a8e494f33c04dda50bb078cf2f0 Merge: ed61a132cbbf b98e26df0754 Author: Linus Torvalds Date: Sat Nov 3 10:45:55 2018 -0700 Merge tag '4.20-rc1-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes and updates from Steve French: "Three small fixes (one Kerberos related, one for stable, and another fixes an oops in xfstest 377), two helpful debugging improvements, three patches for cifs directio and some minor cleanup" * tag '4.20-rc1-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: fix signed/unsigned mismatch on aio_read patch cifs: don't dereference smb_file_target before null check CIFS: Add direct I/O functions to file_operations CIFS: Add support for direct I/O write CIFS: Add support for direct I/O read smb3: missing defines and structs for reparse point handling smb3: allow more detailed protocol info on open files for debugging smb3: on kerberos mount if server doesn't specify auth type use krb5 smb3: add trace point for tree connection cifs: fix spelling mistake, EACCESS -> EACCES cifs: fix return value for cifs_listxattr commit b8a5d06ae234b9522f49d5cc97ff46edc6bdb780 Merge: 265ad0632fef 54e049c227d9 Author: David S. Miller Date: Sat Nov 3 10:44:06 2018 -0700 Merge branch 's390-qeth-fixes' Julian Wiedmann says: ==================== s390/qeth: fixes 2018-11-02 please apply one round of qeth fixes for -net. Patch 1 is rather large and removes a use-after-free hazard from many of our debug trace entries. Patch 2 is yet another fix-up for the L3 subdriver's new IP address management code. Patch 3 and 4 resolve some fallout from the recent changes wrt how/when qeth allocates its net_device. Patch 5 makes sure we don't set reserved bits when building HW commands from user-provided data. And finally, patch 6 allows ethtool to play nice with new HW. ==================== Signed-off-by: David S. Miller commit 54e049c227d9968ff6a7d80aae5fec27b54d39da Author: Julian Wiedmann Date: Fri Nov 2 19:04:13 2018 +0100 s390/qeth: report 25Gbit link speed This adds the various identifiers for 25Gbit cards, and wires them up into sysfs and ethtool. Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit 125d7d30111738a5bdafacc1ed87cd3d7f32b4ea Author: Julian Wiedmann Date: Fri Nov 2 19:04:12 2018 +0100 s390/qeth: sanitize ARP requests The ARP_{ADD,REMOVE}_ENTRY cmd structs contain reserved fields. Introduce a common helper that doesn't raw-copy the user-provided data into the cmd, but only sets those fields that are strictly needed for the command. This also sets the correct command length for ARP_REMOVE_ENTRY. Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit 9fae5c3b60396b8586881a0e7c028ae5bcaeaa3f Author: Julian Wiedmann Date: Fri Nov 2 19:04:11 2018 +0100 s390/qeth: fix initial operstate Setting the carrier 'on' for an unregistered netdevice doesn't update its operstate. Fix this by delaying the update until the netdevice has been registered. Fixes: 91cc98f51e3d ("s390/qeth: remove duplicated carrier state tracking") Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit 30356d08159d7899438e94503ae322a8b881e205 Author: Julian Wiedmann Date: Fri Nov 2 19:04:10 2018 +0100 s390/qeth: unregister netdevice only when registered qeth only registers its netdevice when the qeth device is first set online. Thus a device that has never been set online will trigger a WARN ("network todo 'hsi%d' but state 0") in unregister_netdev() when removed. Fix this by protecting the unregister step, just like we already protect against repeated registering of the netdevice. Fixes: d3d1b205e89f ("s390/qeth: allocate netdevice early") Reported-by: Karsten Graul Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit bd74a7f9cc033cf4d405788f80292268987dc0c5 Author: Julian Wiedmann Date: Fri Nov 2 19:04:09 2018 +0100 s390/qeth: fix HiperSockets sniffer Sniffing mode for L3 HiperSockets requires that no IP addresses are registered with the HW. The preferred way to achieve this is for userspace to delete all the IPs on the interface. But qeth is expected to also tolerate a configuration where that is not the case, by skipping the IP registration when in sniffer mode. Since commit 5f78e29ceebf ("qeth: optimize IP handling in rx_mode callback") reworked the IP registration logic in the L3 subdriver, this no longer works. When the qeth device is set online, qeth_l3_recover_ip() now unconditionally registers all unicast addresses from our internal IP table. While we could fix this particular problem by skipping qeth_l3_recover_ip() on a sniffer device, the more future-proof change is to skip the IP address registration at the lowest level. This way we a) catch any future code path that attempts to register an IP address without considering the sniffer scenario, and b) continue to build up our internal IP table, so that if sniffer mode is switched off later we can operate just like normal. Fixes: 5f78e29ceebf ("qeth: optimize IP handling in rx_mode callback") Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit e19e5be8b4cafa8b3f8b0cd1b1dfe20fa0145b83 Author: Julian Wiedmann Date: Fri Nov 2 19:04:08 2018 +0100 s390/qeth: sanitize strings in debug messages As Documentation/s390/s390dbf.txt states quite clearly, using any pointer in sprinf-formatted s390dbf debug entries is dangerous. The pointers are dereferenced whenever the trace file is read from. So if the referenced data has a shorter life-time than the trace file, any read operation can result in a use-after-free. So rip out all hazardous use of indirect data, and replace any usage of dev_name() and such by the Bus ID number. Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit ed61a132cbbf7cadae7b255cd5083c8fadc77f31 Merge: af102b333a21 2cbfdf4df583 Author: Linus Torvalds Date: Sat Nov 3 10:35:52 2018 -0700 Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull 9p fix from Al Viro: "Regression fix for net/9p handling of iov_iter; broken by braino when switching to iov_iter_is_kvec() et.al., spotted and fixed by Marc" * 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: iov_iter: Fix 9p virtio breakage commit af102b333a21cc77c1834cf7a604d0359db9d54b Merge: cddfa11aef3c 33279c305d07 Author: Linus Torvalds Date: Sat Nov 3 10:34:03 2018 -0700 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull more SCSI updates from James Bottomley: "This is a set of minor small (and safe changes) that didn't make the initial pull request plus some bug fixes" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: mvsas: Remove set but not used variable 'id' scsi: qla2xxx: Remove two arguments from qlafx00_error_entry() scsi: qla2xxx: Make sure that qlafx00_ioctl_iosb_entry() initializes 'res' scsi: qla2xxx: Remove a set-but-not-used variable scsi: qla2xxx: Make qla2x00_sysfs_write_nvram() easier to analyze scsi: qla2xxx: Declare local functions 'static' scsi: qla2xxx: Improve several kernel-doc headers scsi: qla2xxx: Modify fall-through annotations scsi: 3w-sas: 3w-9xxx: Use unsigned char for cdb scsi: mvsas: Use dma_pool_zalloc scsi: target: Don't request modules that aren't even built scsi: target: Set response length for REPORT TARGET PORT GROUPS commit cddfa11aef3c4914f406a059138ccc354f034d1c Merge: 5f21585384a4 dd33ad7b251f Author: Linus Torvalds Date: Sat Nov 3 10:21:43 2018 -0700 Merge branch 'akpm' (patches from Andrew) Merge more updates from Andrew Morton: - more ocfs2 work - various leftovers * emailed patches from Andrew Morton : memory_hotplug: cond_resched in __remove_pages bfs: add sanity check at bfs_fill_super() kernel/sysctl.c: remove duplicated include kernel/kexec_file.c: remove some duplicated includes mm, thp: consolidate THP gfp handling into alloc_hugepage_direct_gfpmask ocfs2: fix clusters leak in ocfs2_defrag_extent() ocfs2: dlmglue: clean up timestamp handling ocfs2: don't put and assigning null to bh allocated outside ocfs2: fix a misuse a of brelse after failing ocfs2_check_dir_entry ocfs2: don't use iocb when EIOCBQUEUED returns ocfs2: without quota support, avoid calling quota recovery ocfs2: remove ocfs2_is_o2cb_active() mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings include/linux/notifier.h: SRCU: fix ctags mm: handle no memcg case in memcg_kmem_charge() properly commit dd33ad7b251f900481701b2a82d25de583867708 Author: Michal Hocko Date: Fri Nov 2 15:48:46 2018 -0700 memory_hotplug: cond_resched in __remove_pages We have received a bug report that unbinding a large pmem (>1TB) can result in a soft lockup: NMI watchdog: BUG: soft lockup - CPU#9 stuck for 23s! [ndctl:4365] [...] Supported: Yes CPU: 9 PID: 4365 Comm: ndctl Not tainted 4.12.14-94.40-default #1 SLE12-SP4 Hardware name: Intel Corporation S2600WFD/S2600WFD, BIOS SE5C620.86B.01.00.0833.051120182255 05/11/2018 task: ffff9cce7d4410c0 task.stack: ffffbe9eb1bc4000 RIP: 0010:__put_page+0x62/0x80 Call Trace: devm_memremap_pages_release+0x152/0x260 release_nodes+0x18d/0x1d0 device_release_driver_internal+0x160/0x210 unbind_store+0xb3/0xe0 kernfs_fop_write+0x102/0x180 __vfs_write+0x26/0x150 vfs_write+0xad/0x1a0 SyS_write+0x42/0x90 do_syscall_64+0x74/0x150 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 RIP: 0033:0x7fd13166b3d0 It has been reported on an older (4.12) kernel but the current upstream code doesn't cond_resched in the hot remove code at all and the given range to remove might be really large. Fix the issue by calling cond_resched once per memory section. Link: http://lkml.kernel.org/r/20181031125840.23982-1-mhocko@kernel.org Signed-off-by: Michal Hocko Acked-by: Johannes Thumshirn Cc: Dan Williams Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9f2df09a33aa2c76ce6385d382693f98d7f2f07e Author: Tetsuo Handa Date: Fri Nov 2 15:48:42 2018 -0700 bfs: add sanity check at bfs_fill_super() syzbot is reporting too large memory allocation at bfs_fill_super() [1]. Since file system image is corrupted such that bfs_sb->s_start == 0, bfs_fill_super() is trying to allocate 8MB of continuous memory. Fix this by adding a sanity check on bfs_sb->s_start, __GFP_NOWARN and printf(). [1] https://syzkaller.appspot.com/bug?id=16a87c236b951351374a84c8a32f40edbc034e96 Link: http://lkml.kernel.org/r/1525862104-3407-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp Signed-off-by: Tetsuo Handa Reported-by: syzbot Reviewed-by: Andrew Morton Cc: Tigran Aivazian Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6f0483d1f91b612186abeaebf3ce43bf805eb9f7 Author: Michael Schupikov Date: Fri Nov 2 15:48:38 2018 -0700 kernel/sysctl.c: remove duplicated include Remove one include of . No functional changes. Link: http://lkml.kernel.org/r/20181004134223.17735-1-michael@schupikov.de Signed-off-by: Michael Schupikov Reviewed-by: Richard Weinberger Acked-by: Luis Chamberlain Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3383b36040522505546cb112f0a543a5998edfb6 Author: zhong jiang Date: Fri Nov 2 15:48:35 2018 -0700 kernel/kexec_file.c: remove some duplicated includes We include kexec.h and slab.h twice in kexec_file.c. It's unnecessary. hence just remove them. Link: http://lkml.kernel.org/r/1537498098-19171-1-git-send-email-zhongjiang@huawei.com Signed-off-by: zhong jiang Reviewed-by: Bhupesh Sharma Reviewed-by: Andrew Morton Acked-by: Baoquan He Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 89c83fb539f95491be80cdd5158e6f0ce329e317 Author: Michal Hocko Date: Fri Nov 2 15:48:31 2018 -0700 mm, thp: consolidate THP gfp handling into alloc_hugepage_direct_gfpmask THP allocation mode is quite complex and it depends on the defrag mode. This complexity is hidden in alloc_hugepage_direct_gfpmask from a large part currently. The NUMA special casing (namely __GFP_THISNODE) is however independent and placed in alloc_pages_vma currently. This both adds an unnecessary branch to all vma based page allocation requests and it makes the code more complex unnecessarily as well. Not to mention that e.g. shmem THP used to do the node reclaiming unconditionally regardless of the defrag mode until recently. This was not only unexpected behavior but it was also hardly a good default behavior and I strongly suspect it was just a side effect of the code sharing more than a deliberate decision which suggests that such a layering is wrong. Get rid of the thp special casing from alloc_pages_vma and move the logic to alloc_hugepage_direct_gfpmask. __GFP_THISNODE is applied to the resulting gfp mask only when the direct reclaim is not requested and when there is no explicit numa binding to preserve the current logic. Please note that there's also a slight difference wrt MPOL_BIND now. The previous code would avoid using __GFP_THISNODE if the local node was outside of policy_nodemask(). After this patch __GFP_THISNODE is avoided for all MPOL_BIND policies. So there's a difference that if local node is actually allowed by the bind policy's nodemask, previously __GFP_THISNODE would be added, but now it won't be. From the behavior POV this is still correct because the policy nodemask is used. Link: http://lkml.kernel.org/r/20180925120326.24392-3-mhocko@kernel.org Signed-off-by: Michal Hocko Acked-by: Vlastimil Babka Cc: Alex Williamson Cc: Andrea Arcangeli Cc: David Rientjes Cc: "Kirill A. Shutemov" Cc: Mel Gorman Cc: Stefan Priebe - Profihost AG Cc: Zi Yan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6194ae4242dec0c9d604bc05df83aa9260a899e4 Author: Larry Chen Date: Fri Nov 2 15:48:27 2018 -0700 ocfs2: fix clusters leak in ocfs2_defrag_extent() ocfs2_defrag_extent() might leak allocated clusters. When the file system has insufficient space, the number of claimed clusters might be less than the caller wants. If that happens, the original code might directly commit the transaction without returning clusters. This patch is based on code in ocfs2_add_clusters_in_btree(). [akpm@linux-foundation.org: include localalloc.h, reduce scope of data_ac] Link: http://lkml.kernel.org/r/20180904041621.16874-3-lchen@suse.com Signed-off-by: Larry Chen Reviewed-by: Andrew Morton Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Cc: Changwei Ge Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3a3d1e51042895c58d4797831921c940b28d8c4b Author: Arnd Bergmann Date: Fri Nov 2 15:48:23 2018 -0700 ocfs2: dlmglue: clean up timestamp handling The handling of timestamps outside of the 1970..2038 range in the dlm glue is rather inconsistent: on 32-bit architectures, this has always wrapped around to negative timestamps in the 1902..1969 range, while on 64-bit kernels all timestamps are interpreted as positive 34 bit numbers in the 1970..2514 year range. Now that the VFS code handles 64-bit timestamps on all architectures, we can make the behavior more consistent here, and return the same result that we had on 64-bit already, making the file system y2038 safe in the process. Outside of dlmglue, it already uses 64-bit on-disk timestamps anway, so that part is fine. For consistency, I'm changing ocfs2_pack_timespec() to clamp anything outside of the supported range to the minimum and maximum values. This avoids a possible ambiguity of values before 1970 in particular, which used to be interpreted as times at the end of the 2514 range previously. Link: http://lkml.kernel.org/r/20180619155826.4106487-1-arnd@arndb.de Signed-off-by: Arnd Bergmann Reviewed-by: Andrew Morton Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Cc: Changwei Ge Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cf76c78595ca87548ca5e45c862ac9e0949c4687 Author: Changwei Ge Date: Fri Nov 2 15:48:19 2018 -0700 ocfs2: don't put and assigning null to bh allocated outside ocfs2_read_blocks() and ocfs2_read_blocks_sync() are both used to read several blocks from disk. Currently, the input argument *bhs* can be NULL or NOT. It depends on the caller's behavior. If the function fails in reading blocks from disk, the corresponding bh will be assigned to NULL and put. Obviously, above process for non-NULL input bh is not appropriate. Because the caller doesn't even know its bhs are put and re-assigned. If buffer head is managed by caller, ocfs2_read_blocks and ocfs2_read_blocks_sync() should not evaluate it to NULL. It will cause caller accessing illegal memory, thus crash. Link: http://lkml.kernel.org/r/HK2PR06MB045285E0F4FBB561F9F2F9B3D5680@HK2PR06MB0452.apcprd06.prod.outlook.com Signed-off-by: Changwei Ge Reviewed-by: Guozhonghua Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Cc: Changwei Ge Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 29aa30167a0a2e6045a0d6d2e89d8168132333d5 Author: Changwei Ge Date: Fri Nov 2 15:48:15 2018 -0700 ocfs2: fix a misuse a of brelse after failing ocfs2_check_dir_entry Somehow, file system metadata was corrupted, which causes ocfs2_check_dir_entry() to fail in function ocfs2_dir_foreach_blk_el(). According to the original design intention, if above happens we should skip the problematic block and continue to retrieve dir entry. But there is obviouse misuse of brelse around related code. After failure of ocfs2_check_dir_entry(), current code just moves to next position and uses the problematic buffer head again and again during which the problematic buffer head is released for multiple times. I suppose, this a serious issue which is long-lived in ocfs2. This may cause other file systems which is also used in a the same host insane. So we should also consider about bakcporting this patch into linux -stable. Link: http://lkml.kernel.org/r/HK2PR06MB045211675B43EED794E597B6D56E0@HK2PR06MB0452.apcprd06.prod.outlook.com Signed-off-by: Changwei Ge Suggested-by: Changkuo Shi Reviewed-by: Andrew Morton Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9e985787750db8aae87f02b67e908f28ac4d6b83 Author: Changwei Ge Date: Fri Nov 2 15:48:11 2018 -0700 ocfs2: don't use iocb when EIOCBQUEUED returns When -EIOCBQUEUED returns, it means that aio_complete() will be called from dio_complete(), which is an asynchronous progress against write_iter. Generally, IO is a very slow progress than executing instruction, but we still can't take the risk to access a freed iocb. And we do face a BUG crash issue. Using the crash tool, iocb is obviously freed already. crash> struct -x kiocb ffff881a350f5900 struct kiocb { ki_filp = 0xffff881a350f5a80, ki_pos = 0x0, ki_complete = 0x0, private = 0x0, ki_flags = 0x0 } And the backtrace shows: ocfs2_file_write_iter+0xcaa/0xd00 [ocfs2] aio_run_iocb+0x229/0x2f0 do_io_submit+0x291/0x540 SyS_io_submit+0x10/0x20 system_call_fastpath+0x16/0x75 Link: http://lkml.kernel.org/r/1523361653-14439-1-git-send-email-ge.changwei@h3c.com Signed-off-by: Changwei Ge Reviewed-by: Andrew Morton Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 21158ca85b73ddd0088076a5209cfd040513a8b5 Author: Guozhonghua Date: Fri Nov 2 15:48:07 2018 -0700 ocfs2: without quota support, avoid calling quota recovery During one dead node's recovery by other node, quota recovery work will be queued. We should avoid calling quota when it is not supported, so check the quota flags. Link: http://lkml.kernel.org/r/71604351584F6A4EBAE558C676F37CA401071AC9FB@H3CMLB12-EX.srv.huawei-3com.com Signed-off-by: guozhonghua Reviewed-by: Jan Kara Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Cc: Changwei Ge Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a634644751c46238df58bbfe992e30c1668388db Author: Gang He Date: Fri Nov 2 15:48:03 2018 -0700 ocfs2: remove ocfs2_is_o2cb_active() Remove ocfs2_is_o2cb_active(). We have similar functions to identify which cluster stack is being used via osb->osb_cluster_stack. Secondly, the current implementation of ocfs2_is_o2cb_active() is not totally safe. Based on the design of stackglue, we need to get ocfs2_stack_lock before using ocfs2_stack related data structures, and that active_stack pointer can be NULL in the case of mount failure. Link: http://lkml.kernel.org/r/1495441079-11708-1-git-send-email-ghe@suse.com Signed-off-by: Gang He Reviewed-by: Joseph Qi Reviewed-by: Eric Ren Acked-by: Changwei Ge Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ac5b2c18911ffe95c08d69273917f90212cf5659 Author: Andrea Arcangeli Date: Fri Nov 2 15:47:59 2018 -0700 mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings THP allocation might be really disruptive when allocated on NUMA system with the local node full or hard to reclaim. Stefan has posted an allocation stall report on 4.12 based SLES kernel which suggests the same issue: kvm: page allocation stalls for 194572ms, order:9, mode:0x4740ca(__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_THISNODE|__GFP_MOVABLE|__GFP_DIRECT_RECLAIM), nodemask=(null) kvm cpuset=/ mems_allowed=0-1 CPU: 10 PID: 84752 Comm: kvm Tainted: G W 4.12.0+98-ph 0000001 SLE15 (unreleased) Hardware name: Supermicro SYS-1029P-WTRT/X11DDW-NT, BIOS 2.0 12/05/2017 Call Trace: dump_stack+0x5c/0x84 warn_alloc+0xe0/0x180 __alloc_pages_slowpath+0x820/0xc90 __alloc_pages_nodemask+0x1cc/0x210 alloc_pages_vma+0x1e5/0x280 do_huge_pmd_wp_page+0x83f/0xf00 __handle_mm_fault+0x93d/0x1060 handle_mm_fault+0xc6/0x1b0 __do_page_fault+0x230/0x430 do_page_fault+0x2a/0x70 page_fault+0x7b/0x80 [...] Mem-Info: active_anon:126315487 inactive_anon:1612476 isolated_anon:5 active_file:60183 inactive_file:245285 isolated_file:0 unevictable:15657 dirty:286 writeback:1 unstable:0 slab_reclaimable:75543 slab_unreclaimable:2509111 mapped:81814 shmem:31764 pagetables:370616 bounce:0 free:32294031 free_pcp:6233 free_cma:0 Node 0 active_anon:254680388kB inactive_anon:1112760kB active_file:240648kB inactive_file:981168kB unevictable:13368kB isolated(anon):0kB isolated(file):0kB mapped:280240kB dirty:1144kB writeback:0kB shmem:95832kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 81225728kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no Node 1 active_anon:250583072kB inactive_anon:5337144kB active_file:84kB inactive_file:0kB unevictable:49260kB isolated(anon):20kB isolated(file):0kB mapped:47016kB dirty:0kB writeback:4kB shmem:31224kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 31897600kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no The defrag mode is "madvise" and from the above report it is clear that the THP has been allocated for MADV_HUGEPAGA vma. Andrea has identified that the main source of the problem is __GFP_THISNODE usage: : The problem is that direct compaction combined with the NUMA : __GFP_THISNODE logic in mempolicy.c is telling reclaim to swap very : hard the local node, instead of failing the allocation if there's no : THP available in the local node. : : Such logic was ok until __GFP_THISNODE was added to the THP allocation : path even with MPOL_DEFAULT. : : The idea behind the __GFP_THISNODE addition, is that it is better to : provide local memory in PAGE_SIZE units than to use remote NUMA THP : backed memory. That largely depends on the remote latency though, on : threadrippers for example the overhead is relatively low in my : experience. : : The combination of __GFP_THISNODE and __GFP_DIRECT_RECLAIM results in : extremely slow qemu startup with vfio, if the VM is larger than the : size of one host NUMA node. This is because it will try very hard to : unsuccessfully swapout get_user_pages pinned pages as result of the : __GFP_THISNODE being set, instead of falling back to PAGE_SIZE : allocations and instead of trying to allocate THP on other nodes (it : would be even worse without vfio type1 GUP pins of course, except it'd : be swapping heavily instead). Fix this by removing __GFP_THISNODE for THP requests which are requesting the direct reclaim. This effectivelly reverts 5265047ac301 on the grounds that the zone/node reclaim was known to be disruptive due to premature reclaim when there was memory free. While it made sense at the time for HPC workloads without NUMA awareness on rare machines, it was ultimately harmful in the majority of cases. The existing behaviour is similar, if not as widespare as it applies to a corner case but crucially, it cannot be tuned around like zone_reclaim_mode can. The default behaviour should always be to cause the least harm for the common case. If there are specialised use cases out there that want zone_reclaim_mode in specific cases, then it can be built on top. Longterm we should consider a memory policy which allows for the node reclaim like behavior for the specific memory ranges which would allow a [1] http://lkml.kernel.org/r/20180820032204.9591-1-aarcange@redhat.com Mel said: : Both patches look correct to me but I'm responding to this one because : it's the fix. The change makes sense and moves further away from the : severe stalling behaviour we used to see with both THP and zone reclaim : mode. : : I put together a basic experiment with usemem configured to reference a : buffer multiple times that is 80% the size of main memory on a 2-socket : box with symmetric node sizes and defrag set to "always". The defrag : setting is not the default but it would be functionally similar to : accessing a buffer with madvise(MADV_HUGEPAGE). Usemem is configured to : reference the buffer multiple times and while it's not an interesting : workload, it would be expected to complete reasonably quickly as it fits : within memory. The results were; : : usemem : vanilla noreclaim-v1 : Amean Elapsd-1 42.78 ( 0.00%) 26.87 ( 37.18%) : Amean Elapsd-3 27.55 ( 0.00%) 7.44 ( 73.00%) : Amean Elapsd-4 5.72 ( 0.00%) 5.69 ( 0.45%) : : This shows the elapsed time in seconds for 1 thread, 3 threads and 4 : threads referencing buffers 80% the size of memory. With the patches : applied, it's 37.18% faster for the single thread and 73% faster with two : threads. Note that 4 threads showing little difference does not indicate : the problem is related to thread counts. It's simply the case that 4 : threads gets spread so their workload mostly fits in one node. : : The overall view from /proc/vmstats is more startling : : 4.19.0-rc1 4.19.0-rc1 : vanillanoreclaim-v1r1 : Minor Faults 35593425 708164 : Major Faults 484088 36 : Swap Ins 3772837 0 : Swap Outs 3932295 0 : : Massive amounts of swap in/out without the patch : : Direct pages scanned 6013214 0 : Kswapd pages scanned 0 0 : Kswapd pages reclaimed 0 0 : Direct pages reclaimed 4033009 0 : : Lots of reclaim activity without the patch : : Kswapd efficiency 100% 100% : Kswapd velocity 0.000 0.000 : Direct efficiency 67% 100% : Direct velocity 11191.956 0.000 : : Mostly from direct reclaim context as you'd expect without the patch. : : Page writes by reclaim 3932314.000 0.000 : Page writes file 19 0 : Page writes anon 3932295 0 : Page reclaim immediate 42336 0 : : Writes from reclaim context is never good but the patch eliminates it. : : We should never have default behaviour to thrash the system for such a : basic workload. If zone reclaim mode behaviour is ever desired but on a : single task instead of a global basis then the sensible option is to build : a mempolicy that enforces that behaviour. This was a severe regression compared to previous kernels that made important workloads unusable and it starts when __GFP_THISNODE was added to THP allocations under MADV_HUGEPAGE. It is not a significant risk to go to the previous behavior before __GFP_THISNODE was added, it worked like that for years. This was simply an optimization to some lucky workloads that can fit in a single node, but it ended up breaking the VM for others that can't possibly fit in a single node, so going back is safe. [mhocko@suse.com: rewrote the changelog based on the one from Andrea] Link: http://lkml.kernel.org/r/20180925120326.24392-2-mhocko@kernel.org Fixes: 5265047ac301 ("mm, thp: really limit transparent hugepage allocation to local node") Signed-off-by: Andrea Arcangeli Signed-off-by: Michal Hocko Reported-by: Stefan Priebe Debugged-by: Andrea Arcangeli Reported-by: Alex Williamson Reviewed-by: Mel Gorman Tested-by: Mel Gorman Cc: Zi Yan Cc: Vlastimil Babka Cc: David Rientjes Cc: "Kirill A. Shutemov" Cc: [4.1+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 94e297c50b529f5d01cfd1dbc808d61e95180ab7 Author: Sam Protsenko Date: Fri Nov 2 15:47:53 2018 -0700 include/linux/notifier.h: SRCU: fix ctags ctags indexing ("make tags" command) throws this warning: ctags: Warning: include/linux/notifier.h:125: null expansion of name pattern "\1" This is the result of DEFINE_PER_CPU() macro expansion. Fix that by getting rid of line break. Similar fix was already done in commit 25528213fe9f ("tags: Fix DEFINE_PER_CPU expansions"), but this one probably wasn't noticed. Link: http://lkml.kernel.org/r/20181030202808.28027-1-semen.protsenko@linaro.org Fixes: 9c80172b902d ("kernel/SRCU: provide a static initializer") Signed-off-by: Sam Protsenko Cc: Sebastian Andrzej Siewior Cc: Andy Shevchenko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e68599a3c3ad0f3171a7cb4e48aa6f9a69381902 Author: Roman Gushchin Date: Fri Nov 2 15:47:49 2018 -0700 mm: handle no memcg case in memcg_kmem_charge() properly Mike Galbraith reported a regression caused by the commit 9b6f7e163cd0 ("mm: rework memcg kernel stack accounting") on a system with "cgroup_disable=memory" boot option: the system panics with the following stack trace: BUG: unable to handle kernel NULL pointer dereference at 00000000000000f8 PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP PTI CPU: 0 PID: 1 Comm: systemd Not tainted 4.19.0-preempt+ #410 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20180531_142017-buildhw-08.phx2.fed4 RIP: 0010:page_counter_try_charge+0x22/0xc0 Code: 41 5d c3 c3 0f 1f 40 00 0f 1f 44 00 00 48 85 ff 0f 84 a7 00 00 00 41 56 48 89 f8 49 89 fe 49 Call Trace: try_charge+0xcb/0x780 memcg_kmem_charge_memcg+0x28/0x80 memcg_kmem_charge+0x8b/0x1d0 copy_process.part.41+0x1ca/0x2070 _do_fork+0xd7/0x3d0 do_syscall_64+0x5a/0x180 entry_SYSCALL_64_after_hwframe+0x49/0xbe The problem occurs because get_mem_cgroup_from_current() returns the NULL pointer if memory controller is disabled. Let's check if this is a case at the beginning of memcg_kmem_charge() and just return 0 if mem_cgroup_disabled() returns true. This is how we handle this case in many other places in the memory controller code. Link: http://lkml.kernel.org/r/20181029215123.17830-1-guro@fb.com Fixes: 9b6f7e163cd0 ("mm: rework memcg kernel stack accounting") Signed-off-by: Roman Gushchin Reported-by: Mike Galbraith Acked-by: Rik van Riel Acked-by: Michal Hocko Cc: Johannes Weiner Cc: Vladimir Davydov Cc: Shakeel Butt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f393808dc64149ccd0e5a8427505ba2974a59854 Author: Vasily Khoruzhick Date: Thu Oct 25 12:15:43 2018 -0700 netfilter: conntrack: fix calculation of next bucket number in early_drop If there's no entry to drop in bucket that corresponds to the hash, early_drop() should look for it in other buckets. But since it increments hash instead of bucket number, it actually looks in the same bucket 8 times: hsize is 16k by default (14 bits) and hash is 32-bit value, so reciprocal_scale(hash, hsize) returns the same value for hash..hash+7 in most cases. Fix it by increasing bucket number instead of hash and rename _hash to bucket to avoid future confusion. Fixes: 3e86638e9a0b ("netfilter: conntrack: consider ct netns in early_drop logic") Cc: # v4.7+ Signed-off-by: Vasily Khoruzhick Signed-off-by: Pablo Neira Ayuso commit e4844c9c62a0fe47980d6c3d4b7a096a5d755925 Author: Florian Westphal Date: Fri Nov 2 11:33:37 2018 +0100 netfilter: nft_compat: ebtables 'nat' table is normal chain type Unlike ip(6)tables, the ebtables nat table has no special properties. This bug causes 'ebtables -A' to fail when using a target such as 'snat' (ebt_snat target sets ".table = "nat"'). Targets that have no table restrictions work fine. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 8866df9264a34e675b4ee8a151db819b87cce2d3 Author: Pablo Neira Ayuso Date: Fri Nov 2 00:14:00 2018 +0100 netfilter: nfnetlink_cttimeout: pass default timeout policy to obj_to_nlattr Otherwise, we hit a NULL pointer deference since handlers always assume default timeout policy is passed. netlink: 24 bytes leftover after parsing attributes in process `syz-executor2'. kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 9575 Comm: syz-executor1 Not tainted 4.19.0+ #312 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:icmp_timeout_obj_to_nlattr+0x77/0x170 net/netfilter/nf_conntrack_proto_icmp.c:297 Fixes: c779e849608a ("netfilter: conntrack: remove get_timeout() indirection") Reported-by: Eric Dumazet Signed-off-by: Pablo Neira Ayuso commit a95a7774d51e13f9cf4b7285666829b68852f07a Author: Pablo Neira Ayuso Date: Fri Nov 2 00:11:34 2018 +0100 netfilter: conntrack: add nf_{tcp,udp,sctp,icmp,dccp,icmpv6,generic}_pernet() Expose these functions to access conntrack protocol tracker netns area, nfnetlink_cttimeout needs this. Signed-off-by: Pablo Neira Ayuso commit 8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7 Author: Jozsef Kadlecsik Date: Tue Oct 30 22:43:42 2018 +0100 netfilter: ipset: Fix calling ip_set() macro at dumping The ip_set() macro is called when either ip_set_ref_lock held only or no lock/nfnl mutex is held at dumping. Take this into account properly. Also, use Pablo's suggestion to use rcu_dereference_raw(), the ref_netlink protects the set. Signed-off-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso commit 54451f60c8fa061af9051a53be9786393947367c Author: Taehee Yoo Date: Sun Oct 21 00:00:08 2018 +0900 netfilter: xt_IDLETIMER: add sysfs filename checking routine When IDLETIMER rule is added, sysfs file is created under /sys/class/xt_idletimer/timers/ But some label name shouldn't be used. ".", "..", "power", "uevent", "subsystem", etc... So that sysfs filename checking routine is needed. test commands: %iptables -I INPUT -j IDLETIMER --timeout 1 --label "power" splat looks like: [95765.423132] sysfs: cannot create duplicate filename '/devices/virtual/xt_idletimer/timers/power' [95765.433418] CPU: 0 PID: 8446 Comm: iptables Not tainted 4.19.0-rc6+ #20 [95765.449755] Call Trace: [95765.449755] dump_stack+0xc9/0x16b [95765.449755] ? show_regs_print_info+0x5/0x5 [95765.449755] sysfs_warn_dup+0x74/0x90 [95765.449755] sysfs_add_file_mode_ns+0x352/0x500 [95765.449755] sysfs_create_file_ns+0x179/0x270 [95765.449755] ? sysfs_add_file_mode_ns+0x500/0x500 [95765.449755] ? idletimer_tg_checkentry+0x3e5/0xb1b [xt_IDLETIMER] [95765.449755] ? rcu_read_lock_sched_held+0x114/0x130 [95765.449755] ? __kmalloc_track_caller+0x211/0x2b0 [95765.449755] ? memcpy+0x34/0x50 [95765.449755] idletimer_tg_checkentry+0x4e2/0xb1b [xt_IDLETIMER] [ ... ] Fixes: 0902b469bd25 ("netfilter: xtables: idletimer target implementation") Signed-off-by: Taehee Yoo Signed-off-by: Pablo Neira Ayuso commit 17b8b74c0f8dbf9b9e3301f9ca5b65dd1c079951 Author: Jozsef Kadlecsik Date: Fri Oct 19 19:35:19 2018 +0200 netfilter: ipset: Correct rcu_dereference() call in ip_set_put_comment() The function is called when rcu_read_lock() is held and not when rcu_read_lock_bh() is held. Signed-off-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso commit fe5192ac81ad0d4dfe1395d11f393f0513c15f7f Author: Martin Kelly Date: Sun Oct 28 20:18:53 2018 -0700 iio:st_magn: Fix enable device after trigger Currently, we enable the device before we enable the device trigger. At high frequencies, this can cause interrupts that don't yet have a poll function associated with them and are thus treated as spurious. At high frequencies with level interrupts, this can even cause an interrupt storm of repeated spurious interrupts (~100,000 on my Beagleboard with the LSM9DS1 magnetometer). If these repeat too much, the interrupt will get disabled and the device will stop functioning. To prevent these problems, enable the device prior to enabling the device trigger, and disable the divec prior to disabling the trigger. This means there's no window of time during which the device creates interrupts but we have no trigger to answer them. Fixes: 90efe055629 ("iio: st_sensors: harden interrupt handling") Signed-off-by: Martin Kelly Tested-by: Denis Ciocca Cc: Signed-off-by: Jonathan Cameron commit cd26ea6d50a207ee37e0364ecc2d196d6c9671e8 Author: Arnaldo Carvalho de Melo Date: Sat Nov 3 08:19:56 2018 -0300 perf trace: Fix setting of augmented payload when using eBPF + raw_syscalls For now with BPF raw_augmented we hook into raw_syscalls:sys_enter and there we get all 6 syscall args plus the tracepoint common fields (sizeof(long)) and the syscall_nr (another long). So we check if that is the case and if so don't look after the sc->args_size, but always after the full raw_syscalls:sys_enter payload, which is fixed. We'll revisit this later to pass s->args_size to the BPF augmenter (now tools/perf/examples/bpf/augmented_raw_syscalls.c, so that it copies only what we need for each syscall, like what happens when we use syscalls:sys_enter_NAME, so that we reduce the kernel/userspace traffic to just what is needed for each syscall. Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-nlslrg8apxdsobt4pwl3n7ur@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 265ad0632fef0fac447894b26fcf91562fbb0e30 Merge: c7e86acfcee3 7cb6a2a2c72c Author: David S. Miller Date: Sat Nov 3 00:03:40 2018 -0700 Merge branch 'net-timeout-fixes-for-GENET-and-SYSTEMPORT' Florian Fainelli says: ==================== net: timeout fixes for GENET and SYSTEMPORT This patch series fixes occasional transmit timeout around the time the system goes into suspend. GENET and SYSTEMPORT have nearly the same logic in that regard and were both affected in the same way. Please queue up for stable, thanks! ==================== Signed-off-by: David S. Miller commit 7cb6a2a2c72c1ed8f42fb01f1a661281b568dead Author: Florian Fainelli Date: Thu Nov 1 15:55:38 2018 -0700 net: systemport: Protect stop from timeout A timing hazard exists when the network interface is stopped that allows a watchdog timeout to be processed by a separate core in parallel. This creates the potential for the timeout handler to wake the queues while the driver is shutting down, or access registers after their clocks have been removed. The more common case is that the watchdog timeout will produce a warning message which doesn't lead to a crash. The chances of this are greatly increased by the fact that bcm_sysport_netif_stop stops the transmit queues which can easily precipitate a watchdog time- out because of stale trans_start data in the queues. This commit corrects the behavior by ensuring that the watchdog timeout is disabled before enterring bcm_sysport_netif_stop. There are currently only two users of the bcm_sysport_netif_stop function: close and suspend. The close case already handles the issue by exiting the RUNNING state before invoking the driver close service. The suspend case now performs the netif_device_detach to exit the PRESENT state before the call to bcm_sysport_netif_stop rather than after it. These behaviors prevent any future scheduling of the driver timeout service during the window. The netif_tx_stop_all_queues function in bcm_sysport_netif_stop is replaced with netif_tx_disable to ensure synchronization with any transmit or timeout threads that may already be executing on other cores. For symmetry, the netif_device_attach call upon resume is moved to after the call to bcm_sysport_netif_start. Since it wakes the transmit queues it is not necessary to invoke netif_tx_start_all_queues from bcm_sysport_netif_start so it is moved into the driver open service. Fixes: 40755a0fce17 ("net: systemport: add suspend and resume support") Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller commit 09e805d2570a3a94f13dd9c9ad2bcab23da76e09 Author: Doug Berger Date: Thu Nov 1 15:55:37 2018 -0700 net: bcmgenet: protect stop from timeout A timing hazard exists when the network interface is stopped that allows a watchdog timeout to be processed by a separate core in parallel. This creates the potential for the timeout handler to wake the queues while the driver is shutting down, or access registers after their clocks have been removed. The more common case is that the watchdog timeout will produce a warning message which doesn't lead to a crash. The chances of this are greatly increased by the fact that bcmgenet_netif_stop stops the transmit queues which can easily precipitate a watchdog time- out because of stale trans_start data in the queues. This commit corrects the behavior by ensuring that the watchdog timeout is disabled before enterring bcmgenet_netif_stop. There are currently only two users of the bcmgenet_netif_stop function: close and suspend. The close case already handles the issue by exiting the RUNNING state before invoking the driver close service. The suspend case now performs the netif_device_detach to exit the PRESENT state before the call to bcmgenet_netif_stop rather than after it. These behaviors prevent any future scheduling of the driver timeout service during the window. The netif_tx_stop_all_queues function in bcmgenet_netif_stop is replaced with netif_tx_disable to ensure synchronization with any transmit or timeout threads that may already be executing on other cores. For symmetry, the netif_device_attach call upon resume is moved to after the call to bcmgenet_netif_start. Since it wakes the transmit queues it is not necessary to invoke netif_tx_start_all_queues from bcmgenet_netif_start so it is moved into the driver open service. Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file") Signed-off-by: Doug Berger Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller commit c7e86acfcee30794dc99a0759924bf7b9d43f1ca Author: David Howells Date: Thu Nov 1 13:39:53 2018 +0000 rxrpc: Fix lockup due to no error backoff after ack transmit error If the network becomes (partially) unavailable, say by disabling IPv6, the background ACK transmission routine can get itself into a tizzy by proposing immediate ACK retransmission. Since we're in the call event processor, that happens immediately without returning to the workqueue manager. The condition should clear after a while when either the network comes back or the call times out. Fix this by: (1) When re-proposing an ACK on failed Tx, don't schedule it immediately. This will allow a certain amount of time to elapse before we try again. (2) Enforce a return to the workqueue manager after a certain number of iterations of the call processing loop. (3) Add a backoff delay that increases the delay on deferred ACKs by a jiffy per failed transmission to a limit of HZ. The backoff delay is cleared on a successful return from kernel_sendmsg(). (4) Cancel calls immediately if the opening sendmsg fails. The layer above can arrange retransmission or rotate to another server. Fixes: 248f219cb8bc ("rxrpc: Rewrite the data and ack handling code") Signed-off-by: David Howells Signed-off-by: David S. Miller commit 284fb78ed7572117846f8e1d1d8e3dbfd16880c2 Author: Tristram Ha Date: Fri Nov 2 19:23:41 2018 -0700 net: dsa: microchip: initialize mutex before use Initialize mutex before use. Avoid kernel complaint when CONFIG_DEBUG_LOCK_ALLOC is enabled. Fixes: b987e98e50ab90e5 ("dsa: add DSA switch driver for Microchip KSZ9477") Signed-off-by: Tristram Ha Reviewed-by: Pavel Machek Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 2384d02520ff2a916169b2fd85ea50e923ed56c2 Author: Jeff Barnhill <0xeffeff@gmail.com> Date: Fri Nov 2 20:23:57 2018 +0000 net/ipv6: Add anycast addresses to a global hashtable icmp6_send() function is expensive on systems with a large number of interfaces. Every time it’s called, it has to verify that the source address does not correspond to an existing anycast address by looping through every device and every anycast address on the device. This can result in significant delays for a CPU when there are a large number of neighbors and ND timers are frequently timing out and calling neigh_invalidate(). Add anycast addresses to a global hashtable to allow quick searching for matching anycast addresses. This is based on inet6_addr_lst in addrconf.c. Signed-off-by: Jeff Barnhill <0xeffeff@gmail.com> Signed-off-by: David S. Miller commit 7b900ead6cc66b2ee873cb042dfba169aa68b56c Author: Frieder Schrempf Date: Wed Oct 31 22:52:19 2018 +0100 usbnet: smsc95xx: disable carrier check while suspending We need to make sure, that the carrier check polling is disabled while suspending. Otherwise we can end up with usbnet_read_cmd() being issued when only usbnet_read_cmd_nopm() is allowed. If this happens, read operations lock up. Fixes: d69d169493 ("usbnet: smsc95xx: fix link detection for disabled autonegotiation") Signed-off-by: Frieder Schrempf Reviewed-by: Raghuram Chary J Signed-off-by: David S. Miller commit 49682bfa1e0e448a711471a5db83be0df1fb39a2 Author: Mathieu Malaterre Date: Wed Oct 31 13:16:58 2018 +0100 net: document skb parameter in function 'skb_gso_size_check' Remove kernel-doc warning: net/core/skbuff.c:4953: warning: Function parameter or member 'skb' not described in 'skb_gso_size_check' Signed-off-by: Mathieu Malaterre Signed-off-by: David S. Miller commit 8008cc78d3d6f5191ffcb2b85a423d516000e7f4 Merge: 00a6a845c0b6 ab6ead7d07ca Author: Olof Johansson Date: Fri Nov 2 22:31:40 2018 -0700 Merge tag 'omap-for-v4.20/omap1-fix-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes Fix for omap1 ams-delta irq We need to use IRQ_NOTCONNECTED instead of -EINVAL for ams_delta_modem_ports irq. * tag 'omap-for-v4.20/omap1-fix-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: OMAP1: ams-delta: Fix impossible .irq < 0 Signed-off-by: Olof Johansson commit 00a6a845c0b66e7ffb9adb6b3a9ce2ae97a0c172 Author: Alexandre Torgue Date: Thu Sep 20 18:34:17 2018 +0200 ARM: dts: stm32: update HASH1 dmas property on stm32mp157c Remove unused parameter from HASH1 dmas property on stm32mp157c SoC. Fixes: 1e726a40e067 ("ARM: dts: stm32: Add HASH support on stm32mp157c") Signed-off-by: Alexandre Torgue [Olof: Bug doesn't cause any harm, so shouldn't need stable backport] Signed-off-by: Olof Johansson commit d4f79cb872bd4faa44eb133c1aee5f3411342c54 Author: Arnd Bergmann Date: Fri Oct 5 18:15:49 2018 +0200 ARM: orion: avoid VLA in orion_mpp_conf Testing randconfig builds found an instance of a VLA that was missed when determining that we have removed them all: arch/arm/plat-orion/mpp.c: In function 'orion_mpp_conf': arch/arm/plat-orion/mpp.c:31:2: error: ISO C90 forbids variable length array 'mpp_ctrl' [-Werror=vla] This one is fairly straightforward: we know what all three callers are, and the maximum length is not very long. Fixes: 68664695ae57 ("Makefile: Globally enable VLA warning") Signed-off-by: Arnd Bergmann Reviewed-by: Andrew Lunn Reviewed-by: Kees Cook Signed-off-by: Olof Johansson commit 2cbfdf4df58330f6cb493500387427dae1c5551d Author: Marc Zyngier Date: Fri Nov 2 17:16:51 2018 +0000 iov_iter: Fix 9p virtio breakage When switching to the new iovec accessors, a negation got subtly dropped, leading to 9p being remarkably broken (here with kvmtool): [ 7.430941] VFS: Mounted root (9p filesystem) on device 0:15. [ 7.432080] devtmpfs: mounted [ 7.432717] Freeing unused kernel memory: 1344K [ 7.433658] Run /virt/init as init process Warning: unable to translate guest address 0x7e00902ff000 to host Warning: unable to translate guest address 0x7e00902fefc0 to host Warning: unable to translate guest address 0x7e00902ff000 to host Warning: unable to translate guest address 0x7e008febef80 to host Warning: unable to translate guest address 0x7e008febf000 to host Warning: unable to translate guest address 0x7e008febef00 to host Warning: unable to translate guest address 0x7e008febf000 to host [ 7.436376] Kernel panic - not syncing: Requested init /virt/init failed (error -8). [ 7.437554] CPU: 29 PID: 1 Comm: swapper/0 Not tainted 4.19.0-rc8-02267-g00e23707442a #291 [ 7.439006] Hardware name: linux,dummy-virt (DT) [ 7.439902] Call trace: [ 7.440387] dump_backtrace+0x0/0x148 [ 7.441104] show_stack+0x14/0x20 [ 7.441768] dump_stack+0x90/0xb4 [ 7.442425] panic+0x120/0x27c [ 7.443036] kernel_init+0xa4/0x100 [ 7.443725] ret_from_fork+0x10/0x18 [ 7.444444] SMP: stopping secondary CPUs [ 7.445391] Kernel Offset: disabled [ 7.446169] CPU features: 0x0,23000438 [ 7.446974] Memory Limit: none [ 7.447645] ---[ end Kernel panic - not syncing: Requested init /virt/init failed (error -8). ]--- Restoring the missing "!" brings the guest back to life. Fixes: 00e23707442a ("iov_iter: Use accessor function") Reported-by: Will Deacon Signed-off-by: Marc Zyngier Signed-off-by: Al Viro commit bff9a1076adfb787036ced707fc28cfa578aee99 Merge: 291d0e5d81e1 ab1e77c3f590 Author: Thomas Gleixner Date: Fri Nov 2 21:58:39 2018 +0100 Merge branch 'clockevents/4.20-rc1' of https://git.linaro.org/people/daniel.lezcano/linux into timers/urgent Pull clockevent update from Daniel Lezcano: - Add the per cpu timer for the c-sky architecture (Guo Ren) - Add the global timer for the c-sky architecture (Guo Ren) commit 28c2fae726bf5003cd209b0d5910a642af98316f Author: Daniel Borkmann Date: Fri Nov 2 11:35:46 2018 +0100 bpf: fix bpf_prog_get_info_by_fd to return 0 func_lens for unpriv While dbecd7388476 ("bpf: get kernel symbol addresses via syscall") zeroed info.nr_jited_ksyms in bpf_prog_get_info_by_fd() for queries from unprivileged users, commit 815581c11cc2 ("bpf: get JITed image lengths of functions via syscall") forgot about doing so and therefore returns the #elems of the user set up buffer which is incorrect. It also needs to indicate a info.nr_jited_func_lens of zero. Fixes: 815581c11cc2 ("bpf: get JITed image lengths of functions via syscall") Signed-off-by: Daniel Borkmann Cc: Sandipan Das Cc: Song Liu Signed-off-by: Alexei Starovoitov commit b0970f235f1ff68a49fd36fdbd8a80dd92bb7b04 Merge: 7de414a9dd91 ff1889fc531f Author: Daniel Borkmann Date: Fri Nov 2 21:39:02 2018 +0100 Merge branch 'bpf-accurate-prog-addr' Song Liu says: ==================== Changes v1 -> v2: 1. Added main program length to bpf_prog_info->jited_fun_lens (3/3). 2. Updated commit message of 1/3 and 2/3 with more background about the address masking, and why it is still save after the changes. 3. Replace "ulong" with "unsigned long". This set improves bpf program address showed in /proc/kallsyms and in bpf_prog_info. First, real program address is showed instead of page address. Second, when there is no subprogram, bpf_prog_info->jited_ksyms and bpf_prog_info->jited_fun_lens returns the main prog address and length. ==================== Acked-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann commit ff1889fc531f582f902175c0acc80321af540b24 Author: Song Liu Date: Fri Nov 2 10:16:17 2018 -0700 bpf: show main program address and length in bpf_prog_info Currently, when there is no subprog (prog->aux->func_cnt == 0), bpf_prog_info does not return any jited_ksyms or jited_func_lens. This patch adds main program address (prog->bpf_func) and main program length (prog->jited_len) to bpf_prog_info. Signed-off-by: Song Liu Signed-off-by: Daniel Borkmann commit de57e99ceb65d0d7775cc14a8ba5931d7de1d708 Author: Song Liu Date: Fri Nov 2 10:16:16 2018 -0700 bpf: show real jited address in bpf_prog_info->jited_ksyms Currently, jited_ksyms in bpf_prog_info shows page addresses of jited bpf program. The main reason here is to not expose randomized start address. However, this is not ideal for detailed profiling (find hot instructions from stack traces). This patch replaces the page address with real prog start address. This change is OK because bpf_prog_get_info_by_fd() is only available to root. Signed-off-by: Song Liu Signed-off-by: Daniel Borkmann commit df0734702a7cbba49d6765bd5ba069340bf9c5db Author: Song Liu Date: Fri Nov 2 10:16:15 2018 -0700 bpf: show real jited prog address in /proc/kallsyms Currently, /proc/kallsyms shows page address of jited bpf program. The main reason here is to not expose randomized start address. However, This is not ideal for detailed profiling (find hot instructions from stack traces). This patch replaces the page address with real prog start address. This change is OK because these addresses are still protected by sysctl kptr_restrict (see kallsyms_show_value()), and only programs loaded by root are added to kallsyms (see bpf_prog_kallsyms_add()). Signed-off-by: Song Liu Signed-off-by: Daniel Borkmann commit b98e26df07549d4649ac5b8f24c49f5c722bbc7e Author: Steve French Date: Thu Nov 1 10:54:32 2018 -0500 cifs: fix signed/unsigned mismatch on aio_read patch The patch "CIFS: Add support for direct I/O read" had a signed/unsigned mismatch (ssize_t vs. size_t) in the return from one function. Similar trivial change in aio_write Signed-off-by: Long Li Signed-off-by: Steve French Reported-by: Julia Lawall commit 8c6c9bed8773375b1d54ccca2911ec892c59db5d Author: Colin Ian King Date: Thu Nov 1 13:14:30 2018 +0000 cifs: don't dereference smb_file_target before null check There is a null check on dst_file->private data which suggests it can be potentially null. However, before this check, pointer smb_file_target is derived from dst_file->private and dereferenced in the call to tlink_tcon, hence there is a potential null pointer deference. Fix this by assigning smb_file_target and target_tcon after the null pointer sanity checks. Detected by CoverityScan, CID#1475302 ("Dereference before null check") Fixes: 04b38d601239 ("vfs: pull btrfs clone API to vfs layer") Signed-off-by: Colin Ian King Signed-off-by: Steve French commit be4eb68846dc4450a9a4998d7c16d9f4955f9988 Author: Long Li Date: Wed Oct 31 22:13:11 2018 +0000 CIFS: Add direct I/O functions to file_operations With direct read/write functions implemented, add them to file_operations. Dircet I/O is used under two conditions: 1. When mounting with "cache=none", CIFS uses direct I/O for all user file data transfer. 2. When opening a file with O_DIRECT, CIFS uses direct I/O for all data transfer on this file. Signed-off-by: Long Li Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg commit 8c5f9c1ab7cb45f6584ce312b14fb310a8fa28f3 Author: Long Li Date: Wed Oct 31 22:13:10 2018 +0000 CIFS: Add support for direct I/O write With direct I/O write, user supplied buffers are pinned to the memory and data are transferred directly from user buffers to the transport layer. Change in v3: add support for kernel AIO Change in v4: Refactor common write code to __cifs_writev for direct and non-direct I/O. Retry on direct I/O failure. Signed-off-by: Long Li Signed-off-by: Steve French commit 6e6e2b86c29c6fcfa16ad9fdc7ea32027bea5d73 Author: Long Li Date: Wed Oct 31 22:13:09 2018 +0000 CIFS: Add support for direct I/O read With direct I/O read, we transfer the data directly from transport layer to the user data buffer. Change in v3: add support for kernel AIO Change in v4: Refactor common read code to __cifs_readv for direct and non-direct I/O. Retry on direct I/O failure. Signed-off-by: Long Li Signed-off-by: Steve French commit 0df444a00f32a3ab4d37c3c101bb960ee38a9617 Author: Steve French Date: Wed Oct 31 11:24:33 2018 -0500 smb3: missing defines and structs for reparse point handling We were missing some structs from MS-FSCC relating to reparse point handling. Add them to protocol defines in smb2pdu.h Signed-off-by: Steve French Reviewed-by: Aurelien Aptel commit dfe33f9abc08997e56f9bdf14fe9ac7ac0e14075 Author: Steve French Date: Tue Oct 30 19:50:31 2018 -0500 smb3: allow more detailed protocol info on open files for debugging In order to debug complex problems it is often helpful to have detailed information on the client and server view of the open file information. Add the ability for root to view the list of smb3 open files and dump the persistent handle and other info so that it can be more easily correlated with server logs. Sample output from "cat /proc/fs/cifs/open_files" # Version:1 # Format: # 0x5 0x800000378 0x8000 1 7704 0 some-file 0x14 0xcb903c0c 0x84412e67 0x8000 1 7754 1001 rofile 0x1a6d 0xcb903c0c 0x9526b767 0x8000 1 7720 1000 file 0x1a5b 0xcb903c0c 0x9ce41a21 0x8000 1 7715 0 smallfile 0xd67 Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg commit 926674de6705f0f1dbf29a62fd758d0977f535d6 Author: Steve French Date: Sun Oct 28 13:13:23 2018 -0500 smb3: on kerberos mount if server doesn't specify auth type use krb5 Some servers (e.g. Azure) do not include a spnego blob in the SMB3 negotiate protocol response, so on kerberos mounts ("sec=krb5") we can fail, as we expected the server to list its supported auth types (OIDs in the spnego blob in the negprot response). Change this so that on krb5 mounts we default to trying krb5 if the server doesn't list its supported protocol mechanisms. Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg CC: Stable commit f8af49dd1702118e9520f946ce1cf591d553608f Author: Steve French Date: Sun Oct 28 00:47:11 2018 -0500 smb3: add trace point for tree connection In debugging certain scenarios, especially reconnect cases, it can be helpful to have a dynamic trace point for the result of tree connect. See sample output below from a reconnect event. The new event is 'smb3_tcon' TASK-PID CPU# |||| TIMESTAMP FUNCTION | | | |||| | | cifsd-6071 [001] .... 2659.897923: smb3_reconnect: server=localhost current_mid=0xa kworker/1:1-71 [001] .... 2666.026342: smb3_cmd_done: sid=0x0 tid=0x0 cmd=0 mid=0 kworker/1:1-71 [001] .... 2666.026576: smb3_cmd_err: sid=0xc49e1787 tid=0x0 cmd=1 mid=1 status=0xc0000016 rc=-5 kworker/1:1-71 [001] .... 2666.031677: smb3_cmd_done: sid=0xc49e1787 tid=0x0 cmd=1 mid=2 kworker/1:1-71 [001] .... 2666.031921: smb3_cmd_done: sid=0xc49e1787 tid=0x6e78f05f cmd=3 mid=3 kworker/1:1-71 [001] .... 2666.031923: smb3_tcon: xid=0 sid=0xc49e1787 tid=0x0 unc_name=\\localhost\test rc=0 kworker/1:1-71 [001] .... 2666.032097: smb3_cmd_done: sid=0xc49e1787 tid=0x6e78f05f cmd=11 mid=4 kworker/1:1-71 [001] .... 2666.032265: smb3_cmd_done: sid=0xc49e1787 tid=0x7912332f cmd=3 mid=5 kworker/1:1-71 [001] .... 2666.032266: smb3_tcon: xid=0 sid=0xc49e1787 tid=0x0 unc_name=\\localhost\IPC$ rc=0 kworker/1:1-71 [001] .... 2666.032386: smb3_cmd_done: sid=0xc49e1787 tid=0x7912332f cmd=11 mid=6 Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg commit 413d61008131c8ea22312164ba498075ce2fccc8 Author: Colin Ian King Date: Fri Oct 26 19:07:21 2018 +0100 cifs: fix spelling mistake, EACCESS -> EACCES Trivial fix to a spelling mistake of the error access name EACCESS, rename to EACCES Signed-off-by: Colin Ian King Signed-off-by: Steve French commit 0c5d6cb6643f48ad3775322f3ebab6c7eb67484e Author: Ronnie Sahlberg Date: Thu Oct 25 15:43:36 2018 +1000 cifs: fix return value for cifs_listxattr If the application buffer was too small to fit all the names we would still count the number of bytes and return this for listxattr. This would then trigger a BUG in usercopy.c Fix the computation of the size so that we return -ERANGE correctly when the buffer is too small. This fixes the kernel BUG for xfstest generic/377 Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French Reviewed-by: Aurelien Aptel commit ab1e77c3f590536b2659c097980efe6e8f713921 Author: Guo Ren Date: Sat Nov 3 00:51:31 2018 +0800 dt-bindings: timer: gx6605s SOC timer Dt-bindings doc for gx6605s SOC's system timer. Signed-off-by: Guo Ren Reviewed-by: Rob Herring Signed-off-by: Daniel Lezcano commit 33745c3cc588d9d5e18d6fd88709002158dddd5e Author: Guo Ren Date: Sat Nov 3 00:51:30 2018 +0800 clocksource/drivers/c-sky: Add gx6605s SOC system timer The driver is for gx6605s SOC system timer and there are two same timers in gx6605s. We use one for clkevt and another one for clksrc. The timer is mmio map to access, so we need give mmio address in dts. The counter at 0x0 offset is clock event. The counter at 0x40 offset is clock source. Signed-off-by: Guo Ren Cc: Daniel Lezcano Cc: Thomas Gleixner Signed-off-by: Daniel Lezcano commit 732e5dca374d764bd9711c8c121b0e18ff92985e Author: Guo Ren Date: Sat Nov 3 00:51:29 2018 +0800 dt-bindings: timer: C-SKY Multi-processor timer Dt-bingdings doc for C-SKY SMP system setting. Signed-off-by: Guo Ren Reviewed-by: Rob Herring Signed-off-by: Daniel Lezcano commit a7ad38b0dd3c1ba8d6e5a55241e875e9db8331ab Author: Guo Ren Date: Sat Nov 3 00:51:28 2018 +0800 clocksource/drivers/c-sky: Add C-SKY SMP timer The driver is for C-SKY SMP timer. It only supports oneshot event and 32bit overflow for clocksource. Per cpu core has one timer and all timers share one clock-counter-input from the same clocksource. This use mfcr&mtcr instructions to access the regs. Signed-off-by: Guo Ren Cc: Daniel Lezcano Cc: Thomas Gleixner Signed-off-by: Daniel Lezcano commit 513eb98595522bc0cb83831a9daee1d5738e66f1 Author: Linus Walleij Date: Fri Oct 19 11:24:26 2018 +0200 ARM: defconfig: Update multi_v7 to use PREEMPT Using CONFIG_PREEMPT as preemption model for ARMv7 systems appear to be the most reasonable default. Signed-off-by: Linus Walleij Signed-off-by: Olof Johansson commit 7f3d08f5255b964827214e69967b4d5008d6ea18 Author: John Garry Date: Fri Oct 19 00:17:07 2018 +0800 arm64: defconfig: Enable some IPMI configs The arm64 port now runs on servers which use IPMI. This patch enables relevant core configs to save manually enabling them when testing mainline. Signed-off-by: John Garry [olof: Switched to =m instead of =y] Signed-off-by: Olof Johansson commit f62717551b2b7d72fc2a3975539117d350bad84d Author: Christoph Hellwig Date: Tue Oct 30 09:41:29 2018 +0200 arm64: fix warnings without CONFIG_IOMMU_DMA __swiotlb_get_sgtable_page and __swiotlb_mmap_pfn are not only misnamed but also only used if CONFIG_IOMMU_DMA is set. Just add a simple ifdef for now, given that we plan to remove them entirely for the next merge window. Reported-by: Florian Fainelli Signed-off-by: Christoph Hellwig Tested-by: Will Deacon Acked-by: Catalin Marinas commit 5f21585384a4a69b8bfdd2cae7e3648ae805f57d Merge: fcc37f76a995 9fe5c59ff6a1 Author: Linus Torvalds Date: Fri Nov 2 11:25:48 2018 -0700 Merge tag 'for-linus-20181102' of git://git.kernel.dk/linux-block Pull block layer fixes from Jens Axboe: "The biggest part of this pull request is the revert of the blkcg cleanup series. It had one fix earlier for a stacked device issue, but another one was reported. Rather than play whack-a-mole with this, revert the entire series and try again for the next kernel release. Apart from that, only small fixes/changes. Summary: - Indentation fixup for mtip32xx (Colin Ian King) - The blkcg cleanup series revert (Dennis Zhou) - Two NVMe fixes. One fixing a regression in the nvme request initialization in this merge window, causing nvme-fc to not work. The other is a suspend/resume p2p resource issue (James, Keith) - Fix sg discard merge, allowing us to merge in cases where we didn't before (Jianchao Wang) - Call rq_qos_exit() after the queue is frozen, preventing a hang (Ming) - Fix brd queue setup, fixing an oops if we fail setting up all devices (Ming)" * tag 'for-linus-20181102' of git://git.kernel.dk/linux-block: nvme-pci: fix conflicting p2p resource adds nvme-fc: fix request private initialization blkcg: revert blkcg cleanups series block: brd: associate with queue until adding disk block: call rq_qos_exit() after queue is frozen mtip32xx: clean an indentation issue, remove extraneous tabs block: fix the DISCARD request merge commit fcc37f76a995cc08546b88b83f9bb5da11307a0b Merge: 0b21f21ae0d7 2153bbc12f77 Author: Linus Torvalds Date: Fri Nov 2 11:22:45 2018 -0700 Merge tag 'pwm/for-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm Pull pwm updates from Thierry Reding: "This series contains a number of improvements to existing drivers, such as LPSS. Some drivers, such as renesas-tpu and rcar get support for more SoC generations. To round things off this fixes an issue with the sysfs interface" * tag 'pwm/for-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm: pwm: lpss: Only set update bit if we are actually changing the settings pwm: lpss: Force runtime-resume on suspend on Cherry Trail pwm: Enable TI ECAP driver for ARCH_K3 dt-bindings: pwm: tiecap: Add TI AM654 SoC specific compatible dt-bindings: pwm: rcar: Add r8a774a1 support pwm: Send a uevent on the pwmchip device upon channel sysfs (un)export Revert "pwm: Set class for exported channels in sysfs" dt-bindings: pwm: renesas-tpu: Document r8a7744 support dt-bindings: pwm: rcar: Add r8a7744 support dt-bindings: pwm: renesas: tpu: Document R8A779{7|8}0 bindings dt-bindings: pwm: renesas: pwm-rcar: Document R8A779{7|8}0 bindings dt-bindings: pwm: renesas: tpu: Fix "compatible" prop description pwm: Use SPDX identifier for Renesas drivers pwm: lpss: Add get_state callback pwm: lpss: Release runtime-pm reference from the driver's remove callback pwm: lpss: Check PWM powerstate after resume on Cherry Trail devices pwm: lpss: Move struct pwm_lpss_chip definition to the header file pwm: lpss: Add ACPI HID for second PWM controller on Cherry Trail devices ACPI / PM: Export acpi_device_get_power() for use by modular build drivers pwm: tegra: Remove gratuituous blank line commit 832ad0e3da4510fd17f98804abe512ea9a747035 Author: Marc Zyngier Date: Wed Oct 31 08:41:34 2018 +0000 soc: ti: QMSS: Fix usage of irq_set_affinity_hint The Keystone QMSS driver is pretty damaged, in the sense that it does things like this: irq_set_affinity_hint(irq, to_cpumask(&cpu_map)); where cpu_map is a local variable. As we leave the function, this will point to nowhere-land, and things will end-up badly. Instead, let's use a proper cpumask that gets allocated, giving the driver a chance to actually work with things like irqbalance as well as have a hypothetical 64bit future. Cc: stable@vger.kernel.org Acked-by: Santosh Shilimkar Signed-off-by: Marc Zyngier Signed-off-by: Olof Johansson commit 0b21f21ae0d746b385a827aceb84cb26c551eb94 Merge: 54480aa7fac3 a324e9396ca3 Author: Linus Torvalds Date: Fri Nov 2 11:17:22 2018 -0700 Merge tag 'edac_for_4.20_2' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp Pull more EDAC updates from Borislav Petkov: "The second part of the EDAC pile which contains the ADXL user and a build fix which addresses a not-so-sensical .config but fixes randconfig builds people do: - skx_edac: Address translation for NVDIMMs (Tony Luck and Qiuxu Zhuo) - ACPI_ADXL build fix" [ I don't think "sensical" is a word, particularly when used in the context of actually meaning "nonsensical", but I like it - Linus ] * tag 'edac_for_4.20_2' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp: EDAC, skx: Fix randconfig builds EDAC, skx_edac: Add address translation for non-volatile DIMMs commit 966866892cf89d606544bca22d584ba2ef9ec208 Author: Anders Roxell Date: Tue Oct 30 12:38:50 2018 +0100 arm64: kprobe: make page to RO mode when allocate it Commit 1404d6f13e47 ("arm64: dump: Add checking for writable and exectuable pages") has successfully identified code that leaves a page with W+X permissions. [ 3.245140] arm64/mm: Found insecure W+X mapping at address (____ptrval____)/0xffff000000d90000 [ 3.245771] WARNING: CPU: 0 PID: 1 at ../arch/arm64/mm/dump.c:232 note_page+0x410/0x420 [ 3.246141] Modules linked in: [ 3.246653] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.19.0-rc5-next-20180928-00001-ge70ae259b853-dirty #62 [ 3.247008] Hardware name: linux,dummy-virt (DT) [ 3.247347] pstate: 80000005 (Nzcv daif -PAN -UAO) [ 3.247623] pc : note_page+0x410/0x420 [ 3.247898] lr : note_page+0x410/0x420 [ 3.248071] sp : ffff00000804bcd0 [ 3.248254] x29: ffff00000804bcd0 x28: ffff000009274000 [ 3.248578] x27: ffff00000921a000 x26: ffff80007dfff000 [ 3.248845] x25: ffff0000093f5000 x24: ffff000009526f6a [ 3.249109] x23: 0000000000000004 x22: ffff000000d91000 [ 3.249396] x21: ffff000000d90000 x20: 0000000000000000 [ 3.249661] x19: ffff00000804bde8 x18: 0000000000000400 [ 3.249924] x17: 0000000000000000 x16: 0000000000000000 [ 3.250271] x15: ffffffffffffffff x14: 295f5f5f5f6c6176 [ 3.250594] x13: 7274705f5f5f5f28 x12: 2073736572646461 [ 3.250941] x11: 20746120676e6970 x10: 70616d20582b5720 [ 3.251252] x9 : 6572756365736e69 x8 : 3039643030303030 [ 3.251519] x7 : 306666666678302f x6 : ffff0000095467b2 [ 3.251802] x5 : 0000000000000000 x4 : 0000000000000000 [ 3.252060] x3 : 0000000000000000 x2 : ffffffffffffffff [ 3.252323] x1 : 4d151327adc50b00 x0 : 0000000000000000 [ 3.252664] Call trace: [ 3.252953] note_page+0x410/0x420 [ 3.253186] walk_pgd+0x12c/0x238 [ 3.253417] ptdump_check_wx+0x68/0xf8 [ 3.253637] mark_rodata_ro+0x68/0x98 [ 3.253847] kernel_init+0x38/0x160 [ 3.254103] ret_from_fork+0x10/0x18 kprobes allocates a writable executable page with module_alloc() in order to store executable code. Reworked to that when allocate a page it sets mode RO. Inspired by commit 63fef14fc98a ("kprobes/x86: Make insn buffer always ROX and use text_poke()"). Suggested-by: Arnd Bergmann Suggested-by: Ard Biesheuvel Acked-by: Will Deacon Acked-by: Masami Hiramatsu Reviewed-by: Laura Abbott Signed-off-by: Anders Roxell [catalin.marinas@arm.com: removed unnecessary casts] Signed-off-by: Catalin Marinas commit 54480aa7fac324c1c50519e69287cf49aa2f3afc Merge: bc6080ae38b3 826b5de90c0b Author: Linus Torvalds Date: Fri Nov 2 11:02:52 2018 -0700 Merge tag 'sound-fix-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A few device-specific fixes: a fix for SPDIF on old Creative PCI board, and two additional fixes for the recent changes in FireWire audio stack" * tag 'sound-fix-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: firewire-lib: fix insufficient PCM rule for period/buffer size ALSA: ca0106: Disable IZD on SB0570 DAC to fix audio pops ALSA: dice: fix to wait for releases of all ALSA character devices commit bc6080ae38b3b0c6e8166f8561e993298095f7be Merge: d81f50bd3464 f9885ef875e9 Author: Linus Torvalds Date: Fri Nov 2 10:58:20 2018 -0700 Merge tag 'drm-next-2018-11-02' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Pretty much a normal fixes pull pre-rc1, mostly amdgpu fixes, one i915 link training regression fix, and a couple of minor panel/bridge fixes and a panel quirk" * tag 'drm-next-2018-11-02' of git://anongit.freedesktop.org/drm/drm: (37 commits) drm/amdgpu: revert "enable gfxoff in non-sriov and stutter mode by default" drm/amd/pp: Print warning if od_sclk/mclk out of range drm/amd/pp: Fix pp_sclk/mclk_od not work on Vega10 drm/amd/pp: Fix pp_sclk/mclk_od not work on smu7 drm/amd/powerplay: no MGPU fan boost enablement on DPM disabled drm/amdgpu: Fix skipping hangged job reset during gpu recover. drm/amd/powerplay: revise Vega20 pptable version check drm/amd/display: set backlight level limit to 1 drm/panel: simple: Innolux TV123WAM is actually P120ZDG-BF1 dt-bindings: drm/panel: simple: Innolux TV123WAM is actually P120ZDG-BF1 drm/bridge: ti-sn65dsi86: Remove the mystery delay drm/panel: simple: Add "no-hpd" delay for Innolux TV123WAM drm/panel: simple: Support panels with HPD where HPD isn't connected dt-bindings: drm/panel: simple: Add no-hpd property drm/edid: Add 6 bpc quirk for BOE panel. drm/amdgpu: fix reporting of failed msg sent to SMU (v2) drm/amdgpu: Fix compute ring 1.0.0 failure after reset drm/amdgpu: fix VM leaf walking drm/amdgpu: fix amdgpu_vm_fini drm/amd/powerplay: commonize the API for retrieving current clocks ... commit 5900e02b5b8cac1792c790ac2c6adb695d530fda Author: Yangtao Li Date: Fri Nov 2 08:36:19 2018 -0400 arm64: kdump: fix small typo This brings the kernel doc in line with the function signature. Signed-off-by: Yangtao Li Signed-off-by: Catalin Marinas commit 98356eb0ae499c63e78073ccedd9a5fc5c563288 Author: Victor Kamensky Date: Tue Oct 30 16:37:10 2018 -0700 arm64: makefile fix build of .i file in external module case After 'a66649dab350 arm64: fix vdso-offsets.h dependency' if one will try to build .i file in case of external kernel module, build fails complaining that prepare0 target is missing. This issue came up with SystemTap when it tries to build variety of .i files for its own generated kernel modules trying to figure given kernel features/capabilities. The issue is that prepare0 is defined in top level Makefile only if KBUILD_EXTMOD is not defined. .i file rule depends on prepare and in case KBUILD_EXTMOD defined top level Makefile contains empty rule for prepare. But after mentioned commit arch/arm64/Makefile would introduce dependency on prepare0 through its own prepare target. Fix it to put proper ifdef KBUILD_EXTMOD around code introduced by mentioned commit. It matches what top level Makefile does. Acked-by: Kevin Brodsky Signed-off-by: Victor Kamensky Signed-off-by: Catalin Marinas commit d81f50bd34646d8373b989e55180c0fc9af94e0b Merge: c2aa1a444cab 566f52ece7bd Author: Linus Torvalds Date: Fri Nov 2 10:04:26 2018 -0700 Merge tag 'apparmor-pr-2018-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor Pull apparmor updates from John Johansen: "Features/Improvements: - replace spin_is_locked() with lockdep - add base support for secmark labeling and matching Cleanups: - clean an indentation issue, remove extraneous space - remove no-op permission check in policy_unpack - fix checkpatch missing spaces error in Parse secmark policy - fix network performance issue in aa_label_sk_perm Bug fixes: - add #ifdef checks for secmark filtering - fix an error code in __aa_create_ns() - don't try to replace stale label in ptrace checks - fix failure to audit context info in build_change_hat - check buffer bounds when mapping permissions mask - fully initialize aa_perms struct when answering userspace query - fix uninitialized value in aa_split_fqname" * tag 'apparmor-pr-2018-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor: apparmor: clean an indentation issue, remove extraneous space apparmor: fix checkpatch error in Parse secmark policy apparmor: add #ifdef checks for secmark filtering apparmor: Fix uninitialized value in aa_split_fqname apparmor: don't try to replace stale label in ptraceme check apparmor: Replace spin_is_locked() with lockdep apparmor: Allow filtering based on secmark policy apparmor: Parse secmark policy apparmor: Add a wildcard secid apparmor: don't try to replace stale label in ptrace access check apparmor: Fix network performance issue in aa_label_sk_perm commit c2aa1a444cab2c673650ada80a7dffc4345ce2e6 Merge: b69f9e17a57a bf4a1fcf0bc1 Author: Linus Torvalds Date: Fri Nov 2 09:33:08 2018 -0700 Merge tag 'xfs-4.20-merge-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull vfs dedup fixes from Dave Chinner: "This reworks the vfs data cloning infrastructure. We discovered many issues with these interfaces late in the 4.19 cycle - the worst of them (data corruption, setuid stripping) were fixed for XFS in 4.19-rc8, but a larger rework of the infrastructure fixing all the problems was needed. That rework is the contents of this pull request. Rework the vfs_clone_file_range and vfs_dedupe_file_range infrastructure to use a common .remap_file_range method and supply generic bounds and sanity checking functions that are shared with the data write path. The current VFS infrastructure has problems with rlimit, LFS file sizes, file time stamps, maximum filesystem file sizes, stripping setuid bits, etc and so they are addressed in these commits. We also introduce the ability for the ->remap_file_range methods to return short clones so that clones for vfs_copy_file_range() don't get rejected if the entire range can't be cloned. It also allows filesystems to sliently skip deduplication of partial EOF blocks if they are not capable of doing so without requiring errors to be thrown to userspace. Existing filesystems are converted to user the new remap_file_range method, and both XFS and ocfs2 are modified to make use of the new generic checking infrastructure" * tag 'xfs-4.20-merge-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (28 commits) xfs: remove [cm]time update from reflink calls xfs: remove xfs_reflink_remap_range xfs: remove redundant remap partial EOF block checks xfs: support returning partial reflink results xfs: clean up xfs_reflink_remap_blocks call site xfs: fix pagecache truncation prior to reflink ocfs2: remove ocfs2_reflink_remap_range ocfs2: support partial clone range and dedupe range ocfs2: fix pagecache truncation prior to reflink ocfs2: truncate page cache for clone destination file before remapping vfs: clean up generic_remap_file_range_prep return value vfs: hide file range comparison function vfs: enable remap callers that can handle short operations vfs: plumb remap flags through the vfs dedupe functions vfs: plumb remap flags through the vfs clone functions vfs: make remap_file_range functions take and return bytes completed vfs: remap helper should update destination inode metadata vfs: pass remap flags to generic_remap_checks vfs: pass remap flags to generic_remap_file_range_prep vfs: combine the clone and dedupe into a single remap_file_range ... commit b69f9e17a57a50bc34d88975afce4425086e525d Merge: 63c6e188f639 1936f094e164 Author: Linus Torvalds Date: Fri Nov 2 09:19:35 2018 -0700 Merge tag 'powerpc-4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "Some things that I missed due to travel, or that came in late. Two fixes also going to stable: - A revert of a buggy change to the 8xx TLB miss handlers. - Our flushing of SPE (Signal Processing Engine) registers on fork was broken. Other changes: - A change to the KVM decrementer emulation to use proper APIs. - Some cleanups to the way we do code patching in the 8xx code. - Expose the maximum possible memory for the system in /proc/powerpc/lparcfg. - Merge some updates from Scott: "a couple device tree updates, and a fix for a missing prototype warning" A few other minor fixes and a handful of fixes for our selftests. Thanks to: Aravinda Prasad, Breno Leitao, Camelia Groza, Christophe Leroy, Felipe Rechia, Joel Stanley, Naveen N. Rao, Paul Mackerras, Scott Wood, Tyrel Datwyler" * tag 'powerpc-4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (21 commits) selftests/powerpc: Fix compilation issue due to asm label selftests/powerpc/cache_shape: Fix out-of-tree build selftests/powerpc/switch_endian: Fix out-of-tree build selftests/powerpc/pmu: Link ebb tests with -no-pie selftests/powerpc/signal: Fix out-of-tree build selftests/powerpc/ptrace: Fix out-of-tree build powerpc/xmon: Relax frame size for clang selftests: powerpc: Fix warning for security subdir selftests/powerpc: Relax L1d miss targets for rfi_flush test powerpc/process: Fix flush_all_to_thread for SPE powerpc/pseries: add missing cpumask.h include file selftests/powerpc: Fix ptrace tm failure KVM: PPC: Use exported tb_to_ns() function in decrementer emulation powerpc/pseries: Export maximum memory value powerpc/8xx: Use patch_site for perf counters setup powerpc/8xx: Use patch_site for memory setup patching powerpc/code-patching: Add a helper to get the address of a patch_site Revert "powerpc/8xx: Use L1 entry APG to handle _PAGE_ACCESSED for CONFIG_SWAP" powerpc/8xx: add missing header in 8xx_mmu.c powerpc/8xx: Add DT node for using the SEC engine of the MPC885 ... commit f9005571701920551bcf54a500973fb61f2e1eda Author: Stefano Stabellini Date: Wed Oct 31 16:11:49 2018 -0700 CONFIG_XEN_PV breaks xen_create_contiguous_region on ARM xen_create_contiguous_region has now only an implementation if CONFIG_XEN_PV is defined. However, on ARM we never set CONFIG_XEN_PV but we do have an implementation of xen_create_contiguous_region which is required for swiotlb-xen to work correctly (although it just sets *dma_handle). Cc: # 4.12 Fixes: 16624390816c ("xen: create xen_create/destroy_contiguous_region() stubs for PVHVM only builds") Signed-off-by: Stefano Stabellini Reviewed-by: Juergen Gross CC: Jeff.Kubascik@dornerworks.com CC: Jarvis.Roach@dornerworks.com CC: Nathan.Studer@dornerworks.com CC: vkuznets@redhat.com CC: boris.ostrovsky@oracle.com CC: jgross@suse.com CC: julien.grall@arm.com Signed-off-by: Juergen Gross commit 63c6e188f639b5828bf744e675270bb5e2adc139 Merge: 8adcc59974b8 ba1f0d955769 Author: Linus Torvalds Date: Fri Nov 2 09:17:39 2018 -0700 Merge tag 'riscv-for-linus-4.20-mw3' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux Pull RISC-V defconfig update from Palmer Dabbelt: "Sorry for the last minute patches, but it was suggested we try to push this in before rc1 to make it easier for people to keep their branch rebases sane" * tag 'riscv-for-linus-4.20-mw3' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux: RISC-V: refresh defconfig commit 9fe5c59ff6a1e5e26a39b75489a1420e7eaaf0b1 Author: Keith Busch Date: Wed Oct 31 13:15:29 2018 -0600 nvme-pci: fix conflicting p2p resource adds The nvme pci driver had been adding its CMB resource to the P2P DMA subsystem everytime on on a controller reset. This results in the following warning: ------------[ cut here ]------------ nvme 0000:00:03.0: Conflicting mapping in same section WARNING: CPU: 7 PID: 81 at kernel/memremap.c:155 devm_memremap_pages+0xa6/0x380 ... Call Trace: pci_p2pdma_add_resource+0x153/0x370 nvme_reset_work+0x28c/0x17b1 [nvme] ? add_timer+0x107/0x1e0 ? dequeue_entity+0x81/0x660 ? dequeue_entity+0x3b0/0x660 ? pick_next_task_fair+0xaf/0x610 ? __switch_to+0xbc/0x410 process_one_work+0x1cf/0x350 worker_thread+0x215/0x3d0 ? process_one_work+0x350/0x350 kthread+0x107/0x120 ? kthread_park+0x80/0x80 ret_from_fork+0x1f/0x30 ---[ end trace f7ea76ac6ee72727 ]--- nvme nvme0: failed to register the CMB This patch fixes this by registering the CMB with P2P only once. Signed-off-by: Keith Busch Reviewed-by: Logan Gunthorpe Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit d19b8bc82fc232d17ec45ca148388e4ba05ac4b9 Author: James Smart Date: Sat Oct 27 12:41:54 2018 -0700 nvme-fc: fix request private initialization The patch made to avoid Coverity reporting of out of bounds access on aen_op moved the assignment of a pointer, leaving it null when it was subsequently used to calculate a private pointer. Thus the private pointer was bad. Move/correct the private pointer initialization to be in sync with the patch. Fixes: 0d2bdf9f4134 ("nvme-fc: rework the request initialization code") Signed-off-by: James Smart Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 995167420797c000bff1f0787ab2390ffa1a9784 Author: Masahiro Yamada Date: Tue Oct 30 22:26:34 2018 +0900 kbuild: remove cc-name variable There is one more user of $(cc-name) in the top Makefile. It is supposed to detect Clang before invoking Kconfig, so it should still be there in the $(shell ...) form. All the other users of $(cc-name) have been replaced with $(CONFIG_CC_IS_CLANG). Hence, scripts/Kbuild.include does not need to define cc-name any more. Signed-off-by: Masahiro Yamada commit 076f421da5d4594d0a3e60c032ccf02ba55e868a Author: Masahiro Yamada Date: Tue Oct 30 22:26:33 2018 +0900 kbuild: replace cc-name test with CONFIG_CC_IS_CLANG Evaluating cc-name invokes the compiler every time even when you are not compiling anything, like 'make help'. This is not efficient. The compiler type has been already detected in the Kconfig stage. Use CONFIG_CC_IS_CLANG, instead. Signed-off-by: Masahiro Yamada Acked-by: Michael Ellerman (powerpc) Acked-by: Paul Burton (MIPS) Acked-by: Joel Stanley commit dafb7f9aef2fd44991ff1691721ff765a23be27b Author: Mauro Carvalho Chehab Date: Fri Nov 2 06:36:32 2018 -0400 v4l2-controls: add a missing include As warned by "make headers_check", the definition for the linux-specific integer types is missing: ./usr/include/linux/v4l2-controls.h:1105: found __[us]{8,16,32,64} type without #include Fixes: c27bb30e7b6d ("media: v4l: Add definitions for MPEG-2 slice format and metadata") Reported-by: Linus Torvalds Reported-by: Stephen Rothwell Signed-off-by: Mauro Carvalho Chehab commit a541f0ebcc08ed8bc0cc492eec9a86cb280a9f24 Author: Justin M. Forbes Date: Wed Oct 31 13:02:03 2018 -0500 s390/mm: Fix ERROR: "__node_distance" undefined! Fixes: ERROR: "__node_distance" [drivers/nvme/host/nvme-core.ko] undefined! make[1]: *** [scripts/Makefile.modpost:92: __modpost] Error 1 make: *** [Makefile:1275: modules] Error 2 + exit 1 Signed-off-by: Justin M. Forbes Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit 9fed920e6817218ad786c3f28e14b4c877cc2aed Author: Vasily Gorbik Date: Fri Oct 26 15:29:59 2018 +0200 s390/kasan: increase instrumented stack size to 64k Increase kasan instrumented kernel stack size from 32k to 64k. Other architectures seems to get away with just doubling kernel stack size under kasan, but on s390 this appears to be not enough due to bigger frame size. The particular pain point is kasan inlined checks (CONFIG_KASAN_INLINE vs CONFIG_KASAN_OUTLINE). With inlined checks one particular case hitting stack overflow is fs sync on xfs filesystem: #0 [9a0681e8] 704 bytes check_usage at 34b1fc #1 [9a0684a8] 432 bytes check_usage at 34c710 #2 [9a068658] 1048 bytes validate_chain at 35044a #3 [9a068a70] 312 bytes __lock_acquire at 3559fe #4 [9a068ba8] 440 bytes lock_acquire at 3576ee #5 [9a068d60] 104 bytes _raw_spin_lock at 21b44e0 #6 [9a068dc8] 1992 bytes enqueue_entity at 2dbf72 #7 [9a069590] 1496 bytes enqueue_task_fair at 2df5f0 #8 [9a069b68] 64 bytes ttwu_do_activate at 28f438 #9 [9a069ba8] 552 bytes try_to_wake_up at 298c4c #10 [9a069dd0] 168 bytes wake_up_worker at 23f97c #11 [9a069e78] 200 bytes insert_work at 23fc2e #12 [9a069f40] 648 bytes __queue_work at 2487c0 #13 [9a06a1c8] 200 bytes __queue_delayed_work at 24db28 #14 [9a06a290] 248 bytes mod_delayed_work_on at 24de84 #15 [9a06a388] 24 bytes kblockd_mod_delayed_work_on at 153e2a0 #16 [9a06a3a0] 288 bytes __blk_mq_delay_run_hw_queue at 158168c #17 [9a06a4c0] 192 bytes blk_mq_run_hw_queue at 1581a3c #18 [9a06a580] 184 bytes blk_mq_sched_insert_requests at 15a2192 #19 [9a06a638] 1024 bytes blk_mq_flush_plug_list at 1590f3a #20 [9a06aa38] 704 bytes blk_flush_plug_list at 1555028 #21 [9a06acf8] 320 bytes schedule at 219e476 #22 [9a06ae38] 760 bytes schedule_timeout at 21b0aac #23 [9a06b130] 408 bytes wait_for_common at 21a1706 #24 [9a06b2c8] 360 bytes xfs_buf_iowait at fa1540 #25 [9a06b430] 256 bytes __xfs_buf_submit at fadae6 #26 [9a06b530] 264 bytes xfs_buf_read_map at fae3f6 #27 [9a06b638] 656 bytes xfs_trans_read_buf_map at 10ac9a8 #28 [9a06b8c8] 304 bytes xfs_btree_kill_root at e72426 #29 [9a06b9f8] 288 bytes xfs_btree_lookup_get_block at e7bc5e #30 [9a06bb18] 624 bytes xfs_btree_lookup at e7e1a6 #31 [9a06bd88] 2664 bytes xfs_alloc_ag_vextent_near at dfa070 #32 [9a06c7f0] 144 bytes xfs_alloc_ag_vextent at dff3ca #33 [9a06c880] 1128 bytes xfs_alloc_vextent at e05fce #34 [9a06cce8] 584 bytes xfs_bmap_btalloc at e58342 #35 [9a06cf30] 1336 bytes xfs_bmapi_write at e618de #36 [9a06d468] 776 bytes xfs_iomap_write_allocate at ff678e #37 [9a06d770] 720 bytes xfs_map_blocks at f82af8 #38 [9a06da40] 928 bytes xfs_writepage_map at f83cd6 #39 [9a06dde0] 320 bytes xfs_do_writepage at f85872 #40 [9a06df20] 1320 bytes write_cache_pages at 73dfe8 #41 [9a06e448] 208 bytes xfs_vm_writepages at f7f892 #42 [9a06e518] 88 bytes do_writepages at 73fe6a #43 [9a06e570] 872 bytes __writeback_single_inode at a20cb6 #44 [9a06e8d8] 664 bytes writeback_sb_inodes at a23be2 #45 [9a06eb70] 296 bytes __writeback_inodes_wb at a242e0 #46 [9a06ec98] 928 bytes wb_writeback at a2500e #47 [9a06f038] 848 bytes wb_do_writeback at a260ae #48 [9a06f388] 536 bytes wb_workfn at a28228 #49 [9a06f5a0] 1088 bytes process_one_work at 24a234 #50 [9a06f9e0] 1120 bytes worker_thread at 24ba26 #51 [9a06fe40] 104 bytes kthread at 26545a #52 [9a06fea8] kernel_thread_starter at 21b6b62 To be able to increase the stack size to 64k reuse LLILL instruction in __switch_to function to load 64k - STACK_FRAME_OVERHEAD - __PT_SIZE (65192) value as unsigned. Reported-by: Benjamin Block Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik Signed-off-by: Martin Schwidefsky commit c43e1c5a801fdde1aad0a2f9ed948753b5275d56 Author: Thomas Richter Date: Thu Oct 25 09:04:05 2018 +0100 s390/cpum_sf: Rework attribute definition for diagnostic sampling Previously, the attribute entry for diagnostic sampling was added if authorized. Otherwise, the array of struct attribute contains two NULL values. Change this logic and reserve space for the attribute for diagnostic sampling. If diagnostic sampling is authorized, add an entry in the respective position in the array of struct attribute. Signed-off-by: Thomas Richter Reviewed-by: Hendrik Brueckner Suggested-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit e12e4044aede97974f2222eb7f0ed726a5179a32 Author: Martin Schwidefsky Date: Mon Oct 15 11:09:16 2018 +0200 s390/mm: fix mis-accounting of pgtable_bytes In case a fork or a clone system fails in copy_process and the error handling does the mmput() at the bad_fork_cleanup_mm label, the following warning messages will appear on the console: BUG: non-zero pgtables_bytes on freeing mm: 16384 The reason for that is the tricks we play with mm_inc_nr_puds() and mm_inc_nr_pmds() in init_new_context(). A normal 64-bit process has 3 levels of page table, the p4d level and the pud level are folded. On process termination the free_pud_range() function in mm/memory.c will subtract 16KB from pgtable_bytes with a mm_dec_nr_puds() call, but there actually is not really a pud table. One issue with this is the fact that pgtable_bytes is usually off by a few kilobytes, but the more severe problem is that for a failed fork or clone the free_pgtables() function is not called. In this case there is no mm_dec_nr_puds() or mm_dec_nr_pmds() that go together with the mm_inc_nr_puds() and mm_inc_nr_pmds in init_new_context(). The pgtable_bytes will be off by 16384 or 32768 bytes and we get the BUG message. The message itself is purely cosmetic, but annoying. To fix this override the mm_pmd_folded, mm_pud_folded and mm_p4d_folded function to check for the true size of the address space. Reported-by: Li Wang Tested-by: Li Wang Signed-off-by: Martin Schwidefsky commit 6d212db11947ae5464e4717536ed9faf61c01e86 Author: Martin Schwidefsky Date: Mon Oct 15 10:30:23 2018 +0200 mm: add mm_pxd_folded checks to pgtable_bytes accounting functions The common mm code calls mm_dec_nr_pmds() and mm_dec_nr_puds() in free_pgtables() if the address range spans a full pud or pmd. If mm_dec_nr_puds/mm_dec_nr_pmds are non-empty due to configuration settings they blindly subtract the size of the pmd or pud table from pgtable_bytes even if the pud or pmd page table layer is folded. Add explicit mm_[pmd|pud]_folded checks to the four pgtable_bytes accounting functions mm_inc_nr_puds, mm_inc_nr_pmds, mm_dec_nr_puds and mm_dec_nr_pmds. As the check for folded page tables can be overwritten by the architecture, this allows to keep a correct pgtable_bytes value for platforms that use a dynamic number of page table levels. Acked-by: Kirill A. Shutemov Signed-off-by: Martin Schwidefsky commit 1071fc5779d9846fec56a4ff6089ab08cac1ab72 Author: Martin Schwidefsky Date: Mon Oct 15 10:25:57 2018 +0200 mm: introduce mm_[p4d|pud|pmd]_folded Add three architecture overrideable functions to test if the p4d, pud, or pmd layer of a page table is folded or not. Acked-by: Kirill A. Shutemov Signed-off-by: Martin Schwidefsky commit a8874e7e8a8896f2b6c641f4b8e2473eafd35204 Author: Martin Schwidefsky Date: Wed Oct 31 12:11:48 2018 +0100 mm: make the __PAGETABLE_PxD_FOLDED defines non-empty Change the currently empty defines for __PAGETABLE_PMD_FOLDED, __PAGETABLE_PUD_FOLDED and __PAGETABLE_P4D_FOLDED to return 1. This makes it possible to use __is_defined() to test if the preprocessor define exists. Acked-by: Kirill A. Shutemov Signed-off-by: Martin Schwidefsky commit 566f52ece7bd1099d20dfe2f6f0801896643cf8f Author: Colin Ian King Date: Tue Oct 30 14:11:31 2018 +0000 apparmor: clean an indentation issue, remove extraneous space Trivial fix to clean up an indentation issue, remove space Signed-off-by: Colin Ian King Signed-off-by: John Johansen commit 76af016e65e74023a11b2710e18a98b68b86e3cd Author: John Johansen Date: Thu Nov 1 22:28:17 2018 -0700 apparmor: fix checkpatch error in Parse secmark policy Fix missed spacing error reported by checkpatch for 9caafbe2b4cf ("Parse secmark policy") Signed-off-by: John Johansen commit f9885ef875e9160454392f85159163674159c51f Merge: 43e0f873b2f2 f9776280c29e Author: Dave Airlie Date: Fri Nov 2 15:17:56 2018 +1000 Merge tag 'drm-intel-next-fixes-2018-10-25' of git://anongit.freedesktop.org/drm/drm-intel into drm-next - Fix to avoid link retraining workaround on eDP (the other is a comment change) Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20181025131836.GA2296@jlahtine-desk.ger.corp.intel.com commit 8adcc59974b8a65b7eac7d503364837c297139bc Merge: 9931a07d518e 3642b29a6367 Author: Linus Torvalds Date: Thu Nov 1 20:19:49 2018 -0700 Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull misc vfs updates from Al Viro: "No common topic, really - a handful of assorted stuff; the least trivial bits are Mark's dedupe patches" * 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fs/exofs: only use true/false for asignment of bool type variable fs/exofs: fix potential memory leak in mount option parsing Delete invalid assignment statements in do_sendfile iomap: remove duplicated include from iomap.c vfs: dedupe should return EPERM if permission is not granted vfs: allow dedupe of user owned read-only files ntfs: don't open-code ERR_CAST ext4: don't open-code ERR_CAST commit 9931a07d518e86eb58a75e508ed9626f86359303 Merge: e468f5c06b5e 0e9b4a827102 Author: Linus Torvalds Date: Thu Nov 1 19:58:52 2018 -0700 Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull AFS updates from Al Viro: "AFS series, with some iov_iter bits included" * 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (26 commits) missing bits of "iov_iter: Separate type from direction and use accessor functions" afs: Probe multiple fileservers simultaneously afs: Fix callback handling afs: Eliminate the address pointer from the address list cursor afs: Allow dumping of server cursor on operation failure afs: Implement YFS support in the fs client afs: Expand data structure fields to support YFS afs: Get the target vnode in afs_rmdir() and get a callback on it afs: Calc callback expiry in op reply delivery afs: Fix FS.FetchStatus delivery from updating wrong vnode afs: Implement the YFS cache manager service afs: Remove callback details from afs_callback_break struct afs: Commit the status on a new file/dir/symlink afs: Increase to 64-bit volume ID and 96-bit vnode ID for YFS afs: Don't invoke the server to read data beyond EOF afs: Add a couple of tracepoints to log I/O errors afs: Handle EIO from delivery function afs: Fix TTL on VL server and address lists afs: Implement VL server rotation afs: Improve FS server rotation error handling ... commit 43e0f873b2f2226f454930172f8090819d380f5a Merge: 52b50ae1af8a 9d064be1e6a1 Author: Dave Airlie Date: Fri Nov 2 12:56:24 2018 +1000 Merge branch 'drm-next-4.20' of git://people.freedesktop.org/~agd5f/linux into drm-next - Fix flickering at low backlight levels on some systems - Fix some overclocking regressions - Vega20 updates for - GPU recovery fixes - Disable gfxoff on RV as some sbios/fw combinations are not stable yet Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20181101151939.2828-1-alexander.deucher@amd.com commit 52b50ae1af8a9672792c55b23471a3488dec7229 Merge: f2bfc71aee75 8f054b6f53ff Author: Dave Airlie Date: Fri Nov 2 11:53:48 2018 +1000 Merge tag 'drm-misc-next-fixes-2018-10-31' of git://anongit.freedesktop.org/drm/drm-misc into drm-next - Properly label Innolux TV123WAM as P120ZDG-BF1 (Doug) - Add optional delay for panels without hpd hooked up (which solves the mystery delay for TI SN65DSI86 bridge) (Doug) - Another 6bpc quirk for BOE panel 0x0771 (Shawn) Cc: Doug Anderson Cc: Lee, Shawn C Signed-off-by: Dave Airlie From: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20181031201944.GA262020@art_vandelay commit b5f2954d30c77649bce9c27e7a0a94299d9cfdf8 Author: Dennis Zhou Date: Thu Nov 1 17:24:10 2018 -0400 blkcg: revert blkcg cleanups series This reverts a series committed earlier due to null pointer exception bug report in [1]. It seems there are edge case interactions that I did not consider and will need some time to understand what causes the adverse interactions. The original series can be found in [2] with a follow up series in [3]. [1] https://www.spinics.net/lists/cgroups/msg20719.html [2] https://lore.kernel.org/lkml/20180911184137.35897-1-dennisszhou@gmail.com/ [3] https://lore.kernel.org/lkml/20181020185612.51587-1-dennis@kernel.org/ This reverts the following commits: d459d853c2ed, b2c3fa546705, 101246ec02b5, b3b9f24f5fcc, e2b0989954ae, f0fcb3ec89f3, c839e7a03f92, bdc2491708c4, 74b7c02a9bc1, 5bf9a1f3b4ef, a7b39b4e961c, 07b05bcc3213, 49f4c2dc2b50, 27e6fa996c53 Signed-off-by: Dennis Zhou Signed-off-by: Jens Axboe commit 153fcd5f6d93b8e1e4040b1337f564a10f8d93af Author: Ming Lei Date: Fri Nov 2 08:50:51 2018 +0800 block: brd: associate with queue until adding disk brd_free() may be called in failure path on one brd instance which disk isn't added yet, so release handler of gendisk may free the associated request_queue early and causes the following use-after-free[1]. This patch fixes this issue by associating gendisk with request_queue just before adding disk. [1] KASAN: use-after-free Read in del_timer_syncNon-volatile memory driver v1.3 Linux agpgart interface v0.103 [drm] Initialized vgem 1.0.0 20120112 for virtual device on minor 0 usbcore: registered new interface driver udl ================================================================== BUG: KASAN: use-after-free in __lock_acquire+0x36d9/0x4c20 kernel/locking/lockdep.c:3218 Read of size 8 at addr ffff8801d1b6b540 by task swapper/0/1 CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.19.0+ #88 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x244/0x39d lib/dump_stack.c:113 print_address_description.cold.7+0x9/0x1ff mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.8+0x242/0x309 mm/kasan/report.c:412 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 __lock_acquire+0x36d9/0x4c20 kernel/locking/lockdep.c:3218 lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3844 del_timer_sync+0xb7/0x270 kernel/time/timer.c:1283 blk_cleanup_queue+0x413/0x710 block/blk-core.c:809 brd_free+0x5d/0x71 drivers/block/brd.c:422 brd_init+0x2eb/0x393 drivers/block/brd.c:518 do_one_initcall+0x145/0x957 init/main.c:890 do_initcall_level init/main.c:958 [inline] do_initcalls init/main.c:966 [inline] do_basic_setup init/main.c:984 [inline] kernel_init_freeable+0x5c6/0x6b9 init/main.c:1148 kernel_init+0x11/0x1ae init/main.c:1068 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:350 Reported-by: syzbot+3701447012fe951dabb2@syzkaller.appspotmail.com Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit e468f5c06b5ebef3f6f3c187e51aa6daab667e57 Merge: baa888d25ea6 1ff2fea5e30c Author: Linus Torvalds Date: Thu Nov 1 18:34:46 2018 -0700 Merge tag 'compiler-attributes-for-linus-4.20-rc1' of https://github.com/ojeda/linux Pull compiler attribute updates from Miguel Ojeda: "This is an effort to disentangle the include/linux/compiler*.h headers and bring them up to date. The main idea behind the series is to use feature checking macros (i.e. __has_attribute) instead of compiler version checks (e.g. GCC_VERSION), which are compiler-agnostic (so they can be shared, reducing the size of compiler-specific headers) and version-agnostic. Other related improvements have been performed in the headers as well, which on top of the use of __has_attribute it has amounted to a significant simplification of these headers (e.g. GCC_VERSION is now only guarding a few non-attribute macros). This series should also help the efforts to support compiling the kernel with clang and icc. A fair amount of documentation and comments have also been added, clarified or removed; and the headers are now more readable, which should help kernel developers in general. The series was triggered due to the move to gcc >= 4.6. In turn, this series has also triggered Sparse to gain the ability to recognize __has_attribute on its own. Finally, the __nonstring variable attribute series has been also applied on top; plus two related patches from Nick Desaulniers for unreachable() that came a bit afterwards" * tag 'compiler-attributes-for-linus-4.20-rc1' of https://github.com/ojeda/linux: compiler-gcc: remove comment about gcc 4.5 from unreachable() compiler.h: update definition of unreachable() Compiler Attributes: ext4: remove local __nonstring definition Compiler Attributes: auxdisplay: panel: use __nonstring Compiler Attributes: enable -Wstringop-truncation on W=1 (gcc >= 8) Compiler Attributes: add support for __nonstring (gcc >= 8) Compiler Attributes: add MAINTAINERS entry Compiler Attributes: add Doc/process/programming-language.rst Compiler Attributes: remove uses of __attribute__ from compiler.h Compiler Attributes: KENTRY used twice the "used" attribute Compiler Attributes: use feature checks instead of version checks Compiler Attributes: add missing SPDX ID in compiler_types.h Compiler Attributes: remove unneeded sparse (__CHECKER__) tests Compiler Attributes: homogenize __must_be_array Compiler Attributes: remove unneeded tests Compiler Attributes: always use the extra-underscores syntax Compiler Attributes: remove unused attributes commit ba1f0d95576902c10930d3467e638bac38f942f1 Author: Anup Patel Date: Thu Nov 1 10:40:32 2018 +0530 RISC-V: refresh defconfig This patch updates defconfig using savedefconfig on Linux-4.19. It is intended to have no functional change. Signed-off-by: Anup Patel Reviewed-by: Palmer Dabbelt Signed-off-by: Palmer Dabbelt commit baa888d25ea64d0c59344d474284ca99cfdd449a Merge: 7260935d71b6 64ae16dfeefe Author: Linus Torvalds Date: Thu Nov 1 15:23:59 2018 -0700 Merge branch 'next-keys2' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull keys updates from James Morris: "Provide five new operations in the key_type struct that can be used to provide access to asymmetric key operations. These will be implemented for the asymmetric key type in a later patch and may refer to a key retained in RAM by the kernel or a key retained in crypto hardware. int (*asym_query)(const struct kernel_pkey_params *params, struct kernel_pkey_query *info); int (*asym_eds_op)(struct kernel_pkey_params *params, const void *in, void *out); int (*asym_verify_signature)(struct kernel_pkey_params *params, const void *in, const void *in2); Since encrypt, decrypt and sign are identical in their interfaces, they're rolled together in the asym_eds_op() operation and there's an operation ID in the params argument to distinguish them. Verify is different in that we supply the data and the signature instead and get an error value (or 0) as the only result on the expectation that this may well be how a hardware crypto device may work" * 'next-keys2' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (22 commits) KEYS: asym_tpm: Add support for the sign operation [ver #2] KEYS: asym_tpm: Implement tpm_sign [ver #2] KEYS: asym_tpm: Implement signature verification [ver #2] KEYS: asym_tpm: Implement the decrypt operation [ver #2] KEYS: asym_tpm: Implement tpm_unbind [ver #2] KEYS: asym_tpm: Add loadkey2 and flushspecific [ver #2] KEYS: Move trusted.h to include/keys [ver #2] KEYS: trusted: Expose common functionality [ver #2] KEYS: asym_tpm: Implement encryption operation [ver #2] KEYS: asym_tpm: Implement pkey_query [ver #2] KEYS: Add parser for TPM-based keys [ver #2] KEYS: asym_tpm: extract key size & public key [ver #2] KEYS: asym_tpm: add skeleton for asym_tpm [ver #2] crypto: rsa-pkcs1pad: Allow hash to be optional [ver #2] KEYS: Implement PKCS#8 RSA Private Key parser [ver #2] KEYS: Implement encrypt, decrypt and sign for software asymmetric key [ver #2] KEYS: Allow the public_key struct to hold a private key [ver #2] KEYS: Provide software public key query function [ver #2] KEYS: Make the X.509 and PKCS7 parsers supply the sig encoding type [ver #2] KEYS: Provide missing asymmetric key subops for new key type ops [ver #2] ... commit 0e9b4a82710220c04100892fb7277b78fd33a747 Author: Al Viro Date: Thu Nov 1 18:19:03 2018 -0400 missing bits of "iov_iter: Separate type from direction and use accessor functions" sunrpc patches from nfs tree conflict with calling conventions change done in iov_iter work. Trivial fixup... Signed-off-by: Al Viro commit 78a63f1235deb1ab9c0780b332d9cc18270247e2 Merge: 3bf0fb6f33dd 331bc71cb175 Author: Al Viro Date: Thu Nov 1 18:17:23 2018 -0400 Merge tag 'nfs-for-4.20-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs backmerge to do fixup of iov_iter_kvec() conflict commit 7260935d71b6d582376543844185add72848dde8 Merge: 34c7685a177a d47748e5ae5a Author: Linus Torvalds Date: Thu Nov 1 14:48:48 2018 -0700 Merge tag 'ovl-update-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs Pull overlayfs updates from Miklos Szeredi: "A mix of fixes and cleanups" * tag 'ovl-update-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs: ovl: automatically enable redirect_dir on metacopy=on ovl: check whiteout in ovl_create_over_whiteout() ovl: using posix_acl_xattr_size() to get size instead of posix_acl_to_xattr() ovl: abstract ovl_inode lock with a helper ovl: remove the 'locked' argument of ovl_nlink_{start,end} ovl: relax requirement for non null uuid of lower fs ovl: fold copy-up helpers into callers ovl: untangle copy up call chain ovl: relax permission checking on underlying layers ovl: fix recursive oi->lock in ovl_link() vfs: fix FIGETBSZ ioctl on an overlayfs file ovl: clean up error handling in ovl_get_tmpfile() ovl: fix error handling in ovl_verify_set_fh() commit 34c7685a177a7bc98066f7e5daa42eef621d0bdb Merge: b5b1de3537e2 c961cb3be906 Author: Linus Torvalds Date: Thu Nov 1 14:45:38 2018 -0700 Merge tag 'devicetree-fixes-for-4.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull Devicetree fixes from Rob Herring: - fix cpu node iterator for powerpc systems - clarify ARM CPU binding 'capacities-dmips-mhz' property calculations * tag 'devicetree-fixes-for-4.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: of: Fix cpu node iterator to not ignore disabled cpu nodes dt-bindings: arm: Explain capacities-dmips-mhz calculations in example commit b5b1de3537e2cd8f52971224a1be24bb3ce34a65 Merge: 90de1fb83e7c 79f800b2e769 Author: Linus Torvalds Date: Thu Nov 1 14:42:49 2018 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio/vhost updates from Michael Tsirkin: "Fixes and tweaks: - virtio balloon page hinting support - vhost scsi control queue - misc fixes" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: MAINTAINERS: remove reference to bogus vsock file vhost/scsi: Use common handling code in request queue handler vhost/scsi: Extract common handling code from control queue handler vhost/scsi: Respond to control queue operations vhost/scsi: truncate T10 PI iov_iter to prot_bytes virtio-balloon: VIRTIO_BALLOON_F_PAGE_POISON mm/page_poison: expose page_poisoning_enabled to kernel modules virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT kvm_config: add CONFIG_VIRTIO_MENU commit 90de1fb83e7c760aa403381f072486fc4e3e8b5f Merge: 2d6bb6adb714 960b82c383d3 Author: Linus Torvalds Date: Thu Nov 1 14:32:43 2018 -0700 Merge tag 'xtensa-20181101' of git://github.com/jcmvbkbc/linux-xtensa Pull Xtensa fixes and cleanups from Max Filippov: - use ZONE_NORMAL instead of ZONE_DMA - fix Image.elf build error caused by assignment of incorrect address to the .note.Linux section - clean up debug and property sections in the vmlinux.lds.S * tag 'xtensa-20181101' of git://github.com/jcmvbkbc/linux-xtensa: xtensa: clean up xtensa-specific property sections xtensa: use DWARF_DEBUG in the vmlinux.lds.S xtensa: add NOTES section to the linker script xtensa: remove ZONE_DMA commit c961cb3be9064d1097ccc019390f8b5739daafc6 Author: Rob Herring Date: Wed Oct 31 09:28:06 2018 -0500 of: Fix cpu node iterator to not ignore disabled cpu nodes In most cases, nodes with 'status = "disabled";' are treated as if the node is not present though it is a common bug to forget to check that. However, cpu nodes are different in that "disabled" simply means offline and the OS can bring the CPU core online. Commit f1f207e43b8a ("of: Add cpu node iterator for_each_of_cpu_node()") followed the common behavior of ignoring disabled cpu nodes. This breaks some powerpc systems (at least NXP P50XX/e5500). Fix this by dropping the status check. Fixes: 651d44f9679c ("of: use for_each_of_cpu_node iterator") Fixes: f1f207e43b8a ("of: Add cpu node iterator for_each_of_cpu_node()") Reported-by: Christian Zigotzky Tested-by: Michael Ellerman Cc: Frank Rowand Signed-off-by: Rob Herring commit 7de414a9dd91426318df7b63da024b2b07e53df5 Author: Cong Wang Date: Thu Nov 1 12:02:37 2018 -0700 net: drop skb on failure in ip_check_defrag() Most callers of pskb_trim_rcsum() simply drop the skb when it fails, however, ip_check_defrag() still continues to pass the skb up to stack. This is suspicious. In ip_check_defrag(), after we learn the skb is an IP fragment, passing the skb to callers makes no sense, because callers expect fragments are defrag'ed on success. So, dropping the skb when we can't defrag it is reasonable. Note, prior to commit 88078d98d1bb, this is not a big problem as checksum will be fixed up anyway. After it, the checksum is not correct on failure. Found this during code review. Fixes: 88078d98d1bb ("net: pskb_trim_rcsum() and CHECKSUM_COMPLETE are friends") Cc: Eric Dumazet Signed-off-by: Cong Wang Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit d47748e5ae5af6572e520cc9767bbe70c22ea498 Author: Miklos Szeredi Date: Thu Nov 1 21:31:39 2018 +0100 ovl: automatically enable redirect_dir on metacopy=on Current behavior is to automatically disable metacopy if redirect_dir is not enabled and proceed with the mount. If "metacopy=on" mount option was given, then this behavior can confuse the user: no mount failure, yet metacopy is disabled. This patch makes metacopy=on imply redirect_dir=on. The converse is also true: turning off full redirect with redirect_dir= {off|follow|nofollow} will disable metacopy. If both metacopy=on and redirect_dir={off|follow|nofollow} is specified, then mount will fail, since there's no way to correctly resolve the conflict. Reported-by: Daniel Walsh Fixes: d5791044d2e5 ("ovl: Provide a mount option metacopy=on/off...") Cc: # v4.19 Signed-off-by: Miklos Szeredi commit 2d6bb6adb714b133db92ccd4bfc9c20f75f71f3f Merge: 7c6c54b505b8 6fcde9046673 Author: Linus Torvalds Date: Thu Nov 1 11:46:27 2018 -0700 Merge tag 'stackleak-v4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull stackleak gcc plugin from Kees Cook: "Please pull this new GCC plugin, stackleak, for v4.20-rc1. This plugin was ported from grsecurity by Alexander Popov. It provides efficient stack content poisoning at syscall exit. This creates a defense against at least two classes of flaws: - Uninitialized stack usage. (We continue to work on improving the compiler to do this in other ways: e.g. unconditional zero init was proposed to GCC and Clang, and more plugin work has started too). - Stack content exposure. By greatly reducing the lifetime of valid stack contents, exposures via either direct read bugs or unknown cache side-channels become much more difficult to exploit. This complements the existing buddy and heap poisoning options, but provides the coverage for stacks. The x86 hooks are included in this series (which have been reviewed by Ingo, Dave Hansen, and Thomas Gleixner). The arm64 hooks have already been merged through the arm64 tree (written by Laura Abbott and reviewed by Mark Rutland and Will Deacon). With VLAs having been removed this release, there is no need for alloca() protection, so it has been removed from the plugin" * tag 'stackleak-v4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: arm64: Drop unneeded stackleak_check_alloca() stackleak: Allow runtime disabling of kernel stack erasing doc: self-protection: Add information about STACKLEAK feature fs/proc: Show STACKLEAK metrics in the /proc file system lkdtm: Add a test for STACKLEAK gcc-plugins: Add STACKLEAK plugin for tracking the kernel stack x86/entry: Add STACKLEAK erasing the kernel stack at the end of syscalls commit d3787af289c85381cc048cb8c56b67260dbbc436 Author: Colin Ian King Date: Fri Oct 26 19:10:31 2018 +0100 NFS: fix spelling mistake, EACCESS -> EACCES Trivial fix to a spelling mistake of the error access name EACCESS, rename to EACCES Signed-off-by: Colin Ian King Signed-off-by: Trond Myklebust commit c3be6577d82a9f0163eb1e2c37a477414d12a209 Author: Paul Burton Date: Thu Nov 1 17:51:34 2018 +0000 SUNRPC: Use atomic(64)_t for seq_send(64) The seq_send & seq_send64 fields in struct krb5_ctx are used as atomically incrementing counters. This is implemented using cmpxchg() & cmpxchg64() to implement what amount to custom versions of atomic_fetch_inc() & atomic64_fetch_inc(). Besides the duplication, using cmpxchg64() has another major drawback in that some 32 bit architectures don't provide it. As such commit 571ed1fd2390 ("SUNRPC: Replace krb5_seq_lock with a lockless scheme") resulted in build failures for some architectures. Change seq_send to be an atomic_t and seq_send64 to be an atomic64_t, then use atomic(64)_* functions to manipulate the values. The atomic64_t type & associated functions are provided even on architectures which lack real 64 bit atomic memory access via CONFIG_GENERIC_ATOMIC64 which uses spinlocks to serialize access. This fixes the build failures for architectures lacking cmpxchg64(). A potential alternative that was raised would be to provide cmpxchg64() on the 32 bit architectures that currently lack it, using spinlocks. However this would provide a version of cmpxchg64() with semantics a little different to the implementations on architectures with real 64 bit atomics - the spinlock-based implementation would only work if all access to the memory used with cmpxchg64() is *always* performed using cmpxchg64(). That is not currently a requirement for users of cmpxchg64(), and making it one seems questionable. As such avoiding cmpxchg64() outside of architecture-specific code seems best, particularly in cases where atomic64_t seems like a better fit anyway. The CONFIG_GENERIC_ATOMIC64 implementation of atomic64_* functions will use spinlocks & so faces the same issue, but with the key difference that the memory backing an atomic64_t ought to always be accessed via the atomic64_* functions anyway making the issue moot. Signed-off-by: Paul Burton Fixes: 571ed1fd2390 ("SUNRPC: Replace krb5_seq_lock with a lockless scheme") Cc: Trond Myklebust Cc: Anna Schumaker Cc: J. Bruce Fields Cc: Jeff Layton Cc: David S. Miller Cc: linux-nfs@vger.kernel.org Cc: netdev@vger.kernel.org Signed-off-by: Trond Myklebust commit 3c5e3dabf3722a883227623a4adf61976c2224ff Author: Arnaldo Carvalho de Melo Date: Thu Nov 1 13:50:35 2018 -0300 perf trace: When augmenting raw_syscalls plug raw_syscalls:sys_exit too With just this commit we get to support all syscalls via hooking raw_syscalls:sys_{enter,exit} to the trace__sys_{enter,exit} routines to combine, strace-like, those tracepoints. # trace -e tools/perf/examples/bpf/augmented_raw_syscalls.c sleep 1 ? ( ): sleep/31680 ... [continued]: execve()) = 0 0.043 ( 0.004 ms): sleep/31680 brk() = 0x55652a851000 0.070 ( 0.009 ms): sleep/31680 access(filename:, mode: R) = -1 ENOENT No such file or directory 0.087 ( 0.006 ms): sleep/31680 openat(dfd: CWD, filename: , flags: CLOEXEC) = 3 0.096 ( 0.003 ms): sleep/31680 fstat(fd: 3, statbuf: 0x7ffc5269e190) = 0 0.101 ( 0.005 ms): sleep/31680 mmap(len: 103334, prot: READ, flags: PRIVATE, fd: 3) = 0x7f709c239000 0.109 ( 0.002 ms): sleep/31680 close(fd: 3) = 0 0.126 ( 0.006 ms): sleep/31680 openat(dfd: CWD, filename: , flags: CLOEXEC) = 3 0.135 ( 0.003 ms): sleep/31680 read(fd: 3, buf: 0x7ffc5269e358, count: 832) = 832 0.141 ( 0.002 ms): sleep/31680 fstat(fd: 3, statbuf: 0x7ffc5269e1f0) = 0 0.146 ( 0.005 ms): sleep/31680 mmap(len: 8192, prot: READ|WRITE, flags: PRIVATE|ANONYMOUS) = 0x7f709c237000 0.159 ( 0.007 ms): sleep/31680 mmap(len: 3889792, prot: EXEC|READ, flags: PRIVATE|DENYWRITE, fd: 3) = 0x7f709bc79000 0.168 ( 0.009 ms): sleep/31680 mprotect(start: 0x7f709be26000, len: 2093056) = 0 0.179 ( 0.010 ms): sleep/31680 mmap(addr: 0x7f709c025000, len: 24576, prot: READ|WRITE, flags: PRIVATE|FIXED|DENYWRITE, fd: 3, off: 1753088) = 0x7f709c025000 0.196 ( 0.005 ms): sleep/31680 mmap(addr: 0x7f709c02b000, len: 14976, prot: READ|WRITE, flags: PRIVATE|FIXED|ANONYMOUS) = 0x7f709c02b000 0.210 ( 0.002 ms): sleep/31680 close(fd: 3) = 0 0.230 ( 0.002 ms): sleep/31680 arch_prctl(option: 4098, arg2: 140121632638208) = 0 0.306 ( 0.009 ms): sleep/31680 mprotect(start: 0x7f709c025000, len: 16384, prot: READ) = 0 0.338 ( 0.005 ms): sleep/31680 mprotect(start: 0x556529607000, len: 4096, prot: READ) = 0 0.348 ( 0.005 ms): sleep/31680 mprotect(start: 0x7f709c253000, len: 4096, prot: READ) = 0 0.356 ( 0.019 ms): sleep/31680 munmap(addr: 0x7f709c239000, len: 103334) = 0 0.463 ( 0.002 ms): sleep/31680 brk() = 0x55652a851000 0.468 ( 0.004 ms): sleep/31680 brk(brk: 0x55652a872000) = 0x55652a872000 0.474 ( 0.002 ms): sleep/31680 brk() = 0x55652a872000 0.484 ( 0.008 ms): sleep/31680 open(filename: , flags: CLOEXEC) = 3 0.497 ( 0.002 ms): sleep/31680 fstat(fd: 3, statbuf: 0x7f709c02aaa0) = 0 0.501 ( 0.006 ms): sleep/31680 mmap(len: 113045344, prot: READ, flags: PRIVATE, fd: 3) = 0x7f70950aa000 0.514 ( 0.002 ms): sleep/31680 close(fd: 3) = 0 0.554 (1000.140 ms): sleep/31680 nanosleep(rqtp: 0x7ffc5269eed0) = 0 1000.734 ( 0.007 ms): sleep/31680 close(fd: 1) = 0 1000.748 ( 0.004 ms): sleep/31680 close(fd: 2) = 0 1000.769 ( ): sleep/31680 exit_group() # Now to allow selecting which syscalls should be traced, using a map. Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-votqqmqhag8e1i9mgyzfez3o@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit febf8a3712e4209b7e650b37b3b240a2b387794d Author: Arnaldo Carvalho de Melo Date: Thu Nov 1 10:34:34 2018 -0300 perf examples bpf: Start augmenting raw_syscalls:sys_{start,exit} The previous approach of attaching to each syscall showed how it is possible to augment tracepoints and use that augmentation, pointer payloads, in the existing beautifiers in 'perf trace', but for a more general solution we now will try to augment the main raw_syscalls:sys_{enter,exit} syscalls, and then pass instructions in maps so that it knows which syscalls and which pointer contents, and how many bytes for each of the arguments should be copied. Start with just the bare minimum to collect what is provided by those two tracepoints via the __augmented_syscalls__ map + bpf-output perf event, which results in perf trace showing them without connecting enter+exit: # perf trace -e tools/perf/examples/bpf/augmented_raw_syscalls.c sleep 1 0.000 sleep/11563 raw_syscalls:sys_exit:NR 59 = 0 0.019 ( ): sleep/11563 brk() ... 0.021 sleep/11563 raw_syscalls:sys_exit:NR 12 = 94682642325504 0.033 ( ): sleep/11563 access(filename:, mode: R) ... 0.037 sleep/11563 raw_syscalls:sys_exit:NR 21 = -2 0.041 ( ): sleep/11563 openat(dfd: CWD, filename: , flags: CLOEXEC) ... 0.044 sleep/11563 raw_syscalls:sys_exit:NR 257 = 3 0.045 ( ): sleep/11563 fstat(fd: 3, statbuf: 0x7ffdbf7119b0) ... 0.046 sleep/11563 raw_syscalls:sys_exit:NR 5 = 0 0.047 ( ): sleep/11563 mmap(len: 103334, prot: READ, flags: PRIVATE, fd: 3) ... 0.049 sleep/11563 raw_syscalls:sys_exit:NR 9 = 140196285493248 0.050 ( ): sleep/11563 close(fd: 3) ... 0.051 sleep/11563 raw_syscalls:sys_exit:NR 3 = 0 0.059 ( ): sleep/11563 openat(dfd: CWD, filename: , flags: CLOEXEC) ... 0.062 sleep/11563 raw_syscalls:sys_exit:NR 257 = 3 0.063 ( ): sleep/11563 read(fd: 3, buf: 0x7ffdbf711b78, count: 832) ... 0.065 sleep/11563 raw_syscalls:sys_exit:NR 0 = 832 0.066 ( ): sleep/11563 fstat(fd: 3, statbuf: 0x7ffdbf711a10) ... 0.067 sleep/11563 raw_syscalls:sys_exit:NR 5 = 0 0.068 ( ): sleep/11563 mmap(len: 8192, prot: READ|WRITE, flags: PRIVATE|ANONYMOUS) ... 0.070 sleep/11563 raw_syscalls:sys_exit:NR 9 = 140196285485056 0.073 ( ): sleep/11563 mmap(len: 3889792, prot: EXEC|READ, flags: PRIVATE|DENYWRITE, fd: 3) ... 0.076 sleep/11563 raw_syscalls:sys_exit:NR 9 = 140196279463936 0.077 ( ): sleep/11563 mprotect(start: 0x7f81fd8a8000, len: 2093056) ... 0.083 sleep/11563 raw_syscalls:sys_exit:NR 10 = 0 0.084 ( ): sleep/11563 mmap(addr: 0x7f81fdaa7000, len: 24576, prot: READ|WRITE, flags: PRIVATE|FIXED|DENYWRITE, fd: 3, off: 1753088) ... 0.088 sleep/11563 raw_syscalls:sys_exit:NR 9 = 140196283314176 0.091 ( ): sleep/11563 mmap(addr: 0x7f81fdaad000, len: 14976, prot: READ|WRITE, flags: PRIVATE|FIXED|ANONYMOUS) ... 0.093 sleep/11563 raw_syscalls:sys_exit:NR 9 = 140196283338752 0.097 ( ): sleep/11563 close(fd: 3) ... 0.098 sleep/11563 raw_syscalls:sys_exit:NR 3 = 0 0.107 ( ): sleep/11563 arch_prctl(option: 4098, arg2: 140196285490432) ... 0.108 sleep/11563 raw_syscalls:sys_exit:NR 158 = 0 0.143 ( ): sleep/11563 mprotect(start: 0x7f81fdaa7000, len: 16384, prot: READ) ... 0.146 sleep/11563 raw_syscalls:sys_exit:NR 10 = 0 0.157 ( ): sleep/11563 mprotect(start: 0x561d037e7000, len: 4096, prot: READ) ... 0.160 sleep/11563 raw_syscalls:sys_exit:NR 10 = 0 0.163 ( ): sleep/11563 mprotect(start: 0x7f81fdcd5000, len: 4096, prot: READ) ... 0.165 sleep/11563 raw_syscalls:sys_exit:NR 10 = 0 0.166 ( ): sleep/11563 munmap(addr: 0x7f81fdcbb000, len: 103334) ... 0.174 sleep/11563 raw_syscalls:sys_exit:NR 11 = 0 0.216 ( ): sleep/11563 brk() ... 0.217 sleep/11563 raw_syscalls:sys_exit:NR 12 = 94682642325504 0.217 ( ): sleep/11563 brk(brk: 0x561d05453000) ... 0.219 sleep/11563 raw_syscalls:sys_exit:NR 12 = 94682642460672 0.220 ( ): sleep/11563 brk() ... 0.221 sleep/11563 raw_syscalls:sys_exit:NR 12 = 94682642460672 0.224 ( ): sleep/11563 open(filename: , flags: CLOEXEC) ... 0.228 sleep/11563 raw_syscalls:sys_exit:NR 2 = 3 0.229 ( ): sleep/11563 fstat(fd: 3, statbuf: 0x7f81fdaacaa0) ... 0.230 sleep/11563 raw_syscalls:sys_exit:NR 5 = 0 0.231 ( ): sleep/11563 mmap(len: 113045344, prot: READ, flags: PRIVATE, fd: 3) ... 0.234 sleep/11563 raw_syscalls:sys_exit:NR 9 = 140196166418432 0.237 ( ): sleep/11563 close(fd: 3) ... 0.238 sleep/11563 raw_syscalls:sys_exit:NR 3 = 0 0.262 ( ): sleep/11563 nanosleep(rqtp: 0x7ffdbf7126f0) ... 1000.399 sleep/11563 raw_syscalls:sys_exit:NR 35 = 0 1000.440 ( ): sleep/11563 close(fd: 1) ... 1000.447 sleep/11563 raw_syscalls:sys_exit:NR 3 = 0 1000.454 ( ): sleep/11563 close(fd: 2) ... 1000.468 ( ): sleep/11563 exit_group( ) # In the next csets we'll connect those events to the existing enter/exit raw_syscalls handlers in 'perf trace', just like we did with the syscalls:sys_{enter,exit}_* tracepoints. Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-5nl8l4hx1tl9pqdx65nkp6pw@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 7c6c54b505b8aea1782ce6a6e8f3b8297d179937 Merge: 6444ccfd699c 012ebc3b7801 Author: Linus Torvalds Date: Thu Nov 1 09:31:19 2018 -0700 Merge branch 'i2c/for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "I2C has a core bugfix & cleanup as well as an ID addition and MAINTAINERS update for you" * 'i2c/for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: MAINTAINERS: add maintainer for IMX LPI2C driver dt-bindings: i2c: i2c-imx-lpi2c: add imx8qxp compatible string i2c: Clear client->irq in i2c_device_remove i2c: Remove unnecessary call to irq_find_mapping commit 6444ccfd699cda8db5edaac7fa469d6a29aa9a47 Merge: 82aa4671516a b5bb42587118 Author: Linus Torvalds Date: Thu Nov 1 09:27:57 2018 -0700 Merge branch 'for-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/dennis/percpu Pull percpu fixes from Dennis Zhou: "Two small things for v4.20. The first fixes a clang uninitialized variable warning for arm64 in the default path calls BUILD_BUG(). The second removes an unnecessary unlikely() in a WARN_ON() use" * 'for-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/dennis/percpu: arm64: percpu: Initialize ret in the default case mm: percpu: remove unnecessary unlikely() commit 82aa4671516a3203261c835e98c3eecab10c994d Merge: ffb845db5001 46ebe2834ba5 Author: Linus Torvalds Date: Thu Nov 1 09:16:01 2018 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) BPF verifier fixes from Daniel Borkmann. 2) HNS driver fixes from Huazhong Tan. 3) FDB only works for ethernet devices, reject attempts to install FDB rules for others. From Ido Schimmel. 4) Fix spectre V1 in vhost, from Jason Wang. 5) Don't pass on-stack object to irq_set_affinity_hint() in mvpp2 driver, from Marc Zyngier. 6) Fix mlx5e checksum handling when RXFCS is enabled, from Eric Dumazet. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (49 commits) openvswitch: Fix push/pop ethernet validation net: stmmac: Fix stmmac_mdio_reset() when building stmmac as modules bpf: test make sure to run unpriv test cases in test_verifier bpf: add various test cases to test_verifier bpf: don't set id on after map lookup with ptr_to_map_val return bpf: fix partial copy of map_ptr when dst is scalar libbpf: Fix compile error in libbpf_attach_type_by_name kselftests/bpf: use ping6 as the default ipv6 ping binary if it exists selftests: mlxsw: qos_mc_aware: Add a test for UC awareness selftests: mlxsw: qos_mc_aware: Tweak for min shaper mlxsw: spectrum: Set minimum shaper on MC TCs mlxsw: reg: QEEC: Add minimum shaper fields net: hns3: bugfix for rtnl_lock's range in the hclgevf_reset() net: hns3: bugfix for rtnl_lock's range in the hclge_reset() net: hns3: bugfix for handling mailbox while the command queue reinitialized net: hns3: fix incorrect return value/type of some functions net: hns3: bugfix for hclge_mdio_write and hclge_mdio_read net: hns3: bugfix for is_valid_csq_clean_head() net: hns3: remove unnecessary queue reset in the hns3_uninit_all_ring() net: hns3: bugfix for the initialization of command queue's spin lock ... commit ffb845db50012eb3704a270efdf9b98be4e3454a Merge: 5c99a8d1edb5 1f2b5b8e2df4 Author: Linus Torvalds Date: Thu Nov 1 09:07:04 2018 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc Pull sparc fixes from David Miller: "Two small fixes" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: sparc64: Wire up compat getpeername and getsockname. sparc64: Remvoe set_fs() from perf_callchain_user(). commit 5c99a8d1edb53921d79fee29231bca3ada77b5d6 Merge: eb7046e9bf46 e8d0c9a726cd Author: Linus Torvalds Date: Thu Nov 1 09:04:30 2018 -0700 Merge tag 'csky-for-linus-4.20-fixup-dtb' of https://github.com/c-sky/csky-linux Pull csky dtb fixups from Guo Ren: "These fix the csky dtb Kbuild to follow the new Devicetree dtb build rules" * tag 'csky-for-linus-4.20-fixup-dtb' of https://github.com/c-sky/csky-linux: csky: use common dtb build rules csky: remove builtin-dtb Kbuild commit eb7046e9bf466cebfcfbcdf640e41d9e3a80086c Merge: 5b7449810ae6 3b692c55e58d Author: Linus Torvalds Date: Thu Nov 1 08:42:21 2018 -0700 Merge tag 'platform-drivers-x86-v4.20-1' of git://git.infradead.org/linux-platform-drivers-x86 Pull x86 platform driver updates from Darren Hart: - Move the Dell dcdbas and dell_rbu drivers into platform/drivers/x86 as they are closely coupled with other drivers in this location. - Improve _init* usage for acerhdf and fix some usage issues with messages and module parameters. - Simplify asus-wmi by calling ACPI/WMI methods directly, eliminating workqueue overhead, eliminate double reporting of keyboard backlight. - Fix wake from USB failure on Bay Trail devices (intel_int0002_vgpio). - Notify intel_telemetry users when IPC1 device is not enabled. - Update various drivers with new laptop model IDs. - Update several intel drivers to use SPDX identifers and order headers alphabetically. * tag 'platform-drivers-x86-v4.20-1' of git://git.infradead.org/linux-platform-drivers-x86: (64 commits) HID: asus: only support backlight when it's not driven by WMI platform/x86: asus-wmi: export function for evaluating WMI methods platform/x86: asus-wmi: Only notify kbd LED hw_change by fn-key pressed platform/x86: wmi: declare device_type structure as constant platform/x86: ideapad: Add Y530-15ICH to no_hw_rfkill platform/x86: Add Intel AtomISP2 dummy / power-management driver platform/x86: touchscreen_dmi: Add min-x and min-y settings for various models platform/x86: touchscreen_dmi: Add info for the Onda V80 Plus v3 tablet platform/x86: touchscreen_dmi: Add info for the Trekstor Primetab T13B tablet platform/x86: intel_telemetry: Get rid of custom macro platform/x86: intel_telemetry: report debugfs failure MAINTAINERS: intel_telemetry: Update maintainers info platform/x86: Add LG Gram laptop special features driver platform/x86: asus-wmi: Simplify the keyboard brightness updating process platform/x86: touchscreen_dmi: Add info for the Trekstor Primebook C11 convertible platform/x86: mlx-platform: Properly use mlxplat_mlxcpld_msn201x_items MAINTAINERS: intel_pmc_core: Update MAINTAINERS firmware: dcdbas: include linux/io.h platform/x86: intel-wmi-thunderbolt: Add dynamic debugging platform/x86: intel-wmi-thunderbolt: Convert to use SPDX identifier ... commit 2cd3faf87d2d8f6123adf34741b9a7b98828a76f Author: Petr Vorel Date: Mon Oct 29 22:10:58 2018 +0100 merge_config.sh: Allow to define config prefix with CONFIG_ environment variable. merge_config.sh uses CONFIG_ which is used in kernel and other projects. There are some projects which use kconfig with different prefixes (e.g. buildroot: BR2_ prefix). CONFIG_ variable is already used for this purpose in kconfig binary (scripts/kconfig/lkc.h), let's use the same rule for in merge_config.sh. Suggested-by: Masahiro Yamada Signed-off-by: Petr Vorel Signed-off-by: Masahiro Yamada commit 3f80babd9ca477d19a027e0b25b95973cd7f7357 Author: Masahiro Yamada Date: Tue Oct 30 01:03:54 2018 +0900 kbuild: remove unused cc-fullversion variable The last user of cc-fullversion was removed by commit f2910f0e6835 ("powerpc: remove old GCC version checks"). Signed-off-by: Masahiro Yamada commit 0085b4191f3e30ec94beef4103679f2828d3c54f Author: Masahiro Yamada Date: Tue Oct 30 00:41:28 2018 +0900 kconfig: remove silentoldconfig target As commit 911a91c39cab ("kconfig: rename silentoldconfig to syncconfig") announced, it is time for the removal. Signed-off-by: Masahiro Yamada Acked-by: Jeff Kirsher commit 04c459d204484fa4747d29c24f00df11fe6334d4 Author: Masahiro Yamada Date: Tue Oct 30 00:41:27 2018 +0900 kconfig: remove oldnoconfig target As commit 312ee68752fa ("kconfig: announce removal of oldnoconfig if used") announced, it is time for the removal. Signed-off-by: Masahiro Yamada commit a15687ca7b927c02fde9ab68ecbbc3043fb72f25 Author: Christoph Hellwig Date: Fri Oct 19 14:09:48 2018 +0200 powerpc: PCI_MSI needs PCI Various powerpc boards select the PCI_MSI config option without selecting PCI, resulting in potentially not compilable configurations if the by default enabled PCI option is disabled. Explicitly select PCI to ensure we always have valid configs. Signed-off-by: Christoph Hellwig Acked-by: Thomas Gleixner Signed-off-by: Masahiro Yamada commit c8bf9212d1c2df2080e8870da5b791354c20376e Author: Christoph Hellwig Date: Fri Oct 19 14:09:47 2018 +0200 powerpc: remove CONFIG_MCA leftovers Signed-off-by: Christoph Hellwig Acked-by: Thomas Gleixner Signed-off-by: Masahiro Yamada commit 3905361b723ad9fbc74b3e449acc1d52bee1b4ce Author: Christoph Hellwig Date: Fri Oct 19 14:09:46 2018 +0200 powerpc: remove CONFIG_PCI_QSPAN This option isn't actually used anywhere. Signed-off-by: Christoph Hellwig Acked-by: Benjamin Herrenschmidt Signed-off-by: Masahiro Yamada commit 3eb2ebcb8e8d2e57d7a9f21ffe1dc82bf0322bdc Author: Christoph Hellwig Date: Fri Oct 19 14:09:44 2018 +0200 scsi: aha152x: rename the PCMCIA define We plan to enable building the PCMCIA core and drivers, and the non-prefixed PCMCIA name clashes with some arch headers. Signed-off-by: Christoph Hellwig Acked-by: Thomas Gleixner Signed-off-by: Masahiro Yamada commit 9d064be1e6a195eaaa3762af5c7c6cd3f66aa6cc Author: Christian König Date: Wed Oct 24 14:59:10 2018 +0200 drm/amdgpu: revert "enable gfxoff in non-sriov and stutter mode by default" This is still completely breaking my Raven system. This reverts commit cdf2f910fa969adca1b0e3ad2b487821233dc038. Revert until we sort out the sbios and firmware combinations that work correctly. bug: https://bugs.freedesktop.org/show_bug.cgi?id=108606 Cc: stable@vger.kernel.org # v4.19 Reviewed-by: Alex Deucher Signed-off-by: Christian König Signed-off-by: Alex Deucher commit a4c3f247ee94945ac949f3280b7c050c712857cd Author: Rex Zhu Date: Wed Oct 31 19:12:01 2018 +0800 drm/amd/pp: Print warning if od_sclk/mclk out of range print warning in dmesg to notify user the setting for sclk_od/mclk_od out of range that vbios can support Reviewed-by: Alex Deucher Signed-off-by: Rex Zhu Signed-off-by: Alex Deucher commit 47fdd897534704a8a3e77d0091e43479b64d3de1 Author: Rex Zhu Date: Tue Oct 30 20:01:59 2018 +0800 drm/amd/pp: Fix pp_sclk/mclk_od not work on Vega10 not update dpm table with user's setting. Reviewed-by: Alex Deucher Signed-off-by: Rex Zhu Signed-off-by: Alex Deucher commit 17c7c7e714624dd8f00fb6b85a214745fc2bae6b Author: Rex Zhu Date: Mon Oct 22 13:27:37 2018 +0800 drm/amd/pp: Fix pp_sclk/mclk_od not work on smu7 not update the dpm table with user's setting Acked-by: Alex Deucher Signed-off-by: Rex Zhu Signed-off-by: Alex Deucher commit 5be3bb6e92549f246f472d74bfaa54f56acbf998 Author: Evan Quan Date: Wed Oct 31 14:15:04 2018 +0800 drm/amd/powerplay: no MGPU fan boost enablement on DPM disabled As MGPU fan boost feature will be definitely not needed when DPM is disabled. So, there is no need to error out. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 734afd4b217f827e71b39abea10f5492c6f27606 Author: Andrey Grodzovsky Date: Wed Oct 31 10:23:05 2018 -0400 drm/amdgpu: Fix skipping hangged job reset during gpu recover. Problem: During GPU recover DAL would hang in amdgpu_pm_compute_clocks->amdgpu_fence_wait_empty Fix: Turns out there was a typo introduced by 3320b8d drm/amdgpu: remove job->ring which caused skipping amdgpu_fence_driver_force_completion and so the hangged job was never force signaled and this would cause the hang later in DAL. Signed-off-by: Andrey Grodzovsky Reviewed-by: Christian König Signed-off-by: Alex Deucher commit a662315d8ad9e687fe648b6eea9bd35017f565dd Author: Serge Semin Date: Tue Jul 17 12:24:37 2018 +0300 ntb: idt: Alter the driver info comments Since IDT PCIe-switch temperature sensor is now always available irregardless of the EEPROM/BIOS settings, Kconfig and in-code description should be properly altered. In addition lets update the driver copyright lines. Signed-off-by: Serge Semin Signed-off-by: Jon Mason commit b8babacbae624da6d244d0721263edda56be3991 Author: Serge Semin Date: Tue Jul 17 12:24:36 2018 +0300 ntb: idt: Discard temperature sensor IRQ handler IDT PCIe-switch temperature sensor interface is very broken. First of all only a few combinations of TMPCTL threshold enable bits really cause the interrupts unmasked. Even if an individual bit indicates the event unmasked, corresponding IRQ just isn't generated. Most of the threshold enable bits combinations are in fact useless and non of them can help to create a fully functional alarm interface. So to speak, we can't create a well defined hwmon alarms based on the IDT PCI-switch threshold IRQs. Secondly a single threshold IRQ (not a combination of thresholds) can be successfully enabled without the issue described above. But in this case we experienced an enormous number of interrupts generated by the chip if the temperature got near the enabled threshold value. Filter adjustment didn't help much. It also doesn't provide a hysteresis settings. Due to the temperature sample fluctuations near the threshold the interrupts spate makes the system nearly unusable until the temperature value finally settled so being pushed either to be fully higher or lower the threshold. All of these issues makes the temperature sensor alarm interface useless and even at some point dangerous to be used in the driver. In this case it is safer to completely discard it and disable the temperature alarm interrupts. Signed-off-by: Serge Semin Signed-off-by: Jon Mason commit aed1b7b31154bdd6f2fccca0ab5cf8a6fe2f52eb Author: Serge Semin Date: Tue Jul 17 12:24:35 2018 +0300 ntb: idt: Add basic hwmon sysfs interface IDT PCIe switches provide an embedded temperature sensor working within [0; 127.5]C with resolution of 0.5C. They also can generate a PCIe upstream interrupt in case if the temperature passes through specified thresholds. Since this thresholds interface is very broken the created hwmon-sysfs interface exposes only the next set of hwmon nodes: current input temperature, lowest and highest values measured, history resetting, value offset. HWmon alarm interface isn't provided. IDT PCIe switch also've got an ADC/filter settings of the sensor. This driver doesn't expose them to the hwmon-sysfs interface at the moment, except the offset node. Signed-off-by: Serge Semin Signed-off-by: Jon Mason commit 40070408f54e76896d75ddccaabdd0c0714600f1 Author: Serge Semin Date: Tue Jul 17 12:24:34 2018 +0300 ntb: idt: Alter temperature read method In order to create a hwmon interface for the IDT PCIe-switch temperature sensor the already available reader method should be improved. Particularly we need to redesign it so one would be able to read temperature/offset values from registers of the passed types. Since IDT sensor interface provides temperature in unsigned format 0:7:1 (7 bits for real value and one for fraction) we also need to have helpers for the typical sysfs temperature data type conversion to and from this format. Even though the IDT PCIe-switch provided temperature offset got the same but signed type it can be translated by these methods too. Signed-off-by: Serge Semin Signed-off-by: Jon Mason commit 51f5fd2e4615dcdc25cd7f9d19b7b27eb9ecdac7 Author: Will Deacon Date: Wed Oct 31 17:44:08 2018 +0000 tools headers barrier: Fix arm64 tools build failure wrt smp_load_{acquire,release} Cheers for reporting this. I managed to reproduce the build failure with gcc version 6.3.0 20170516 (Debian 6.3.0-18+deb9u1). The code in question is the arm64 versions of smp_load_acquire() and smp_store_release(). Unlike other architectures, these are not built around READ_ONCE() and WRITE_ONCE() since we have instructions we can use instead of fences. Bringing our macros up-to-date with those (i.e. tweaking the union initialisation and using the special "uXX_alias_t" types) appears to fix the issue for me. Committer notes: Testing it in the systems previously failing: # time dm android-ndk:r12b-arm \ android-ndk:r15c-arm \ debian:experimental-x-arm64 \ ubuntu:14.04.4-x-linaro-arm64 \ ubuntu:16.04-x-arm \ ubuntu:16.04-x-arm64 \ ubuntu:18.04-x-arm \ ubuntu:18.04-x-arm64 1 android-ndk:r12b-arm : Ok arm-linux-androideabi-gcc (GCC) 4.9.x 20150123 (prerelease) 2 android-ndk:r15c-arm : Ok arm-linux-androideabi-gcc (GCC) 4.9.x 20150123 (prerelease) 3 debian:experimental-x-arm64 : Ok aarch64-linux-gnu-gcc (Debian 8.2.0-7) 8.2.0 4 ubuntu:14.04.4-x-linaro-arm64 : Ok aarch64-linux-gnu-gcc (Linaro GCC 5.5-2017.10) 5.5.0 5 ubuntu:16.04-x-arm : Ok arm-linux-gnueabihf-gcc (Ubuntu/Linaro 5.4.0-6ubuntu1~16.04.9) 5.4.0 20160609 6 ubuntu:16.04-x-arm64 : Ok aarch64-linux-gnu-gcc (Ubuntu/Linaro 5.4.0-6ubuntu1~16.04.9) 5.4.0 20160609 7 ubuntu:18.04-x-arm : Ok arm-linux-gnueabihf-gcc (Ubuntu/Linaro 7.3.0-27ubuntu1~18.04) 7.3.0 8 ubuntu:18.04-x-arm64 : Ok aarch64-linux-gnu-gcc (Ubuntu/Linaro 7.3.0-27ubuntu1~18.04) 7.3.0 Reported-by: Arnaldo Carvalho de Melo Signed-off-by: Will Deacon Tested-by: Arnaldo Carvalho de Melo Tested-by: Daniel Borkmann Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/20181031174408.GA27871@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 98f76206b33504b934209d16196477dfa519a807 Author: Dmitry Safonov Date: Fri Oct 12 14:42:53 2018 +0100 compat: Cleanup in_compat_syscall() callers Now that in_compat_syscall() is consistent on all architectures and does not longer report true on native i686, the workarounds (ifdeffery and helpers) can be removed. Signed-off-by: Dmitry Safonov Signed-off-by: Thomas Gleixner Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Ard Biesheuvel Cc: Andy Lutomirsky Cc: "David S. Miller" Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: John Stultz Cc: "Kirill A. Shutemov" Cc: Oleg Nesterov Cc: Steffen Klassert Cc: Stephen Boyd Cc: Steven Rostedt Cc: linux-efi@vger.kernel.org Cc: netdev@vger.kernel.org Link: https://lkml.kernel.org/r/20181012134253.23266-3-dima@arista.com commit a846446b1914d1e3d996d657754f43fde89bab51 Author: Dmitry Safonov Date: Fri Oct 12 14:42:52 2018 +0100 x86/compat: Adjust in_compat_syscall() to generic code under !COMPAT The result of in_compat_syscall() can be pictured as: x86 platform: --------------------------------------------------- | Arch\syscall | 64-bit | ia32 | x32 | |-------------------------------------------------| | x86_64 | false | true | true | |-------------------------------------------------| | i686 | | | | --------------------------------------------------- Other platforms: ------------------------------------------- | Arch\syscall | 64-bit | compat | |-----------------------------------------| | 64-bit | false | true | |-----------------------------------------| | 32-bit(?) | | | ------------------------------------------- As seen, the result of in_compat_syscall() on generic 32-bit platform differs from i686. There is no reason for in_compat_syscall() == true on native i686. It also easy to misread code if the result on native 32-bit platform differs between arches. Because of that non arch-specific code has many places with: if (IS_ENABLED(CONFIG_COMPAT) && in_compat_syscall()) in different variations. It looks-like the only non-x86 code which uses in_compat_syscall() not under CONFIG_COMPAT guard is in amd/amdkfd. But according to the commit a18069c132cb ("amdkfd: Disable support for 32-bit user processes"), it actually should be disabled on native i686. Rename in_compat_syscall() to in_32bit_syscall() for x86-specific code and make in_compat_syscall() false under !CONFIG_COMPAT. A follow on patch will clean up generic users which were forced to check IS_ENABLED(CONFIG_COMPAT) with in_compat_syscall(). Signed-off-by: Dmitry Safonov Signed-off-by: Thomas Gleixner Reviewed-by: Andy Lutomirski Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Ard Biesheuvel Cc: "David S. Miller" Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: John Stultz Cc: "Kirill A. Shutemov" Cc: Oleg Nesterov Cc: Steffen Klassert Cc: Stephen Boyd Cc: Steven Rostedt Cc: linux-efi@vger.kernel.org Cc: netdev@vger.kernel.org Link: https://lkml.kernel.org/r/20181012134253.23266-2-dima@arista.com commit 3424243e39e8ec138486926949e3668e7553125d Author: Dan Carpenter Date: Sat Oct 13 13:22:46 2018 +0300 irqchip/irq-mvebu-sei: Fix a NULL vs IS_ERR() bug in probe function The devm_ioremap_resource() function never returns NULL, it returns error pointers. Fixes: 61ce8d8d8a81 ("irqchip/irq-mvebu-sei: Add new driver for Marvell SEI") Signed-off-by: Dan Carpenter Signed-off-by: Thomas Gleixner Reviewed-by: Miquel Raynal Cc: Jason Cooper Cc: Andrew Lunn Cc: Gregory Clement Cc: Sebastian Hesselbarth Cc: Marc Zyngier Cc: linux-arm-kernel@lists.infradead.org Cc: kernel-janitors@vger.kernel.org Link: https://lkml.kernel.org/r/20181013102246.GD16086@mwanda commit 57f01796f14fecf00d330fe39c8d2477ced9cd79 Author: Michael Kelley Date: Thu Nov 1 00:35:05 2018 +0000 irq/matrix: Fix memory overallocation IRQ_MATRIX_SIZE is the number of longs needed for a bitmap, multiplied by the size of a long, yielding a byte count. But it is used to size an array of longs, which is way more memory than is needed. Change IRQ_MATRIX_SIZE so it is just the number of longs needed and the arrays come out the correct size. Fixes: 2f75d9e1c905 ("genirq: Implement bitmap matrix allocator") Signed-off-by: Michael Kelley Signed-off-by: Thomas Gleixner Cc: KY Srinivasan Link: https://lkml.kernel.org/r/1541032428-10392-1-git-send-email-mikelley@microsoft.com commit bcb6fb5da77c2a228adf07cc9cb1a0c2aa2001c6 Author: Josh Poimboeuf Date: Wed Oct 31 21:57:30 2018 -0500 objtool: Support GCC 9 cold subfunction naming scheme Starting with GCC 8, a lot of unlikely code was moved out of line to "cold" subfunctions in .text.unlikely. For example, the unlikely bits of: irq_do_set_affinity() are moved out to the following subfunction: irq_do_set_affinity.cold.49() Starting with GCC 9, the numbered suffix has been removed. So in the above example, the cold subfunction is instead: irq_do_set_affinity.cold() Tweak the objtool subfunction detection logic so that it detects both GCC 8 and GCC 9 naming schemes. Reported-by: Peter Zijlstra (Intel) Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Tested-by: Peter Zijlstra (Intel) Acked-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/015e9544b1f188d36a7f02fa31e9e95629aa5f50.1541040800.git.jpoimboe@redhat.com commit e8d0c9a726cd1eae410148fcc6a1db23019f0334 Author: Guo Ren Date: Tue Oct 30 18:46:47 2018 +0800 csky: use common dtb build rules Remove the Kbuild rules in arch/csky and use common dtb build rules. This modification is based on: commit 37c8a5fafa3b ("kbuild: consolidate Devicetree dtb build rules") Signed-off-by: Guo Ren Reviewed-by: Rob Herring Acked-by: Arnd Bergmann commit c4c14c3bd177ea769fee938674f73a8ec0cdd47a Author: Guo Ren Date: Tue Oct 30 18:42:32 2018 +0800 csky: remove builtin-dtb Kbuild Remove the builtin-dtb implementation in arch/csky. Signed-off-by: Guo Ren Reviewed-by: Rob Herring Reviewed-by: Arnd Bergmann commit 46ebe2834ba5b541f28ee72e556a3fed42c47570 Author: Jaime Caamaño Ruiz Date: Wed Oct 31 18:52:03 2018 +0100 openvswitch: Fix push/pop ethernet validation When there are both pop and push ethernet header actions among the actions to be applied to a packet, an unexpected EINVAL (Invalid argument) error is obtained. This is due to mac_proto not being reset correctly when those actions are validated. Reported-at: https://mail.openvswitch.org/pipermail/ovs-discuss/2018-October/047554.html Fixes: 91820da6ae85 ("openvswitch: add Ethernet push and pop actions") Signed-off-by: Jaime Caamaño Ruiz Tested-by: Greg Rose Reviewed-by: Greg Rose Signed-off-by: David S. Miller commit 30549aab146ccb1275230c3b4b4bc6b4181fd54e Author: Niklas Cassel Date: Wed Oct 31 16:08:10 2018 +0100 net: stmmac: Fix stmmac_mdio_reset() when building stmmac as modules When building stmmac, it is only possible to select CONFIG_DWMAC_GENERIC, or any of the glue drivers, when CONFIG_STMMAC_PLATFORM is set. The only exception is CONFIG_STMMAC_PCI. When calling of_mdiobus_register(), it will call our ->reset() callback, which is set to stmmac_mdio_reset(). Most of the code in stmmac_mdio_reset() is protected by a "#if defined(CONFIG_STMMAC_PLATFORM)", which will evaluate to false when CONFIG_STMMAC_PLATFORM=m. Because of this, the phy reset gpio will only be pulled when stmmac is built as built-in, but not when built as modules. Fix this by using "#if IS_ENABLED()" instead of "#if defined()". Signed-off-by: Niklas Cassel Signed-off-by: David S. Miller commit 1f2b5b8e2df4591fbca430aff9c5a072dcc0f408 Author: David S. Miller Date: Wed Oct 31 18:30:21 2018 -0700 sparc64: Wire up compat getpeername and getsockname. Fixes: 8b30ca73b7cc ("sparc: Add all necessary direct socket system calls.") Reported-by: Joseph Myers Signed-off-by: David S. Miller commit 4d3163cf873f628dc598d5e9a15911b198655a07 Merge: df975da4e578 6702185c1ffe Author: David S. Miller Date: Wed Oct 31 18:21:37 2018 -0700 Merge branch '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue Jeff Kirsher says: ==================== Intel Wired LAN Driver Updates 2018-10-31 This series contains a various collection of fixes. Miroslav Lichvar from Red Hat or should I say IBM now? Updates the PHC timecounter interval for igb so that it gets updated at least once every 550 seconds. Ngai-Mint provides a fix for fm10k to prevent a soft lockup or system crash by adding a new condition to determine if the SM mailbox is in the correct state before proceeding. Jake provides several fm10k fixes, first one marks complier aborts as non-fatal since on some platforms trigger machine check errors when the compile aborts. Added missing device ids to the in-kernel driver. Due to the recent fixes, bumped the driver version. I (Jeff Kirsher) fixed a XFRM_ALGO dependency for both ixgbe and ixgbevf. This fix was based on the original work from Arnd Bergmann, which only fixed ixgbe. Mitch provides a fix for i40e/avf to update the status codes, which resolves an issue between a mis-match between i40e and the iavf driver, which also supports the ice LAN driver. Radoslaw fixes the ixgbe where the driver is logging a message about spoofed packets detected when the VF is re-started with a different MAC address. ==================== Signed-off-by: David S. Miller commit 906e86b22dba61cb1baaed9be7fdcbf0afd74d7b Author: Aaron Sierra Date: Mon Oct 15 15:32:47 2018 -0500 ntb_netdev: Simplify remove with client device drvdata Replace the elaborate private structure global linked-list used in ntb_netdev_probe() and ntb_netdev_remove() by stashing our private data in the NTB transport client device. Signed-off-by: Aaron Sierra Reviewed-by: Logan Gunthorpe Signed-off-by: Jon Mason commit fc5d1829f9bf3d8275322727c0e9a8baf268b7c6 Author: Aaron Sierra Date: Fri Oct 12 15:35:03 2018 -0500 NTB: transport: Try harder to alloc an aligned MW buffer Be a little wasteful if the (likely CMA) message window buffer is not suitably aligned after our first attempt; allocate a buffer twice as big as we need and manually align our MW buffer within it. This was needed on Intel Broadwell DE platforms with intel_iommu=off Signed-off-by: Aaron Sierra Reviewed-by: Dave Jiang Signed-off-by: Jon Mason commit 846429bc998f4c42d9961c139ce82d0f76a51d35 Author: Gustavo A. R. Silva Date: Fri Oct 5 09:12:34 2018 +0200 ntb: ntb_transport: Mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Addresses-Coverity-ID: 1373888 ("Missing break in switch") Addresses-Coverity-ID: 1373889 ("Missing break in switch") Signed-off-by: Gustavo A. R. Silva Acked-by: Allen Hubbe Signed-off-by: Jon Mason commit 37a3e9693d444701e4b8f8b98ee0480450bb5982 Author: Serge Semin Date: Wed Jul 11 23:40:51 2018 +0300 ntb: idt: Set PCIe bus address to BARLIMITx IDT NTB driver sets the upper limit of actual translation address being written to the corresponding memory window setup. It is achieved by BARLIMITx register initialization. Needless to say, that the register works within PCIe bus address space. In general CPU and PCIe address spaces are different. It means, that addresses used for Memory TLPs routine can be different from CPU addresses. While in most of cases they are the same, there are exceptions when the proper mapping must be performed to have the portable driver code. There used to be a virt_to_bus()/bus_to_virt() interface for this purpose. But it's deprecated now. It was also a mistake to use pci_resource_start() since the return address of the method is at the CPU address space. In order to achieve the desired purpose we need to use pci_bus_address() helper. This method shall return a PCIe bus base address of the corresponding BAR resource. Signed-off-by: Serge Semin Acked-by: Allen Hubbe Signed-off-by: Jon Mason commit df975da4e578eb06453f41a3ecd73c2a4c28044d Merge: e2acdddde015 dfeb8f4c9692 Author: David S. Miller Date: Wed Oct 31 17:34:08 2018 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2018-11-01 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) Fix tcp_bpf_recvmsg() to return -EAGAIN instead of 0 in non-blocking case when no data is available yet, from John. 2) Fix a compilation error in libbpf_attach_type_by_name() when compiled with clang 3.8, from Andrey. 3) Fix a partial copy of map pointer on scalar alu and remove id generation for RET_PTR_TO_MAP_VALUE return types, from Daniel. 4) Add unlimited memlock limit for kernel selftest's flow_dissector_load program, from Yonghong. 5) Fix ping for some BPF shell based kselftests where distro does not ship "ping -6" anymore, from Li. ==================== Signed-off-by: David S. Miller commit dfeb8f4c9692fd5e6c3eef19c2e4ae5338dbdb01 Merge: 361535321874 832c6f2c29ec Author: Alexei Starovoitov Date: Wed Oct 31 16:53:18 2018 -0700 Merge branch 'verifier-fixes' Daniel Borkmann says: ==================== The series contains two fixes in BPF core and test cases. For details please see individual patches. Thanks! ==================== Signed-off-by: Alexei Starovoitov commit 832c6f2c29ec519b766923937f4f93fb1008b47d Author: Daniel Borkmann Date: Thu Nov 1 00:05:55 2018 +0100 bpf: test make sure to run unpriv test cases in test_verifier Right now unprivileged tests are never executed as a BPF test run, only loaded. Allow for running them as well so that we can check the outcome and probe for regressions. Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: Alexei Starovoitov commit 2683f4128c8730699296827d3209d2de80fa1d6c Author: Daniel Borkmann Date: Thu Nov 1 00:05:54 2018 +0100 bpf: add various test cases to test_verifier Add some more map related test cases to test_verifier kselftest to improve test coverage. Summary: 1012 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: Alexei Starovoitov commit 4d31f30148cea6e97e42616231eed55295117fe7 Author: Daniel Borkmann Date: Thu Nov 1 00:05:53 2018 +0100 bpf: don't set id on after map lookup with ptr_to_map_val return In the verifier there is no such semantics where registers with PTR_TO_MAP_VALUE type have an id assigned to them. This is only used in PTR_TO_MAP_VALUE_OR_NULL and later on nullified once the test against NULL has been pattern matched and type transformed into PTR_TO_MAP_VALUE. Fixes: 3e6a4b3e0289 ("bpf/verifier: introduce BPF_PTR_TO_MAP_VALUE") Signed-off-by: Daniel Borkmann Cc: Roman Gushchin Acked-by: Alexei Starovoitov Signed-off-by: Alexei Starovoitov commit 0962590e553331db2cc0aef2dc35c57f6300dbbe Author: Daniel Borkmann Date: Thu Nov 1 00:05:52 2018 +0100 bpf: fix partial copy of map_ptr when dst is scalar ALU operations on pointers such as scalar_reg += map_value_ptr are handled in adjust_ptr_min_max_vals(). Problem is however that map_ptr and range in the register state share a union, so transferring state through dst_reg->range = ptr_reg->range is just buggy as any new map_ptr in the dst_reg is then truncated (or null) for subsequent checks. Fix this by adding a raw member and use it for copying state over to dst_reg. Fixes: f1174f77b50c ("bpf/verifier: rework value tracking") Signed-off-by: Daniel Borkmann Cc: Edward Cree Acked-by: Alexei Starovoitov Signed-off-by: Alexei Starovoitov commit 5b7449810ae6d652629c550d3974c8453836d229 Merge: 3dca04d694f1 bc3f4b5c60db Author: Linus Torvalds Date: Wed Oct 31 16:47:55 2018 -0700 Merge tag 'tag-chrome-platform-for-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/bleung/chrome-platform Pull chrome-platform updates from Benson Leung: - Move mfd/cros_ec_lpc* includes to drivers/platform from mfd - Adding a new interrupt path for cros_ec_lpc * tag 'tag-chrome-platform-for-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/bleung/chrome-platform: platform/chrome: chromeos_tbmc - Remove unneeded const platform/chrome: Add a new interrupt path for cros_ec_lpc mfd: cros_ec: Fix and improve kerneldoc comments. platform/chrome: Move mfd/cros_ec_lpc* includes to drivers/platform. commit 012ebc3b7801fcf424d0ebb4689c98f90a8593e0 Author: A.s. Dong Date: Tue Oct 30 15:28:14 2018 +0000 MAINTAINERS: add maintainer for IMX LPI2C driver The LPI2C is used in IMX7ULP/MX8 SoCs. Signed-off-by: Dong Aisheng Signed-off-by: Wolfram Sang commit 69819c7fc836e17a870a23a54b885a44afc89d85 Author: A.s. Dong Date: Tue Oct 30 15:28:11 2018 +0000 dt-bindings: i2c: i2c-imx-lpi2c: add imx8qxp compatible string Add imx8qxp compatible string Reviewed-by: Rob Herring Signed-off-by: Dong Aisheng Signed-off-by: Wolfram Sang commit 6f108dd70d3010c391c1e9f56f3f20d1f9e75450 Author: Charles Keepax Date: Fri Oct 19 09:59:58 2018 +0100 i2c: Clear client->irq in i2c_device_remove The IRQ will be mapped in i2c_device_probe only if client->irq is zero and i2c_device_remove does not clear this. When rebinding an I2C device, whos IRQ provider has also been rebound this means that an IRQ mapping will never be created, causing the I2C device to fail to acquire its IRQ. Fix this issue by clearing client->irq in i2c_device_remove, forcing i2c_device_probe to lookup the mapping again. Signed-off-by: Charles Keepax Reviewed-by: Benjamin Tissoires Signed-off-by: Wolfram Sang commit b9bb3fdf4e870fb655064f5c3c81c1fee7fd89ce Author: Charles Keepax Date: Fri Oct 19 09:59:57 2018 +0100 i2c: Remove unnecessary call to irq_find_mapping irq_create_mapping calls irq_find_mapping internally and will use the found mapping if one exists, so there is no need to manually call this from i2c_smbus_host_notify_to_irq. Signed-off-by: Charles Keepax Reviewed-by: Benjamin Tissoires Signed-off-by: Wolfram Sang commit ed956f3947a01ff9875cd908d7c1ef1fe7f47bf0 Author: Andrey Ryabinin Date: Mon Oct 22 23:30:40 2018 +0200 netfilter: ipset: fix ip_set_list allocation failure ip_set_create() and ip_set_net_init() attempt to allocate physically contiguous memory for ip_set_list. If memory is fragmented, the allocations could easily fail: vzctl: page allocation failure: order:7, mode:0xc0d0 Call Trace: dump_stack+0x19/0x1b warn_alloc_failed+0x110/0x180 __alloc_pages_nodemask+0x7bf/0xc60 alloc_pages_current+0x98/0x110 kmalloc_order+0x18/0x40 kmalloc_order_trace+0x26/0xa0 __kmalloc+0x279/0x290 ip_set_net_init+0x4b/0x90 [ip_set] ops_init+0x3b/0xb0 setup_net+0xbb/0x170 copy_net_ns+0xf1/0x1c0 create_new_namespaces+0xf9/0x180 copy_namespaces+0x8e/0xd0 copy_process+0xb61/0x1a00 do_fork+0x91/0x320 Use kvcalloc() to fallback to 0-order allocations if high order page isn't available. Signed-off-by: Andrey Ryabinin Signed-off-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso commit 886503f34d63e681662057448819edb5b1057a97 Author: Eric Westbrook Date: Tue Aug 28 15:14:42 2018 -0600 netfilter: ipset: actually allow allowable CIDR 0 in hash:net,port,net Allow /0 as advertised for hash:net,port,net sets. For "hash:net,port,net", ipset(8) says that "either subnet is permitted to be a /0 should you wish to match port between all destinations." Make that statement true. Before: # ipset create cidrzero hash:net,port,net # ipset add cidrzero 0.0.0.0/0,12345,0.0.0.0/0 ipset v6.34: The value of the CIDR parameter of the IP address is invalid # ipset create cidrzero6 hash:net,port,net family inet6 # ipset add cidrzero6 ::/0,12345,::/0 ipset v6.34: The value of the CIDR parameter of the IP address is invalid After: # ipset create cidrzero hash:net,port,net # ipset add cidrzero 0.0.0.0/0,12345,0.0.0.0/0 # ipset test cidrzero 192.168.205.129,12345,172.16.205.129 192.168.205.129,tcp:12345,172.16.205.129 is in set cidrzero. # ipset create cidrzero6 hash:net,port,net family inet6 # ipset add cidrzero6 ::/0,12345,::/0 # ipset test cidrzero6 fe80::1,12345,ff00::1 fe80::1,tcp:12345,ff00::1 is in set cidrzero6. See also: https://bugzilla.kernel.org/show_bug.cgi?id=200897 https://github.com/ewestbrook/linux/commit/df7ff6efb0934ab6acc11f003ff1a7580d6c1d9c Signed-off-by: Eric Westbrook Signed-off-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso commit 439cd39ea136d2c026805264d58a91f36b6b64ca Author: Stefano Brivio Date: Sat Jul 14 21:59:43 2018 +0200 netfilter: ipset: list:set: Decrease refcount synchronously on deletion and replace Commit 45040978c899 ("netfilter: ipset: Fix set:list type crash when flush/dump set in parallel") postponed decreasing set reference counters to the RCU callback. An 'ipset del' command can terminate before the RCU grace period is elapsed, and if sets are listed before then, the reference counter shown in userspace will be wrong: # ipset create h hash:ip; ipset create l list:set; ipset add l # ipset del l h; ipset list h Name: h Type: hash:ip Revision: 4 Header: family inet hashsize 1024 maxelem 65536 Size in memory: 88 References: 1 Number of entries: 0 Members: # sleep 1; ipset list h Name: h Type: hash:ip Revision: 4 Header: family inet hashsize 1024 maxelem 65536 Size in memory: 88 References: 0 Number of entries: 0 Members: Fix this by making the reference count update synchronous again. As a result, when sets are listed, ip_set_name_byindex() might now fetch a set whose reference count is already zero. Instead of relying on the reference count to protect against concurrent set renaming, grab ip_set_ref_lock as reader and copy the name, while holding the same lock in ip_set_rename() as writer instead. Reported-by: Li Shuang Fixes: 45040978c899 ("netfilter: ipset: Fix set:list type crash when flush/dump set in parallel") Signed-off-by: Stefano Brivio Signed-off-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso commit 3dca04d694f16cc74dc87de9a13547e2ffec81d7 Merge: 9bb9d4fdce9e ef70696a63c7 Author: Linus Torvalds Date: Wed Oct 31 16:20:28 2018 -0700 Merge tag 'riscv-for-linus-4.20-mw2' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux Pull more RISC-V updates from Palmer Dabbelt: "This contains the follow-on patches I'd like to target for the 4.20 merge window. I'm being somewhat conservative here, as while there are a few patches on the mailing list that were posted early in the merge window I'd like to let those bake for another round -- this was a fairly big release as far as RISC-V is concerened, and we need to walk before we can run. As far as the patches that made it go: - A patch to ignore offline CPUs when calculating AT_HWCAP. This should fix GDB on the HiFive unleashed, which has an embedded core for hart 0 which is exposed to Linux as an offline CPU. - A move of EM_RISCV to elf-em.h, which is where it should have been to begin with. - I've also removed the 64-bit divide routines. I know I'm not really playing by my own rules here because I posted the patches this morning, but since they shouldn't be in the kernel I think it's better to err on the side of going too fast here. I don't anticipate any more patch sets for the merge window" * tag 'riscv-for-linus-4.20-mw2' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux: Move EM_RISCV into elf-em.h RISC-V: properly determine hardware caps Revert "lib: Add umoddi3 and udivmoddi4 of GCC library routines" Revert "RISC-V: Select GENERIC_LIB_UMODDI3 on RV32" commit 1936f094e164cc13ebf17aba1d6b34e033e64188 Author: Naveen N. Rao Date: Wed Oct 31 22:48:13 2018 +0530 selftests/powerpc: Fix compilation issue due to asm label We are using 'dscr_insn' as a label in inline asm to identify if a SIGILL was generated by the mtspr instruction at that point. However, with inline assembly, the compiler is still free to duplicate the asm statement for optimization purposes, which results in the label being defined twice with the error: /tmp/ccerQCql.s:874: Error: symbol `dscr_insn' is already defined With different compiler versions, we may also see: /tmp/ccJzLDlN.o:(.toc+0x0): undefined reference to `dscr_insn' Remove the use of the label in the inline assembly. Instead, just look for the offending instruction in the signal handler. Fixes: d2bf793237b3 ("selftests/powerpc: Add test to verify rfi flush across a system call") Reported-by: Breno Leitao Signed-off-by: Naveen N. Rao Tested-by: Breno Leitao Signed-off-by: Michael Ellerman commit 9bb9d4fdce9e6b351b7b905f150745a0fccccc06 Merge: adb6b2b2b59f 917e2fd2c53e Author: Linus Torvalds Date: Wed Oct 31 15:46:16 2018 -0700 Merge branch 'for-linus-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml Pull UML updates from Richard Weinberger: - removal of old and dead code - a bug fix for our tty driver - other minor cleanups across the code base * 'for-linus-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml: um: Make line/tty semantics use true write IRQ um: trap: fix spelling mistake, EACCESS -> EACCES um: Don't hardcode path as it is architecture dependent um: NULL check before kfree is not needed um: remove unused AIO code um: Give start_idle_thread() a return code um: Remove update_debugregs() um: Drop own definition of PTRACE_SYSEMU/_SINGLESTEP commit adb6b2b2b59f7872322f255206583b4c3ce661a3 Merge: 9b5cf826ef8b 4d8106f0299c Author: Linus Torvalds Date: Wed Oct 31 15:39:25 2018 -0700 Merge tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming Pull c6x update from Mark Salter. * tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming: c6x: switch to NO_BOOTMEM commit 3615353218744bb60f55170c620ce4dce1a008c7 Author: Andrey Ignatov Date: Wed Oct 31 12:57:18 2018 -0700 libbpf: Fix compile error in libbpf_attach_type_by_name Arnaldo Carvalho de Melo reported build error in libbpf when clang version 3.8.1-24 (tags/RELEASE_381/final) is used: libbpf.c:2201:36: error: comparison of constant -22 with expression of type 'const enum bpf_attach_type' is always false [-Werror,-Wtautological-constant-out-of-range-compare] if (section_names[i].attach_type == -EINVAL) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ ~~~~~~~ 1 error generated. Fix the error by keeping "is_attachable" property of a program in a separate struct field instead of trying to use attach_type itself. Fixes: 956b620fcf0b ("libbpf: Introduce libbpf_attach_type_by_name") Reported-by: Arnaldo Carvalho de Melo Signed-off-by: Andrey Ignatov Tested-by: Arnaldo Carvalho de Melo Signed-off-by: Daniel Borkmann commit deee2cae27d1914850195e3fb219cc611e953560 Author: Li Zhijian Date: Tue Oct 30 11:15:55 2018 +0800 kselftests/bpf: use ping6 as the default ipv6 ping binary if it exists ping binary on some distros doesn't support "ping -6" anymore. Signed-off-by: Li Zhijian Acked-by: Song Liu Signed-off-by: Daniel Borkmann commit 29995d296e3e9ce4f9767963ecbef143ade26c36 Merge: 28fa741c27e6 5d4f0edaa3ac Author: Ingo Molnar Date: Wed Oct 31 22:53:40 2018 +0100 Merge tag 'perf-urgent-for-mingo-4.20-20181031' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent improvements and fixes from Arnaldo Carvalho de Melo: - Fixes dealing with the removal of the fallback to looking up samples marked as userspace in the kernel maps, done recently: - For intel-pt, that was setting the synthesized header misc field as PERF_RECORD_MISC_USER, depending thus on the fallback to take place, now it sets as USER or KERNEL according to x86 specific knowledge. Also now it inserts the PERF_CONTEXT_{USER,KERNEL} into the PERF_SAMPLE_CALLCHAINs it synthesizes from hw traces (Adrian Hunter) - Similar fixes for the cs-etm ARM HW trace code, that used the Intel PT model as a starting point (Leo Yan) - For the "caller" callchain order, where the callchain returned by the kernel was simply reversed without taking into account the PERF_CONTEXT_{USER,KERNEL,etc} markers from where to define if an entry was for kernel or userspace, working just because the map lookup fallback was in place (David S. Miller) - Allow for selecting if 'overwrite' mode should be used in 'perf top' and make the default for it not to be used. This is due to problems with the current implementation where the pausing used ends up making 'perf top' miss PERF_RECORD_{MMAP,FORK,EXEC,etc} events, which with short lifetime threads workloads leads quickly to many "unknown" maps (and thus symbols) to appear in the UI. Workloads with long thread lifetimes and with few metadata events can still use --overwrite to take advantage of the overwrite mode (Arnaldo Carvalho de Melo) - Start 'perf top''s display thread earlier, so that the screen doesn't remain blank for too long at tool start (David S. Miller) - Don't clone maps from parent when synthesizing forks, to avoid the inevitable flurry of overlapping maps as we process the synthesized MMAP2 events that get delivered shortly thereafter. (David S. Miller) - Take pgoff into account when reporting elf to libdwfl, now the unwinding results are the same with elfutils's libdwfl and libunwind (Milian Wolff) - Update lotsa kernel ABI headers (Arnaldo Carvalho de Melo) - 'perf trace' syscall arg beautification improvements to allow for handling args such as mount's 'flags', where maks have to be ignored before considering what is left, that, if only zeroes, is suppressed like other args without such masks (Arnaldo Carvalho de Melo) - Beautify mount's 'source' and 'flags' args (Arnaldo Carvalho de Melo) - Generate mmap's flags bit constants from linux/mman.h and all the arch specific mman.h files, so that no changes in the main 'perf trace' source files is required when new flags get added (Arnaldo Carvalho de Melo) - Consider syscall aliases, so that 'perf trace -e umount' works and we don't have to use 'umount2' (that works as well, just not required) (Arnaldo Carvalho de Melo) Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit 9b5cf826ef8b607d452ba7bf683ae5510a745232 Merge: 31990f0f5366 5571f1e65486 Author: Linus Torvalds Date: Wed Oct 31 14:50:02 2018 -0700 Merge tag 'fuse-update-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse updates from Miklos Szeredi: "As well as the usual bug fixes, this adds the following new features: - cached readdir and readlink - max I/O size increased from 128k to 1M - improved performance and scalability of request queues - copy_file_range support The only non-fuse bits are trivial cleanups of macros in " * tag 'fuse-update-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: (31 commits) fuse: enable caching of symlinks fuse: only invalidate atime in direct read fuse: don't need GETATTR after every READ fuse: allow fine grained attr cache invaldation bitops: protect variables in bit_clear_unless() macro bitops: protect variables in set_mask_bits() macro fuse: realloc page array fuse: add max_pages to init_out fuse: allocate page array more efficiently fuse: reduce size of struct fuse_inode fuse: use iversion for readdir cache verification fuse: use mtime for readdir cache verification fuse: add readdir cache version fuse: allow using readdir cache fuse: allow caching readdir fuse: extract fuse_emit() helper fuse: add FOPEN_CACHE_DIR fuse: split out readdir.c fuse: Use hash table to link processing request fuse: kill req->intr_unique ... commit 31990f0f5366a8f66688edae8688723b22034108 Merge: a9ac6cc47bbb ea4cdc548e5e Author: Linus Torvalds Date: Wed Oct 31 14:42:31 2018 -0700 Merge tag 'ceph-for-4.20-rc1' of git://github.com/ceph/ceph-client Pull ceph updates from Ilya Dryomov: "The highlights are: - a series that fixes some old memory allocation issues in libceph (myself). We no longer allocate memory in places where allocation failures cannot be handled and BUG when the allocation fails. - support for copy_file_range() syscall (Luis Henriques). If size and alignment conditions are met, it leverages RADOS copy-from operation. Otherwise, a local copy is performed. - a patch that reduces memory requirement of ceph_sync_read() from the size of the entire read to the size of one object (Zheng Yan). - fallocate() syscall is now restricted to FALLOC_FL_PUNCH_HOLE (Luis Henriques)" * tag 'ceph-for-4.20-rc1' of git://github.com/ceph/ceph-client: (25 commits) ceph: new mount option to disable usage of copy-from op ceph: support copy_file_range file operation libceph: support the RADOS copy-from operation ceph: add non-blocking parameter to ceph_try_get_caps() libceph: check reply num_data_items in setup_request_data() libceph: preallocate message data items libceph, rbd, ceph: move ceph_osdc_alloc_messages() calls libceph: introduce alloc_watch_request() libceph: assign cookies in linger_submit() libceph: enable fallback to ceph_msg_new() in ceph_msgpool_get() ceph: num_ops is off by one in ceph_aio_retry_work() libceph: no need to call osd_req_opcode_valid() in osd_req_encode_op() ceph: set timeout conditionally in __cap_delay_requeue libceph: don't consume a ref on pagelist in ceph_msg_data_add_pagelist() libceph: introduce ceph_pagelist_alloc() libceph: osd_req_op_cls_init() doesn't need to take opcode libceph: bump CEPH_MSG_MAX_DATA_LEN ceph: only allow punch hole mode in fallocate ceph: refactor ceph_sync_read() ceph: check if LOOKUPNAME request was aborted when filling trace ... commit 1b7619828d0c341612f58683e73f279c37e70bbc Author: Gustavo A. R. Silva Date: Mon Aug 27 17:13:06 2018 -0500 NTB: ntb_hw_idt: replace IS_ERR_OR_NULL with regular NULL checks Both devm_kcalloc() and devm_kzalloc() return NULL on error. They never return error pointers. The use of IS_ERR_OR_NULL is currently applied to the wrong context. Fix this by replacing IS_ERR_OR_NULL with regular NULL checks. Fixes: bf2a952d31d2 ("NTB: Add IDT 89HPESxNTx PCIe-switches support") Signed-off-by: Gustavo A. R. Silva Signed-off-by: Jon Mason commit 7756e2b5d68c36e170a111dceea22f7365f83256 Author: Dave Jiang Date: Tue Aug 28 17:13:59 2018 -0700 ntb: intel: fix return value for ndev_vec_mask() ndev_vec_mask() should be returning u64 mask value instead of int. Otherwise the mask value returned can be incorrect for larger vectors. Fixes: e26a5843f7f5 ("NTB: Split ntb_hw_intel and ntb_transport drivers") Signed-off-by: Dave Jiang Tested-by: Lucas Van Signed-off-by: Jon Mason commit a861594b1b7ffd630f335b351c4e9f938feadb8e Author: Jon Mason Date: Mon Jun 11 16:13:12 2018 -0400 ntb_netdev: fix sleep time mismatch The tx_time should be in usecs (according to the comment above the variable), but the setting of the timer during the rearming is done in msecs. Change it to match the expected units. Fixes: e74bfeedad08 ("NTB: Add flow control to the ntb_netdev") Suggested-by: Gerd W. Haeussler Signed-off-by: Jon Mason Acked-by: Dave Jiang commit e2acdddde01511c74e4f6f1d5951a0f5d9bea14a Merge: c4d63c714715 a5ee171d087e Author: David S. Miller Date: Wed Oct 31 12:56:59 2018 -0700 Merge branch 'mlxsw-Enable-minimum-shaper-on-MC-TCs' Ido Schimmel says: ==================== mlxsw: Enable minimum shaper on MC TCs Petr says: An MC-aware mode was introduced in commit 7b8195306694 ("mlxsw: spectrum: Configure MC-aware mode on mlxsw ports"). In MC-aware mode, BUM traffic gets a special treatment by being assigned to a separate set of traffic classes 8..15. Pairs of TCs 0 and 8, 1 and 9, etc., are then configured to strictly prioritize the lower-numbered ones. The intention is to prevent BUM traffic from flooding the switch and push out all UC traffic, which would otherwise happen, and instead give UC traffic precedence. However strictly prioritizing UC traffic has the effect that UC overload pushes out all BUM traffic, such as legitimate ARP queries. These packets are kept in queues for a while, but under sustained UC overload, their lifetime eventually expires and these packets are dropped. That is detrimental to network performance as well. In this patchset, MC TCs (8..15) are configured with minimum shaper of 200Mbps (a minimum permitted value) to allow a trickle of necessary control traffic to get through. First in patch #1, the QEEC register is extended with fields necessary to configure the minimum shaper. In patch #2, minimum shaper is enabled on TCs 8..15. In patches #3 and #4, first the MC-awareness test is tweaked to support the minimum shaper, and then a new test is introduced to test that MC traffic behaves well under UC overload. ==================== Signed-off-by: David S. Miller commit a5ee171d087ee632a5f190bb3ce1c0f98e06ec0a Author: Petr Machata Date: Wed Oct 31 09:56:46 2018 +0000 selftests: mlxsw: qos_mc_aware: Add a test for UC awareness In a previous patch, mlxsw was updated to configure a minimum bandwidth allowance on MC TCs. Test that this indeed fixes the problem of UC traffic overload pushing out all MC traffic. Fixes: b5638d46c90a ("selftests: mlxsw: Add a test for UC behavior under MC flood") Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 8f3f09358c81248109463b3cae254b7db4ea9af0 Author: Petr Machata Date: Wed Oct 31 09:56:45 2018 +0000 selftests: mlxsw: qos_mc_aware: Tweak for min shaper Since the minimum shaper is now being enabled for MC TCs, it's unreasonable to expect no UC traffic loss. Minimal min shaper value is 200Mbps, which is 20% of the 1Gbps that this test configures on egress. To cover for glitches, tolerate up to 25% UC degradation under MC overload. Fixes: b5638d46c90a ("selftests: mlxsw: Add a test for UC behavior under MC flood") Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 0fe64023162aef123de2f1993ba13a35a786e1de Author: Petr Machata Date: Wed Oct 31 09:56:44 2018 +0000 mlxsw: spectrum: Set minimum shaper on MC TCs An MC-aware mode was introduced in commit 7b8195306694 ("mlxsw: spectrum: Configure MC-aware mode on mlxsw ports"). In MC-aware mode, BUM traffic gets a special treatment by being assigned to a separate set of traffic classes 8..15. Pairs of TCs 0 and 8, 1 and 9, etc., are then configured to strictly prioritize the lower-numbered ones. The intention is to prevent BUM traffic from flooding the switch and push out all UC traffic, which would otherwise happen, and instead give UC traffic precedence. However strictly prioritizing UC traffic has the effect that UC overload pushes out all BUM traffic, such as legitimate ARP queries. These packets are kept in queues for a while, but under sustained UC overload, their lifetime eventually expires and these packets are dropped. That is detrimental to network performance as well. Therefore configure the MC TCs (8..15) with minimum shaper of 200Mbps (a minimum permitted value) to allow a trickle of necessary control traffic to get through. Fixes: 7b8195306694 ("mlxsw: spectrum: Configure MC-aware mode on mlxsw ports") Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 8b931821aa04823e2e5df0ae93937baabbd23286 Author: Petr Machata Date: Wed Oct 31 09:56:42 2018 +0000 mlxsw: reg: QEEC: Add minimum shaper fields Add QEEC.mise (minimum shaper enable) and QEEC.min_shaper_rate to enable configuration of minimum shaper. Increase the QEEC length to 0x20 as well: that's the length that the register has had for a long time now, but with the configurations that mlxsw typically exercises, the firmware tolerated 0x1C-sized packets. With mise=true however, FW rejects packets unless they have the full required length. Fixes: b9b7cee40579 ("mlxsw: reg: Add QoS ETS Element Configuration register") Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit c4d63c714715bc44fee3f7a818052e59216a7d8e Merge: d48051c5b837 29118ab962d5 Author: David S. Miller Date: Wed Oct 31 12:42:39 2018 -0700 Merge branch 'hns3-fixes' Huazhong Tan says: ==================== Bugfix for the HNS3 driver This patch series include bugfix for the HNS3 ethernet controller driver. Change log: V4->V5: Fixes comments from Joe Perches & Sergei Shtylyov V3->V4: Fixes comments from Sergei Shtylyov V2->V3: Fixes comments from Sergei Shtylyov V1->V2: Fixes the compilation break reported by kbuild test robot http://patchwork.ozlabs.org/patch/989818/ ==================== Signed-off-by: David S. Miller commit 29118ab962d5476fdc65fae312ac38db68092d78 Author: Huazhong Tan Date: Tue Oct 30 21:50:53 2018 +0800 net: hns3: bugfix for rtnl_lock's range in the hclgevf_reset() Since hclgevf_reset_wait() is used to wait for the hardware to complete the reset, it is not necessary to hold the rtnl_lock during hclgevf_reset_wait(). So this patch releases the lock for the duration of hclgevf_reset_wait(). Fixes: 6988eb2a9b77 ("net: hns3: Add support to reset the enet/ring mgmt layer") Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit a963052e539887df481d4d3a6ad4c92ca6461852 Author: Huazhong Tan Date: Tue Oct 30 21:50:52 2018 +0800 net: hns3: bugfix for rtnl_lock's range in the hclge_reset() Since hclge_reset_wait() is used to wait for the hardware to complete the reset, it is not necessary to hold the rtnl_lock during hclge_reset_wait(). So this patch releases the lock for the duration of hclge_reset_wait(). Fixes: 6d4fab39533f ("net: hns3: Reset net device with rtnl_lock") Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 3c88ed1d798da355859ca083d3884a16ce0841f2 Author: Huazhong Tan Date: Tue Oct 30 21:50:51 2018 +0800 net: hns3: bugfix for handling mailbox while the command queue reinitialized In a multi-core machine, the mailbox service and reset service will be executed at the same time. The reset service will re-initialize the command queue, before that, the mailbox handler can only get some invalid messages. The HCLGE_STATE_CMD_DISABLE flag means that the command queue is not available and needs to be reinitialized. Therefore, when the mailbox handler recognizes this flag, it should not process the command. Fixes: dde1a86e93ca ("net: hns3: Add mailbox support to PF driver") Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 7fa6be4fd2f60399f3f3370a87629e102407a724 Author: Huazhong Tan Date: Tue Oct 30 21:50:50 2018 +0800 net: hns3: fix incorrect return value/type of some functions There are some functions that, when they fail to send the command, need to return the corresponding error value to its caller. Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support") Fixes: 681ec3999b3d ("net: hns3: fix for vlan table lost problem when resetting") Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 1c12493809924deda6c0834cb2f2c5a6dc786390 Author: Huazhong Tan Date: Tue Oct 30 21:50:49 2018 +0800 net: hns3: bugfix for hclge_mdio_write and hclge_mdio_read When there is a PHY, the driver needs to complete some operations through MDIO during reset reinitialization, so HCLGE_STATE_CMD_DISABLE is more suitable than HCLGE_STATE_RST_HANDLING to prevent the MDIO operation from being sent during the hardware reset. Fixes: b50ae26c57cb ("net: hns3: never send command queue message to IMP when reset) Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 6d71ec6cbf74ac9c2823ef751b1baa5b889bb3ac Author: Huazhong Tan Date: Tue Oct 30 21:50:48 2018 +0800 net: hns3: bugfix for is_valid_csq_clean_head() The HEAD pointer of the hardware command queue maybe equal to the command queue's next_to_use in the driver, so that does not belong to the invalid HEAD pointer, since the hardware may not process the command in time, causing the HEAD pointer to be too late to update. The variables' name in this function is unreadable, so give them a more readable one. Fixes: 3ff504908f95 ("net: hns3: fix a dead loop in hclge_cmd_csq_clean") Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 5faaf0752a0c43735b7c508dcf3c4c7b36a032db Author: Huazhong Tan Date: Tue Oct 30 21:50:47 2018 +0800 net: hns3: remove unnecessary queue reset in the hns3_uninit_all_ring() It is not necessary to reset the queue in the hns3_uninit_all_ring(), since the queue is stopped in the down operation, and will be reset in the up operation. And the judgment of the HCLGE_STATE_RST_HANDLING flag in the hclge_reset_tqp() is not correct, because we need to reset tqp during pf reset, otherwise it may cause queue not being reset to working state problem. Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC") Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit b2f74dbaf12bf59ff35d451005b3cdee78232ff0 Author: Huazhong Tan Date: Tue Oct 30 21:50:46 2018 +0800 net: hns3: bugfix for the initialization of command queue's spin lock The spin lock of the command queue only need to be initialized once when the driver initializes the command queue. It is not necessary to initialize the spin lock when resetting. At the same time, the modification of the queue member should be performed after acquiring the lock. Fixes: 3efb960f056d ("net: hns3: Refactor the initialization of command queue") Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 0d4411408a7fb9aad0645f23911d9bfdd2ce3177 Author: Huazhong Tan Date: Tue Oct 30 21:50:45 2018 +0800 net: hns3: bugfix for reporting unknown vector0 interrupt repeatly problem The current driver supports handling two vector0 interrupts, reset and mailbox. When the hardware reports an interrupt of another type of interrupt source, if the driver does not process the interrupt, but enables the interrupt, the hardware will repeatedly report the unknown interrupt. Therefore, the driver enables the vector0 interrupt after clearing the known type of interrupt source. Other conditions are not enabled. Fixes: cd8c5c269b1d ("net: hns3: Fix for hclge_reset running repeatly problem") Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit 73b907a083b8a8c1c62cb494bc9fbe6ae086c460 Author: Huazhong Tan Date: Tue Oct 30 21:50:44 2018 +0800 net: hns3: bugfix for buffer not free problem during resetting When hns3_get_ring_config()/hns3_queue_to_ring()/ hns3_get_vector_ring_chain() failed during resetting, the allocated memory has not been freed before these three functions return. So this patch adds error handler in these functions to fix it. Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC") Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit ece4bf46e98c9f3775a488f3932a531508d3b1a2 Author: Huazhong Tan Date: Tue Oct 30 21:50:43 2018 +0800 net: hns3: add error handler for hns3_nic_init_vector_data() When hns3_nic_init_vector_data() fails to map ring to vector, it should cancel the netif_napi_add() that has been successfully done and then exits. Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC") Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller commit d48051c5b8376038c2b287c3b1bd55b8d391d567 Author: Eric Dumazet Date: Tue Oct 30 00:57:25 2018 -0700 net/mlx5e: fix csum adjustments caused by RXFCS As shown by Dmitris, we need to use csum_block_add() instead of csum_add() when adding the FCS contribution to skb csum. Before 4.18 (more exactly commit 88078d98d1bb "net: pskb_trim_rcsum() and CHECKSUM_COMPLETE are friends"), the whole skb csum was thrown away, so RXFCS changes were ignored. Then before commit d55bef5059dd ("net: fix pskb_trim_rcsum_slow() with odd trim offset") both mlx5 and pskb_trim_rcsum_slow() bugs were canceling each other. Now we fixed pskb_trim_rcsum_slow() we need to fix mlx5. Note that this patch also rewrites mlx5e_get_fcs() to : - Use skb_header_pointer() instead of reinventing it. - Use __get_unaligned_cpu32() to avoid possible non aligned accesses as Dmitris pointed out. Fixes: 902a545904c7 ("net/mlx5e: When RXFCS is set, add FCS data into checksum calculation") Reported-by: Paweł Staszewski Signed-off-by: Eric Dumazet Cc: Eran Ben Elisha Cc: Saeed Mahameed Cc: Dimitris Michailidis Cc: Cong Wang Cc: Paweł Staszewski Reviewed-by: Eran Ben Elisha Tested-By: Maria Pasechnik Signed-off-by: David S. Miller commit ff002269a4ee9c769dbf9365acef633ebcbd6cbe Author: Jason Wang Date: Tue Oct 30 14:10:49 2018 +0800 vhost: Fix Spectre V1 vulnerability The idx in vhost_vring_ioctl() was controlled by userspace, hence a potential exploitation of the Spectre variant 1 vulnerability. Fixing this by sanitizing idx before using it to index d->vqs. Cc: Michael S. Tsirkin Cc: Josh Poimboeuf Cc: Andrea Arcangeli Signed-off-by: Jason Wang Signed-off-by: David S. Miller commit b1c234441e07da748ccded3aaa37177622d469d3 Author: Bo YU Date: Mon Oct 29 23:42:10 2018 -0400 net: drop a space before tabs Fix a warning from checkpatch.pl:'please no space before tabs' in include/net/af_unix.h Signed-off-by: Bo YU Signed-off-by: David S. Miller commit c4147beabec19fc7b37eb79251114bad3e9915dd Author: Bo YU Date: Mon Oct 29 23:42:09 2018 -0400 net: add an identifier name for 'struct sock *' Fix a warning from checkpatch: function definition argument 'struct sock *' should also have an identifier name in include/net/af_unix.h. Signed-off-by: Bo YU Signed-off-by: David S. Miller commit e7611088f0357339d8c30540222debfa24095d4b Author: Colin Ian King Date: Mon Oct 29 22:46:11 2018 +0000 net: hns3: fix spelling mistake "intrerrupt" -> "interrupt" Trivial fix to spelling mistake in dev_err message Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit ef70696a63c773280ef46f5764a6cda39ef2f383 Merge: 9b4789eacb65 0ef08ca36a3a Author: Palmer Dabbelt Date: Wed Oct 31 12:13:54 2018 -0700 lib: Remove umoddi3 and udivmoddi4 These were only necessary for an out-of-tree driver that has since been fixed to use the proper divide routines. I've simply reverted the pair of commits we made last week. Signed-off-by: Palmer Dabbelt commit 9b4789eacb654b7bbc806c831bcebd799ae0e2f5 Author: Palmer Dabbelt Date: Mon Jun 25 13:23:12 2018 -0700 Move EM_RISCV into elf-em.h This should never have been inside our arch port to begin with, it's just a relic from when we were maintaining out of tree patches. Reviewed-by: Kees Cook Reviewed-by: Paul Walmsley Reviewed-by: Christoph Hellwig Tested-by: David Abdurachmanov Signed-off-by: Palmer Dabbelt commit 732e8e4130ffccb618390e0f80a884543e61fd61 Author: Andreas Schwab Date: Tue Oct 23 09:33:47 2018 +0200 RISC-V: properly determine hardware caps On the Hifive-U platform, cpu 0 is a masked cpu with less capabilities than the other cpus. Ignore it for the purpose of determining the hardware capabilities of the system. Signed-off-by: Andreas Schwab Signed-off-by: Palmer Dabbelt commit 0ef08ca36a3aafbf0dcce7b3c2c4b6b664ce56bd Author: Palmer Dabbelt Date: Fri Oct 26 12:38:11 2018 -0700 Revert "lib: Add umoddi3 and udivmoddi4 of GCC library routines" We don't want 64-bit divide in the kernel. This reverts commit 6315730e9eab7de5fa9864bb13a352713f48aef1. Signed-off-by: Palmer Dabbelt commit 3b306f6f3a03c285a7044350d263cb9251def49d Author: Palmer Dabbelt Date: Fri Oct 26 12:37:43 2018 -0700 Revert "RISC-V: Select GENERIC_LIB_UMODDI3 on RV32" I'm removing the generic 64-bit divide support, which means this will no longer work. This reverts commit 757331db921428295948fed5e7377a436e66d34e. Signed-off-by: Palmer Dabbelt commit a9ac6cc47bbb0fdd042012044f737ba13da10cb4 Merge: d547d44e5c5d 217188d9f985 Author: Linus Torvalds Date: Wed Oct 31 11:41:37 2018 -0700 Merge tag 'fbdev-v4.20' of https://github.com/bzolnier/linux Pull fbdev updates from Bartlomiej Zolnierkiewicz: "No major changes to the subsystem itself, mainly fb drivers fixes & cleanups (atyfb & udlfb updates stand out from the rest) + removal of no longer needed old clps711xfb driver. Details: - update atyfb driver - improvements for ATI Mach64 chips: detect the dot clock divider correctly on Sparc, fix display corruptions (due to endianness issues and improper reading of accelerator registers), optimize scrolling performance and also fix debugging printks (Mikulas Patocka) - rewrite USB unplug handling in udlfb driver using framebuffer subsystem reference counting (Mikulas Patocka) - fix support for native-mode display-timings in atmel_lcdfb driver (Sam Ravnborg) - fix information leak & add missing access_ok() checks in sbuslib (Dan Carpenter) - allow using GPIO expanders that can sleep in ssd1307fb driver (Michal Vokáč) - convert omapfb driver to use GPIO descriptors instead of GPIO numbers for Amstrad Delta board (Janusz Krzysztofik) - fix broken Kconfig menu dependencies (Randy Dunlap) - convert fbdev subsystem to use %pOFn instead of device_node.name (Rob Herring) - remove the dead old CLPS711x LCD support driver (the new CLPS711x LCD support driver is still available) - misc fixes (Jia-Ju Bai, Gustavo A. R. Silva) - misc cleanups (Mehdi Bounya, Nathan Chancellor, YueHaibing)" * tag 'fbdev-v4.20' of https://github.com/bzolnier/linux: (22 commits) video: fbdev: remove redundant 'default n' from Kconfig-s video: fbdev: remove dead old CLPS711x LCD support driver Revert "video: ssd1307fb: Do not hard code active-low reset sequence" video: fbdev: arcfb: mark expected switch fall-through pxa168fb: remove set but not used variables 'mi' video: ssd1307fb: Do not hard code active-low reset sequence video: ssd1307fb: Use gpiod_set_value_cansleep() for reset fbdev: fix broken menu dependencies video: fbdev: sis: Remove unnecessary parentheses and commented code video: fbdev: omapfb: lcd_ams_delta: use GPIO lookup table fbdev: sbuslib: integer overflow in sbusfb_ioctl_helper() fbdev: sbuslib: use checked version of put_user() fbdev: Convert to using %pOFn instead of device_node.name atmel_lcdfb: support native-mode display-timings Video: vgastate: fixed a spacing coding style atyfb: fix debugging printks mach64: optimize wait_for_fifo mach64: fix image corruption due to reading accelerator registers mach64: fix display corruption on big endian machines mach64: detect the dot clock divider correctly on sparc ... commit d547d44e5c5dd82b32c2399632b254395a099072 Merge: 519f64bf15dc c2b59d279dbb Author: Linus Torvalds Date: Wed Oct 31 11:28:12 2018 -0700 Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux Pull thermal management updates from Zhang Rui: - Fix a use-after-free issue when unregistering a thermal cooling device (Dmitry Osipenko) - use power_efficient_wq for thermal worker to save more power (Jeson Gao) * 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux: thermal: core: using power_efficient_wq for thermal worker thermal: core: Fix use-after-free in thermal_cooling_device_destroy_sysfs commit a324e9396ca3d00e1101476ba067b412e0aba232 Author: Borislav Petkov Date: Wed Oct 31 19:20:20 2018 +0100 EDAC, skx: Fix randconfig builds The driver depends on the ADXL component glue and selects it. However, ADXL itself implicitly depends on ACPI and in nonsensical randconfig builds like this: # CONFIG_ACPI is not set CONFIG_ACPI_ADXL=y where ACPI is not enabled, the build fails with: drivers/edac/skx_edac.o: In function `skx_mce_check_error': skx_edac.c:(.text+0xab): undefined reference to `adxl_decode' drivers/edac/skx_edac.o: In function `skx_init': skx_edac.c:(.init.text+0x8bf): undefined reference to `adxl_get_component_names' make: *** [vmlinux] Error 1 Add stubs for that case so that the build succeeds. CONFIG_ACPI=n doesn't make any sense for real configurations but this fix will at least silence randconfig builds. Signed-off-by: Borislav Petkov Acked-by: Tony Luck Cc: "Rafael J. Wysocki" commit 519f64bf15dccb4f64af34b74ed186c32363ab59 Merge: 0c86e761b951 9a1d6b232bed Author: Linus Torvalds Date: Wed Oct 31 11:08:30 2018 -0700 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk updates from Stephen Boyd: "This time it looks like a quieter release cycle in the clk tree. I guess that's because of summer time holidays/vacations. The biggest change in the diffstat is in the Qualcomm clk driver, where they got support for CPUs and handful of SoCs. After that, the at91 driver got a major rewrite for newer DT bindings that should make things easier going forward and the TI code moved to a clockdomain based design. The long tail is mostly small driver updates for newer clks and some simpler SoC clock drivers such as the Hisilicon and imx support. In the core framework, we only have two small changes this time. One is a new clk API to get all clks for a device with the bulk clk APIs. This allows drivers that don't care about doing anything besides turning on all the clks to just clk_get() them all and turn them on. The other change is the beginning of a way to support save and restore of clk settings in the clk framework. TI is the only user right now, but we will want to expand upon this design in the future to support more save and restore of clk registers. At least this gets us started and works well enough for one SoC, but there's more work in the future. Core: - clk_bulk_get_all() API and friends to get all the clks for a device - Basic clk state save/restore hooks New Drivers: - Renesas RZ/A2 (R7S9210) SoC, including early clocks - Rensas RZ/G1N (R8A7744) and RZ/G2E (R8A774C0) SoCs - Rensas RZ/G2M (r8a774a1) SoC - Qualcomm Krait CPU clk support - Qualcomm QCS404 GCC support - Qualcomm SDM660 GCC support - Qualcomm SDM845 camera clock controller - Ingenic jz4725b CGU - Hisilicon 3670 SoC support - TI SCI clks on K3 SoCs - iMX6 MMDC clks - Reset Controller (RMU) support for Actions Semi Owl S900 and S700 SoCs Updates: - Rework at91 PMC clock driver for new DT bindings - Nvidia Tegra clk driver MBIST workaround fix - S2RAM support for Marvell mvebu periph clks - Use updated printk format for OF node names - Fix TI code to only search DT subnodes - Various static analysis finds - Tag various drivers with SPDX license tags - Support dynamic frequency switching (DFS) on qcom SDM845 GCC - Only use s2mps11 dt-binding defines instead of redefining them in the driver - Add some more missing clks to qcom MSM8996 GCC - Quad SPI clks on qcom SDM845 - Add support for CMT timer clocks on R-Car V3H - Add support for SHDI and various timer clocks on R-Car V3M - Improve OSC and RCLK (watchdog) handling on R-Car Gen3 SoCs - Amlogic clk-pll driver improvements and updates - Amlogic axg audio controller system clocks - Register Amlogic meson8b clock controller early - Add support for SATA and Fine Display Processor (FDP) clocks on R-Car M3-N - Consolidation of system suspend related code in Exynos, S5P, S3C SoC clk drivers - Fixes for system suspend support on Exynos542x (Odroid boards) and Exynos5433 SoC - Remove obsoleted Exynos4212 ISP clock definitions - Migrated TI am3/4/5 and dra7 SoCs to clockdomain based design - TI RTC+DDR sleep mode support for clock save/restore - Allwinner A64 display engine support and fixes - Allwinner A83t display engine support and fixes" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (186 commits) clk: qcom: Remove unused arrays in SDM845 GCC clk: fixed-rate: fix of_node_get-put imbalance clk: s2mps11: Add used attribute to s2mps11_dt_match clk: qcom: gcc-sdm660: Add MODULE_LICENSE clk: qcom: Add safe switch hook for krait mux clocks dt-bindings: clock: Document qcom,krait-cc clk: qcom: Add Krait clock controller driver dt-bindings: arm: Document qcom,kpss-gcc clk: qcom: Add KPSS ACC/GCC driver clk: qcom: Add support for Krait clocks clk: qcom: Add IPQ806X's HFPLLs clk: qcom: Add MSM8960/APQ8064's HFPLLs dt-bindings: clock: Document qcom,hfpll clk: qcom: Add HFPLL driver clk: qcom: Add support for High-Frequency PLLs (HFPLLs) ARM: Add Krait L2 register accessor functions clk: imx6q: add mmdc0 ipg clock clk: imx6sl: add mmdc ipg clocks clk: imx6sll: add mmdc1 ipg clock clk: imx6sx: add mmdc1 ipg clock ... commit 6702185c1ffec3421181b5e24491e3fac920cb61 Author: Radoslaw Tyl Date: Mon Oct 22 08:44:31 2018 +0200 ixgbe: fix MAC anti-spoofing filter after VFLR This change resolves a driver bug where the driver is logging a message that says "Spoofed packets detected". This can occur on the PF (host) when a VF has VLAN+MACVLAN enabled and is re-started with a different MAC address. MAC and VLAN anti-spoofing filters are to be enabled together. Signed-off-by: Radoslaw Tyl Tested-by: Andrew Bowers Acked-by: Piotr Skajewski Signed-off-by: Jeff Kirsher commit 0c86e761b95131943c2b8af2ffb3c0554f9a71f5 Merge: b3491d8430dd 104c7405a64d Author: Linus Torvalds Date: Wed Oct 31 11:01:38 2018 -0700 Merge tag 'vfio-v4.20-rc1.v2' of git://github.com/awilliam/linux-vfio Pull VFIO updates from Alex Williamson: - EDID interfaces for vfio devices supporting display extensions (Gerd Hoffmann) - Generically select Type-1 IOMMU model support on ARM/ARM64 (Geert Uytterhoeven) - Quirk for VFs reporting INTx pin (Alex Williamson) - Fix error path memory leak in MSI support (Li Qiang) * tag 'vfio-v4.20-rc1.v2' of git://github.com/awilliam/linux-vfio: vfio: add edid support to mbochs sample driver vfio: add edid api for display (vgpu) devices. drivers/vfio: Allow type-1 IOMMU instantiation with all ARM/ARM64 IOMMUs vfio/pci: Mask buggy SR-IOV VF INTx support vfio/pci: Fix potential memory leak in vfio_msi_cap_len commit bb58fd7eeffc9bd5d6e2a16cbf0e9e259f8d09f2 Author: Mitch Williams Date: Fri Oct 19 14:11:03 2018 -0700 i40e: Update status codes Add a few new status code which will be used by the ice driver, and rename a few to make them more consistent. Error code are mapped to similar values as in i40e_status.h, so as to be compatible with older VF drivers not using this status enum. Signed-off-by: Mitch Williams Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit b3491d8430dd25f0a4e00c33d60da22a9bd9d052 Merge: 59fc453b21f7 e4183d3256e3 Author: Linus Torvalds Date: Wed Oct 31 10:53:29 2018 -0700 Merge tag 'media/v4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull new experimental media request API from Mauro Carvalho Chehab: "A new media request API This API is needed to support device drivers that can dynamically change their parameters for each new frame. The latest versions of Google camera and codec HAL depends on such feature. At this stage, it supports only stateless codecs. It has been discussed for a long time (at least over the last 3-4 years), and we finally reached to something that seem to work. This series contain both the API and core changes required to support it and a new m2m decoder driver (cedrus). As the current API is still experimental, the only real driver using it (cedrus) was added at staging[1]. We intend to keep it there for a while, in order to test the API. Only when we're sure that this API works for other cases (like encoders), we'll move this driver out of staging and set the API into a stone. [1] We added support for the vivid virtual driver (used only for testing) to it too, as it makes easier to test the API for the ones that don't have the cedrus hardware" * tag 'media/v4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (53 commits) media: dt-bindings: Document the Rockchip VPU bindings media: platform: Add Cedrus VPU decoder driver media: dt-bindings: media: Document bindings for the Cedrus VPU driver media: v4l: Add definition for the Sunxi tiled NV12 format media: v4l: Add definitions for MPEG-2 slice format and metadata media: videobuf2-core: Rework and rename helper for request buffer count media: v4l2-ctrls.c: initialize an error return code with zero media: v4l2-compat-ioctl32.c: add missing documentation for a field media: media-request: update documentation media: media-request: EPERM -> EACCES/EBUSY media: v4l2-ctrls: improve media_request_(un)lock_for_update media: v4l2-ctrls: use media_request_(un)lock_for_access media: media-request: add media_request_(un)lock_for_access media: vb2: set reqbufs/create_bufs capabilities media: videodev2.h: add new capabilities for buffer types media: buffer.rst: only set V4L2_BUF_FLAG_REQUEST_FD for QBUF media: v4l2-ctrls: return -EACCES if request wasn't completed media: media-request: return -EINVAL for invalid request_fds media: vivid: add request support media: vivid: add mc ... commit 48e01e001da31d5a40e31ed5f8cea83a18823cc1 Author: Jeff Kirsher Date: Thu Oct 18 15:39:43 2018 -0700 ixgbe/ixgbevf: fix XFRM_ALGO dependency Based on the original work from Arnd Bergmann. When XFRM_ALGO is not enabled, the new ixgbe IPsec code produces a link error: drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.o: In function `ixgbe_ipsec_vf_add_sa': ixgbe_ipsec.c:(.text+0x1266): undefined reference to `xfrm_aead_get_byname' Simply selecting XFRM_ALGO from here causes circular dependencies, so to fix it, we probably want this slightly more complex solution that is similar to what other drivers with XFRM offload do: A separate Kconfig symbol now controls whether we include the IPsec offload code. To keep the old behavior, this is left as 'default y'. The dependency in XFRM_OFFLOAD still causes a circular dependency but is not actually needed because this symbol is not user visible, so removing that dependency on top makes it all work. CC: Arnd Bergmann CC: Shannon Nelson Fixes: eda0333ac293 ("ixgbe: add VF IPsec management") Signed-off-by: Jeff Kirsher Tested-by: Andrew Bowers commit 35ae5414e7085dfabe3d1737569eff549b04942e Author: Jacob Keller Date: Mon Oct 15 12:21:28 2018 -0700 fm10k: bump driver version to match out-of-tree release The upstream and out-of-tree drivers are once again at comparable functionality. It's been a while since we updated the upstream driver version, so bump it now. Signed-off-by: Jacob Keller Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 9a1fe1e2bbc4194103bd6f5f8d78383d3bef41ae Author: Jacob Keller Date: Mon Oct 15 12:18:29 2018 -0700 fm10k: add missing device IDs to the upstream driver The device IDs for the Ethernet SDI Adapter devices were never added to the upstream driver. The IDs are already in the pci.ids database, and are supported by the out-of-tree driver. Add the device IDs now, so that the upstream driver can recognize and load these devices. Signed-off-by: Jacob Keller Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit e330af788998b0de4da4f5bd7ddd087507999800 Author: Jacob Keller Date: Mon Oct 15 12:18:28 2018 -0700 fm10k: ensure completer aborts are marked as non-fatal after a resume VF drivers can trigger PCIe completer aborts any time they read a queue that they don't own. Even in nominal circumstances, it is not possible to prevent the VF driver from reading queues it doesn't own. VF drivers may attempt to read queues it previously owned, but which it no longer does due to a PF reset. Normally these completer aborts aren't an issue. However, on some platforms these trigger machine check errors. This is true even if we lower their severity from fatal to non-fatal. Indeed, we already have code for lowering the severity. We could attempt to mask these errors conditionally around resets, which is the most common time they would occur. However this would essentially be a race between the PF and VF drivers, and we may still occasionally see machine check exceptions on these strictly configured platforms. Instead, mask the errors entirely any time we resume VFs. By doing so, we prevent the completer aborts from being sent to the parent PCIe device, and thus these strict platforms will not upgrade them into machine check errors. Additionally, we don't lose any information by masking these errors, because we'll still report VFs which attempt to access queues via the FUM_BAD_VF_QACCESS errors. Without this change, on platforms where completer aborts cause machine check exceptions, the VF reading queues it doesn't own could crash the host system. Masking the completer abort prevents this, so we should mask it for good, and not just around a PCIe reset. Otherwise malicious or misconfigured VFs could cause the host system to crash. Because we are masking the error entirely, there is little reason to also keep setting the severity bit, so that code is also removed. Signed-off-by: Jacob Keller Signed-off-by: Jeff Kirsher commit e69e40c8066c0e2fafd63a5919cb9b2fb9f81f2e Author: Ngai-Mint Kwan Date: Mon Oct 15 12:18:27 2018 -0700 fm10k: fix SM mailbox full condition Current condition will always incorrectly report a full SM mailbox if an IES API application is not running. Due to this, the "fm10k_service_task" will be infinitely queued into the driver's workqueue. This, in turn, will cause a "kworker" thread to report 100% CPU utilization and might cause "soft lockup" events or system crashes. To fix this issue, a new condition is added to determine if the SM mailbox is in the correct state of FM10K_STATE_OPEN before proceeding. In other words, an instance of the IES API must be running. If there is, the remainder of the flow stays the same which is to determine if the SM mailbox capacity has been exceeded or not and take appropriate action. Signed-off-by: Ngai-Mint Kwan Signed-off-by: Jacob Keller Signed-off-by: Jeff Kirsher commit 094bf4d0e9657f6ea1ee3d7e07ce3970796949ce Author: Miroslav Lichvar Date: Fri Oct 12 13:13:39 2018 +0200 igb: shorten maximum PHC timecounter update interval The timecounter needs to be updated at least once per ~550 seconds in order to avoid a 40-bit SYSTIM timestamp to be misinterpreted as an old timestamp. Since commit 500462a9d ("timers: Switch to a non-cascading wheel"), scheduling of delayed work seems to be less accurate and a requested delay of 540 seconds may actually be longer than 550 seconds. Shorten the delay to 480 seconds to be sure the timecounter is updated in time. This fixes an issue with HW timestamps on 82580/I350/I354 being off by ~1100 seconds for few seconds every ~9 minutes. Cc: Jacob Keller Cc: Richard Cochran Cc: Thomas Gleixner Signed-off-by: Miroslav Lichvar Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher commit 59fc453b21f767f2fb0ff4dc0a947e9b9c9e6d14 Merge: 310c7585e830 2ebe82288b32 Author: Linus Torvalds Date: Wed Oct 31 09:25:15 2018 -0700 Merge branch 'akpm' (patches from Andrew) Merge more updates from Andrew Morton: - the rest of MM - lib/bitmap updates - hfs updates - fatfs updates - various other misc things * emailed patches from Andrew Morton : (94 commits) mm/gup.c: fix __get_user_pages_fast() comment mm: Fix warning in insert_pfn() memory-hotplug.rst: add some details about locking internals powerpc/powernv: hold device_hotplug_lock when calling memtrace_offline_pages() powerpc/powernv: hold device_hotplug_lock when calling device_online() mm/memory_hotplug: fix online/offline_pages called w.o. mem_hotplug_lock mm/memory_hotplug: make add_memory() take the device_hotplug_lock mm/memory_hotplug: make remove_memory() take the device_hotplug_lock mm/memblock.c: warn if zero alignment was requested memblock: stop using implicit alignment to SMP_CACHE_BYTES docs/boot-time-mm: remove bootmem documentation mm: remove include/linux/bootmem.h memblock: replace BOOTMEM_ALLOC_* with MEMBLOCK variants mm: remove nobootmem memblock: rename __free_pages_bootmem to memblock_free_pages memblock: rename free_all_bootmem to memblock_free_all memblock: replace free_bootmem_late with memblock_free_late memblock: replace free_bootmem{_node} with memblock_free mm: nobootmem: remove bootmem allocation APIs memblock: replace alloc_bootmem with memblock_alloc ... commit 5d4f0edaa3ac4f1844ed7c64cd2bae6f1912bac5 Author: Adrian Hunter Date: Wed Oct 31 11:10:43 2018 +0200 perf intel-pt/bts: Calculate cpumode for synthesized samples In the absence of a fallback, samples must provide a correct cpumode for the 'ip'. Do that now there is no fallback. Signed-off-by: Adrian Hunter Reviewed-by: Jiri Olsa Cc: Andi Kleen Cc: David S. Miller Cc: Leo Yan Cc: Mathieu Poirier Cc: stable@vger.kernel.org # 4.19 Link: http://lkml.kernel.org/r/20181031091043.23465-6-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 242483068b4b9ad02f1653819b6e683577681e0e Author: Adrian Hunter Date: Wed Oct 31 11:10:42 2018 +0200 perf intel-pt: Insert callchain context into synthesized callchains In the absence of a fallback, callchains must encode also the callchain context. Do that now there is no fallback. Signed-off-by: Adrian Hunter Reviewed-by: Jiri Olsa Cc: Andi Kleen Cc: David S. Miller Cc: Leo Yan Cc: Mathieu Poirier Cc: stable@vger.kernel.org # 4.19 Link: http://lkml.kernel.org/r/100ea2ec-ed14-b56d-d810-e0a6d2f4b069@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 2ebe82288b3278b8e538ee8adce4142dbdedd8f6 Author: Fengguang Wu Date: Tue Oct 30 15:10:51 2018 -0700 mm/gup.c: fix __get_user_pages_fast() comment mmu_gather_tlb() no longer exists. Replace with mmu_table_batch(). Link: http://lkml.kernel.org/r/20180928053441.rpzwafzlsnp74mkl@wfg-t540p.sh.intel.com Signed-off-by: Fengguang Wu Reviewed-by: Andrew Morton Cc: Jiri Kosina Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f2c57d91b0d96aa13ccff4e3b178038f17b00658 Author: Jan Kara Date: Tue Oct 30 15:10:47 2018 -0700 mm: Fix warning in insert_pfn() In DAX mode a write pagefault can race with write(2) in the following way: CPU0 CPU1 write fault for mapped zero page (hole) dax_iomap_rw() iomap_apply() xfs_file_iomap_begin() - allocates blocks dax_iomap_actor() invalidate_inode_pages2_range() - invalidates radix tree entries in given range dax_iomap_pte_fault() grab_mapping_entry() - no entry found, creates empty ... xfs_file_iomap_begin() - finds already allocated block ... vmf_insert_mixed_mkwrite() - WARNs and does nothing because there is still zero page mapped in PTE unmap_mapping_pages() This race results in WARN_ON from insert_pfn() and is occasionally triggered by fstest generic/344. Note that the race is otherwise harmless as before write(2) on CPU0 is finished, we will invalidate page tables properly and thus user of mmap will see modified data from write(2) from that point on. So just restrict the warning only to the case when the PFN in PTE is not zero page. Link: http://lkml.kernel.org/r/20180824154542.26872-1-jack@suse.cz Signed-off-by: Jan Kara Reviewed-by: Andrew Morton Cc: Ross Zwisler Cc: Dan Williams Cc: Dave Jiang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dee6da22efac451d361f5224a60be2796d847b51 Author: David Hildenbrand Date: Tue Oct 30 15:10:44 2018 -0700 memory-hotplug.rst: add some details about locking internals Let's document the magic a bit, especially why device_hotplug_lock is required when adding/removing memory and how it all play together with requests to online/offline memory from user space. Link: http://lkml.kernel.org/r/20180925091457.28651-7-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Pavel Tatashin Reviewed-by: Rashmica Gupta Reviewed-by: Oscar Salvador Cc: Jonathan Corbet Cc: Michal Hocko Cc: Balbir Singh Cc: Benjamin Herrenschmidt Cc: Boris Ostrovsky Cc: Dan Williams Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Heiko Carstens Cc: John Allen Cc: Joonsoo Kim Cc: Juergen Gross Cc: Kate Stewart Cc: "K. Y. Srinivasan" Cc: Len Brown Cc: Martin Schwidefsky Cc: Mathieu Malaterre Cc: Michael Ellerman Cc: Michael Neuling Cc: Nathan Fontenot Cc: Paul Mackerras Cc: Philippe Ombredanne Cc: Rafael J. Wysocki Cc: "Rafael J. Wysocki" Cc: Stephen Hemminger Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: YASUAKI ISHIMATSU Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5666848774ef43d3db5151ec518f1deb63515c20 Author: David Hildenbrand Date: Tue Oct 30 15:10:39 2018 -0700 powerpc/powernv: hold device_hotplug_lock when calling memtrace_offline_pages() Let's perform all checking + offlining + removing under device_hotplug_lock, so nobody can mess with these devices via sysfs concurrently. [david@redhat.com: take device_hotplug_lock outside of loop] Link: http://lkml.kernel.org/r/20180927092554.13567-6-david@redhat.com Link: http://lkml.kernel.org/r/20180925091457.28651-6-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Pavel Tatashin Reviewed-by: Rashmica Gupta Acked-by: Balbir Singh Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Michael Ellerman Cc: Rashmica Gupta Cc: Michael Neuling Cc: Boris Ostrovsky Cc: Dan Williams Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Heiko Carstens Cc: John Allen Cc: Jonathan Corbet Cc: Joonsoo Kim Cc: Juergen Gross Cc: Kate Stewart Cc: "K. Y. Srinivasan" Cc: Len Brown Cc: Martin Schwidefsky Cc: Mathieu Malaterre Cc: Michal Hocko Cc: Nathan Fontenot Cc: Oscar Salvador Cc: Philippe Ombredanne Cc: Rafael J. Wysocki Cc: "Rafael J. Wysocki" Cc: Stephen Hemminger Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: YASUAKI ISHIMATSU Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cec1680591d6d5b10ecc10f370210089416e98af Author: David Hildenbrand Date: Tue Oct 30 15:10:33 2018 -0700 powerpc/powernv: hold device_hotplug_lock when calling device_online() device_online() should be called with device_hotplug_lock() held. Link: http://lkml.kernel.org/r/20180925091457.28651-5-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Pavel Tatashin Reviewed-by: Rashmica Gupta Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Michael Ellerman Cc: Rashmica Gupta Cc: Balbir Singh Cc: Michael Neuling Cc: Boris Ostrovsky Cc: Dan Williams Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Heiko Carstens Cc: John Allen Cc: Jonathan Corbet Cc: Joonsoo Kim Cc: Juergen Gross Cc: Kate Stewart Cc: "K. Y. Srinivasan" Cc: Len Brown Cc: Martin Schwidefsky Cc: Mathieu Malaterre Cc: Michal Hocko Cc: Nathan Fontenot Cc: Oscar Salvador Cc: Philippe Ombredanne Cc: Rafael J. Wysocki Cc: "Rafael J. Wysocki" Cc: Stephen Hemminger Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: YASUAKI ISHIMATSU Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 381eab4a6ee81266f8dddc62e57376c7e584e5b8 Author: David Hildenbrand Date: Tue Oct 30 15:10:29 2018 -0700 mm/memory_hotplug: fix online/offline_pages called w.o. mem_hotplug_lock There seem to be some problems as result of 30467e0b3be ("mm, hotplug: fix concurrent memory hot-add deadlock"), which tried to fix a possible lock inversion reported and discussed in [1] due to the two locks a) device_lock() b) mem_hotplug_lock While add_memory() first takes b), followed by a) during bus_probe_device(), onlining of memory from user space first took a), followed by b), exposing a possible deadlock. In [1], and it was decided to not make use of device_hotplug_lock, but rather to enforce a locking order. The problems I spotted related to this: 1. Memory block device attributes: While .state first calls mem_hotplug_begin() and the calls device_online() - which takes device_lock() - .online does no longer call mem_hotplug_begin(), so effectively calls online_pages() without mem_hotplug_lock. 2. device_online() should be called under device_hotplug_lock, however onlining memory during add_memory() does not take care of that. In addition, I think there is also something wrong about the locking in 3. arch/powerpc/platforms/powernv/memtrace.c calls offline_pages() without locks. This was introduced after 30467e0b3be. And skimming over the code, I assume it could need some more care in regards to locking (e.g. device_online() called without device_hotplug_lock. This will be addressed in the following patches. Now that we hold the device_hotplug_lock when - adding memory (e.g. via add_memory()/add_memory_resource()) - removing memory (e.g. via remove_memory()) - device_online()/device_offline() We can move mem_hotplug_lock usage back into online_pages()/offline_pages(). Why is mem_hotplug_lock still needed? Essentially to make get_online_mems()/put_online_mems() be very fast (relying on device_hotplug_lock would be very slow), and to serialize against addition of memory that does not create memory block devices (hmm). [1] http://driverdev.linuxdriverproject.org/pipermail/ driverdev-devel/ 2015-February/065324.html This patch is partly based on a patch by Vitaly Kuznetsov. Link: http://lkml.kernel.org/r/20180925091457.28651-4-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Pavel Tatashin Reviewed-by: Rashmica Gupta Reviewed-by: Oscar Salvador Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Michael Ellerman Cc: "Rafael J. Wysocki" Cc: Len Brown Cc: Greg Kroah-Hartman Cc: "K. Y. Srinivasan" Cc: Haiyang Zhang Cc: Stephen Hemminger Cc: Martin Schwidefsky Cc: Heiko Carstens Cc: Boris Ostrovsky Cc: Juergen Gross Cc: Rashmica Gupta Cc: Michael Neuling Cc: Balbir Singh Cc: Kate Stewart Cc: Thomas Gleixner Cc: Philippe Ombredanne Cc: Pavel Tatashin Cc: Vlastimil Babka Cc: Dan Williams Cc: Oscar Salvador Cc: YASUAKI ISHIMATSU Cc: Mathieu Malaterre Cc: John Allen Cc: Jonathan Corbet Cc: Joonsoo Kim Cc: Nathan Fontenot Cc: Rafael J. Wysocki Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8df1d0e4a265f25dc1e7e7624ccdbcb4a6630c89 Author: David Hildenbrand Date: Tue Oct 30 15:10:24 2018 -0700 mm/memory_hotplug: make add_memory() take the device_hotplug_lock add_memory() currently does not take the device_hotplug_lock, however is aleady called under the lock from arch/powerpc/platforms/pseries/hotplug-memory.c drivers/acpi/acpi_memhotplug.c to synchronize against CPU hot-remove and similar. In general, we should hold the device_hotplug_lock when adding memory to synchronize against online/offline request (e.g. from user space) - which already resulted in lock inversions due to device_lock() and mem_hotplug_lock - see 30467e0b3be ("mm, hotplug: fix concurrent memory hot-add deadlock"). add_memory()/add_memory_resource() will create memory block devices, so this really feels like the right thing to do. Holding the device_hotplug_lock makes sure that a memory block device can really only be accessed (e.g. via .online/.state) from user space, once the memory has been fully added to the system. The lock is not held yet in drivers/xen/balloon.c arch/powerpc/platforms/powernv/memtrace.c drivers/s390/char/sclp_cmd.c drivers/hv/hv_balloon.c So, let's either use the locked variants or take the lock. Don't export add_memory_resource(), as it once was exported to be used by XEN, which is never built as a module. If somebody requires it, we also have to export a locked variant (as device_hotplug_lock is never exported). Link: http://lkml.kernel.org/r/20180925091457.28651-3-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Pavel Tatashin Reviewed-by: Rafael J. Wysocki Reviewed-by: Rashmica Gupta Reviewed-by: Oscar Salvador Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Michael Ellerman Cc: "Rafael J. Wysocki" Cc: Len Brown Cc: Greg Kroah-Hartman Cc: Boris Ostrovsky Cc: Juergen Gross Cc: Nathan Fontenot Cc: John Allen Cc: Michal Hocko Cc: Dan Williams Cc: Joonsoo Kim Cc: Vlastimil Babka Cc: Mathieu Malaterre Cc: Pavel Tatashin Cc: YASUAKI ISHIMATSU Cc: Balbir Singh Cc: Haiyang Zhang Cc: Heiko Carstens Cc: Jonathan Corbet Cc: Kate Stewart Cc: "K. Y. Srinivasan" Cc: Martin Schwidefsky Cc: Michael Neuling Cc: Philippe Ombredanne Cc: Stephen Hemminger Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d15e59260f62bd5e0f625cf5f5240f6ffac78ab6 Author: David Hildenbrand Date: Tue Oct 30 15:10:18 2018 -0700 mm/memory_hotplug: make remove_memory() take the device_hotplug_lock Patch series "mm: online/offline_pages called w.o. mem_hotplug_lock", v3. Reading through the code and studying how mem_hotplug_lock is to be used, I noticed that there are two places where we can end up calling device_online()/device_offline() - online_pages()/offline_pages() without the mem_hotplug_lock. And there are other places where we call device_online()/device_offline() without the device_hotplug_lock. While e.g. echo "online" > /sys/devices/system/memory/memory9/state is fine, e.g. echo 1 > /sys/devices/system/memory/memory9/online Will not take the mem_hotplug_lock. However the device_lock() and device_hotplug_lock. E.g. via memory_probe_store(), we can end up calling add_memory()->online_pages() without the device_hotplug_lock. So we can have concurrent callers in online_pages(). We e.g. touch in online_pages() basically unprotected zone->present_pages then. Looks like there is a longer history to that (see Patch #2 for details), and fixing it to work the way it was intended is not really possible. We would e.g. have to take the mem_hotplug_lock in device/base/core.c, which sounds wrong. Summary: We had a lock inversion on mem_hotplug_lock and device_lock(). More details can be found in patch 3 and patch 6. I propose the general rules (documentation added in patch 6): 1. add_memory/add_memory_resource() must only be called with device_hotplug_lock. 2. remove_memory() must only be called with device_hotplug_lock. This is already documented and holds for all callers. 3. device_online()/device_offline() must only be called with device_hotplug_lock. This is already documented and true for now in core code. Other callers (related to memory hotplug) have to be fixed up. 4. mem_hotplug_lock is taken inside of add_memory/remove_memory/ online_pages/offline_pages. To me, this looks way cleaner than what we have right now (and easier to verify). And looking at the documentation of remove_memory, using lock_device_hotplug also for add_memory() feels natural. This patch (of 6): remove_memory() is exported right now but requires the device_hotplug_lock, which is not exported. So let's provide a variant that takes the lock and only export that one. The lock is already held in arch/powerpc/platforms/pseries/hotplug-memory.c drivers/acpi/acpi_memhotplug.c arch/powerpc/platforms/powernv/memtrace.c Apart from that, there are not other users in the tree. Link: http://lkml.kernel.org/r/20180925091457.28651-2-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Pavel Tatashin Reviewed-by: Rafael J. Wysocki Reviewed-by: Rashmica Gupta Reviewed-by: Oscar Salvador Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Michael Ellerman Cc: "Rafael J. Wysocki" Cc: Len Brown Cc: Rashmica Gupta Cc: Michael Neuling Cc: Balbir Singh Cc: Nathan Fontenot Cc: John Allen Cc: Michal Hocko Cc: Dan Williams Cc: Joonsoo Kim Cc: Vlastimil Babka Cc: Greg Kroah-Hartman Cc: YASUAKI ISHIMATSU Cc: Mathieu Malaterre Cc: Boris Ostrovsky Cc: Haiyang Zhang Cc: Heiko Carstens Cc: Jonathan Corbet Cc: Juergen Gross Cc: Kate Stewart Cc: "K. Y. Srinivasan" Cc: Martin Schwidefsky Cc: Philippe Ombredanne Cc: Stephen Hemminger Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2f770806fd2c3db9616965e57ba60d80f43c827d Author: Mike Rapoport Date: Tue Oct 30 15:10:01 2018 -0700 mm/memblock.c: warn if zero alignment was requested After updating all memblock users to explicitly specify SMP_CACHE_BYTES alignment rather than use 0, it is still possible that uncovered users may sneak in. Add a WARN_ON_ONCE for such cases. [sfr@canb.auug.org.au: use dump_stack() instead of WARN_ON_ONCE for the alignment checks] Link: http://lkml.kernel.org/r/20181016131927.6ceba6ab@canb.auug.org.au [akpm@linux-foundation.org: add apologetic comment] Link: http://lkml.kernel.org/r/20181011060850.GA19822@rapoport-lnx Signed-off-by: Mike Rapoport Signed-off-by: Stephen Rothwell Reviewed-by: Andrew Morton Acked-by: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7e1c4e27928e5f87b9b1eaf06dc31773b2f1e7f1 Author: Mike Rapoport Date: Tue Oct 30 15:09:57 2018 -0700 memblock: stop using implicit alignment to SMP_CACHE_BYTES When a memblock allocation APIs are called with align = 0, the alignment is implicitly set to SMP_CACHE_BYTES. Implicit alignment is done deep in the memblock allocator and it can come as a surprise. Not that such an alignment would be wrong even when used incorrectly but it is better to be explicit for the sake of clarity and the prinicple of the least surprise. Replace all such uses of memblock APIs with the 'align' parameter explicitly set to SMP_CACHE_BYTES and stop implicit alignment assignment in the memblock internal allocation functions. For the case when memblock APIs are used via helper functions, e.g. like iommu_arena_new_node() in Alpha, the helper functions were detected with Coccinelle's help and then manually examined and updated where appropriate. The direct memblock APIs users were updated using the semantic patch below: @@ expression size, min_addr, max_addr, nid; @@ ( | - memblock_alloc_try_nid_raw(size, 0, min_addr, max_addr, nid) + memblock_alloc_try_nid_raw(size, SMP_CACHE_BYTES, min_addr, max_addr, nid) | - memblock_alloc_try_nid_nopanic(size, 0, min_addr, max_addr, nid) + memblock_alloc_try_nid_nopanic(size, SMP_CACHE_BYTES, min_addr, max_addr, nid) | - memblock_alloc_try_nid(size, 0, min_addr, max_addr, nid) + memblock_alloc_try_nid(size, SMP_CACHE_BYTES, min_addr, max_addr, nid) | - memblock_alloc(size, 0) + memblock_alloc(size, SMP_CACHE_BYTES) | - memblock_alloc_raw(size, 0) + memblock_alloc_raw(size, SMP_CACHE_BYTES) | - memblock_alloc_from(size, 0, min_addr) + memblock_alloc_from(size, SMP_CACHE_BYTES, min_addr) | - memblock_alloc_nopanic(size, 0) + memblock_alloc_nopanic(size, SMP_CACHE_BYTES) | - memblock_alloc_low(size, 0) + memblock_alloc_low(size, SMP_CACHE_BYTES) | - memblock_alloc_low_nopanic(size, 0) + memblock_alloc_low_nopanic(size, SMP_CACHE_BYTES) | - memblock_alloc_from_nopanic(size, 0, min_addr) + memblock_alloc_from_nopanic(size, SMP_CACHE_BYTES, min_addr) | - memblock_alloc_node(size, 0, nid) + memblock_alloc_node(size, SMP_CACHE_BYTES, nid) ) [mhocko@suse.com: changelog update] [akpm@linux-foundation.org: coding-style fixes] [rppt@linux.ibm.com: fix missed uses of implicit alignment] Link: http://lkml.kernel.org/r/20181016133656.GA10925@rapoport-lnx Link: http://lkml.kernel.org/r/1538687224-17535-1-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Suggested-by: Michal Hocko Acked-by: Paul Burton [MIPS] Acked-by: Michael Ellerman [powerpc] Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: Geert Uytterhoeven Cc: Guan Xuetao Cc: Ingo Molnar Cc: Matt Turner Cc: Michal Simek Cc: Richard Weinberger Cc: Russell King Cc: Thomas Gleixner Cc: Tony Luck Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 530d4c0cfd5b71caf2d17f73a80696c4a4509813 Author: Mike Rapoport Date: Tue Oct 30 15:09:54 2018 -0700 docs/boot-time-mm: remove bootmem documentation Link: http://lkml.kernel.org/r/1536927045-23536-31-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 57c8a661d95dff48dd9c2f2496139082bbaf241a Author: Mike Rapoport Date: Tue Oct 30 15:09:49 2018 -0700 mm: remove include/linux/bootmem.h Move remaining definitions and declarations from include/linux/bootmem.h into include/linux/memblock.h and remove the redundant header. The includes were replaced with the semantic patch below and then semi-automated removal of duplicated '#include @@ @@ - #include + #include [sfr@canb.auug.org.au: dma-direct: fix up for the removal of linux/bootmem.h] Link: http://lkml.kernel.org/r/20181002185342.133d1680@canb.auug.org.au [sfr@canb.auug.org.au: powerpc: fix up for removal of linux/bootmem.h] Link: http://lkml.kernel.org/r/20181005161406.73ef8727@canb.auug.org.au [sfr@canb.auug.org.au: x86/kaslr, ACPI/NUMA: fix for linux/bootmem.h removal] Link: http://lkml.kernel.org/r/20181008190341.5e396491@canb.auug.org.au Link: http://lkml.kernel.org/r/1536927045-23536-30-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Signed-off-by: Stephen Rothwell Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 97ad1087efffed26cb00e310a927f9603332dfcb Author: Mike Rapoport Date: Tue Oct 30 15:09:44 2018 -0700 memblock: replace BOOTMEM_ALLOC_* with MEMBLOCK variants Drop BOOTMEM_ALLOC_ACCESSIBLE and BOOTMEM_ALLOC_ANYWHERE in favor of identical MEMBLOCK definitions. Link: http://lkml.kernel.org/r/1536927045-23536-29-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bda49a81164ab3e62f5348447345711586fd42e9 Author: Mike Rapoport Date: Tue Oct 30 15:09:40 2018 -0700 mm: remove nobootmem Move a few remaining functions from nobootmem.c to memblock.c and remove nobootmem Link: http://lkml.kernel.org/r/1536927045-23536-28-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7c2ee349cf79b6348e833dd7d8167c4004a72ecb Author: Mike Rapoport Date: Tue Oct 30 15:09:36 2018 -0700 memblock: rename __free_pages_bootmem to memblock_free_pages The conversion is done using sed -i 's@__free_pages_bootmem@memblock_free_pages@' \ $(git grep -l __free_pages_bootmem) Link: http://lkml.kernel.org/r/1536927045-23536-27-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c6ffc5ca8fb311a89cb6de5c31b6511308ddac8d Author: Mike Rapoport Date: Tue Oct 30 15:09:30 2018 -0700 memblock: rename free_all_bootmem to memblock_free_all The conversion is done using sed -i 's@free_all_bootmem@memblock_free_all@' \ $(git grep -l free_all_bootmem) Link: http://lkml.kernel.org/r/1536927045-23536-26-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 53ab85ebfd27cdf16c8ddc72781c072a63bef3cb Author: Mike Rapoport Date: Tue Oct 30 15:09:25 2018 -0700 memblock: replace free_bootmem_late with memblock_free_late The free_bootmem_late and memblock_free_late do exactly the same thing: they iterate over a range and give pages to the page allocator. Replace calls to free_bootmem_late with calls to memblock_free_late and remove the bootmem variant. Link: http://lkml.kernel.org/r/1536927045-23536-25-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2013288f723887837d2f1cebef5fcf663b2319de Author: Mike Rapoport Date: Tue Oct 30 15:09:21 2018 -0700 memblock: replace free_bootmem{_node} with memblock_free The free_bootmem and free_bootmem_node are merely wrappers for memblock_free. Replace their usage with a call to memblock_free using the following semantic patch: @@ expression e1, e2, e3; @@ ( - free_bootmem(e1, e2) + memblock_free(e1, e2) | - free_bootmem_node(e1, e2, e3) + memblock_free(e2, e3) ) Link: http://lkml.kernel.org/r/1536927045-23536-24-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6c7835f8d0d1839ca93bd3cf6faa15706f03d604 Author: Mike Rapoport Date: Tue Oct 30 15:09:15 2018 -0700 mm: nobootmem: remove bootmem allocation APIs The bootmem compatibility APIs are not used and can be removed. Link: http://lkml.kernel.org/r/1536927045-23536-23-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2a5bda5a624d6471d25e953b9adba5182ab1b51f Author: Mike Rapoport Date: Tue Oct 30 15:09:09 2018 -0700 memblock: replace alloc_bootmem with memblock_alloc The alloc_bootmem(size) is a shortcut for allocation of SMP_CACHE_BYTES aligned memory. When the align parameter of memblock_alloc() is 0, the alignment is implicitly set to SMP_CACHE_BYTES and thus alloc_bootmem(size) and memblock_alloc(size, 0) are equivalent. The conversion is done using the following semantic patch: @@ expression size; @@ - alloc_bootmem(size) + memblock_alloc(size, 0) Link: http://lkml.kernel.org/r/1536927045-23536-22-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4fc4a09e4cc1126c4e8a86c293425cffa2a2eb3c Author: Mike Rapoport Date: Tue Oct 30 15:09:03 2018 -0700 memblock: replace __alloc_bootmem with memblock_alloc_from The functions are equivalent, just the later does not require nobootmem translation layer. The conversion is done using the following semantic patch: @@ expression size, align, goal; @@ - __alloc_bootmem(size, align, goal) + memblock_alloc_from(size, align, goal) Link: http://lkml.kernel.org/r/1536927045-23536-21-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 15c3c114ed144e5d9ad0f9e8f9f2998bae372190 Author: Mike Rapoport Date: Tue Oct 30 15:08:58 2018 -0700 memblock: replace alloc_bootmem_pages with memblock_alloc The alloc_bootmem_pages() function allocates PAGE_SIZE aligned memory. memblock_alloc() with alignment set to PAGE_SIZE does exactly the same thing. The conversion is done using the following semantic patch: @@ expression e; @@ - alloc_bootmem_pages(e) + memblock_alloc(e, PAGE_SIZE) Link: http://lkml.kernel.org/r/1536927045-23536-20-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e8625dce71b4c23eb81bc9b023c7628807df89e8 Author: Mike Rapoport Date: Tue Oct 30 15:08:54 2018 -0700 memblock: replace alloc_bootmem_low_pages with memblock_alloc_low The alloc_bootmem_low_pages() function allocates PAGE_SIZE aligned regions from low memory. memblock_alloc_low() with alignment set to PAGE_SIZE does exactly the same thing. The conversion is done using the following semantic patch: @@ expression e; @@ - alloc_bootmem_low_pages(e) + memblock_alloc_low(e, PAGE_SIZE) Link: http://lkml.kernel.org/r/1536927045-23536-19-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3bb1f80ee6873e8be6cb57eec4926e9647e88ea7 Author: Mike Rapoport Date: Tue Oct 30 15:08:49 2018 -0700 memblock: replace alloc_bootmem_node with memblock_alloc_node Both functions attempt to allocate memory with specified alignment from a particular node. If the allocation from that node fails, they both fall back to allocating from any node in the system. Usage of native memblock API eliminates the nobootmem translation layer. Link: http://lkml.kernel.org/r/1536927045-23536-18-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ccfa2a0f2e8581a68715aaad5ad0fb56daf7db43 Author: Mike Rapoport Date: Tue Oct 30 15:08:45 2018 -0700 memblock: replace __alloc_bootmem_node with appropriate memblock_ API Use memblock_alloc_try_nid whenever goal (i.e. minimal address is specified) and memblock_alloc_node otherwise. Link: http://lkml.kernel.org/r/1536927045-23536-17-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 64c0066c1e74650ca7bc90876fbc6bad3bf50c91 Author: Mike Rapoport Date: Tue Oct 30 15:08:41 2018 -0700 memblock: replace alloc_bootmem_pages_node with memblock_alloc_node The functions are equivalent, just the later does not require nobootmem translation layer. Link: http://lkml.kernel.org/r/1536927045-23536-16-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3913c8f9f96bb75a062ad16ea10a1cdad48bb716 Author: Mike Rapoport Date: Tue Oct 30 15:08:36 2018 -0700 memblock: add align parameter to memblock_alloc_node() With the align parameter memblock_alloc_node() can be used as drop in replacement for alloc_bootmem_pages_node() and __alloc_bootmem_node(), which is done in the following patches. Link: http://lkml.kernel.org/r/1536927045-23536-15-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a5159e84daf491a865b20b1ba5ef87f70dc5a627 Author: Mike Rapoport Date: Tue Oct 30 15:08:31 2018 -0700 memblock: replace __alloc_bootmem_nopanic with memblock_alloc_from_nopanic When __alloc_bootmem_nopanic() is used with explicit lower limit for the allocation it attempts to allocate memory at or above that limit and falls back to allocation with no limit set. The memblock_alloc_from_nopanic() does exactly the same thing and can be used as a replacement for __alloc_bootmem_nopanic() is such cases. Link: http://lkml.kernel.org/r/1536927045-23536-14-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 510d22f44d1621d32deb6c510a258504c8946750 Author: Mike Rapoport Date: Tue Oct 30 15:08:26 2018 -0700 memblock: replace alloc_bootmem_low with memblock_alloc_low (2) The alloc_bootmem_low(size) allocates low memory with default alignment and can be replaced by memblock_alloc_low(size, 0) Link: http://lkml.kernel.org/r/1536927045-23536-13-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 238997e5e63ab6a655c73d6a65c81cfb7f452f25 Author: Mike Rapoport Date: Tue Oct 30 15:08:22 2018 -0700 memblock: replace alloc_bootmem_pages_nopanic with memblock_alloc_nopanic The alloc_bootmem_pages_nopanic(size) is a shortcut for __alloc_bootmem_nopanic(size, PAGE_SIZE, BOOTMEM_LOW_LIMIT) which allocates PAGE_SIZE aligned memory. Since BOOTMEM_LOW_LIMIT is hardwired to 0 there is no restrictions on where the allocated memory should reside. The memblock_alloc_nopanic(size, PAGE_SIZE) also allocates PAGE_SIZE aligned memory without any restrictions and thus can be used as a replacement for alloc_bootmem_pages_nopanic() Link: http://lkml.kernel.org/r/1536927045-23536-12-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bf2886efdc1bdbe839a14d0f47d5d8533b8609a0 Author: Mike Rapoport Date: Tue Oct 30 15:08:18 2018 -0700 memblock: replace __alloc_bootmem_node_nopanic with memblock_alloc_try_nid_nopanic The __alloc_bootmem_node_nopanic() attempts to allocate memory for a specified node. If the allocation fails it then retries to allocate memory from any node. Upon success, the allocated memory is set to 0. The memblock_alloc_try_nid_nopanic() does exactly the same thing and can be used instead. Link: http://lkml.kernel.org/r/1536927045-23536-11-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 079151704d0118e19d84075592d64668d7fcfecd Author: Mike Rapoport Date: Tue Oct 30 15:08:12 2018 -0700 memblock: replace alloc_bootmem_low with memblock_alloc_low The functions are equivalent, just the later does not require nobootmem translation layer. Link: http://lkml.kernel.org/r/1536927045-23536-10-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e0802b8dfcd1fded7d82ef5993eb0c1087788b1a Author: Mike Rapoport Date: Tue Oct 30 15:08:08 2018 -0700 memblock: replace alloc_bootmem_align with memblock_alloc The functions are equivalent, just the later does not require nobootmem translation layer. Link: http://lkml.kernel.org/r/1536927045-23536-9-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit eb31d559f1e8390195372cd51cfb198da8bc84b9 Author: Mike Rapoport Date: Tue Oct 30 15:08:04 2018 -0700 memblock: remove _virt from APIs returning virtual address The conversion is done using sed -i 's@memblock_virt_alloc@memblock_alloc@g' \ $(git grep -l memblock_virt_alloc) Link: http://lkml.kernel.org/r/1536927045-23536-8-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9a8dd708d547268c899f1cb443c49bd4d8c84eb3 Author: Mike Rapoport Date: Tue Oct 30 15:07:59 2018 -0700 memblock: rename memblock_alloc{_nid,_try_nid} to memblock_phys_alloc* Make it explicit that the caller gets a physical address rather than a virtual one. This will also allow using meblock_alloc prefix for memblock allocations returning virtual address, which is done in the following patches. The conversion is done using the following semantic patch: @@ expression e1, e2, e3; @@ ( - memblock_alloc(e1, e2) + memblock_phys_alloc(e1, e2) | - memblock_alloc_nid(e1, e2, e3) + memblock_phys_alloc_nid(e1, e2, e3) | - memblock_alloc_try_nid(e1, e2, e3) + memblock_phys_alloc_try_nid(e1, e2, e3) ) Link: http://lkml.kernel.org/r/1536927045-23536-7-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b146ada221c178a384fee2a8e2e5b2e8a04476b1 Author: Mike Rapoport Date: Tue Oct 30 15:07:54 2018 -0700 mm: nobootmem: remove dead code Several bootmem functions and macros are not used. Remove them. Link: http://lkml.kernel.org/r/1536927045-23536-6-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 355c45affca7114ab510e296a5b7012943aeea17 Author: Mike Rapoport Date: Tue Oct 30 15:07:50 2018 -0700 mm: remove bootmem allocator implementation. All architectures have been converted to use MEMBLOCK + NO_BOOTMEM. The bootmem allocator implementation can be removed. Link: http://lkml.kernel.org/r/1536927045-23536-5-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aca52c39838910605b1063a2243f553aa2a02d5c Author: Mike Rapoport Date: Tue Oct 30 15:07:44 2018 -0700 mm: remove CONFIG_HAVE_MEMBLOCK All architecures use memblock for early memory management. There is no need for the CONFIG_HAVE_MEMBLOCK configuration option. [rppt@linux.vnet.ibm.com: of/fdt: fixup #ifdefs] Link: http://lkml.kernel.org/r/20180919103457.GA20545@rapoport-lnx [rppt@linux.vnet.ibm.com: csky: fixups after bootmem removal] Link: http://lkml.kernel.org/r/20180926112744.GC4628@rapoport-lnx [rppt@linux.vnet.ibm.com: remove stale #else and the code it protects] Link: http://lkml.kernel.org/r/1538067825-24835-1-git-send-email-rppt@linux.vnet.ibm.com Link: http://lkml.kernel.org/r/1536927045-23536-4-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Michal Hocko Tested-by: Jonathan Cameron Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b4a991ec584b3ce333342c431c3cc4fef8a690d7 Author: Mike Rapoport Date: Tue Oct 30 15:07:40 2018 -0700 mm: remove CONFIG_NO_BOOTMEM All achitectures select NO_BOOTMEM which essentially becomes 'Y' for any kernel configuration and therefore it can be removed. [alexander.h.duyck@linux.intel.com: remove now defunct NO_BOOTMEM from depends list for deferred init] Link: http://lkml.kernel.org/r/20180925201814.3576.15105.stgit@localhost.localdomain Link: http://lkml.kernel.org/r/1536927045-23536-3-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Signed-off-by: Alexander Duyck Acked-by: Michal Hocko Cc: Catalin Marinas Cc: Chris Zankel Cc: "David S. Miller" Cc: Geert Uytterhoeven Cc: Greentime Hu Cc: Greg Kroah-Hartman Cc: Guan Xuetao Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Jonas Bonn Cc: Jonathan Corbet Cc: Ley Foon Tan Cc: Mark Salter Cc: Martin Schwidefsky Cc: Matt Turner Cc: Michael Ellerman Cc: Michal Simek Cc: Palmer Dabbelt Cc: Paul Burton Cc: Richard Kuo Cc: Richard Weinberger Cc: Rich Felker Cc: Russell King Cc: Serge Semin Cc: Thomas Gleixner Cc: Tony Luck Cc: Vineet Gupta Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 69a60bc75fe73511af89328ded1b33bc4a625a5c Author: Alexander Pateenok Date: Tue Oct 30 15:07:36 2018 -0700 percpu: remove PER_CPU_DEF_ATTRIBUTES macro The macro is not used: $ grep -r PER_CPU_DEF_ATTRIBUTES include/linux/percpu-defs.h: __PCPU_ATTRS(sec) PER_CPU_DEF_ATTRIBUTES __weak \ include/linux/percpu-defs.h: __PCPU_ATTRS(sec) PER_CPU_DEF_ATTRIBUTES \ include/asm-generic/percpu.h:#ifndef PER_CPU_DEF_ATTRIBUTES include/asm-generic/percpu.h:#define PER_CPU_DEF_ATTRIBUTES It was added with b01e8dc34379 ("alpha: fix percpu build breakage") and removed in 2009 with b01e8dc34379..6088464cf1ae. Link: http://lkml.kernel.org/r/20180821164904.qqhcduimjznods66@K55DR.localdomain Signed-off-by: Alexander Pateenok Acked-by: Tejun Heo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6a32c2469c3fbfee8f25bcd20af647326650a6cf Author: Arnd Bergmann Date: Tue Oct 30 15:07:32 2018 -0700 kbuild: fix kernel/bounds.c 'W=1' warning Building any configuration with 'make W=1' produces a warning: kernel/bounds.c:16:6: warning: no previous prototype for 'foo' [-Wmissing-prototypes] When also passing -Werror, this prevents us from building any other files. Nobody ever calls the function, but we can't make it 'static' either since we want the compiler output. Calling it 'main' instead however avoids the warning, because gcc does not insist on having a declaration for main. Link: http://lkml.kernel.org/r/20181005083313.2088252-1-arnd@arndb.de Signed-off-by: Arnd Bergmann Reported-by: Kieran Bingham Reviewed-by: Kieran Bingham Cc: David Laight Cc: Masahiro Yamada Cc: Greg Kroah-Hartman Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2209fda323e2fd2a2d0885595fd5097717f8d2aa Author: Gao Xiang Date: Tue Oct 30 15:07:28 2018 -0700 lib/lz4: update LZ4 decompressor module Update the LZ4 compression module based on LZ4 v1.8.3 in order for the erofs file system to use the newest LZ4_decompress_safe_partial() which can now decode exactly the nb of bytes requested [1] to take place of the open hacked code in the erofs file system itself. Currently, apart from the erofs file system, no other users use LZ4_decompress_safe_partial, so no worry about the interface. In addition, LZ4 v1.8.x boosts up decompression speed compared to the current code which is based on LZ4 v1.7.3, mainly due to shortcut optimization for the specific common LZ4-sequences [2]. lzbench testdata (tested in kirin710, 8 cores, 4 big cores at 2189Mhz, 2GB DDR RAM at 1622Mhz, with enwik8 testdata [3]): Compressor name Compress. Decompress. Compr. size Ratio Filename memcpy 5004 MB/s 4924 MB/s 100000000 100.00 enwik8 lz4hc 1.7.3 -9 12 MB/s 653 MB/s 42203253 42.20 enwik8 lz4hc 1.8.0 -9 12 MB/s 908 MB/s 42203096 42.20 enwik8 lz4hc 1.8.3 -9 11 MB/s 965 MB/s 42203094 42.20 enwik8 [1] https://github.com/lz4/lz4/issues/566 https://github.com/lz4/lz4/commit/08d347b5b217b011ff7487130b79480d8cfdaeb8 [2] v1.8.1 perf: slightly faster compression and decompression speed https://github.com/lz4/lz4/commit/a31b7058cb97e4393da55e78a77a1c6f0c9ae038 v1.8.2 perf: slightly faster HC compression and decompression speed https://github.com/lz4/lz4/commit/45f8603aae389d34c689d3ff7427b314071ccd2c https://github.com/lz4/lz4/commit/1a191b3f8d26b50a7c1d41590b529ec308d768cd [3] http://mattmahoney.net/dc/textdata.html http://mattmahoney.net/dc/enwik8.zip Link: http://lkml.kernel.org/r/1537181207-21932-1-git-send-email-gaoxiang25@huawei.com Signed-off-by: Gao Xiang Tested-by: Guo Xuenan Cc: Colin Ian King Cc: Yann Collet Cc: Greg Kroah-Hartman Cc: Fang Wei Cc: Chao Yu Cc: Miao Xie Cc: Sven Schmidt <4sschmid@informatik.uni-hamburg.de> Cc: Kyungsik Lee Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8c81ddd2acd2c10979f5a64f6784ce7c6717495e Author: Waiman Long Date: Tue Oct 30 15:07:24 2018 -0700 ipc: IPCMNI limit check for semmni For SysV semaphores, the semmni value is the last part of the 4-element sem number array. To make semmni behave in a similar way to msgmni and shmmni, we can't directly use the _minmax handler. Instead, a special sem specific handler is added to check the last argument to make sure that it is limited to the [0, IPCMNI] range. An error will be returned if this is not the case. Link: http://lkml.kernel.org/r/1536352137-12003-3-git-send-email-longman@redhat.com Signed-off-by: Waiman Long Reviewed-by: Davidlohr Bueso Cc: "Eric W. Biederman" Cc: Jonathan Corbet Cc: Kees Cook Cc: Luis R. Rodriguez Cc: Matthew Wilcox Cc: Takashi Iwai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6730e6580177d13f4612767873cb5a533ad63c61 Author: Waiman Long Date: Tue Oct 30 15:07:20 2018 -0700 ipc: IPCMNI limit check for msgmni and shmmni Patch series "ipc: IPCMNI limit check for *mni & increase that limit", v9. The sysctl parameters msgmni, shmmni and semmni have an inherent limit of IPC_MNI (32k). However, users may not be aware of that because they can write a value much higher than that without getting any error or notification. Reading the parameters back will show the newly written values which are not real. The real IPCMNI limit is now enforced to make sure that users won't put in an unrealistic value. The first 2 patches enforce the limits. There are also users out there requesting increase in the IPCMNI value. The last 2 patches attempt to do that by using a boot kernel parameter "ipcmni_extend" to increase the IPCMNI limit from 32k to 8M if the users really want the extended value. This patch (of 4): A user can write arbitrary integer values to msgmni and shmmni sysctl parameters without getting error, but the actual limit is really IPCMNI (32k). This can mislead users as they think they can get a value that is not real. The right limits are now set for msgmni and shmmni so that the users will become aware if they set a value outside of the acceptable range. Link: http://lkml.kernel.org/r/1536352137-12003-2-git-send-email-longman@redhat.com Signed-off-by: Waiman Long Acked-by: Luis R. Rodriguez Reviewed-by: Davidlohr Bueso Cc: Kees Cook Cc: Jonathan Corbet Cc: Matthew Wilcox Cc: "Eric W. Biederman" Cc: Takashi Iwai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b49dec1cf8ff1e0b204dd2c30b95a92d75591146 Author: Borislav Petkov Date: Tue Oct 30 15:07:17 2018 -0700 kernel/panic.c: filter out a potential trailing newline If a call to panic() terminates the string with a \n , the result puts the closing brace ']---' on a newline because panic() itself adds \n too. Now, if one goes and removes the newline chars from all panic() invocations - and the stats right now look like this: ~300 calls with a \n ~500 calls without a \n one is destined to a neverending game of whack-a-mole because the usual thing to do is add a newline at the end of a string a function is supposed to print. Therefore, simply zap any \n at the end of the panic string to avoid touching so many places in the kernel. Link: http://lkml.kernel.org/r/20181009205019.2786-1-bp@alien8.de Signed-off-by: Borislav Petkov Acked-by: Kees Cook Reviewed-by: Steven Rostedt (VMware) Acked-by: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 95c4fb78fb23081472465ca20d5d31c4b780ed82 Author: Borislav Petkov Date: Tue Oct 30 15:07:13 2018 -0700 kernel/panic.c: do not append newline to the stack protector panic string ... because panic() itself already does this. Otherwise you have line-broken trailer: [ 1.836965] ---[ end Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: pgd_alloc+0x29e/0x2a0 [ 1.836965] ]--- Link: http://lkml.kernel.org/r/20181008202901.7894-1-bp@alien8.de Signed-off-by: Borislav Petkov Acked-by: Kees Cook Cc: Masahiro Yamada Cc: "Steven Rostedt (VMware)" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3819ddec1f8c8a5daf215bec4067f8fd1dc40d6d Author: Gustavo A. R. Silva Date: Tue Oct 30 15:07:10 2018 -0700 include/linux/signal.h: mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Link: http://lkml.kernel.org/r/20181013114847.GA3160@embeddedor.com Signed-off-by: Gustavo A. R. Silva Acked-by: Kees Cook Reviewed-by: Michael Ellerman Cc: Oleg Nesterov Cc: "Eric W. Biederman" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2e58f57d859fbe0ce79e052d7a63bba32d5786e8 Author: Weikang Shi Date: Tue Oct 30 15:07:05 2018 -0700 kernel/signal.c: fix a comment error Because get_signal_to_deliver() was renamed to get_signal() the comment should be fixed. Link: http://lkml.kernel.org/r/1539179128-45709-1-git-send-email-swkhack@gmail.com Signed-off-by: Weikang Shi Reported-by: Christian Brauner Cc: Eric W. Biederman Cc: Oleg Nesterov Cc: Anna-Maria Gleixner Cc: "Luck, Tony" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 22ea4eba63410515c1aa6e0dde67bda22d31a660 Author: Frank Sorenson Date: Tue Oct 30 15:07:01 2018 -0700 fat: truncate inode timestamp updates in setattr setattr_copy can't truncate timestamps correctly for msdos/vfat, so truncate and copy them ourselves. Link: http://lkml.kernel.org/r/a2b4701b1125573fafaeaae6802050ca86d6f8cc.1538363961.git.sorenson@redhat.com Signed-off-by: Frank Sorenson Acked-by: OGAWA Hirofumi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cd83f6b194e95fa616dd3157ae7a63d4713b6670 Author: Frank Sorenson Date: Tue Oct 30 15:06:57 2018 -0700 fat: change timestamp updates to use fat_truncate_time Convert the inode timestamp updates to use fat_truncate_time. Link: http://lkml.kernel.org/r/2663d3083c4dd62f00b64612c8eaf5542bb05a4c.1538363961.git.sorenson@redhat.com Signed-off-by: Frank Sorenson Acked-by: OGAWA Hirofumi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6bb885ecd746752aa70d146b58f2f83e5e21813d Author: Frank Sorenson Date: Tue Oct 30 15:06:53 2018 -0700 fat: add functions to update and truncate timestamps appropriately Add the fat-specific inode_operation ->update_time() and fat_truncate_time() function to truncate the inode timestamps from 1 nanosecond to the appropriate granularity. Link: http://lkml.kernel.org/r/38af1ba3c3cf0d7381ce7b63077ef8af75901532.1538363961.git.sorenson@redhat.com Signed-off-by: Frank Sorenson Acked-by: OGAWA Hirofumi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d9f4d94261d52a5fe31ad2ec00a06824a150af6f Author: Frank Sorenson Date: Tue Oct 30 15:06:50 2018 -0700 fat: create a function to calculate the timezone offest Patch series "fat: timestamp updates", v5. fat/msdos timestamps are stored on-disk with several different granularities, some of them lower resolution than timespec64_trunc() can provide. In addition, they are only truncated as they are written to disk, so the timestamps in-memory for new or modified files/directories may be different from the same timestamps after a remount, as the now-truncated times are re-read from the on-disk format. These patches allow finer granularity for the timestamps where possible and add fat-specific ->update_time inode operation and fat_truncate_time functions to truncate each timestamp correctly, giving consistent times across remounts. This patch (of 4): Move the calculation of the number of seconds in the timezone offset to a common function. Link: http://lkml.kernel.org/r/3671ff8cff5eeedbb85ebda5e4de0728920db4f6.1538363961.git.sorenson@redhat.com Signed-off-by: Frank Sorenson Acked-by: OGAWA Hirofumi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit eceb8902be2910be296f00ad6662941d79c09f8e Author: Mihir Mehta Date: Tue Oct 30 15:06:46 2018 -0700 fat: expand a slightly out-of-date comment The file namei.c seems to have been renamed to namei_msdos.c, so I decided to update the comment with the correct name, and expand it a bit to tell the reader what to look for. Link: http://lkml.kernel.org/r/20180928194947.23932-1-mihir@cs.utexas.edu Signed-off-by: Mihir Mehta Acked-by: OGAWA Hirofumi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 21bfc8309cca566b76fc0c1d65c598e62f8971a1 Author: Masahiro Yamada Date: Tue Oct 30 15:06:42 2018 -0700 reiserfs: remove workaround code for GCC 3.x cafa0010cd51 ("Raise the minimum required gcc version to 4.6") bumped the minimum GCC version to 4.6 for all architectures. The workaround code in fs/reiserfs/Makefile is obsolete now. Link: http://lkml.kernel.org/r/1535337230-13222-1-git-send-email-yamada.masahiro@socionext.com Signed-off-by: Masahiro Yamada Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b10298d56c9623f9b173f19959732d3184b35f4f Author: Jann Horn Date: Tue Oct 30 15:06:38 2018 -0700 reiserfs: propagate errors from fill_with_dentries() properly fill_with_dentries() failed to propagate errors up to reiserfs_for_each_xattr() properly. Plumb them through. Note that reiserfs_for_each_xattr() is only used by reiserfs_delete_xattrs() and reiserfs_chown_xattrs(). The result of reiserfs_delete_xattrs() is discarded anyway, the only difference there is whether a warning is printed to dmesg. The result of reiserfs_chown_xattrs() does matter because it can block chowning of the file to which the xattrs belong; but either way, the resulting state can have misaligned ownership, so my patch doesn't improve things greatly. Credit for making me look at this code goes to Al Viro, who pointed out that the ->actor calling convention is suboptimal and should be changed. Link: http://lkml.kernel.org/r/20180802163335.83312-1-jannh@google.com Signed-off-by: Jann Horn Reviewed-by: Andrew Morton Cc: Jeff Mahoney Cc: Eric Biggers Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6c9a3f843a29d6894dfc40df338b91dbd78f0ae3 Author: Colin Ian King Date: Tue Oct 30 15:06:35 2018 -0700 fs/hfs/extent.c: fix array out of bounds read of array extent Currently extent and index i are both being incremented causing an array out of bounds read on extent[i]. Fix this by removing the extraneous increment of extent. Ernesto said: : This is only triggered when deleting a file with a resource fork. I : may be wrong because the documentation isn't clear, but I don't think : you can create those under linux. So I guess nobody was testing them. : : > A disk space leak, perhaps? : : That's what it looks like in general. hfs_free_extents() won't do : anything if the block count doesn't add up, and the error will be : ignored. Now, if the block count randomly does add up, we could see : some corruption. Detected by CoverityScan, CID#711541 ("Out of bounds read") Link: http://lkml.kernel.org/r/20180831140538.31566-1-colin.king@canonical.com Signed-off-by: Colin Ian King Reviewed-by: Ernesto A. Fernndez Cc: David Howells Cc: Al Viro Cc: Hin-Tak Leung Cc: Vyacheslav Dubeyko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8cd3cb5061730af085a3f9890a3352f162b4e20c Author: Ernesto A. Fernández Date: Tue Oct 30 15:06:31 2018 -0700 hfs: update timestamp on truncate() The vfs takes care of updating mtime on ftruncate(), but on truncate() it must be done by the module. Link: http://lkml.kernel.org/r/e1611eda2985b672ed2d8677350b4ad8c2d07e8a.1539316825.git.ernesto.mnd.fernandez@gmail.com Signed-off-by: Ernesto A. Fernández Reviewed-by: Vyacheslav Dubeyko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dc8844aada735890a6de109bef327f5df36a982e Author: Ernesto A. Fernández Date: Tue Oct 30 15:06:27 2018 -0700 hfsplus: update timestamps on truncate() The vfs takes care of updating ctime and mtime on ftruncate(), but on truncate() it must be done by the module. This patch can be tested with xfstests generic/313. Link: http://lkml.kernel.org/r/9beb0913eea37288599e8e1b7cec8768fb52d1b8.1539316825.git.ernesto.mnd.fernandez@gmail.com Signed-off-by: Ernesto A. Fernández Reviewed-by: Vyacheslav Dubeyko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1267a07be5ebbff2d2739290f3d043ae137c15b4 Author: Ernesto A. Fernández Date: Tue Oct 30 15:06:24 2018 -0700 hfs: fix return value of hfs_get_block() Direct writes to empty inodes fail with EIO. The generic direct-io code is in part to blame (a patch has been submitted as "direct-io: allow direct writes to empty inodes"), but hfs is worse affected than the other filesystems because the fallback to buffered I/O doesn't happen. The problem is the return value of hfs_get_block() when called with !create. Change it to be more consistent with the other modules. Link: http://lkml.kernel.org/r/4538ab8c35ea37338490525f0f24cbc37227528c.1539195310.git.ernesto.mnd.fernandez@gmail.com Signed-off-by: Ernesto A. Fernández Reviewed-by: Vyacheslav Dubeyko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 839c3a6a5e1fbc8542d581911b35b2cb5cd29304 Author: Ernesto A. Fernández Date: Tue Oct 30 15:06:21 2018 -0700 hfsplus: fix return value of hfsplus_get_block() Direct writes to empty inodes fail with EIO. The generic direct-io code is in part to blame (a patch has been submitted as "direct-io: allow direct writes to empty inodes"), but hfsplus is worse affected than the other filesystems because the fallback to buffered I/O doesn't happen. The problem is the return value of hfsplus_get_block() when called with !create. Change it to be more consistent with the other modules. Link: http://lkml.kernel.org/r/2cd1301404ec7cf1e39c8f11a01a4302f1460ad6.1539195310.git.ernesto.mnd.fernandez@gmail.com Signed-off-by: Ernesto A. Fernández Reviewed-by: Vyacheslav Dubeyko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 54640c7502e5ed41fbf4eedd499e85f9acc9698f Author: Ernesto A. Fernández Date: Tue Oct 30 15:06:17 2018 -0700 hfs: prevent btree data loss on ENOSPC Inserting a new record in a btree may require splitting several of its nodes. If we hit ENOSPC halfway through, the new nodes will be left orphaned and their records will be lost. This could mean lost inodes or extents. Henceforth, check the available disk space before making any changes. This still leaves the potential problem of corruption on ENOMEM. There is no need to reserve space before deleting a catalog record, as we do for hfsplus. This difference is because hfs index nodes have fixed length keys. Link: http://lkml.kernel.org/r/ab5fc8a7d5ffccfd5f27b1cf2cb4ceb6c110da74.1536269131.git.ernesto.mnd.fernandez@gmail.com Signed-off-by: Ernesto A. Fernández Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d92915c35bfaf763d78bf1d5ac7f183420e3bd99 Author: Ernesto A. Fernández Date: Tue Oct 30 15:06:14 2018 -0700 hfsplus: prevent btree data loss on ENOSPC Inserting or deleting a record in a btree may require splitting several of its nodes. If we hit ENOSPC halfway through, the new nodes will be left orphaned and their records will be lost. This could mean lost inodes, extents or xattrs. Henceforth, check the available disk space before making any changes. This still leaves the potential problem of corruption on ENOMEM. The patch can be tested with xfstests generic/027. Link: http://lkml.kernel.org/r/4596eef22fbda137b4ffa0272d92f0da15364421.1536269129.git.ernesto.mnd.fernandez@gmail.com Signed-off-by: Ernesto A. Fernández Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ef75bcc5763d130451a99825f247d301088b790b Author: Ernesto A. Fernández Date: Tue Oct 30 15:06:11 2018 -0700 hfs: fix BUG on bnode parent update hfs_brec_update_parent() may hit BUG_ON() if the first record of both a leaf node and its parent are changed, and if this forces the parent to be split. It is not possible for this to happen on a valid hfs filesystem because the index nodes have fixed length keys. For reasons I ignore, the hfs module does have support for a number of hfsplus features. A corrupt btree header may report variable length keys and trigger this BUG, so it's better to fix it. Link: http://lkml.kernel.org/r/cf9b02d57f806217a2b1bf5db8c3e39730d8f603.1535682463.git.ernesto.mnd.fernandez@gmail.com Signed-off-by: Ernesto A. Fernández Reviewed-by: Andrew Morton Cc: Christoph Hellwig Cc: Viacheslav Dubeyko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d057c036672f33d43a5f7344acbb08cf3a8a0c09 Author: Ernesto A. Fernández Date: Tue Oct 30 15:06:07 2018 -0700 hfs: prevent btree data loss on root split This bug is triggered whenever hfs_brec_update_parent() needs to split the root node. The height of the btree is not increased, which leaves the new node orphaned and its records lost. It is not possible for this to happen on a valid hfs filesystem because the index nodes have fixed length keys. For reasons I ignore, the hfs module does have support for a number of hfsplus features. A corrupt btree header may report variable length keys and trigger this bug, so it's better to fix it. Link: http://lkml.kernel.org/r/9750b1415685c4adca10766895f6d5ef12babdb0.1535682463.git.ernesto.mnd.fernandez@gmail.com Signed-off-by: Ernesto A. Fernández Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 19a9d0f1acf75e8be8cfba19c1a34e941846fa2b Author: Ernesto A. Fernández Date: Tue Oct 30 15:06:04 2018 -0700 hfsplus: fix BUG on bnode parent update Creating, renaming or deleting a file may hit BUG_ON() if the first record of both a leaf node and its parent are changed, and if this forces the parent to be split. This bug is triggered by xfstests generic/027, somewhat rarely; here is a more reliable reproducer: truncate -s 50M fs.iso mkfs.hfsplus fs.iso mount fs.iso /mnt i=1000 while [ $i -le 2400 ]; do touch /mnt/$i &>/dev/null ((++i)) done i=2400 while [ $i -ge 1000 ]; do mv /mnt/$i /mnt/$(perl -e "print $i x61") &>/dev/null ((--i)) done The issue is that a newly created bnode is being put twice. Reset new_node to NULL in hfs_brec_update_parent() before reaching goto again. Link: http://lkml.kernel.org/r/5ee1db09b60373a15890f6a7c835d00e76bf601d.1535682461.git.ernesto.mnd.fernandez@gmail.com Signed-off-by: Ernesto A. Fernández Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0a3021d4f5295aa073c7bf5c5e4de60a2e292578 Author: Ernesto A. Fernández Date: Tue Oct 30 15:06:00 2018 -0700 hfsplus: prevent btree data loss on root split Creating, renaming or deleting a file may cause catalog corruption and data loss. This bug is randomly triggered by xfstests generic/027, but here is a faster reproducer: truncate -s 50M fs.iso mkfs.hfsplus fs.iso mount fs.iso /mnt i=100 while [ $i -le 150 ]; do touch /mnt/$i &>/dev/null ((++i)) done i=100 while [ $i -le 150 ]; do mv /mnt/$i /mnt/$(perl -e "print $i x82") &>/dev/null ((++i)) done umount /mnt fsck.hfsplus -n fs.iso The bug is triggered whenever hfs_brec_update_parent() needs to split the root node. The height of the btree is not increased, which leaves the new node orphaned and its records lost. Link: http://lkml.kernel.org/r/26d882184fc43043a810114258f45277752186c7.1535682461.git.ernesto.mnd.fernandez@gmail.com Signed-off-by: Ernesto A. Fernández Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f027c34d844013d9d6c902af8fa01a82d6e5073d Author: Nikolaus Voss Date: Tue Oct 30 15:05:57 2018 -0700 init/do_mounts.c: add root=PARTLABEL= support Support referencing the root partition label from GPT as argument to the root= option on the kernel command line in analogy to referencing the partition uuid as root=PARTUUID=. Specifying the partition label instead of the uuid is often much easier, e.g. in embedded environments when there is an A/B rootfs partition scheme for interruptible firmware updates (i.e. rootfsA/ rootfsB). The partition label can be queried with the blkid command. Link: http://lkml.kernel.org/r/20180822060904.828E510665E@pc-niv.weinmann.com Signed-off-by: Nikolaus Voss Reviewed-by: Andrew Morton Cc: Dominik Brodowski Cc: Sasha Levin Cc: Al Viro Cc: Jens Axboe Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 22ebb72b32606aa0f891e09de007be7d3d8effd1 Author: Christophe Leroy Date: Tue Oct 30 15:05:53 2018 -0700 checkpatch: remove GCC_BINARY_CONSTANT warning This warning was there to avoid the use of 0bxxx values as they are not supported by gcc prior to v4.3 Since cafa0010cd51f ("Raise the minimum required gcc version to 4.6"), it's not an issue anymore and using such values can increase readability of code. Joe said: : Seems sensible as the other compilers also support binary literals from : relatively old versions. : http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2012/n3472.pdf : https://software.intel.com/en-us/articles/c14-features-supported-by-intel-c-compiler Link: http://lkml.kernel.org/r/392eeae782302ee8812a3c932a602035deed1609.1535351453.git.christophe.leroy@c-s.fr Signed-off-by: Christophe Leroy Cc: Joe Perches Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 89976005536c47a788bdd6cef5a4e9fef3c0de32 Author: Gustavo A. R. Silva Date: Tue Oct 30 15:05:49 2018 -0700 include/linux/compat.h: mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Link: http://lkml.kernel.org/r/20181013115048.GA3262@embeddedor.com Signed-off-by: Gustavo A. R. Silva Acked-by: Kees Cook Cc: Michael Ellerman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 048e513d876113ebc2352ac2add66e4bfec67037 Author: Alexey Dobriyan Date: Tue Oct 30 15:05:46 2018 -0700 lib/kstrtox.c: delete unnecessary casts Implicit casts to the same type are done by the language if necessary. Link: http://lkml.kernel.org/r/20181014223934.GA18107@avx2 Signed-off-by: Alexey Dobriyan Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7e5ca363a5a1ec42c54dc1e0644b361a2daf984c Author: Wei Yang Date: Tue Oct 30 15:05:42 2018 -0700 lib/rbtree.c: fix typo in comment of rb_insert_augmented() The function name in the comment is not correct. Link: http://lkml.kernel.org/r/20181010021344.60433-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7f476715d05f53915f0390e074a6988ce6a12f36 Author: zhong jiang Date: Tue Oct 30 15:05:37 2018 -0700 lib/sg_pool.c: remove unnecessary null check when freeing object mempool_destroy(NULL) and kmem_cache_destroy(NULL) are legal Link: http://lkml.kernel.org/r/1533054107-35657-1-git-send-email-zhongjiang@huawei.com Signed-off-by: zhong jiang Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7a20c2fa1cc6edc1c3d1d40174fc30d1bbafa4d1 Author: Corentin Labbe Date: Tue Oct 30 15:05:33 2018 -0700 lib/zlib_inflate/inflate.c: remove fall through warnings This patch remove all following fall through warnings by adding /* fall through */ markers. Note that we cannot add "__attribute__ ((fallthrough));" due to it is GCC7 only arch/arm/boot/compressed/../../../../lib/zlib_inflate/inflate.c:384:25: warning: this statement may fall through [-Wimplicit-fallthrough=] arch/arm/boot/compressed/../../../../lib/zlib_inflate/inflate.c:391:25: warning: this statement may fall through [-Wimplicit-fallthrough=] arch/arm/boot/compressed/../../../../lib/zlib_inflate/inflate.c:393:16: warning: this statement may fall through [-Wimplicit-fallthrough=] arch/arm/boot/compressed/../../../../lib/zlib_inflate/inflate.c:430:25: warning: this statement may fall through [-Wimplicit-fallthrough=] arch/arm/boot/compressed/../../../../lib/zlib_inflate/inflate.c:556:25: warning: this statement may fall through [-Wimplicit-fallthrough=] arch/arm/boot/compressed/../../../../lib/zlib_inflate/inflate.c:595:25: warning: this statement may fall through [-Wimplicit-fallthrough=] arch/arm/boot/compressed/../../../../lib/zlib_inflate/inflate.c:602:25: warning: this statement may fall through [-Wimplicit-fallthrough=] arch/arm/boot/compressed/../../../../lib/zlib_inflate/inflate.c:627:25: warning: this statement may fall through [-Wimplicit-fallthrough=] arch/arm/boot/compressed/../../../../lib/zlib_inflate/inflate.c:646:25: warning: this statement may fall through [-Wimplicit-fallthrough=] arch/arm/boot/compressed/../../../../lib/zlib_inflate/inflate.c:696:25: warning: this statement may fall through [-Wimplicit-fallthrough=] It is easy to see that thoses fall through are needed since in each case state->mode are set to the case value just below. Link: http://lkml.kernel.org/r/1536215920-19955-1-git-send-email-clabbe@baylibre.com Signed-off-by: Corentin Labbe Cc: David Miller Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 36c8d1e7a27f94b4d812b2a0abf106dab0fa377e Author: Eric Biggers Date: Tue Oct 30 15:05:30 2018 -0700 lib/parser.c: switch match_number() over to use match_strdup() This simplifies the code. No change in behavior. Link: http://lkml.kernel.org/r/20180830194727.191555-1-ebiggers@kernel.org Signed-off-by: Eric Biggers Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4ed97b3c6d088e063e065142fc3217fae5cc29f8 Author: Eric Biggers Date: Tue Oct 30 15:05:26 2018 -0700 lib/parser.c: switch match_u64int() over to use match_strdup() This simplifies the code. No change in behavior. Link: http://lkml.kernel.org/r/20180830194814.192880-1-ebiggers@kernel.org Signed-off-by: Eric Biggers Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 30f7bc99a2a97cce9cda17d411c748550c0ece7b Author: Eric Biggers Date: Tue Oct 30 15:05:22 2018 -0700 lib/parser.c: switch match_strdup() over to use kmemdup_nul() This simplifies the code. No change in behavior. Link: http://lkml.kernel.org/r/20180830194436.188867-1-ebiggers@kernel.org Signed-off-by: Eric Biggers Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8ec3d76863d8bb317f330bbe4bf35cded8d85f01 Author: Rasmus Villemoes Date: Tue Oct 30 15:05:18 2018 -0700 lib/bitmap.c: simplify bitmap_print_to_pagebuf() len is guaranteed to lie in [1, PAGE_SIZE]. If scnprintf is called with a buffer size of 1, it is guaranteed to return 0. So in the extremely unlikely case of having just one byte remaining in the page, let's just call scnprintf anyway. The only difference is that this will write a '\0' to that final byte in the page, but that's an improvement: We now guarantee that after the call, buf is a properly terminated C string of length exactly the return value. Link: http://lkml.kernel.org/r/20180818131623.8755-8-linux@rasmusvillemoes.dk Signed-off-by: Rasmus Villemoes Reviewed-by: Andy Shevchenko Cc: Yury Norov Cc: Rasmus Villemoes Cc: Sudeep Holla Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ce1091d471107dbf6f91db66a480a25950c9b9ff Author: Rasmus Villemoes Date: Tue Oct 30 15:05:14 2018 -0700 lib/bitmap.c: fix remaining space computation in bitmap_print_to_pagebuf For various alignments of buf, the current expression computes 4096 ok 4095 ok 8190 8189 ... 4097 i.e., if the caller has already written two bytes into the page buffer, len is 8190 rather than 4094, because PTR_ALIGN aligns up to the next boundary. So if the printed version of the bitmap is huge, scnprintf() ends up writing beyond the page boundary. I don't think any current callers actually write anything before bitmap_print_to_pagebuf, but the API seems to be designed to allow it. [akpm@linux-foundation.org: use offset_in_page(), per Andy] [akpm@linux-foundation.org: include mm.h for offset_in_page()] Link: http://lkml.kernel.org/r/20180818131623.8755-7-linux@rasmusvillemoes.dk Signed-off-by: Rasmus Villemoes Reviewed-by: Andy Shevchenko Cc: Yury Norov Cc: Rasmus Villemoes Cc: Sudeep Holla Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 41e7b1661ffbf562d3aa2b7ce4ad283db50b711a Author: Rasmus Villemoes Date: Tue Oct 30 15:05:10 2018 -0700 linux/bitmap.h: relax comment on compile-time constant nbits It's not clear what's so horrible about emitting a function call to handle a run-time sized bitmap. Moreover, gcc also emits a function call for a compile-time-constant-but-huge nbits, so the comment isn't even accurate. Link: http://lkml.kernel.org/r/20180818131623.8755-6-linux@rasmusvillemoes.dk Signed-off-by: Rasmus Villemoes Reviewed-by: Andy Shevchenko Cc: Yury Norov Cc: Rasmus Villemoes Cc: Sudeep Holla Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d9873969fa8725dc6a5a21ab788c057fd8719751 Author: Rasmus Villemoes Date: Tue Oct 30 15:05:07 2018 -0700 linux/bitmap.h: fix type of nbits in bitmap_shift_right() Most other bitmap API, including the OOL version __bitmap_shift_right, take unsigned nbits. This was accidentally left out from 2fbad29917c98. Link: http://lkml.kernel.org/r/20180818131623.8755-5-linux@rasmusvillemoes.dk Fixes: 2fbad29917c98 ("lib: bitmap: change bitmap_shift_right to take unsigned parameters") Signed-off-by: Rasmus Villemoes Reported-by: Yury Norov Reviewed-by: Andy Shevchenko Cc: Rasmus Villemoes Cc: Sudeep Holla Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c8cebc553368209426f7279736db4f88f1853396 Author: Rasmus Villemoes Date: Tue Oct 30 15:05:02 2018 -0700 linux/bitmap.h: remove redundant uses of small_const_nbits() In the _zero, _fill and _copy functions, the small_const_nbits branch is redundant. If nbits is small and const, gcc knows full well that BITS_TO_LONGS(nbits) is 1, so len is also a compile-time constant (sizeof(long)), and calling memset or memcpy with a length argument of sizeof(long) makes gcc generate the expected code anyway: #include void a(unsigned long *x) { memset(x, 0, 8); } void b(unsigned long *x) { memset(x, 0xff, 8); } void c(unsigned long *x, const unsigned long *y) { memcpy(x, y, 8); } turns into 0000000000000000 : 0: 48 c7 07 00 00 00 00 movq $0x0,(%rdi) 7: c3 retq 8: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1) f: 00 0000000000000010 : 10: 48 c7 07 ff ff ff ff movq $0xffffffffffffffff,(%rdi) 17: c3 retq 18: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1) 1f: 00 0000000000000020 : 20: 48 8b 06 mov (%rsi),%rax 23: 48 89 07 mov %rax,(%rdi) 26: c3 retq Link: http://lkml.kernel.org/r/20180818131623.8755-4-linux@rasmusvillemoes.dk Signed-off-by: Rasmus Villemoes Reviewed-by: Andy Shevchenko Cc: Yury Norov Cc: Rasmus Villemoes Cc: Sudeep Holla Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7275b097851a5e2e0dd4da039c7e96b59ac5314e Author: Rasmus Villemoes Date: Tue Oct 30 15:04:59 2018 -0700 linux/bitmap.h: handle constant zero-size bitmaps correctly The static inlines in bitmap.h do not handle a compile-time constant nbits==0 correctly (they dereference the passed src or dst pointers, despite only 0 words being valid to access). I had the 0-day buildbot chew on a patch [1] that would cause build failures for such cases without complaining, suggesting that we don't have any such users currently, at least for the 70 .config/arch combinations that was built. Should any turn up, make sure they use the out-of-line versions, which do handle nbits==0 correctly. This is of course not the most efficient, but it's much less churn than teaching all the static inlines an "if (zero_const_nbits())", and since we don't have any current instances, this doesn't affect existing code at all. [1] lkml.kernel.org/r/20180815085539.27485-1-linux@rasmusvillemoes.dk Link: http://lkml.kernel.org/r/20180818131623.8755-3-linux@rasmusvillemoes.dk Signed-off-by: Rasmus Villemoes Reviewed-by: Andy Shevchenko Cc: Yury Norov Cc: Rasmus Villemoes Cc: Sudeep Holla Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 696e4219237b4cac48b5145f497f4840bb5e3391 Author: Rasmus Villemoes Date: Tue Oct 30 15:04:54 2018 -0700 lib/bitmap.c: remove wrong documentation This promise is violated in a number of places, e.g. already in the second function below this paragraph. Since I don't think anybody relies on this being true, and since actually honouring it would hurt performance and code size in various places, just remove the paragraph. Link: http://lkml.kernel.org/r/20180818131623.8755-2-linux@rasmusvillemoes.dk Signed-off-by: Rasmus Villemoes Reviewed-by: Andy Shevchenko Cc: Yury Norov Cc: Rasmus Villemoes Cc: Sudeep Holla Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ea6f650465c61c70b4c96648ed2cb8a0c55db337 Author: zhong jiang Date: Tue Oct 30 15:04:51 2018 -0700 kernel/fail_function.c: remove meaningless null pointer check before debugfs_remove_recursive debugfs_remove_recursive() has taken the null pointer into account. just remove the null check before debugfs_remove_recursive(). Link: http://lkml.kernel.org/r/1537494404-16473-1-git-send-email-zhongjiang@huawei.com Signed-off-by: zhong jiang Acked-by: Masami Hiramatsu Acked-by: Kees Cook Cc: Ingo Molnar Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit de0d22e50cd3d57277f073ccf65d57aa519d6888 Author: Nick Desaulniers Date: Tue Oct 30 15:04:47 2018 -0700 treewide: remove current_text_addr Prefer _THIS_IP_ defined in linux/kernel.h. Most definitions of current_text_addr were the same as _THIS_IP_, but a few archs had inline assembly instead. This patch removes the final call site of current_text_addr, making all of the definitions dead code. [akpm@linux-foundation.org: fix arch/csky/include/asm/processor.h] Link: http://lkml.kernel.org/r/20180911182413.180715-1-ndesaulniers@google.com Signed-off-by: Nick Desaulniers Cc: Peter Zijlstra Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 49ef341ab668df248949c8e011d176ac6f8918fe Author: Oleksij Rempel Date: Tue Oct 30 15:04:43 2018 -0700 .mailmap: add Oleksij Rempel I have had various email addresses and a name change after marriage. Link: http://lkml.kernel.org/r/20181009125207.6096-1-o.rempel@pengutronix.de Signed-off-by: Oleksij Rempel Cc: Jiri Kosina Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b5c212374c85353a4412a08a958ecb6e0d2aa95f Author: Souptick Joarder Date: Tue Oct 30 15:04:35 2018 -0700 fs/proc/vmcore.c: Convert to use vmf_error() This code can be replaced with vmf_error() inline function. Link: http://lkml.kernel.org/r/20180918145945.GA11392@jordon-HP-15-Notebook-PC Signed-off-by: Souptick Joarder Reviewed-by: Matthew Wilcox Cc: Alexey Dobriyan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4b408c74ee5a0b74fc9265c2fe39b0e7dec7c056 Author: Dan Carpenter Date: Tue Oct 30 15:04:32 2018 -0700 mm/gup_benchmark.c: prevent integer overflow in ioctl The concern here is that "gup->size" is a u64 and "nr_pages" is unsigned long. On 32 bit systems we could trick the kernel into allocating fewer pages than expected. Link: http://lkml.kernel.org/r/20181025061546.hnhkv33diogf2uis@kili.mountain Fixes: 64c349f4ae78 ("mm: add infrastructure for get_user_pages_fast() benchmarking") Signed-off-by: Dan Carpenter Acked-by: Kirill A. Shutemov Reviewed-by: Andrew Morton Cc: Stephen Rothwell Cc: Keith Busch Cc: "Michael S. Tsirkin" Cc: Kees Cook Cc: YueHaibing Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ec131b2d7fa629edf88a1f51669d1b4a189cba44 Author: Jérôme Glisse Date: Tue Oct 30 15:04:28 2018 -0700 mm/hmm: invalidate device page table at start of invalidation Invalidate device page table at start of invalidation and invalidate in progress CPU page table snapshooting at both start and end of any invalidation. This is helpful when device need to dirty page because the device page table report the page as dirty. Dirtying page must happen in the start mmu notifier callback and not in the end one. Link: http://lkml.kernel.org/r/20181019160442.18723-7-jglisse@redhat.com Signed-off-by: Jérôme Glisse Cc: Ralph Campbell Cc: John Hubbard Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 44532d4c591c10d6907ac5030373bc306617d92b Author: Jérôme Glisse Date: Tue Oct 30 15:04:24 2018 -0700 mm/hmm: use a structure for update callback parameters Use a structure to gather all the parameters for the update callback. This make it easier when adding new parameters by avoiding having to update all callback function signature. The hmm_update structure is always associated with a mmu_notifier callbacks so we are not planing on grouping multiple updates together. Nor do we care about page size for the range as range will over fully cover the page being invalidated (this is a mmu_notifier property). Link: http://lkml.kernel.org/r/20181019160442.18723-6-jglisse@redhat.com Signed-off-by: Jérôme Glisse Cc: Ralph Campbell Cc: John Hubbard Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d08faca018c4618068e54dfef4f1d71230feff38 Author: Jérôme Glisse Date: Tue Oct 30 15:04:20 2018 -0700 mm/hmm: properly handle migration pmd Before this patch migration pmd entry (!pmd_present()) would have been treated as a bad entry (pmd_bad() returns true on migration pmd entry). The outcome was that device driver would believe that the range covered by the pmd was bad and would either SIGBUS or simply kill all the device's threads (each device driver decide how to react when the device tries to access poisonnous or invalid range of memory). This patch explicitly handle the case of migration pmd entry which are non present pmd entry and either wait for the migration to finish or report empty range (when device is just trying to pre- fill a range of virtual address and thus do not want to wait or trigger page fault). Link: http://lkml.kernel.org/r/20181019160442.18723-5-jglisse@redhat.com Signed-off-by: Aneesh Kumar K.V Signed-off-by: Jérôme Glisse Cc: Zi Yan Cc: Michal Hocko Cc: Ralph Campbell Cc: John Hubbard Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 86a2d59841ab0b147ffc1b7b3041af87927cf312 Author: Ralph Campbell Date: Tue Oct 30 15:04:14 2018 -0700 mm/hmm: fix race between hmm_mirror_unregister() and mmu_notifier callback In hmm_mirror_unregister(), mm->hmm is set to NULL and then mmu_notifier_unregister_no_release() is called. That creates a small window where mmu_notifier can call mmu_notifier_ops with mm->hmm equal to NULL. Fix this by first unregistering mmu notifier callbacks and then setting mm->hmm to NULL. Similarly in hmm_register(), set mm->hmm before registering mmu_notifier callbacks so callback functions always see mm->hmm set. Link: http://lkml.kernel.org/r/20181019160442.18723-4-jglisse@redhat.com Signed-off-by: Ralph Campbell Signed-off-by: Jérôme Glisse Reviewed-by: John Hubbard Reviewed-by: Jérôme Glisse Reviewed-by: Balbir Singh Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aab8d0520e6e7c2a61f71195e6ce7007a4843afb Author: Ralph Campbell Date: Tue Oct 30 15:04:11 2018 -0700 mm/rmap: map_pte() was not handling private ZONE_DEVICE page properly Private ZONE_DEVICE pages use a special pte entry and thus are not present. Properly handle this case in map_pte(), it is already handled in check_pte(), the map_pte() part was lost in some rebase most probably. Without this patch the slow migration path can not migrate back to any private ZONE_DEVICE memory to regular memory. This was found after stress testing migration back to system memory. This ultimatly can lead to the CPU constantly page fault looping on the special swap entry. Link: http://lkml.kernel.org/r/20181019160442.18723-3-jglisse@redhat.com Signed-off-by: Ralph Campbell Signed-off-by: Jérôme Glisse Reviewed-by: Balbir Singh Cc: Andrew Morton Cc: Kirill A. Shutemov Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f813f21971b96f61a789dd48151f92220fdd2e0a Author: Jérôme Glisse Date: Tue Oct 30 15:04:06 2018 -0700 mm/hmm: fix utf8 ... Patch series "HMM updates, improvements and fixes", v2 Few fixes that only affect HMM users. Improve the synchronization call back so that we match was other mmu_notifier listener do and add proper support to the new blockable flags in the process. For curious folks here are branches to leverage HMM in various existing device drivers: https://cgit.freedesktop.org/~glisse/linux/log/?h=hmm-nouveau-v01 https://cgit.freedesktop.org/~glisse/linux/log/?h=hmm-radeon-v00 https://cgit.freedesktop.org/~glisse/linux/log/?h=hmm-intel-v00 More to come (amd gpu, Mellanox, ...) I expect more of the preparatory work for nouveau will be merge in 4.20 (like we have been doing since 4.16) and i will wait until this patchset is upstream before pushing the patches that actualy make use of HMM (to avoid complex tree inter-dependency). This patch (of 6): Somehow utf=8 must have been broken. Link: http://lkml.kernel.org/r/20181019160442.18723-2-jglisse@redhat.com Signed-off-by: Jérôme Glisse Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c57cdf7a9e51d97a43e29b8f4a04157875104000 Author: Ming Lei Date: Wed Oct 24 21:18:09 2018 +0800 block: call rq_qos_exit() after queue is frozen rq_qos_exit() removes the current q->rq_qos, this action has to be done after queue is frozen, otherwise the IO queue path may never be waken up, then IO hang is caused. So fixes this issue by moving rq_qos_exit() after queue is frozen. Cc: Josef Bacik Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 3b692c55e58d06ba9b17c66784cab5a95ba5be9b Author: Daniel Drake Date: Tue Oct 9 14:40:56 2018 +0800 HID: asus: only support backlight when it's not driven by WMI The Asus GL502VSK has the same 0B05:1837 keyboard as we've seen in several Republic of Gamers laptops. However, in this model, the keybard backlight control exposed by hid-asus has no effect on the keyboard backlight. Instead, the keyboard backlight is correctly driven by asus-wmi. With two keyboard backlight devices available (and only the acer-wmi one working), GNOME is picking the wrong one to drive in the UI. Avoid this problem by not creating the backlight interface when we detect a WMI-driven keyboard backlight. We have also tested Asus GL702VMK which does have the hid-asus backlight present, and it still works fine with this patch (WMI method call returns UNSUPPORTED_METHOD). A direct "depends on ASUS_WMI" is intentionally avoided so that HID_ASUS users who have ASUS_WMI=n will not quietly lose their HID_ASUS driver on a kernel upgrade. Signed-off-by: Daniel Drake Reviewed-by: Benjamin Tissoires Signed-off-by: Andy Shevchenko commit ffb6ce7086ee2d68d8d6d987882f1c5e923fee7e Author: Daniel Drake Date: Tue Oct 9 14:40:55 2018 +0800 platform/x86: asus-wmi: export function for evaluating WMI methods Export asus_wmi_evaluate_method() and related headers for use by other drivers. hid-asus is going to use this to avoid advertising that it has a keyboard backlight when the keyboard backlight is controlled via WMI. Signed-off-by: Daniel Drake Signed-off-by: Andy Shevchenko commit 29f6eb533c3be9b9c74cdeacc7bf14d927a8adb4 Author: Jian-Hong Pan Date: Mon Oct 22 18:00:04 2018 +0800 platform/x86: asus-wmi: Only notify kbd LED hw_change by fn-key pressed Since commit dbb3d78f61ba ("platform/x86: asus-wmi: Call led hw_changed API on kbd brightness change"), asus-wmi directly changes the keyboard LED brightness when the keyboard brightness keys are pressed, raising the appropriate notification. However, this notification was unintentionally also being raised during boot and resume from suspend. This was resulting in userspace showing the keyboard LED OSD on resume for no good reason. Move the keyboard LED brightness changed notification from kbd_led_update to the new kbd_led_set_by_kbd function which is only called from the keyboard brightness function keys codepath. Signed-off-by: Jian-Hong Pan Signed-off-by: Daniel Drake Signed-off-by: Andy Shevchenko commit 69372c1dbdee8cab3c3892eda932c624af59a494 Author: Bhumika Goyal Date: Sun Oct 28 11:37:00 2018 +0530 platform/x86: wmi: declare device_type structure as constant The only usage of device_type structure is getting stored as a reference in the type field of device structure. This type field is declared const. Therefore, the device_type structure can never be modified and can be declared as const. Signed-off-by: Bhumika Goyal Signed-off-by: Andy Shevchenko commit 0252894f53fc2693672308d5453d5076b7516637 Author: Misha Komarovskiy Date: Sat Oct 27 02:07:23 2018 +0300 platform/x86: ideapad: Add Y530-15ICH to no_hw_rfkill Lenovo Legion Y530-15ICH is another model without hardware radio switch. Add it to no_hw_rfkill to enable wireless. Signed-off-by: Misha Komarovskiy Signed-off-by: Andy Shevchenko commit 4f8f382e635707ddaddf8269a116e4f8cc8835c0 Author: David Miller Date: Tue Oct 30 22:24:04 2018 -0700 perf tools: Don't clone maps from parent when synthesizing forks When synthesizing FORK events, we are trying to create thread objects for the already running tasks on the machine. Normally, for a kernel FORK event, we want to clone the parent's maps because that is what the kernel just did. But when synthesizing, this should not be done. If we do, we end up with overlapping maps as we process the sythesized MMAP2 events that get delivered shortly thereafter. Use the FORK event misc flags in an internal way to signal this situation, so we can elide the map clone when appropriate. Signed-off-by: David S. Miller Cc: Don Zickus Cc: Jiri Olsa Cc: Joe Mario Link: http://lkml.kernel.org/r/20181030.222404.2085088822877051075.davem@davemloft.net [ Added comment about flag use in machine__process_fork_event(), use ternary op in thread__clone_map_groups() as suggested by Jiri ] Signed-off-by: Arnaldo Carvalho de Melo commit ff27a06af6ffd3f49b9e193eb68f487ad76651e1 Author: David Miller Date: Tue Oct 30 22:30:03 2018 -0700 perf top: Start display thread earlier If events are coming in at a rate such that the event processing thread can barely keep up, our initial run of the event ring will almost never terminate and this delays the starting of the display thread. The screen basically stays black until the event thread can get out of it's endless loop. Therefore, start the display thread before we start processing the ring buffer. This also make sure that we always have the user requested real time setting engaged when processing the ring. Signed-off-by: David S. Miller Tested-by: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Link: http://lkml.kernel.org/r/20181030.223003.2242527041807905962.davem@davemloft.net Signed-off-by: Arnaldo Carvalho de Melo commit 76b0b801782b34b3028dcef3de36cb634e3908a8 Author: Arnaldo Carvalho de Melo Date: Tue Oct 30 17:06:57 2018 -0300 tools headers uapi: Update linux/if_link.h header copy To pick the changes from: 9163a0fc1f0c ("net: bridge: add support for per-port vlan stats") And silence this build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/if_link.h' differs from latest version at 'include/uapi/linux/if_link.h' Cc: Alexei Starovoitov Cc: David S. Miller Cc: Eric Leblond Cc: Nikolay Aleksandrov Link: https://lkml.kernel.org/n/tip-7p53ghippywz7fqkwo3nkzet@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit d45a57fff0a657045a77b395ae713ffae0cb4e46 Author: Arnaldo Carvalho de Melo Date: Tue Oct 30 17:04:47 2018 -0300 tools headers uapi: Update linux/netlink.h header copy Picking the changes from: 89d35528d17d ("netlink: Add new socket option to enable strict checking on dumps") To silence this build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/netlink.h' differs from latest version at 'include/uapi/linux/netlink.h' Cc: Alexei Starovoitov Cc: David Ahern Cc: David S. Miller Cc: Eric Leblond Link: https://lkml.kernel.org/n/tip-1xymkfjpmhxfzrs46t8z8mjw@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 827758129a0f84fbd0b2dda15e14a77a7604803d Author: Arnaldo Carvalho de Melo Date: Tue Oct 30 17:01:46 2018 -0300 tools headers: Sync the various kvm.h header copies For powerpc, s390, x86 and the main uapi linux/kvm.h header, none of them entail changes in tooling. Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-avn7iy8f4tcm2y40sbsdk31m@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 685626dc26bd9cead850d06520708acbd16bcfda Author: Arnaldo Carvalho de Melo Date: Tue Oct 30 16:50:08 2018 -0300 tools include uapi: Update linux/mmap.h copy To pick up the changes from: 20916d4636a9 ("mm/hugetlb: add mmap() encodings for 32MB and 512MB page sizes") That do not entail changes in in tools, this just shows that we have to consider bits [26:31] of flags to beautify that in tools like 'perf trace' This silences this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/mman.h' differs from latest version at 'include/uapi/linux/mman.h' diff -u tools/include/uapi/linux/mman.h include/uapi/linux/mman.h Cc: Anshuman Khandual Cc: Greg Kroah-Hartman Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-3rvc39lon93kgt5pl31d8g4x@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 2f967f1dbbc1f746ad0deda8352bcf563d59e1c7 Author: Arnaldo Carvalho de Melo Date: Tue Oct 30 16:30:38 2018 -0300 perf trace beauty: Use the mmap flags table generated from headers Instead of requiring us to go on and edit sources to add new flag. # perf trace -e *mmap sleep 0.1 0.025 ( 0.005 ms): sleep/29876 mmap(len: 163746, prot: READ, flags: PRIVATE, fd: 3) = 0x7faa68ad1000 0.059 ( 0.004 ms): sleep/29876 mmap(len: 8192, prot: READ|WRITE, flags: PRIVATE|ANONYMOUS) = 0x7faa68acf000 0.069 ( 0.006 ms): sleep/29876 mmap(len: 3889792, prot: EXEC|READ, flags: PRIVATE|DENYWRITE, fd: 3) = 0x7faa6851f000 0.086 ( 0.009 ms): sleep/29876 mmap(addr: 0x7faa688cb000, len: 24576, prot: READ|WRITE, flags: PRIVATE|FIXED|DENYWRITE, fd: 3, off: 1753088) = 0x7faa688cb000 0.101 ( 0.005 ms): sleep/29876 mmap(addr: 0x7faa688d1000, len: 14976, prot: READ|WRITE, flags: PRIVATE|FIXED|ANONYMOUS) = 0x7faa688d1000 0.348 ( 0.005 ms): sleep/29876 mmap(len: 111950656, prot: READ, flags: PRIVATE, fd: 3) = 0x7faa61a5b000 # Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-ggmoy6vxoygh5yim890ht0kf@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit fbd7458db75790e37903c75be68513a4c087737c Author: Arnaldo Carvalho de Melo Date: Tue Oct 30 16:11:59 2018 -0300 perf beauty: Wire up the mmap flags table generator to the Makefile Now when we run 'make -C tools/perf O=/tmp/build/perf' we end up with: $ cat /tmp/build/perf/trace/beauty/generated/mmap_flags_array.c static const char *mmap_flags[] = { [ilog2(0x40) + 1] = "32BIT", [ilog2(0x01) + 1] = "SHARED", [ilog2(0x02) + 1] = "PRIVATE", [ilog2(0x10) + 1] = "FIXED", [ilog2(0x20) + 1] = "ANONYMOUS", [ilog2(0x100000) + 1] = "FIXED_NOREPLACE", [ilog2(0x0100) + 1] = "GROWSDOWN", [ilog2(0x0800) + 1] = "DENYWRITE", [ilog2(0x1000) + 1] = "EXECUTABLE", [ilog2(0x2000) + 1] = "LOCKED", [ilog2(0x4000) + 1] = "NORESERVE", [ilog2(0x8000) + 1] = "POPULATE", [ilog2(0x10000) + 1] = "NONBLOCK", [ilog2(0x20000) + 1] = "STACK", [ilog2(0x40000) + 1] = "HUGETLB", [ilog2(0x80000) + 1] = "SYNC", }; $ Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-t3fn7u3tjsupio6e6vkufx9m@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 80ee5668b8a755039ca6180c6272a6e8efee5aad Author: Arnaldo Carvalho de Melo Date: Tue Oct 30 15:26:47 2018 -0300 perf beauty: Add a generator for MAP_ mmap's flag constants It'll use tools/{arch}/*,include copies of mman.h to generate a table to be used by tools, initially by the 'mmap' beautifiers in 'perf trace', but that could also be used to translate from a string constant to the integer value to be used in a eBPF or tracefs tracepoint filter. Tested for all archs using: $ for arch in `ls tools/arch/` ; \ do echo $arch ; tools/perf/trace/beauty/mmap_flags.sh $arch ; \ done | less Example for alpha, an oddball, doesn't include any header, defines all its stuff: $ tools/perf/trace/beauty/mmap_flags.sh alpha static const char *mmap_flags[] = { [ilog2(0x10) + 1] = "ANONYMOUS", [ilog2(0x02000) + 1] = "DENYWRITE", [ilog2(0x04000) + 1] = "EXECUTABLE", [ilog2(0x100) + 1] = "FIXED", [ilog2(0x01000) + 1] = "GROWSDOWN", [ilog2(0x100000) + 1] = "HUGETLB", [ilog2(0x08000) + 1] = "LOCKED", [ilog2(0x40000) + 1] = "NONBLOCK", [ilog2(0x10000) + 1] = "NORESERVE", [ilog2(0x20000) + 1] = "POPULATE", [ilog2(0x02) + 1] = "PRIVATE", [ilog2(0x01) + 1] = "SHARED", [ilog2(0x80000) + 1] = "STACK", }; $ Common case, my workstation, defines one entry (MAP_32BIT), then includes mman.h, which gets it to include mman-common.h too: $ tools/perf/trace/beauty/mmap_flags.sh static const char *mmap_flags[] = { [ilog2(0x40) + 1] = "32BIT", [ilog2(0x01) + 1] = "SHARED", [ilog2(0x02) + 1] = "PRIVATE", [ilog2(0x10) + 1] = "FIXED", [ilog2(0x20) + 1] = "ANONYMOUS", [ilog2(0x100000) + 1] = "FIXED_NOREPLACE", [ilog2(0x0100) + 1] = "GROWSDOWN", [ilog2(0x0800) + 1] = "DENYWRITE", [ilog2(0x1000) + 1] = "EXECUTABLE", [ilog2(0x2000) + 1] = "LOCKED", [ilog2(0x4000) + 1] = "NORESERVE", [ilog2(0x8000) + 1] = "POPULATE", [ilog2(0x10000) + 1] = "NONBLOCK", [ilog2(0x20000) + 1] = "STACK", [ilog2(0x40000) + 1] = "HUGETLB", [ilog2(0x80000) + 1] = "SYNC", }; $ uname -m x86_64 $ Sparc, that defines a bunch then includes just mman-common.h: $ tools/perf/trace/beauty/mmap_flags.sh sparc static const char *mmap_flags[] = { [ilog2(0x0800) + 1] = "DENYWRITE", [ilog2(0x1000) + 1] = "EXECUTABLE", [ilog2(0x0200) + 1] = "GROWSDOWN", [ilog2(0x40000) + 1] = "HUGETLB", [ilog2(0x100) + 1] = "LOCKED", [ilog2(0x10000) + 1] = "NONBLOCK", [ilog2(0x40) + 1] = "NORESERVE", [ilog2(0x8000) + 1] = "POPULATE", [ilog2(0x20000) + 1] = "STACK", [ilog2(0x01) + 1] = "SHARED", [ilog2(0x02) + 1] = "PRIVATE", [ilog2(0x10) + 1] = "FIXED", [ilog2(0x20) + 1] = "ANONYMOUS", [ilog2(0x100000) + 1] = "FIXED_NOREPLACE", }; [acme@jouet perf]$ Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-xydeh491z8fkgglcmqnl5thj@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 89eb1f3b7f2a9156ce6f78713d7924c1bb2fab9f Author: Arnaldo Carvalho de Melo Date: Tue Oct 30 14:20:07 2018 -0300 tools include uapi: Update asound.h copy To silence this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/sound/asound.h' differs from latest version at 'include/uapi/sound/asound.h' diff -u tools/include/uapi/sound/asound.h include/uapi/sound/asound.h Due to this cset: a98401518def ("ALSA: timer: fix wrong comment to refer to 'SNDRV_TIMER_PSFLG_*'") Cc: Jiri Olsa Cc: Namhyung Kim Cc: Takashi Sakamoto Cc: Takashi Iwai Link: https://lkml.kernel.org/n/tip-76gsvs0w2g0x723ivqa2xua3@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 8dd4c0f68c0db4c0f01af60a99a7ed34fd3dee2b Author: Arnaldo Carvalho de Melo Date: Tue Oct 30 13:10:50 2018 -0300 tools arch uapi: Update asm-generic/unistd.h and arm64 unistd.h copies To get the changes in: 82b355d161c9 ("y2038: Remove newstat family from default syscall set") Which will make the syscall table used by 'perf trace' for arm64 to be updated from the changes in that patch. This silences these perf build warnings: Warning: Kernel ABI header at 'tools/arch/arm64/include/uapi/asm/unistd.h' differs from latest version at 'arch/arm64/include/uapi/asm/unistd.h' diff -u tools/arch/arm64/include/uapi/asm/unistd.h arch/arm64/include/uapi/asm/unistd.h Warning: Kernel ABI header at 'tools/include/uapi/asm-generic/unistd.h' differs from latest version at 'include/uapi/asm-generic/unistd.h' diff -u tools/include/uapi/asm-generic/unistd.h include/uapi/asm-generic/unistd.h Cc: Kim Phillips Cc: Arnd Bergmann Cc: Geert Uytterhoeven Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-3euy7c4yy5mvnp5bm16t9vqg@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 733ac4f9935c4b257aff2ec476e6c20665daf6c2 Author: Arnaldo Carvalho de Melo Date: Tue Oct 30 12:27:37 2018 -0300 tools include uapi: Update linux/fs.h copy To silence this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/fs.h' differs from latest version at 'include/uapi/linux/fs.h' diff -u tools/include/uapi/linux/fs.h include/uapi/linux/fs.h Due to just two comments added by: Fixes: 578bdaabd015 ("crypto: speck - remove Speck") So nothing that entails changes in tools/, that so far uses fs.h to generate the mount and umount syscalls 'flags' argument integer->string tables with: $ tools/perf/trace/beauty/mount_flags.sh static const char *mount_flags[] = { [4096 ? (ilog2(4096) + 1) : 0] = "BIND", [30 + 1] = "ACTIVE", [31 + 1] = "NOUSER", }; $ # trace -e mount,umount mount --bind /proc /mnt 1.228 ( 2.581 ms): mount/1068 mount(dev_name: /mnt, dir_name: 0x55f011c354a0, type: 0x55f011c38170, flags: BIND) = 0 # trace -e mount,umount umount /proc /mnt umount: /proc: target is busy. 1.587 ( 0.010 ms): umount/1070 umount2(name: /proc) = -1 EBUSY Device or resource busy 1.799 (12.660 ms): umount/1070 umount2(name: /mnt) = 0 # Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Cc: Jason A. Donenfeld Cc: Herbert Xu Link: https://lkml.kernel.org/n/tip-c00bqzclscgah26z2g5zxm73@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit e9024d519d892b38176cafd46f68a7cdddd77412 Author: David S. Miller Date: Tue Oct 30 12:12:26 2018 -0300 perf callchain: Honour the ordering of PERF_CONTEXT_{USER,KERNEL,etc} When processing using 'perf report -g caller', which is the default, we ended up reverting the callchain entries received from the kernel, but simply reverting throws away the information that tells that from a point onwards the addresses are for userspace, kernel, guest kernel, guest user, hypervisor. The idea is that if we are walking backwards, for each cluster of non-cpumode entries we have to first scan backwards for the next one and use that for the cluster. This seems silly and more expensive than it needs to be but it is enough for a initial fix. The code here is really complicated because it is intimately intertwined with the lbr and branch handling, as well as this callchain order, further fixes will be needed to properly take into account the cpumode in those cases. Another problem with ORDER_CALLER is that the NULL "0" IP that is at the end of most callchains shows up at the top of the histogram because every callchain contains it and with ORDER_CALLER it is the first entry. Signed-off-by: David S. Miller Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Souvik Banerjee Cc: Wang Nan Cc: stable@vger.kernel.org # 4.19 Link: https://lkml.kernel.org/n/tip-2wt3ayp6j2y2f2xowixa8y6y@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit d6c9c05fe1eb4b213b183d8a1e79416256dc833a Author: Leo Yan Date: Tue Oct 30 15:18:28 2018 +0800 perf cs-etm: Correct CPU mode for samples Since commit edeb0c90df35 ("perf tools: Stop fallbacking to kallsyms for vdso symbols lookup"), the kernel address cannot be properly parsed to kernel symbol with command 'perf script -k vmlinux'. The reason is CoreSight samples is always to set CPU mode as PERF_RECORD_MISC_USER, thus it fails to find corresponding map/dso in below flows: process_sample_event() `-> machine__resolve() `-> thread__find_map(thread, sample->cpumode, sample->ip, al); In this flow it needs to pass argument 'sample->cpumode' to tell what's the CPU mode, before it always passed PERF_RECORD_MISC_USER but without any failure until the commit edeb0c90df35 ("perf tools: Stop fallbacking to kallsyms for vdso symbols lookup") has been merged. The reason is even with the wrong CPU mode the function thread__find_map() firstly fails to find map but it will rollback to find kernel map for vdso symbols lookup. In the latest code it has removed the fallback code, thus if CPU mode is PERF_RECORD_MISC_USER then it cannot find map anymore with kernel address. This patch is to correct samples CPU mode setting, it creates a new helper function cs_etm__cpu_mode() to tell what's the CPU mode based on the address with the info from machine structure; this patch has a bit extension to check not only kernel and user mode, but also check for host/guest and hypervisor mode. Finally this patch uses the function in instruction and branch samples and also apply in cs_etm__mem_access() for a minor polishing. Signed-off-by: Leo Yan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: David Miller Cc: Jiri Olsa Cc: Mathieu Poirier Cc: Namhyung Kim Cc: Peter Zijlstra Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Cc: stable@kernel.org # v4.19 Link: http://lkml.kernel.org/r/1540883908-17018-1-git-send-email-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 1fe627da30331024f453faef04d500079b901107 Author: Milian Wolff Date: Mon Oct 29 15:16:44 2018 +0100 perf unwind: Take pgoff into account when reporting elf to libdwfl libdwfl parses an ELF file itself and creates mappings for the individual sections. perf on the other hand sees raw mmap events which represent individual sections. When we encounter an address pointing into a mapping with pgoff != 0, we must take that into account and report the file at the non-offset base address. This fixes unwinding with libdwfl in some cases. E.g. for a file like: ``` using namespace std; mutex g_mutex; double worker() { lock_guard guard(g_mutex); uniform_real_distribution uniform(-1E5, 1E5); default_random_engine engine; double s = 0; for (int i = 0; i < 1000; ++i) { s += norm(complex(uniform(engine), uniform(engine))); } cout << s << endl; return s; } int main() { vector> results; for (int i = 0; i < 10000; ++i) { results.push_back(async(launch::async, worker)); } return 0; } ``` Compile it with `g++ -g -O2 -lpthread cpp-locking.cpp -o cpp-locking`, then record it with `perf record --call-graph dwarf -e sched:sched_switch`. When you analyze it with `perf script` and libunwind, you should see: ``` cpp-locking 20038 [005] 54830.236589: sched:sched_switch: prev_comm=cpp-locking prev_pid=20038 prev_prio=120 prev_state=T ==> next_comm=swapper/5 next_pid=0 next_prio=120 ffffffffb166fec5 __sched_text_start+0x545 (/lib/modules/4.14.78-1-lts/build/vmlinux) ffffffffb166fec5 __sched_text_start+0x545 (/lib/modules/4.14.78-1-lts/build/vmlinux) ffffffffb1670208 schedule+0x28 (/lib/modules/4.14.78-1-lts/build/vmlinux) ffffffffb16737cc rwsem_down_read_failed+0xec (/lib/modules/4.14.78-1-lts/build/vmlinux) ffffffffb1665e04 call_rwsem_down_read_failed+0x14 (/lib/modules/4.14.78-1-lts/build/vmlinux) ffffffffb1672a03 down_read+0x13 (/lib/modules/4.14.78-1-lts/build/vmlinux) ffffffffb106bd85 __do_page_fault+0x445 (/lib/modules/4.14.78-1-lts/build/vmlinux) ffffffffb18015f5 page_fault+0x45 (/lib/modules/4.14.78-1-lts/build/vmlinux) 7f38e4252591 new_heap+0x101 (/usr/lib/libc-2.28.so) 7f38e4252d0b arena_get2.part.4+0x2fb (/usr/lib/libc-2.28.so) 7f38e4255b1c tcache_init.part.6+0xec (/usr/lib/libc-2.28.so) 7f38e42569e5 __GI___libc_malloc+0x115 (inlined) 7f38e4241790 __GI__IO_file_doallocate+0x90 (inlined) 7f38e424fbbf __GI__IO_doallocbuf+0x4f (inlined) 7f38e424ee47 __GI__IO_file_overflow+0x197 (inlined) 7f38e424df36 _IO_new_file_xsputn+0x116 (inlined) 7f38e4242bfb __GI__IO_fwrite+0xdb (inlined) 7f38e463fa6d std::basic_streambuf >::sputn(char const*, long)+0x1cd (inlined) 7f38e463fa6d std::ostreambuf_iterator >::_M_put(char const*, long)+0x1cd (inlined) 7f38e463fa6d std::ostreambuf_iterator > std::__write(std::ostreambuf_iterator >, char const*, int)+0x1cd (inlined) 7f38e463fa6d std::ostreambuf_iterator > std::num_put > >::_M_insert_float(std::ostreambuf_iterator 7f38e464bd70 std::num_put > >::put(std::ostreambuf_iterator >, std::ios_base&, char, double) const+0x90 (inl> 7f38e464bd70 std::ostream& std::ostream::_M_insert(double)+0x90 (/usr/lib/libstdc++.so.6.0.25) 563b9cb502f7 std::ostream::operator<<(double)+0xb7 (inlined) 563b9cb502f7 worker()+0xb7 (/ssd/milian/projects/kdab/rnd/hotspot/build/tests/test-clients/cpp-locking/cpp-locking) 563b9cb506fb double std::__invoke_impl(std::__invoke_other, double (*&&)())+0x2b (inlined) 563b9cb506fb std::__invoke_result::type std::__invoke(double (*&&)())+0x2b (inlined) 563b9cb506fb decltype (__invoke((_S_declval<0ul>)())) std::thread::_Invoker >::_M_invoke<0ul>(std::_Index_tuple<0ul>)+0x2b (inlined) 563b9cb506fb std::thread::_Invoker >::operator()()+0x2b (inlined) 563b9cb506fb std::__future_base::_Task_setter, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker >, dou> 563b9cb506fb std::_Function_handler (), std::__future_base::_Task_setter 563b9cb507e8 std::function ()>::operator()() const+0x28 (inlined) 563b9cb507e8 std::__future_base::_State_baseV2::_M_do_set(std::function ()>*, bool*)+0x28 (/ssd/milian/> 7f38e46d24fe __pthread_once_slow+0xbe (/usr/lib/libpthread-2.28.so) 563b9cb51149 __gthread_once+0xe9 (inlined) 563b9cb51149 void std::call_once ()>*, bool*)> 563b9cb51149 std::__future_base::_State_baseV2::_M_set_result(std::function ()>, bool)+0xe9 (inlined) 563b9cb51149 std::__future_base::_Async_state_impl >, double>::_Async_state_impl(std::thread::_Invoker >&&)::{lambda()#1}::op> 563b9cb51149 void std::__invoke_impl >, double>::_Async_state_impl(std::thread::_Invoker 563b9cb51149 std::__invoke_result >, double>::_Async_state_impl(std::thread::_Invoker >> 563b9cb51149 decltype (__invoke((_S_declval<0ul>)())) std::thread::_Invoker >, double>::_Async_state_> 563b9cb51149 std::thread::_Invoker >, double>::_Async_state_impl(std::thread::_Invoker 563b9cb51149 std::thread::_State_impl >, double>::_Async_state_impl(std::thread> 7f38e45f0062 execute_native_thread_routine+0x12 (/usr/lib/libstdc++.so.6.0.25) 7f38e46caa9c start_thread+0xfc (/usr/lib/libpthread-2.28.so) 7f38e42ccb22 __GI___clone+0x42 (inlined) ``` Before this patch, using libdwfl, you would see: ``` cpp-locking 20038 [005] 54830.236589: sched:sched_switch: prev_comm=cpp-locking prev_pid=20038 prev_prio=120 prev_state=T ==> next_comm=swapper/5 next_pid=0 next_prio=120 ffffffffb166fec5 __sched_text_start+0x545 (/lib/modules/4.14.78-1-lts/build/vmlinux) ffffffffb166fec5 __sched_text_start+0x545 (/lib/modules/4.14.78-1-lts/build/vmlinux) ffffffffb1670208 schedule+0x28 (/lib/modules/4.14.78-1-lts/build/vmlinux) ffffffffb16737cc rwsem_down_read_failed+0xec (/lib/modules/4.14.78-1-lts/build/vmlinux) ffffffffb1665e04 call_rwsem_down_read_failed+0x14 (/lib/modules/4.14.78-1-lts/build/vmlinux) ffffffffb1672a03 down_read+0x13 (/lib/modules/4.14.78-1-lts/build/vmlinux) ffffffffb106bd85 __do_page_fault+0x445 (/lib/modules/4.14.78-1-lts/build/vmlinux) ffffffffb18015f5 page_fault+0x45 (/lib/modules/4.14.78-1-lts/build/vmlinux) 7f38e4252591 new_heap+0x101 (/usr/lib/libc-2.28.so) a041161e77950c5c [unknown] ([unknown]) ``` With this patch applied, we get a bit further in unwinding: ``` cpp-locking 20038 [005] 54830.236589: sched:sched_switch: prev_comm=cpp-locking prev_pid=20038 prev_prio=120 prev_state=T ==> next_comm=swapper/5 next_pid=0 next_prio=120 ffffffffb166fec5 __sched_text_start+0x545 (/lib/modules/4.14.78-1-lts/build/vmlinux) ffffffffb166fec5 __sched_text_start+0x545 (/lib/modules/4.14.78-1-lts/build/vmlinux) ffffffffb1670208 schedule+0x28 (/lib/modules/4.14.78-1-lts/build/vmlinux) ffffffffb16737cc rwsem_down_read_failed+0xec (/lib/modules/4.14.78-1-lts/build/vmlinux) ffffffffb1665e04 call_rwsem_down_read_failed+0x14 (/lib/modules/4.14.78-1-lts/build/vmlinux) ffffffffb1672a03 down_read+0x13 (/lib/modules/4.14.78-1-lts/build/vmlinux) ffffffffb106bd85 __do_page_fault+0x445 (/lib/modules/4.14.78-1-lts/build/vmlinux) ffffffffb18015f5 page_fault+0x45 (/lib/modules/4.14.78-1-lts/build/vmlinux) 7f38e4252591 new_heap+0x101 (/usr/lib/libc-2.28.so) 7f38e4252d0b arena_get2.part.4+0x2fb (/usr/lib/libc-2.28.so) 7f38e4255b1c tcache_init.part.6+0xec (/usr/lib/libc-2.28.so) 7f38e42569e5 __GI___libc_malloc+0x115 (inlined) 7f38e4241790 __GI__IO_file_doallocate+0x90 (inlined) 7f38e424fbbf __GI__IO_doallocbuf+0x4f (inlined) 7f38e424ee47 __GI__IO_file_overflow+0x197 (inlined) 7f38e424df36 _IO_new_file_xsputn+0x116 (inlined) 7f38e4242bfb __GI__IO_fwrite+0xdb (inlined) 7f38e463fa6d std::basic_streambuf >::sputn(char const*, long)+0x1cd (inlined) 7f38e463fa6d std::ostreambuf_iterator >::_M_put(char const*, long)+0x1cd (inlined) 7f38e463fa6d std::ostreambuf_iterator > std::__write(std::ostreambuf_iterator >, char const*, int)+0x1cd (inlined) 7f38e463fa6d std::ostreambuf_iterator > std::num_put > >::_M_insert_float(std::ostreambuf_iterator 7f38e464bd70 std::num_put > >::put(std::ostreambuf_iterator >, std::ios_base&, char, double) const+0x90 (inl> 7f38e464bd70 std::ostream& std::ostream::_M_insert(double)+0x90 (/usr/lib/libstdc++.so.6.0.25) 563b9cb502f7 std::ostream::operator<<(double)+0xb7 (inlined) 563b9cb502f7 worker()+0xb7 (/ssd/milian/projects/kdab/rnd/hotspot/build/tests/test-clients/cpp-locking/cpp-locking) 6eab825c1ee3e4ff [unknown] ([unknown]) ``` Note that the backtrace is still stopping too early, when compared to the nice results obtained via libunwind. It's unclear so far what the reason for that is. Committer note: Further comment by Milian on the thread started on the Link: tag below: --- The remaining issue is due to a bug in elfutils: https://sourceware.org/ml/elfutils-devel/2018-q4/msg00089.html With both patches applied, libunwind and elfutils produce the same output for the above scenario. --- Signed-off-by: Milian Wolff Acked-by: Jiri Olsa Link: http://lkml.kernel.org/r/20181029141644.3907-1-milian.wolff@kdab.com Signed-off-by: Arnaldo Carvalho de Melo commit 218d61110f69632974034b6e27686ce482a1c455 Author: Arnaldo Carvalho de Melo Date: Mon Oct 29 09:47:00 2018 -0300 perf top: Do not use overwrite mode by default Enabling --overwrite mode allows us to to use just the most recent records, which helps in high core count machines such as Knights Landing/Mill, but right now is being disabled by default as the pausing used in this technique is leading to loss of metadata events such as PERF_RECORD_MMAP which makes 'perf top' unable to resolve samples, leading to lots of unknown samples appearing on the UI. Enabling this may be useful if you are in such machines and profiling a workload that doesn't creates short lived threads and/or doesn't uses many executable mmap operations. Work is being planed to solve this situation, till then, this will remain disabled by default. Reported-by: David Miller Acked-by: Kan Liang Link: https://lkml.kernel.org/r/4f84468f-37d9-cf1b-12c1-514ef74b6a48@linux.intel.com Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Fixes: ebebbf082357 ("perf top: Switch default mode to overwrite mode") Link: https://lkml.kernel.org/n/tip-ehvf77vi1si9409r7p4wx788@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 69f8117f17b332a68cd8f4bf8c2d0d3d5b84efc5 Author: Michael Ellerman Date: Mon Oct 29 22:23:53 2018 +1100 selftests/powerpc/cache_shape: Fix out-of-tree build Use TEST_GEN_PROGS and don't redefine all, this makes the out-of-tree build work. We need to move the extra dependencies below the include of lib.mk, because it adds the $(OUTPUT) prefix if it's defined. We can also drop the clean rule, lib.mk does it for us. Signed-off-by: Michael Ellerman commit 266bac361d5677e61a6815bd29abeb3bdced2b07 Author: Michael Ellerman Date: Mon Oct 29 22:23:52 2018 +1100 selftests/powerpc/switch_endian: Fix out-of-tree build For the out-of-tree build to work we need to tell switch_endian_test to look for check-reversed.S in $(OUTPUT). Signed-off-by: Michael Ellerman commit 98415da03ae6559dc62899fd31e55e194779c45b Author: Joel Stanley Date: Mon Oct 29 22:23:51 2018 +1100 selftests/powerpc/pmu: Link ebb tests with -no-pie When running the ebb tests after building on a ppc64le Ubuntu machine: $ pmu/ebb/reg_access_test: error while loading shared libraries: R_PPC64_ADDR16_HI reloc at 0x000000013a965130 for symbol `' out of range This is because the Ubuntu toolchain builds has PIE enabled by default. Change it to be always off instead. Signed-off-by: Joel Stanley Signed-off-by: Michael Ellerman commit 27825349d7b238533a47e3d98b8bb0efd886b752 Author: Joel Stanley Date: Mon Oct 29 22:23:50 2018 +1100 selftests/powerpc/signal: Fix out-of-tree build We should use TEST_GEN_PROGS, not TEST_PROGS. That tells the selftests makefile (lib.mk) that those tests are generated (built), and so it adds the $(OUTPUT) prefix for us, making the out-of-tree build work correctly. It also means we don't need our own clean rule, lib.mk does it. We also have to update the signal_tm rule to use $(OUTPUT). Signed-off-by: Joel Stanley Signed-off-by: Michael Ellerman commit c39b79082a38a4f8c801790edecbbb4d62ed2992 Author: Joel Stanley Date: Mon Oct 29 22:23:49 2018 +1100 selftests/powerpc/ptrace: Fix out-of-tree build We should use TEST_GEN_PROGS, not TEST_PROGS. That tells the selftests makefile (lib.mk) that those tests are generated (built), and so it adds the $(OUTPUT) prefix for us, making the out-of-tree build work correctly. It also means we don't need our own clean rule, lib.mk does it. We also have to update the ptrace-pkey and core-pkey rules to use $(OUTPUT). Signed-off-by: Joel Stanley Signed-off-by: Michael Ellerman commit 399474e4c1100bca264ed14fa3ad0d68fab484d8 Author: Julian Sax Date: Wed Oct 24 22:40:26 2018 +0200 HID: i2c-hid: add Direkt-Tek DTLAPY133-1 to descriptor override This device uses the SIPODEV SP1064 touchpad, which does not supply descriptors, so it has to be added to the override list. Reported-by: Tim Aldridge Signed-off-by: Julian Sax Signed-off-by: Jiri Kosina commit 5e1275808630ea3b2c97c776f40e475017535f72 Author: Miklos Szeredi Date: Wed Oct 31 12:15:23 2018 +0100 ovl: check whiteout in ovl_create_over_whiteout() Kaixuxia repors that it's possible to crash overlayfs by removing the whiteout on the upper layer before creating a directory over it. This is a reproducer: mkdir lower upper work merge touch lower/file mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merge rm merge/file ls -al merge/file rm upper/file ls -al merge/ mkdir merge/file Before commencing with a vfs_rename(..., RENAME_EXCHANGE) verify that the lookup of "upper" is positive and is a whiteout, and return ESTALE otherwise. Reported by: kaixuxia Signed-off-by: Miklos Szeredi Fixes: e9be9d5e76e3 ("overlay filesystem") Cc: # v3.18 commit 3ee9a76a8c5a10e1bfb04b81db767c6d562ddaf3 Author: Kuninori Morimoto Date: Wed Oct 31 00:48:12 2018 +0000 ASoC: rsnd: fixup clock start checker commit 4d230d12710646 ("ASoC: rsnd: fixup not to call clk_get/set under non-atomic") fixuped clock start timing. But it exchanged clock start checker from ssi->usrcnt to ssi->rate. Current rsnd_ssi_master_clk_start() is called from .prepare, but some player (for example GStreamer) might calls it many times. In such case, the checker might returns error even though it was not error. It should check ssi->usrcnt instead of ssi->rate. This patch fixup it. Without this patch, GStreamer can't switch 48kHz / 44.1kHz. Reported-by: Yusuke Goda Signed-off-by: Kuninori Morimoto Tested-by: Yusuke Goda Signed-off-by: Mark Brown commit a4d8f64f7267a88d4688f5c216926f5f6cafbae6 Author: Leilk Liu Date: Wed Oct 31 16:49:16 2018 +0800 spi: mediatek: use correct mata->xfer_len when in fifo transfer when xfer_len is greater than 64 bytes and use fifo mode to transfer, the actual length from the third time is mata->xfer_len but not len in mtk_spi_interrupt(). Signed-off-by: Leilk Liu Signed-off-by: Mark Brown commit 9c87156cce5a63735d1218f0096a65c50a7a32aa Author: Joel Stanley Date: Wed Oct 31 11:39:34 2018 +1030 powerpc/xmon: Relax frame size for clang When building with clang (8 trunk, 7.0 release) the frame size limit is hit: arch/powerpc/xmon/xmon.c:452:12: warning: stack frame size of 2576 bytes in function 'xmon_core' [-Wframe-larger-than=] Some investigation by Naveen indicates this is due to clang saving the addresses to printf format strings on the stack. While this issue is investigated, bump up the frame size limit for xmon when building with clang. Link: https://github.com/ClangBuiltLinux/linux/issues/252 Signed-off-by: Joel Stanley Signed-off-by: Michael Ellerman commit 5e7154ff5e8e21dc9acac4f8dba7533552365374 Author: Longhe Zheng Date: Tue Oct 30 16:12:10 2018 +0800 drm/i915/gvt: Handle values of EDP_PSR_IMR and EDP_PSR_IIR GVT-g only simulates DP port for guest and leaves EDP_PSR_IMR and EDP_PSR_IIR registers as default MMIO read/write. So guest won't get expected initial values of these registers when initializing the gpu driver, which results in following warning and logs. -------- Interrupt register 0x64838 is not zero: 0xffffffff WARNING: CPU: 1 PID: 157 at drivers/gpu/drm/i915/i915_irq.c:177 gen3_assert_iir_is_zero+0x38/0xa0 Call Trace: gen8_de_irq_postinstall+0xa7/0x400 gen8_irq_postinstall+0x27/0x80 drm_irq_install+0xbc/0x140 i915_driver_load+0xa9d/0xd50 -------- Because GVT-g does not handle EDP(embedded DP) simulation for guests, always set EDP_PSR_IMR and EDP_PSR_IIR to value 0. Signed-off-by: Longhe Zheng Signed-off-by: Zhenyu Wang commit 606a745944bc0ebd14f77dfc61ac7d6cb685cefe Author: Xinyun Liu Date: Wed Sep 19 15:28:53 2018 +0800 drm/i915/gvt: correct mask setting for CSFE_CHICKEN1 CSFE_CHICKEN1(0x20d4) needs access with mask. This is caught in AcrnGT conformance check test: [drm:intel_gvt_vgpu_conformance_check] *ERROR* gvt: vgpu1 unconformance mmio 0x20d4:0x40004,0x4 Signed-off-by: Xinyun Liu Signed-off-by: Zhi Wang Signed-off-by: Zhenyu Wang commit bc0686ff5fad7a842cc88377439e78be87fedc80 Author: Hang Yuan Date: Wed Sep 19 14:42:10 2018 +0800 drm/i915/gvt: support inconsecutive partial gtt entry write Previously we assumed two 4-byte writes to the same PTE coming in sequence. But recently we observed inconsecutive partial write happening as well. So this patch enhances the previous solution. It now uses a list to save more partial writes. If one partial write can be combined with another one in the list to construct a full PTE, update its shadow entry. Otherwise, save the partial write in the list. v2: invalidate old entry and flush ggtt (Zhenyu) v3: split old ggtt page unmap to another patch (Zhenyu) v4: refine codes (Zhenyu) Signed-off-by: Hang Yuan Cc: Yan Zhao Cc: Xiaolin Zhang Cc: Zhenyu Wang Reviewed-by: Xiaolin Zhang Signed-off-by: Zhenyu Wang commit a0aebae07f211c05d64be886e56d352eea86350b Author: Joel Stanley Date: Mon Oct 22 22:39:26 2018 +1030 selftests: powerpc: Fix warning for security subdir typing 'make' inside tools/testing/selftests/powerpc gave a build warning: BUILD_TARGET=tools/testing/selftests/powerpc/security; mkdir -p $BUILD_TARGET; make OUTPUT=$BUILD_TARGET -k -C security all make[1]: Entering directory 'tools/testing/selftests/powerpc/security' ../../lib.mk:20: ../../../../scripts/subarch.include: No such file or directory make[1]: *** No rule to make target '../../../../scripts/subarch.include'. make[1]: Failed to remake makefile '../../../../scripts/subarch.include'. The build is one level deeper than lib.mk thinks it is. Set top_srcdir to set things straight. Note that the test program is still built. Signed-off-by: Joel Stanley Signed-off-by: Michael Ellerman commit 27b31e68bc9fc25c519c7772fa23913687218d5f Author: John Fastabend Date: Mon Oct 29 12:31:28 2018 -0700 bpf: tcp_bpf_recvmsg should return EAGAIN when nonblocking and no data We return 0 in the case of a nonblocking socket that has no data available. However, this is incorrect and may confuse applications. After this patch we do the correct thing and return the error EAGAIN. Quoting return codes from recvmsg manpage, EAGAIN or EWOULDBLOCK The socket is marked nonblocking and the receive operation would block, or a receive timeout had been set and the timeout expired before data was received. Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: John Fastabend Acked-by: Song Liu Signed-off-by: Daniel Borkmann commit b31d30d9be32d41bef3e6076a965565d3a3d8005 Author: Yonghong Song Date: Mon Oct 29 14:56:48 2018 -0700 tools/bpf: add unlimited rlimit for flow_dissector_load On our test machine, bpf selftest test_flow_dissector.sh failed with the following error: # ./test_flow_dissector.sh bpffs not mounted. Mounting... libbpf: failed to create map (name: 'jmp_table'): Operation not permitted libbpf: failed to load object 'bpf_flow.o' ./flow_dissector_load: bpf_prog_load bpf_flow.o selftests: test_flow_dissector [FAILED] Let us increase the rlimit to remove the above map creation failure. Signed-off-by: Yonghong Song Acked-by: Song Liu Signed-off-by: Daniel Borkmann commit 204c881e96e435606451e8a167cdb5a12fafd32a Author: Viresh Kumar Date: Mon Oct 29 15:13:05 2018 +0530 dt-bindings: arm: Explain capacities-dmips-mhz calculations in example The example contains two values for the capacity currently, 446 in text and 578 in code. The numbers are all correct but can confuse some of the readers. This patch tries to explain how the numbers are calculated to avoid same confusion going forward. Acked-by: Daniel Lezcano Signed-off-by: Viresh Kumar Signed-off-by: Rob Herring commit 1ecd0da5888960ecff6409393c11b35fad644104 Author: Evan Quan Date: Tue Oct 30 09:12:22 2018 +0800 drm/amd/powerplay: revise Vega20 pptable version check Tell the version numbers when the pptable versions do not match. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 0cafc82fae41531b0162150f9a97f2c74f97118f Author: Guttula, Suresh Date: Mon Oct 29 05:23:25 2018 +0000 drm/amd/display: set backlight level limit to 1 This patch will work as workaround for silicon limitation related to PWM dutycycle when the backlight level goes to 0. Actually PWM value is 16 bit value and valid range from 1-65535. when ever user requested to set this PWM value to 0 which is not fall in the range, in VBIOS taken care this by limiting to 1. This patch here will do the same. Either driver or VBIOS can not pass 0 value as it is not a valid range for PWM and it will give a high PWM pulse which is not the intended behaviour as per HW constraints. Signed-off-by: suresh guttula Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit 698b53b3119c45a59eef10b516d780b3e9a5402d Author: Colin Ian King Date: Tue Oct 30 11:29:42 2018 +0000 mtip32xx: clean an indentation issue, remove extraneous tabs Trivial fix to clean up an indentation issue, remove tabs Signed-off-by: Colin Ian King Signed-off-by: Jens Axboe commit 310c7585e8300ddc46211df0757c11e4299ec482 Merge: 9b190ecca11c 93f38b6fae0e Author: Linus Torvalds Date: Tue Oct 30 13:03:29 2018 -0700 Merge tag 'nfsd-4.20' of git://linux-nfs.org/~bfields/linux Pull nfsd updates from Bruce Fields: "Olga added support for the NFSv4.2 asynchronous copy protocol. We already supported COPY, by copying a limited amount of data and then returning a short result, letting the client resend. The asynchronous protocol should offer better performance at the expense of some complexity. The other highlight is Trond's work to convert the duplicate reply cache to a red-black tree, and to move it and some other server caches to RCU. (Previously these have meant taking global spinlocks on every RPC) Otherwise, some RDMA work and miscellaneous bugfixes" * tag 'nfsd-4.20' of git://linux-nfs.org/~bfields/linux: (30 commits) lockd: fix access beyond unterminated strings in prints nfsd: Fix an Oops in free_session() nfsd: correctly decrement odstate refcount in error path svcrdma: Increase the default connection credit limit svcrdma: Remove try_module_get from backchannel svcrdma: Remove ->release_rqst call in bc reply handler svcrdma: Reduce max_send_sges nfsd: fix fall-through annotations knfsd: Improve lookup performance in the duplicate reply cache using an rbtree knfsd: Further simplify the cache lookup knfsd: Simplify NFS duplicate replay cache knfsd: Remove dead code from nfsd_cache_lookup SUNRPC: Simplify TCP receive code SUNRPC: Replace the cache_detail->hash_lock with a regular spinlock SUNRPC: Remove non-RCU protected lookup NFS: Fix up a typo in nfs_dns_ent_put NFS: Lockless DNS lookups knfsd: Lockless lookup of NFSv4 identities. SUNRPC: Lockless server RPCSEC_GSS context lookup knfsd: Allow lockless lookups of the exports ... commit 9b190ecca11c6ed6e20f35caef5746416d8ee0f0 Merge: 343a9f35409b 56ce68bceeef Author: Linus Torvalds Date: Tue Oct 30 12:46:25 2018 -0700 Merge tag 'cramfs_fixes' of git://git.linaro.org/people/nicolas.pitre/linux Pull cramfs fixes from Nicolas Pitre: "Make the Cramfs code more robust against filesystem corruptions, plus trivial indentation fixes" * tag 'cramfs_fixes' of git://git.linaro.org/people/nicolas.pitre/linux: Cramfs: trivial whitespace fixes Cramfs: fix abad comparison when wrap-arounds occur commit a6b3a3fa042343e29ffaf9169f5ba3c819d4f9a2 Author: Marc Zyngier Date: Tue Oct 30 15:41:00 2018 +0000 net: mvpp2: Fix affinity hint allocation The mvpp2 driver has the curious behaviour of passing a stack variable to irq_set_affinity_hint(), which results in the kernel exploding the first time anyone accesses this information. News flash: userspace does, and irqbalance will happily take the machine down. Great stuff. An easy fix is to track the mask within the queue_vector structure, and to make sure it has the same lifetime as the interrupt itself. Fixes: e531f76757eb ("net: mvpp2: handle cases where more CPUs are available than s/w threads") Signed-off-by: Marc Zyngier Signed-off-by: David S. Miller commit 56ce68bceeefa38e5b3509bf3d39259138e2d76a Author: Nicolas Pitre Date: Tue Oct 30 14:22:58 2018 -0400 Cramfs: trivial whitespace fixes Signed-off-by: Nicolas Pitre commit 672ca9dd13f1aca0c17516f76fc5b0e8344b3e46 Author: Nicolas Pitre Date: Tue Oct 30 13:26:15 2018 -0400 Cramfs: fix abad comparison when wrap-arounds occur It is possible for corrupted filesystem images to produce very large block offsets that may wrap when a length is added, and wrongly pass the buffer size test. Reported-by: Anatoly Trosinenko Signed-off-by: Nicolas Pitre Cc: stable@vger.kernel.org commit 3aa8029e1ac4faea2967e36281d93f5d099ed6a9 Author: Eric Dumazet Date: Tue Oct 30 00:18:12 2018 -0700 net/mlx4_en: add a missing include Abdul Haleem reported a build error on ppc : drivers/net/ethernet/mellanox/mlx4/en_rx.c:582:18: warning: `struct iphdr` declared inside parameter list [enabled by default] struct iphdr *iph) ^ drivers/net/ethernet/mellanox/mlx4/en_rx.c:582:18: warning: its scope is only this definition or declaration, which is probably not what you want [enabled by default] drivers/net/ethernet/mellanox/mlx4/en_rx.c: In function get_fixed_ipv4_csum: drivers/net/ethernet/mellanox/mlx4/en_rx.c:586:20: error: dereferencing pointer to incomplete type __u8 ipproto = iph->protocol; ^ Fixes: 55469bc6b577 ("drivers: net: remove inclusion when not needed") Signed-off-by: Eric Dumazet Reported-by: Abdul Haleem Signed-off-by: David S. Miller commit 343a9f35409b68b6de66ecd0db90a277aee90ec2 Merge: f4267b3604a8 a2acce536921 Author: Linus Torvalds Date: Tue Oct 30 09:49:56 2018 -0700 Merge tag 'trace-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing updates from Steven Rostedt: "The biggest change here is the updates to kprobes Back in January I posted patches to create function based events. These were the events that you suggested I make to allow developers to easily create events in code where no trace event exists. After posting those changes for review, it was suggested that we implement this instead with kprobes. The problem with kprobes is that the interface is too complex and needs to be simplified. Masami Hiramatsu posted patches in March and I've been playing with them a bit. There's been a bit of clean up in the kprobe code that was inspired by the function based event patches, and a couple of enhancements to the kprobe event interface. - If the arch supports it (we added support for x86), you can place a kprobe event at the start of a function and use $arg1, $arg2, etc to reference the arguments of a function. (Before you needed to know what register or where on the stack the argument was). - The second is a way to see array of events. For example, if you reference a mac address, you can add: echo 'p:mac ip_rcv perm_addr=+574($arg2):x8[6]' > kprobe_events And this will produce: mac: (ip_rcv+0x0/0x140) perm_addr={0x52,0x54,0x0,0xc0,0x76,0xec} Other changes include - Exporting trace_dump_stack to modules - Have the stack tracer trace the entire stack (stop trying to remove tracing itself, as we keep removing too much). - Added support for SDT in uprobes" [ SDT - "Statically Defined Tracing" are userspace markers for tracing. Let's not use random TLA's in explanations unless they are fairly well-established as generic (at least for kernel people) - Linus ] * tag 'trace-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: (24 commits) tracing: Have stack tracer trace full stack tracing: Export trace_dump_stack to modules tracing: probeevent: Fix uninitialized used of offset in parse args tracing/kprobes: Allow kprobe-events to record module symbol tracing/kprobes: Check the probe on unloaded module correctly tracing/uprobes: Fix to return -EFAULT if copy_from_user failed tracing: probeevent: Add $argN for accessing function args x86: ptrace: Add function argument access API tracing: probeevent: Add array type support tracing: probeevent: Add symbol type tracing: probeevent: Unify fetch_insn processing common part tracing: probeevent: Append traceprobe_ for exported function tracing: probeevent: Return consumed bytes of dynamic area tracing: probeevent: Unify fetch type tables tracing: probeevent: Introduce new argument fetching code tracing: probeevent: Remove NOKPROBE_SYMBOL from print functions tracing: probeevent: Cleanup argument field definition tracing: probeevent: Cleanup print argument functions trace_uprobe: support reference counter in fd-based uprobe perf probe: Support SDT markers having reference counter (semaphore) ... commit f4267b3604a84ff72c013a0e3e467289908603a6 Merge: 5b4c0d87de2d 0d0352d8b3d6 Author: Linus Torvalds Date: Tue Oct 30 09:47:28 2018 -0700 Merge tag 'trace-v4.19-rc8-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: "Masami had a couple more fixes to the synthetic events. One was a proper error return value, and the other is for the self tests" * tag 'trace-v4.19-rc8-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: selftests/ftrace: Fix synthetic event test to delete event correctly tracing: Return -ENOENT if there is no target synthetic event commit 5b4c0d87de2d4932354ebcf118677c94533f9a01 Merge: c2101d018264 7a048cec598e Author: Linus Torvalds Date: Tue Oct 30 09:31:07 2018 -0700 Merge tag 'for-linus-4.20a-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: "Only several small fixes and cleanups this time" * tag 'for-linus-4.20a-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen: drop writing error messages to xenstore xen/pvh: don't try to unplug emulated devices add myself as reviewer for Xen support in Linux xen: remove redundant 'default n' from Kconfig xen/balloon: Support xend-based toolstack xen/pvh: increase early stack size xen: make xen_qlock_wait() nestable xen: fix race in xen_qlock_wait() xen/balloon: Grammar s/Is it/It is/ xen: Make XEN_BACKEND selectable by DomU commit c2101d01826480755f2bd9f3dd5e36757be61e23 Merge: 6ef746769ef5 6a9b593d4b6f Author: Linus Torvalds Date: Tue Oct 30 09:15:31 2018 -0700 Merge tag 'acpi-4.20-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more ACPI updates from Rafael Wysocki: "Rework the handling of the P-unit semaphore on Intel Baytrail and Cherrytrail systems to avoid race conditions and excessive overhead related to it (Hans de Goede)" * tag 'acpi-4.20-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI / PMIC: xpower: Add depends on IOSF_MBI to Kconfig entry i2c: designware: Cleanup bus lock handling ACPI / PMIC: xpower: Block P-Unit I2C access during read-modify-write x86: baytrail/cherrytrail: Rework and move P-Unit PMIC bus semaphore code commit 6ef746769ef5cfef84cdfdf61ecbab5a6aa4651a Merge: 85b5d4bcab8b c4ac6889930d Author: Linus Torvalds Date: Tue Oct 30 09:08:07 2018 -0700 Merge tag 'pm-4.20-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more power management updates from Rafael Wysocki: "These remove a questionable heuristic from the menu cpuidle governor, fix a recent build regression in the intel_pstate driver, clean up ARM big-Little support in cpufreq and fix up hung task watchdog's interaction with system-wide power management transitions. Specifics: - Fix build regression in the intel_pstate driver that doesn't build without CONFIG_ACPI after recent changes (Dominik Brodowski). - One of the heuristics in the menu cpuidle governor is based on a function returning 0 most of the time, so drop it and clean up the scheduler code related to it (Daniel Lezcano). - Prevent the arm_big_little cpufreq driver from being used on ARM64 which is not suitable for it and drop the arm_big_little_dt driver that is not used any more (Sudeep Holla). - Prevent the hung task watchdog from triggering during resume from system-wide sleep states by disabling it before freezing tasks and enabling it again after they have been thawed (Vitaly Kuznetsov)" * tag 'pm-4.20-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: kernel: hung_task.c: disable on suspend cpufreq: remove unused arm_big_little_dt driver cpufreq: drop ARM_BIG_LITTLE_CPUFREQ support for ARM64 cpufreq: intel_pstate: Fix compilation for !CONFIG_ACPI cpuidle: menu: Remove get_loadavg() from the performance multiplier sched: Factor out nr_iowait and nr_iowait_cpu commit 23cb2d04db54535df65edbbebbca89f2590f08bd Author: Pierre-Louis Bossart Date: Fri Oct 26 16:54:43 2018 -0500 ASoC: fix oops w/ for_each_rtd_codec_dai_rollback() macro A kernel oops happens on an error case (usual missing BE mixer configuration required by Intel SST driver). Git bisect points to this macro and an operator precedence issue. for (; ((i--) >= 0) && ((dai) = rtd->codec_dais[i]);) The initial code replaced by this macro was while (--i >= 0) { codec_dai = rtd->codec_dais[i]; Fix the C operator precedence difference by reverting to pre-decrement Fixes: 0b7990e3897 ('ASoC: add for_each_rtd_codec_dai() macro') Cc: Kuninori Morimoto Signed-off-by: Pierre-Louis Bossart Signed-off-by: Mark Brown commit 85b5d4bcab8b46664f8e1993bd5919cb0f24a3ca Merge: 11743c56785c 9084cb6a24bf Author: Linus Torvalds Date: Tue Oct 30 08:27:13 2018 -0700 Merge tag 'for-4.20-part2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull more btrfs updates from David Sterba: "This contains a few minor updates and fixes that were under testing or arrived shortly after the merge window freeze, mostly stable material" * tag 'for-4.20-part2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: Btrfs: fix use-after-free when dumping free space Btrfs: fix use-after-free during inode eviction btrfs: move the dio_sem higher up the callchain btrfs: don't run delayed_iputs in commit btrfs: fix insert_reserved error handling btrfs: only free reserved extent if we didn't insert it btrfs: don't use ctl->free_space for max_extent_size btrfs: set max_extent_size properly btrfs: reset max_extent_size properly MAINTAINERS: update my email address for btrfs btrfs: delayed-ref: extract find_first_ref_head from find_ref_head Btrfs: fix deadlock when writing out free space caches Btrfs: fix assertion on fsync of regular file when using no-holes feature Btrfs: fix null pointer dereference on compressed write path error commit 4e303fbe2d95806c875f5ebfcb3d980e20b4bd83 Author: Arnaldo Carvalho de Melo Date: Fri Oct 26 15:55:23 2018 -0300 perf top: Allow disabling the overwrite mode In ebebbf082357 ("perf top: Switch default mode to overwrite mode") we forgot to leave a way to disable that new default, add a --overwrite option that can be disabled using --no-overwrite, since the code already in such a way that we can readily disable this mode. This is useful when investigating bugs with this mode like the recent report from David Miller where lots of unknown symbols appear due to disabling the events while processing them which disables all record types, not just PERF_RECORD_SAMPLE, which makes it impossible to resolve maps when we lose PERF_RECORD_MMAP records. This can be easily seen while building a kernel, when there are lots of short lived processes. Reported-by: David Miller Acked-by: Kan Liang Cc: Adrian Hunter Cc: Andi Kleen Cc: David Ahern Cc: Jin Yao Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Wang Nan Fixes: ebebbf082357 ("perf top: Switch default mode to overwrite mode") Link: https://lkml.kernel.org/n/tip-oqgsz2bq4kgrnnajrafcdhie@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 23c07a23cbed389d0b9c7a06486574621df8d1a4 Author: Arnaldo Carvalho de Melo Date: Fri Oct 26 13:51:45 2018 -0300 perf trace: Beautify mount's first pathname arg The pathname beautifiers so far support just one augmented pathname per syscall, so do it just for mount's first arg, later this will get fixed. With: # perf probe -l probe:vfs_getname (on getname_flags:73@acme/git/linux/fs/namei.c with pathname) # Later this will get added to augmented_syscalls.c (eBPF): In one xterm: # perf trace -e mount,umount 2687.331 ( 3.544 ms): mount/8892 mount(dev_name: /mnt, dir_name: 0x561f9ac184a0, type: 0x561f9ac1b170, flags: BIND) = 0 3912.126 ( 8.807 ms): umount/8895 umount2(name: /mnt) = 0 ^C# In the other: $ sudo mount --bind /proc /mnt $ sudo umount /mnt Cc: Adrian Hunter Cc: Benjamin Peterson Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-qsvhrm2es635cl4zicqjeth2@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 476c92cacf383c83584ba02d06c88cf18f062afb Author: Arnaldo Carvalho de Melo Date: Fri Oct 26 13:23:25 2018 -0300 perf trace: Beautify the umount's 'name' argument By using the SCA_FILENAME beautifier, that works when either the probe:vfs_getname probe is in place or with the eBPF program tools/perf/examples/bpf/augmented_syscalls.c: # perf probe -l probe:vfs_getname (on getname_flags:73@acme/git/linux/fs/namei.c with pathname) # perf trace -e umount 9630.332 ( 9.521 ms): umount/8082 umount2(name: /mnt) = 0 # The augmented syscalls one will be done in the next patch. Cc: Adrian Hunter Cc: Benjamin Peterson Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-hegbzlpd2nrn584l5jxn7sy2@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit f932184e282f574cfd34afee917a10b782fd3e76 Author: Arnaldo Carvalho de Melo Date: Thu Oct 25 17:24:45 2018 -0300 perf trace: Consider syscall aliases too When trying to trace the 'umount' syscall on x86_64 I noticed that it was failing: # trace -e umount umount /mnt event syntax error: 'umount' \___ parser error Run 'perf list' for a list of valid events Usage: perf trace [] [] or: perf trace [] -- [] or: perf trace record [] [] or: perf trace record [] -- [] -e, --event event/syscall selector. use 'perf list' to list available events # This is because in the x86-64 we have it just as 'umount2': $ grep umount arch/x86/entry/syscalls/syscall_64.tbl 166 common umount2 __x64_sys_umount $ So if the syscall name fails, try fallbacking to looking at the aliases we have in the syscall_fmts table to then re-lookup, now: # trace -e umount umount -f /mnt umount: /mnt: not mounted. 1.759 ( 0.004 ms): umount/18365 umount2(name: 0x55fbfcbc4480, flags: 1) = -1 EINVAL Invalid argument # Time to beautify the flags arg :-) Cc: Adrian Hunter Cc: Benjamin Peterson Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-ukweodgzbmjd25lfkgryeft1@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 73d141adcea66de656d0c8336811f2b0bbd9700c Author: Arnaldo Carvalho de Melo Date: Thu Oct 25 15:18:06 2018 -0300 perf trace beauty: Beautify mount/umount's 'flags' argument # trace -e mount mount -o ro -t debugfs nodev /mnt 0.000 ( 1.040 ms): mount/27235 mount(dev_name: 0x5601cc8c64e0, dir_name: 0x5601cc8c6500, type: 0x5601cc8c6480, flags: RDONLY) = 0 # trace -e mount mount -o remount,relatime -t debugfs nodev /mnt 0.000 ( 2.946 ms): mount/27262 mount(dev_name: 0x55f4a73d64e0, dir_name: 0x55f4a73d6500, type: 0x55f4a73d6480, flags: REMOUNT|RELATIME) = 0 # trace -e mount mount -o remount,strictatime -t debugfs nodev /mnt 0.000 ( 2.934 ms): mount/27265 mount(dev_name: 0x5617f71d94e0, dir_name: 0x5617f71d9500, type: 0x5617f71d9480, flags: REMOUNT|STRICTATIME) = 0 # trace -e mount mount -o remount,suid,silent -t debugfs nodev /mnt 0.000 ( 0.049 ms): mount/27273 mount(dev_name: 0x55ad65df24e0, dir_name: 0x55ad65df2500, type: 0x55ad65df2480, flags: REMOUNT|SILENT) = 0 # trace -e mount mount -o remount,rw,sync,lazytime -t debugfs nodev /mnt 0.000 ( 2.684 ms): mount/27281 mount(dev_name: 0x561216055530, dir_name: 0x561216055550, type: 0x561216055510, flags: SYNCHRONOUS|REMOUNT|LAZYTIME) = 0 # trace -e mount mount -o remount,dirsync -t debugfs nodev /mnt 0.000 ( 3.512 ms): mount/27314 mount(dev_name: 0x55c4e7188480, dir_name: 0x55c4e7188530, type: 0x55c4e71884a0, flags: REMOUNT|DIRSYNC, data: 0x55c4e71884e0) = 0 # Cc: Adrian Hunter Cc: Benjamin Peterson Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-i5ncao73c0bd02qprgrq6wb9@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 496fd346b71ffa0ff35623e9ec79df0bad47bd66 Author: Arnaldo Carvalho de Melo Date: Thu Oct 25 16:09:47 2018 -0300 perf trace beauty: Allow syscalls to mask an argument before considering it Take mount's 'flags' arg, to cope with this semantic, as defined in do_mount in fs/namespace.c: /* * Pre-0.97 versions of mount() didn't have a flags word. When the * flags word was introduced its top half was required to have the * magic value 0xC0ED, and this remained so until 2.4.0-test9. * Therefore, if this magic number is present, it carries no * information and must be discarded. */ We need to mask this arg, and then see if it is zero, when we simply don't print the arg name and value. The next patch will use this for mount's 'flag' arg. Cc: Adrian Hunter Cc: Benjamin Peterson Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-btue14k5jemayuykfrwsnh85@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 579e5ff629b17744f62473f314768de8b6f1e66c Author: Arnaldo Carvalho de Melo Date: Thu Oct 25 14:21:31 2018 -0300 perf beauty: Introduce strarray__scnprintf_flags() Generalizing pkey_alloc__scnprintf_access_rights(), so that we can use it with other flags-like arguments, such as mount's mountflags argument. Cc: Adrian Hunter Cc: Benjamin Peterson Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-o3ymi3104m8moaz9865g09w9@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 794f594e0c3be6199e0b3e2324280e8785806fb6 Author: Arnaldo Carvalho de Melo Date: Wed Oct 24 15:54:23 2018 -0300 perf beauty: Switch from GPL v2.0 to LGPL v2.1 The intention is to have this as a library, since it is not perf specific at all. I did the switch for the files where I'm the only contributor, with the exception of a few lines changed by Jiri Olsa. Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: David Ahern Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-a04q6chdyjknm1hr305ulx8h@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit ceaf8e5b49ce18e9e58d292130e92150d01a34e6 Author: Arnaldo Carvalho de Melo Date: Wed Oct 24 14:54:55 2018 -0300 perf beauty: Add a generator for MS_ mount/umount's flag constants It'll use tools/include copy of linux/fs.h to generate a table to be used by tools, initially by the 'mount' and 'umount' beautifiers in 'perf trace', but that could also be used to translate from a string constant to the integer value to be used in a eBPF or tracefs tracepoint filter. When used without any args it produces: $ tools/perf/trace/beauty/mount_flags.sh static const char *mount_flags[] = { [1 ? (ilog2(1) + 1) : 0] = "RDONLY", [2 ? (ilog2(2) + 1) : 0] = "NOSUID", [4 ? (ilog2(4) + 1) : 0] = "NODEV", [8 ? (ilog2(8) + 1) : 0] = "NOEXEC", [16 ? (ilog2(16) + 1) : 0] = "SYNCHRONOUS", [32 ? (ilog2(32) + 1) : 0] = "REMOUNT", [64 ? (ilog2(64) + 1) : 0] = "MANDLOCK", [128 ? (ilog2(128) + 1) : 0] = "DIRSYNC", [1024 ? (ilog2(1024) + 1) : 0] = "NOATIME", [2048 ? (ilog2(2048) + 1) : 0] = "NODIRATIME", [4096 ? (ilog2(4096) + 1) : 0] = "BIND", [8192 ? (ilog2(8192) + 1) : 0] = "MOVE", [16384 ? (ilog2(16384) + 1) : 0] = "REC", [32768 ? (ilog2(32768) + 1) : 0] = "SILENT", [16 + 1] = "POSIXACL", [17 + 1] = "UNBINDABLE", [18 + 1] = "PRIVATE", [19 + 1] = "SLAVE", [20 + 1] = "SHARED", [21 + 1] = "RELATIME", [22 + 1] = "KERNMOUNT", [23 + 1] = "I_VERSION", [24 + 1] = "STRICTATIME", [25 + 1] = "LAZYTIME", [26 + 1] = "SUBMOUNT", [27 + 1] = "NOREMOTELOCK", [28 + 1] = "NOSEC", [29 + 1] = "BORN", [30 + 1] = "ACTIVE", [31 + 1] = "NOUSER", }; $ Cc: Adrian Hunter Cc: Benjamin Peterson Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-mgutbbkmip9gfnmd28ikg7xt@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit f443f38c5789ece6ebe59ae21c27bf861e61c4e2 Author: Arnaldo Carvalho de Melo Date: Wed Oct 24 14:31:12 2018 -0300 tools include uapi: Grab a copy of linux/fs.h We'll use it to create tables for the 'flags' argument to the 'mount' and 'umount' syscalls. Add it to check_headers.sh so that when a new protocol gets added we get a notification during the build process. Cc: Adrian Hunter Cc: Benjamin Peterson Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-yacf9jvkwfwg2g95r2us3xb3@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit a95ecac5cb2fc8a8ee606991384d33ee121df00c Author: Naveen N. Rao Date: Tue Oct 23 13:34:56 2018 +0530 selftests/powerpc: Relax L1d miss targets for rfi_flush test When running the rfi_flush test, if the system is loaded, we see two issues: 1. The L1d misses when rfi_flush is disabled increase significantly due to other workloads interfering with the cache. 2. The L1d misses when rfi_flush is enabled sometimes goes slightly below the expected number of misses. To address these, let's relax the expected number of L1d misses: 1. When rfi_flush is disabled, we allow upto half the expected number of the misses for when rfi_flush is enabled. 2. When rfi_flush is enabled, we allow ~1% lower number of cache misses. Reported-by: Joel Stanley Signed-off-by: Naveen N. Rao Tested-by: Joel Stanley Signed-off-by: Michael Ellerman commit 826b5de90c0bca4e9de6231da9e1730480621588 Author: Takashi Sakamoto Date: Tue Oct 30 15:31:15 2018 +0900 ALSA: firewire-lib: fix insufficient PCM rule for period/buffer size In a former commit, PCM constraint based on LCM of SYT_INTERVAL was obsoleted with PCM rule. However, the new PCM rule brings -EINVAL in some cases that max/min values of size of buffer/period is not multiples of one of values of SYT_INTERVAL. For example, pulseaudio always fail to configure PCM substream. This commit changes strategy for the PCM rule. Although the buggy rules had a single dependency (rate from period, period from rate, rate from buffer, buffer from rate), a revised rule has double dependencies (period from period/rate, buffer from buffer/rate). A step of value is calculated with table of SYT_INTERVAL and list of available rates. This prevents interval template which brings -EINVAL to a call of snd_interval_refine(). Fixes: 5950229582bc('ALSA: firewire-lib: add PCM rules to obsolete PCM constraints based on LCM of SYT_INTERVAL') Signed-off-by: Takashi Sakamoto Signed-off-by: Takashi Iwai commit c6ee7a548e2c291398b4f32c1f741c66b9f98e1c Author: Dave Jiang Date: Thu Oct 25 13:26:45 2018 -0700 x86/numa_emulation: Fix uniform-split numa emulation The numa_emulation() routine in the 'uniform' case walks through all the physical 'memblk' instances and divides them into N emulated nodes with split_nodes_size_interleave_uniform(). As each physical node is consumed it is removed from the physical memblk array in the numa_remove_memblk_from() helper. Since split_nodes_size_interleave_uniform() handles advancing the array as the 'memblk' is consumed it is expected that the base of the array is always specified as the argument. Otherwise, on multi-socket (> 2) configurations the uniform-split capability can generate an invalid numa configuration leading to boot failures with signatures like the following: rcu: INFO: rcu_sched detected stalls on CPUs/tasks: Sending NMI from CPU 0 to CPUs 2: NMI backtrace for cpu 2 CPU: 2 PID: 1332 Comm: pgdatinit0 Not tainted 4.19.0-rc8-next-20181019-baseline #59 RIP: 0010:__init_single_page.isra.74+0x81/0x90 [..] Call Trace: deferred_init_pages+0xaa/0xe3 deferred_init_memmap+0x18f/0x318 kthread+0xf8/0x130 ? deferred_free_pages.isra.105+0xc9/0xc9 ? kthread_stop+0x110/0x110 ret_from_fork+0x35/0x40 Fixes: 1f6a2c6d9f121 ("x86/numa_emulation: Introduce uniform split capability") Signed-off-by: Dave Jiang Signed-off-by: Dan Williams Signed-off-by: Thomas Gleixner Tested-by: Alexander Duyck Reviewed-by: Dave Hansen Cc: Borislav Petkov Cc: "H. Peter Anvin" Cc: Andy Lutomirski Cc: Peter Zijlstra Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/154049911459.2685845.9210186007479774286.stgit@dwillia2-desk3.amr.corp.intel.com commit 7847c7be0481558f17e3ef3b03f573677fd30d29 Author: Juergen Gross Date: Tue Oct 30 07:33:01 2018 +0100 x86/paravirt: Remove unused _paravirt_ident_32 There is no user of _paravirt_ident_32 left in the tree. Remove it together with the related paravirt_patch_ident_32(). paravirt_patch_ident_64() can be moved inside CONFIG_PARAVIRT_XXL=y. Signed-off-by: Juergen Gross Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: akataria@vmware.com Cc: boris.ostrovsky@oracle.com Cc: rusty@rustcorp.com.au Cc: virtualization@lists.linux-foundation.org Cc: xen-devel@lists.xenproject.org Link: http://lkml.kernel.org/r/20181030063301.15054-1-jgross@suse.com Signed-off-by: Ingo Molnar commit 28fa741c27e6d57f6bf594ba3c444ce79e671e09 Author: Colin Ian King Date: Mon Oct 29 23:32:11 2018 +0000 perf/core: Clean up inconsisent indentation Replace a bunch of spaces with tab, cleans up indentation Signed-off-by: Colin Ian King Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: kernel-janitors@vger.kernel.org Link: http://lkml.kernel.org/r/20181029233211.21475-1-colin.king@canonical.com Signed-off-by: Ingo Molnar commit 960b82c383d38fea4439e4182b5be4352a6048e2 Author: Max Filippov Date: Tue Oct 30 01:28:56 2018 -0700 xtensa: clean up xtensa-specific property sections xtensa-specific property sections may be section-specific. They should be collected in the order of appearance. .gnu.linkonce.prop.* input sections should be collected into the .xt.prop output section. Signed-off-by: Max Filippov commit 1026ded6936f0f9caba5759e2e7438f4dee67867 Author: Max Filippov Date: Mon Oct 29 18:30:46 2018 -0700 xtensa: use DWARF_DEBUG in the vmlinux.lds.S Xtensa doesn't have anything custom in its debug sections list. Use macro DWARF_DEBUG instead of opencoding it. Signed-off-by: Max Filippov commit c4ac6889930d027ffa5cf77e0c202e7e97a4be06 Merge: a1c6ca3c6de7 a7fe5190c03f f174e49e4906 Author: Rafael J. Wysocki Date: Tue Oct 30 08:47:14 2018 +0100 Merge branches 'pm-cpuidle' and 'pm-cpufreq' * pm-cpuidle: cpuidle: menu: Remove get_loadavg() from the performance multiplier sched: Factor out nr_iowait and nr_iowait_cpu * pm-cpufreq: cpufreq: remove unused arm_big_little_dt driver cpufreq: drop ARM_BIG_LITTLE_CPUFREQ support for ARM64 cpufreq: intel_pstate: Fix compilation for !CONFIG_ACPI commit 0f0a691f1ef9af0f8943f601b325a219d1ba8184 Author: David S. Miller Date: Mon Oct 29 22:17:12 2018 -0700 sparc64: Remvoe set_fs() from perf_callchain_user(). Ever since commit 88b0193d9418 ("perf/callchain: Force USER_DS when invoking perf_callchain_user()") the caller does this for us. Signed-off-by: David S. Miller commit da71577545a52be3e0e9225a946e5fd79cfab015 Author: Ido Schimmel Date: Mon Oct 29 20:36:43 2018 +0000 rtnetlink: Disallow FDB configuration for non-Ethernet device When an FDB entry is configured, the address is validated to have the length of an Ethernet address, but the device for which the address is configured can be of any type. The above can result in the use of uninitialized memory when the address is later compared against existing addresses since 'dev->addr_len' is used and it may be greater than ETH_ALEN, as with ip6tnl devices. Fix this by making sure that FDB entries are only configured for Ethernet devices. BUG: KMSAN: uninit-value in memcmp+0x11d/0x180 lib/string.c:863 CPU: 1 PID: 4318 Comm: syz-executor998 Not tainted 4.19.0-rc3+ #49 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x14b/0x190 lib/dump_stack.c:113 kmsan_report+0x183/0x2b0 mm/kmsan/kmsan.c:956 __msan_warning+0x70/0xc0 mm/kmsan/kmsan_instr.c:645 memcmp+0x11d/0x180 lib/string.c:863 dev_uc_add_excl+0x165/0x7b0 net/core/dev_addr_lists.c:464 ndo_dflt_fdb_add net/core/rtnetlink.c:3463 [inline] rtnl_fdb_add+0x1081/0x1270 net/core/rtnetlink.c:3558 rtnetlink_rcv_msg+0xa0b/0x1530 net/core/rtnetlink.c:4715 netlink_rcv_skb+0x36e/0x5f0 net/netlink/af_netlink.c:2454 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:4733 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline] netlink_unicast+0x1638/0x1720 net/netlink/af_netlink.c:1343 netlink_sendmsg+0x1205/0x1290 net/netlink/af_netlink.c:1908 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] ___sys_sendmsg+0xe70/0x1290 net/socket.c:2114 __sys_sendmsg net/socket.c:2152 [inline] __do_sys_sendmsg net/socket.c:2161 [inline] __se_sys_sendmsg+0x2a3/0x3d0 net/socket.c:2159 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2159 do_syscall_64+0xb8/0x100 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 RIP: 0033:0x440ee9 Code: e8 cc ab 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb 0a fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fff6a93b518 EFLAGS: 00000213 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000440ee9 RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00000000004002c8 R09: 00000000004002c8 R10: 00000000004002c8 R11: 0000000000000213 R12: 000000000000b4b0 R13: 0000000000401ec0 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline] kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:181 kmsan_kmalloc+0x98/0x100 mm/kmsan/kmsan_hooks.c:91 kmsan_slab_alloc+0x10/0x20 mm/kmsan/kmsan_hooks.c:100 slab_post_alloc_hook mm/slab.h:446 [inline] slab_alloc_node mm/slub.c:2718 [inline] __kmalloc_node_track_caller+0x9e7/0x1160 mm/slub.c:4351 __kmalloc_reserve net/core/skbuff.c:138 [inline] __alloc_skb+0x2f5/0x9e0 net/core/skbuff.c:206 alloc_skb include/linux/skbuff.h:996 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1189 [inline] netlink_sendmsg+0xb49/0x1290 net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] ___sys_sendmsg+0xe70/0x1290 net/socket.c:2114 __sys_sendmsg net/socket.c:2152 [inline] __do_sys_sendmsg net/socket.c:2161 [inline] __se_sys_sendmsg+0x2a3/0x3d0 net/socket.c:2159 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2159 do_syscall_64+0xb8/0x100 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 v2: * Make error message more specific (David) Fixes: 090096bf3db1 ("net: generic fdb support for drivers without ndo_fdb_") Signed-off-by: Ido Schimmel Reported-and-tested-by: syzbot+3a288d5f5530b901310e@syzkaller.appspotmail.com Reported-and-tested-by: syzbot+d53ab4e92a1db04110ff@syzkaller.appspotmail.com Cc: Vlad Yasevich Cc: David Ahern Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 713358369382cebf92f6e98ce2005f94e7344931 Author: Xin Long Date: Mon Oct 29 23:13:11 2018 +0800 sctp: check policy more carefully when getting pr status When getting pr_assocstatus and pr_streamstatus by sctp_getsockopt, it doesn't correctly process the case when policy is set with SCTP_PR_SCTP_ALL | SCTP_PR_SCTP_MASK. It even causes a slab-out-of-bounds in sctp_getsockopt_pr_streamstatus(). This patch fixes it by return -EINVAL for this case. Fixes: 0ac1077e3a54 ("sctp: get pr_assoc and pr_stream all status with SCTP_PR_SCTP_ALL") Reported-by: syzbot+5da0d0a72a9e7d791748@syzkaller.appspotmail.com Suggested-by: Marcelo Ricardo Leitner Signed-off-by: Xin Long Signed-off-by: David S. Miller commit df132eff463873e14e019a07f387b4d577d6d1f9 Author: Xin Long Date: Mon Oct 29 23:10:29 2018 +0800 sctp: clear the transport of some out_chunk_list chunks in sctp_assoc_rm_peer If a transport is removed by asconf but there still are some chunks with this transport queuing on out_chunk_list, later an use-after-free issue will be caused when accessing this transport from these chunks in sctp_outq_flush(). This is an old bug, we fix it by clearing the transport of these chunks in out_chunk_list when removing a transport in sctp_assoc_rm_peer(). Reported-by: syzbot+56a40ceee5fb35932f4d@syzkaller.appspotmail.com Signed-off-by: Xin Long Signed-off-by: David S. Miller commit 2b0ab72799c29ac63f889f3ccb14d6e22a8ac6bb Merge: 6e29464b8a72 a22712a96291 Author: David S. Miller Date: Mon Oct 29 20:48:00 2018 -0700 Merge branch 'mlxsw-Couple-of-fixes' Ido Schimmel says: ==================== mlxsw: Couple of fixes First patch makes sure mlxsw does not ignore user requests to delete FDB entries that were learned by the device. Second patch fixes a use-after-free that can be triggered by requesting a reload via devlink when the previous reload failed. Please consider both patches for stable. They apply cleanly to both 4.18.y and 4.19.y. ==================== Signed-off-by: David S. Miller commit a22712a962912faf257e857ab6857f56a93cfb34 Author: Shalom Toledo Date: Mon Oct 29 14:26:16 2018 +0000 mlxsw: core: Fix devlink unregister flow After a failed reload, the driver is still registered to devlink, its devlink instance is still allocated and the 'reload_fail' flag is set. Then, in the next reload try, the driver's allocated devlink instance will be freed without unregistering from devlink and its components (e.g, resources). This scenario can cause a use-after-free if the user tries to execute command via devlink user-space tool. Fix by not freeing the devlink instance during reload (failed or not). Fixes: 24cc68ad6c46 ("mlxsw: core: Add support for reload") Signed-off-by: Shalom Toledo Reviewed-by: Jiri Pirko Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit ad0b9d94182be8356978d220c82f9837cffeb7a9 Author: Petr Machata Date: Mon Oct 29 14:26:14 2018 +0000 mlxsw: spectrum_switchdev: Don't ignore deletions of learned MACs Demands to remove FDB entries should be honored even if the FDB entry in question was originally learned, and not added by the user. Therefore ignore the added_by_user datum for SWITCHDEV_FDB_DEL_TO_DEVICE. Fixes: 816a3bed9549 ("switchdev: Add fdb.added_by_user to switchdev notifications") Signed-off-by: Petr Machata Suggested-by: Ido Schimmel Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 6e29464b8a72e74ec7c3f816f53bfe46a43601bc Author: Nathan Chancellor Date: Mon Oct 29 03:51:58 2018 -0700 hinic: Fix l4_type parameter in hinic_task_set_tunnel_l4 Clang warns: drivers/net/ethernet/huawei/hinic/hinic_tx.c:392:34: error: implicit conversion from enumeration type 'enum hinic_l4_tunnel_type' to different enumeration type 'enum hinic_l4_offload_type' [-Werror,-Wenum-conversion] hinic_task_set_tunnel_l4(task, TUNNEL_UDP_NO_CSUM, ~~~~~~~~~~~~~~~~~~~~~~~~ ^~~~~~~~~~~~~~~~~~ 1 error generated. It seems that hinic_task_set_tunnel_l4 was meant to take an enum of type hinic_l4_tunnel_type, not hinic_l4_offload_type, given both the name of the functions and the values used. Fixes: cc18a7543d2f ("net-next/hinic: add checksum offload and TSO support") Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Signed-off-by: David S. Miller commit e2d00e62f24b907d49b83802ae91a6fa6254a48c Author: Lorenzo Colitti Date: Mon Oct 29 09:30:29 2018 +0900 Documentation: ip-sysctl.txt: Document tcp_fwmark_accept This patch documents the tcp_fwmark_accept sysctl that was added in 3.15. Signed-off-by: Lorenzo Colitti Signed-off-by: David S. Miller commit 414dd6fb9a1a1b59983aea7bf0f79f0085ecc5b8 Author: Tobias Jungel Date: Sun Oct 28 12:54:10 2018 +0100 bonding: fix length of actor system The attribute IFLA_BOND_AD_ACTOR_SYSTEM is sent to user space having the length of sizeof(bond->params.ad_actor_system) which is 8 byte. This patch aligns the length to ETH_ALEN to have the same MAC address exposed as using sysfs. Fixes: f87fda00b6ed2 ("bonding: prevent out of bound accesses") Signed-off-by: Tobias Jungel Signed-off-by: David S. Miller commit 966c37f2d77eb44d47af8e919267b1ba675b2eca Author: Hangbin Liu Date: Fri Oct 26 11:30:35 2018 +0800 ipv4/igmp: fix v1/v2 switchback timeout based on rfc3376, 8.12 Similiar with ipv6 mcast commit 89225d1ce6af3 ("net: ipv6: mld: fix v1/v2 switchback timeout to rfc3810, 9.12.") i) RFC3376 8.12. Older Version Querier Present Timeout says: The Older Version Querier Interval is the time-out for transitioning a host back to IGMPv3 mode once an older version query is heard. When an older version query is received, hosts set their Older Version Querier Present Timer to Older Version Querier Interval. This value MUST be ((the Robustness Variable) times (the Query Interval in the last Query received)) plus (one Query Response Interval). Currently we only use a hardcode value IGMP_V1/v2_ROUTER_PRESENT_TIMEOUT. Fix it by adding two new items mr_qi(Query Interval) and mr_qri(Query Response Interval) in struct in_device. Now we can calculate the switchback time via (mr_qrv * mr_qi) + mr_qri. We need update these values when receive IGMPv3 queries. Reported-by: Ying Xu Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit 4119ba211bc4f1bf638f41e50b7a0f329f58aa16 Author: Max Filippov Date: Mon Oct 29 18:30:13 2018 -0700 xtensa: add NOTES section to the linker script This section collects all source .note.* sections together in the vmlinux image. Without it .note.Linux section may be placed at address 0, while the rest of the kernel is at its normal address, resulting in a huge vmlinux.bin image that may not be linked into the xtensa Image.elf. Cc: stable@vger.kernel.org Signed-off-by: Max Filippov commit 11743c56785c751c087eecdb98713eef796609e0 Merge: 929e134c43c9 928002a5e9da Author: Linus Torvalds Date: Mon Oct 29 17:10:03 2018 -0700 Merge tag 'rpmsg-v4.20' of git://github.com/andersson/remoteproc Pull rpmsg updates from Bjorn Andersson: "This migrates rpmsg_char to use read/write_iter to allow being operated using aio, removes the message size alignment requirements from glink, closes a potential memory leak in SMD and switches to %pOFn for printing device_node names" * tag 'rpmsg-v4.20' of git://github.com/andersson/remoteproc: rpmsg: glink: smem: Support rx peak for size less than 4 bytes rpmsg: smd: fix memory leak on channel create rpmsg: glink: Remove chunk size word align warning rpmsg: Convert to using %pOFn instead of device_node.name rpmsg: char: Migrate to iter versions of read and write commit 929e134c43c95822663367c47fb211ca272309f7 Merge: 4b42745211af f18b7e914fd2 Author: Linus Torvalds Date: Mon Oct 29 17:07:53 2018 -0700 Merge tag 'rproc-v4.20' of git://github.com/andersson/remoteproc Pull remoteproc updates from Bjorn Andersson: "This contains a series of patches that reworks the memory carveout handling in remoteproc, in order to allow this to be reused for statically allocated memory regions to be used for e.g. firmware. It adds support for audio DSP (both TZ-assisted and non-TZ assisted) and compute DSP on Qualcomm SDM845, TZ-assisted audio DSP, compute DSP and WiFi processor on Qualcomm QCS404 and through some renaming of the drivers cleans up the naming situation. Finally support for custom coreudmp segment handlers is added and is used in the Qualcomm modem remoteproc driver to gather memory dumps of the firmware" * tag 'rproc-v4.20' of git://github.com/andersson/remoteproc: (36 commits) remoteproc: qcom: q6v5-mss: Register segments/dumpfn for coredump remoteproc: qcom: q6v5-mss: Add custom dump function for modem remoteproc: qcom: q6v5-mss: Refactor mba load/unload sequence remoteproc: Add mechanism for custom dump function assignment remoteproc: Introduce custom dump function for each remoteproc segment remoteproc: modify vring allocation to rely on centralized carveout allocator remoteproc: qcom: q6v5: shore up resource probe handling remoteproc: qcom: qcom_q6v5_adsp: Fix some return value check remoteproc: modify rproc_handle_carveout to support pre-registered region remoteproc: add helper function to check carveout device address remoteproc: add helper function to allocate rproc_mem_entry from reserved memory remoteproc: add alloc ops in rproc_mem_entry struct remoteproc: introduce rproc_find_carveout_by_name function remoteproc: introduce rproc_add_carveout function remoteproc: add helper function to allocate and init rproc_mem_entry struct remoteproc: add name in rproc_mem_entry struct remoteproc: add release ops in rproc_mem_entry struct remoteproc: add rproc_va_to_pa function remoteproc: configure IOMMU only if device address requested remoteproc: qcom: q6v5-mss: add SCM probe dependency ... commit bf4a1fcf0bc18d52cf0fce6571d6f327ab5eaf22 Author: Darrick J. Wong Date: Tue Oct 30 10:47:48 2018 +1100 xfs: remove [cm]time update from reflink calls Now that the vfs remap helper dirties the inode [cm]time for us, xfs no longer needs to do that on its own. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 3fc9f5e409319e994d113cf1327ba6ab147423c2 Author: Darrick J. Wong Date: Tue Oct 30 10:47:26 2018 +1100 xfs: remove xfs_reflink_remap_range Since xfs_file_remap_range is a thin wrapper, move the contents of xfs_reflink_remap_range into the shell. This cuts down on the vfs calls being made from internal xfs code. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 7a6ccf004e234c01fb2a11771de9837c9ff3d56d Author: Darrick J. Wong Date: Tue Oct 30 10:47:16 2018 +1100 xfs: remove redundant remap partial EOF block checks Now that we've moved the partial EOF block checks to the VFS helpers, we can remove the redundant functionality from XFS. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 3f68c1f562f1e4c5e1a515b392a2e0a509a342d5 Author: Darrick J. Wong Date: Tue Oct 30 10:47:06 2018 +1100 xfs: support returning partial reflink results Back when the XFS reflink code only supported clone_file_range, we were only able to return zero or negative error codes to userspace. However, now that copy_file_range (which returns bytes copied) can use XFS' clone_file_range, we have the opportunity to return partial results. For example, if userspace sends a 1GB clone request and we run out of space halfway through, we at least can tell userspace that we completed 512M of that request like a regular write. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 9f04aaffddb3e487f3eda1945f1a9531d6cc7628 Author: Darrick J. Wong Date: Tue Oct 30 10:46:50 2018 +1100 xfs: clean up xfs_reflink_remap_blocks call site Move the offset <-> blocks unit conversions into xfs_reflink_remap_blocks to make the call site less ugly. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 4918ef4ea008cd2ff47eb852894e3f9b9047f4f3 Author: Darrick J. Wong Date: Tue Oct 30 10:46:33 2018 +1100 xfs: fix pagecache truncation prior to reflink Prior to remapping blocks, it is necessary to remove pages from the destination file's page cache. Unfortunately, the truncation is not aggressive enough -- if page size > block size, we'll end up zeroing subpage blocks instead of removing them. So, round the start offset down and the end offset up to page boundaries. We already wrote all the dirty data so the larger range shouldn't be a problem. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Reviewed-by: Christoph Hellwig Signed-off-by: Dave Chinner commit 65f098e91ffbb64d7ca2ed93b6ab2428a2e34452 Author: Darrick J. Wong Date: Tue Oct 30 10:45:48 2018 +1100 ocfs2: remove ocfs2_reflink_remap_range Since ocfs2_remap_file_range is a thin shell around ocfs2_remap_remap_range, move everything from the latter into the former. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 900611a1bd06ef4a79980e58babc61ef056c81ab Author: Darrick J. Wong Date: Tue Oct 30 10:44:45 2018 +1100 ocfs2: support partial clone range and dedupe range Change the ocfs2 remap code to allow for returning partial results. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit a8a94302c9754d05069ee149cf01df8aa5116aaa Author: Darrick J. Wong Date: Tue Oct 30 10:43:16 2018 +1100 ocfs2: fix pagecache truncation prior to reflink Prior to remapping blocks, it is necessary to remove pages from the destination file's page cache. Unfortunately, the truncation is not aggressive enough -- if page size > block size, we'll end up zeroing subpage blocks instead of removing them. So, round the start offset down and the end offset up to page boundaries. We already wrote all the dirty data so the larger range should be fine. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 2587b1f1fae2d992de67e57b519f36e7c9ba70cd Author: Darrick J. Wong Date: Tue Oct 30 10:42:56 2018 +1100 ocfs2: truncate page cache for clone destination file before remapping When cloning blocks into another file, truncate the page cache before we start remapping blocks so that concurrent reads wait for us to finish. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 8c5c836bd6c3b9f9fc1c5a210d630b8c42f4f7df Author: Darrick J. Wong Date: Tue Oct 30 10:42:24 2018 +1100 vfs: clean up generic_remap_file_range_prep return value Since the remap prep function can update the length of the remap request, we can change this function to return the usual return status instead of the odd behavior it has now. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Dave Chinner commit c32e5f39953fa6bbff35c655bdcb7b3128f1e79f Author: Darrick J. Wong Date: Tue Oct 30 10:42:17 2018 +1100 vfs: hide file range comparison function There are no callers of vfs_dedupe_file_range_compare, so we might as well make it a static helper and remove the export. Signed-off-by: Darrick J. Wong Reviewed-by: Amir Goldstein Reviewed-by: Christoph Hellwig Signed-off-by: Dave Chinner commit eca3654e3cc7d93e9734d0fa96cfb15c7f356244 Author: Darrick J. Wong Date: Tue Oct 30 10:42:10 2018 +1100 vfs: enable remap callers that can handle short operations Plumb in a remap flag that enables the filesystem remap handler to shorten remapping requests for callers that can handle it. Now copy_file_range can report partial success (in case we run up against alignment problems, resource limits, etc.). We also enable CAN_SHORTEN for fideduperange to maintain existing userspace-visible behavior where xfs/btrfs shorten the dedupe range to avoid stale post-eof data exposure. Signed-off-by: Darrick J. Wong Reviewed-by: Amir Goldstein Signed-off-by: Dave Chinner commit df3658361951e17364f1e1c3fa92862a990ad8bd Author: Darrick J. Wong Date: Tue Oct 30 10:42:03 2018 +1100 vfs: plumb remap flags through the vfs dedupe functions Plumb a remap_flags argument through the vfs_dedupe_file_range_one functions so that dedupe can take advantage of it. Signed-off-by: Darrick J. Wong Reviewed-by: Amir Goldstein Signed-off-by: Dave Chinner commit 452ce65951a2f0719e4e119ecca134c06cfe22ee Author: Darrick J. Wong Date: Tue Oct 30 10:41:56 2018 +1100 vfs: plumb remap flags through the vfs clone functions Plumb a remap_flags argument through the {do,vfs}_clone_file_range functions so that clone can take advantage of it. Signed-off-by: Darrick J. Wong Reviewed-by: Amir Goldstein Signed-off-by: Dave Chinner commit 42ec3d4c02187a18e27ff94b409ec27234bf2ffd Author: Darrick J. Wong Date: Tue Oct 30 10:41:49 2018 +1100 vfs: make remap_file_range functions take and return bytes completed Change the remap_file_range functions to take a number of bytes to operate upon and return the number of bytes they operated on. This is a requirement for allowing fs implementations to return short clone/dedupe results to the user, which will enable us to obey resource limits in a graceful manner. A subsequent patch will enable copy_file_range to signal to the ->clone_file_range implementation that it can handle a short length, which will be returned in the function's return value. For now the short return is not implemented anywhere so the behavior won't change -- either copy_file_range manages to clone the entire range or it tries an alternative. Neither clone ioctl can take advantage of this, alas. Signed-off-by: Darrick J. Wong Reviewed-by: Amir Goldstein Signed-off-by: Dave Chinner commit 8dde90bca6fca3736ea20109654bcf6dcf2ecf1d Author: Darrick J. Wong Date: Tue Oct 30 10:41:41 2018 +1100 vfs: remap helper should update destination inode metadata Extend generic_remap_file_range_prep to handle inode metadata updates when remapping into a file. If the operation can possibly alter the file contents, we must update the ctime and mtime and remove security privileges, just like we do for regular file writes. Signed-off-by: Darrick J. Wong Reviewed-by: Amir Goldstein Signed-off-by: Dave Chinner commit 3d28193e1df043764deb7abdaba5e3a6660bc393 Author: Darrick J. Wong Date: Tue Oct 30 10:41:34 2018 +1100 vfs: pass remap flags to generic_remap_checks Pass the same remap flags to generic_remap_checks for consistency. Signed-off-by: Darrick J. Wong Reviewed-by: Amir Goldstein Reviewed-by: Christoph Hellwig Signed-off-by: Dave Chinner commit a91ae49bbaf43910edb09e03fedf26b23875bd52 Author: Darrick J. Wong Date: Tue Oct 30 10:41:28 2018 +1100 vfs: pass remap flags to generic_remap_file_range_prep Plumb the remap flags through the filesystem from the vfs function dispatcher all the way to the prep function to prepare for behavior changes in subsequent patches. Signed-off-by: Darrick J. Wong Reviewed-by: Amir Goldstein Reviewed-by: Christoph Hellwig Signed-off-by: Dave Chinner commit 2e5dfc99f2e61c42083ba742395e7a7b353513d1 Author: Darrick J. Wong Date: Tue Oct 30 10:41:21 2018 +1100 vfs: combine the clone and dedupe into a single remap_file_range Combine the clone_file_range and dedupe_file_range operations into a single remap_file_range file operation dispatch since they're fundamentally the same operation. The differences between the two can be made in the prep functions. Signed-off-by: Darrick J. Wong Reviewed-by: Amir Goldstein Reviewed-by: Christoph Hellwig Signed-off-by: Dave Chinner commit 6095028b455d775e369ae27875f698ff0f6fdeb8 Author: Darrick J. Wong Date: Tue Oct 30 10:41:14 2018 +1100 vfs: rename clone_verify_area to remap_verify_area Since we use clone_verify_area for both clone and dedupe range checks, rename the function to make it clear that it's for both. Signed-off-by: Darrick J. Wong Reviewed-by: Amir Goldstein Signed-off-by: Dave Chinner commit a83ab01a62e61616ebb8b97f90f568c1214dc10d Author: Darrick J. Wong Date: Tue Oct 30 10:41:08 2018 +1100 vfs: rename vfs_clone_file_prep to be more descriptive The vfs_clone_file_prep is a generic function to be called by filesystem implementations only. Rename the prefix to generic_ and make it more clear that it applies to remap operations, not just clones. Signed-off-by: Darrick J. Wong Reviewed-by: Amir Goldstein Signed-off-by: Dave Chinner commit 9aae20500d9cd3e7d55d0536d359bdd1c869db89 Author: Darrick J. Wong Date: Tue Oct 30 10:41:01 2018 +1100 vfs: skip zero-length dedupe requests Don't bother calling the filesystem for a zero-length dedupe request; we can return zero and exit. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Amir Goldstein Signed-off-by: Dave Chinner commit 07d19dc9fbe9128378b9e226abe886fd8fd473df Author: Darrick J. Wong Date: Tue Oct 30 10:40:55 2018 +1100 vfs: avoid problematic remapping requests into partial EOF block A deduplication data corruption is exposed in XFS and btrfs. It is caused by extending the block match range to include the partial EOF block, but then allowing unknown data beyond EOF to be considered a "match" to data in the destination file because the comparison is only made to the end of the source file. This corrupts the destination file when the source extent is shared with it. The VFS remapping prep functions only support whole block dedupe, but we still need to appear to support whole file dedupe correctly. Hence if the dedupe request includes the last block of the souce file, don't include it in the actual dedupe operation. If the rest of the range dedupes successfully, then reject the entire request. A subsequent patch will enable us to shorten dedupe requests correctly. When reflinking sub-file ranges, a data corruption can occur when the source file range includes a partial EOF block. This shares the unknown data beyond EOF into the second file at a position inside EOF, exposing stale data in the second file. If the reflink request includes the last block of the souce file, only proceed with the reflink operation if it lands at or past the destination file's current EOF. If it lands within the destination file EOF, reject the entire request with -EINVAL and make the caller go the hard way. A subsequent patch will enable us to shorten reflink requests correctly. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Dave Chinner commit 9fd91a90cb9837372af24a804853e15c11aed93e Author: Darrick J. Wong Date: Tue Oct 30 10:40:46 2018 +1100 vfs: strengthen checking of file range inputs to generic_remap_checks File range remapping, if allowed to run past the destination file's EOF, is an optimization on a regular file write. Regular file writes that extend the file length are subject to various constraints which are not checked by range cloning. This is a correctness problem because we're never allowed to touch ranges that the page cache can't support (s_maxbytes); we're not supposed to deal with large offsets (MAX_NON_LFS) if O_LARGEFILE isn't set; and we must obey resource limits (RLIMIT_FSIZE). Therefore, add these checks to the new generic_remap_checks function so that we curtail unexpected behavior. Signed-off-by: Darrick J. Wong Reviewed-by: Amir Goldstein Reviewed-by: Christoph Hellwig Signed-off-by: Dave Chinner commit 2c5773f102c9bb07d5328467f61f0a88f2f2892d Author: Darrick J. Wong Date: Tue Oct 30 10:40:39 2018 +1100 vfs: exit early from zero length remap operations If a remap caller asks us to remap to the source file's EOF and the source file length leaves us with a zero byte request, exit early. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Dave Chinner commit 1383a7ed67490fb00d793e36c7a4d599ff88a64d Author: Darrick J. Wong Date: Tue Oct 30 10:40:31 2018 +1100 vfs: check file ranges before cloning files Move the file range checks from vfs_clone_file_prep into a separate generic_remap_checks function so that all the checks are collected in a central location. This forms the basis for adding more checks from generic_write_checks that will make cloning's input checking more consistent with write input checking. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Amir Goldstein Signed-off-by: Dave Chinner commit 5b49f64db299d0b3f7c2170088186aa593d0be7d Author: Darrick J. Wong Date: Tue Oct 30 10:40:22 2018 +1100 vfs: vfs_clone_file_prep_inodes should return EINVAL for a clone from beyond EOF vfs_clone_file_prep_inodes cannot return 0 if it is asked to remap from a zero byte file because that's what btrfs does. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Dave Chinner commit 4b42745211af552f170f38a1b97f4a112b5da6b2 Merge: b22b6beae611 f4f9554f16d0 Author: Linus Torvalds Date: Mon Oct 29 15:37:33 2018 -0700 Merge tag 'armsoc-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC platform updates from Arnd Bergmann: "A couple of platforms change hands in the MAINTAINERS file: - Linus Walleij lists himself for the ARM Reference platforms: versatile, vexpress, integrator and realview. He has been the main contributor for these for a while, and makes it official now. - Vladimir Zapolskiy takes over the LPC18xx platform from Joachim Eastwood - Manivannan Sadhasivam becomes a secondary maintainer for the Actions Semi machines - Nicolas Ferre lists updates the MAINTAINER listing for the AT91 platform: Ludovic Desroches is now a co-maintainer for the platform, and several other people (Claudiu Beznea, Cristian Birsan, Eugen Hristev, Codrin Ciubotariu) take over individual device drivers. Thanks everyone for working on this, and welcome to the new maintainers! The "virt" platform on qemy or kvm can now be used in big-endian mode without additional tricks, thanks to Jason Donenfeld. Once again, we gain support for another NXP i.MX6 variant, this time it's the i.MX 6ULZ 32-bit single-core version. On arm64, we add support for two SoCs from Renesas: RZ/G2E (r8a774c0) and RZ/G2M (r8a774a1). These are described as microcontrollers on the manufacturer website, but appear to be rather powerful. The RZ/G2M is used on the reference board for the CIP Super Long Term Support (SLTS) Linux Kernels" * tag 'armsoc-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (54 commits) MAINTAINERS: Assign myself as a maintainer of ARM/LPC18XX architecture arm64: exynos: Enable generic power domain support MAINTAINERS: remove non-exsiting email address of Baoyou MAINTAINERS: fix pattern in ARM/Synaptics berlin SoC section MAINTAINERS: Drop dt-bindings/genpd/k2g.h ARM: samsung: Limit SAMSUNG_PM_CHECK config option to non-Exynos platforms arm64: actions: Enable PINCTRL in platforms Kconfig MAINTAINERS: Add entry for Actions Semi Owl SoCs DMA driver MAINTAINERS: Add entry for Actions Semiconductor Owl I2C driver MAINTAINERS: Update clock binding entry for Actions Semi Owl SoCs ARM: imx: add i.mx6ulz msl support ARM: Assume maintainership of ARM reference designs ARM: support big-endian for the virt architecture MAINTAINERS: sdhci: move the Microchip entry to proper location MAINTAINERS: move former ATMEL entries to proper MICROCHIP location MAINTAINERS: remove the / ATMEL string from MICROCHIP entries MAINTAINERS: iio: add co-maintainer to SAMA5D2-compatible ADC driver MAINTAINERS: pwm: add entry for Microchip pwm driver MAINTAINERS: dmaengine: add files to Microchip dma entry MAINTAINERS: USB: change maintainer for Microchip USBA gadget driver ... commit b22b6beae6116e3a9c46ced312c626f6737a3fa6 Merge: 53b7a3b7ec00 c1a92909dbc2 Author: Linus Torvalds Date: Mon Oct 29 15:16:01 2018 -0700 Merge tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC driver updates from Arnd Bergmann: "The most noteworthy SoC driver changes this time include: - The TEE subsystem gains an in-kernel interface to access the TEE from device drivers. - The reset controller subsystem gains a driver for the Qualcomm Snapdragon 845 Power Domain Controller. - The Xilinx Zynq platform now has a firmware interface for its platform management unit. This contains a firmware "ioctl" interface that was a little controversial at first, but the version we merged solved that by not exposing arbitrary firmware calls to user space. - The Amlogic Meson platform gains a "canvas" driver that is used for video processing and shared between different high-level drivers. The rest is more of the usual, mostly related to SoC specific power management support and core drivers in drivers/soc: - Several Renesas SoCs (RZ/G1N, RZ/G2M, R-Car V3M, RZ/A2M) gain new features related to power and reset control. - The Mediatek mt8183 and mt6765 SoC platforms gain support for their respective power management chips. - A new driver for NXP i.MX8, which need a firmware interface for power management. - The SCPI firmware interface now contains support estimating power usage of performance states - The NVIDIA Tegra "pmc" driver gains a few new features, in particular a pinctrl interface for configuring the pads. - Lots of small changes for Qualcomm, in particular the "smem" device driver. - Some cleanups for the TI OMAP series related to their sysc controller. Additional cleanups and bugfixes in SoC specific drivers include the Meson, Keystone, NXP, AT91, Sunxi, Actions, and Tegra platforms" * tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (129 commits) firmware: tegra: bpmp: Implement suspend/resume support drivers: clk: Add ZynqMP clock driver dt-bindings: clock: Add bindings for ZynqMP clock driver firmware: xilinx: Add zynqmp IOCTL API for device control Documentation: xilinx: Add documentation for eemi APIs MAINTAINERS: imx: include drivers/firmware/imx path firmware: imx: add misc svc support firmware: imx: add SCU firmware driver support reset: Fix potential use-after-free in __of_reset_control_get() dt-bindings: arm: fsl: add scu binding doc soc: fsl: qbman: add interrupt coalesce changing APIs soc: fsl: bman_portals: defer probe after bman's probe soc: fsl: qbman: Use last response to determine valid bit soc: fsl: qbman: Add 64 bit DMA addressing requirement to QBMan soc: fsl: qbman: replace CPU 0 with any online CPU in hotplug handlers soc: fsl: qbman: Check if CPU is offline when initializing portals reset: qcom: PDC Global (Power Domain Controller) reset controller dt-bindings: reset: Add PDC Global binding for SDM845 SoCs reset: Grammar s/more then once/more than once/ bus: ti-sysc: Just use SET_NOIRQ_SYSTEM_SLEEP_PM_OPS ... commit 53b7a3b7ec00f207c18e71f58ef2bca48635c622 Merge: 93335e5911db e8c3f6322cc8 Author: Linus Torvalds Date: Mon Oct 29 15:10:45 2018 -0700 Merge tag 'armsoc-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC defconfig updates from Arnd Bergmann: "The defconfig changes are split out from the rest again. This time we have a number of changes for NXP i.MX and Renesas, including a cleanup of old options. Some smaller changes are for Socionext Uniphier, Allwinner, Qualcomm, Rockchip, Renesas, AT91, Hisilicon, and STM32. All of these just enable platform specific device drivers" * tag 'armsoc-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (40 commits) arm64: defconfig: Enable SERIAL_8250_OMAP arm64: defconfig: Enable TI_SCI related configs ARM: imx_v6_v7_defconfig: Select CONFIG_TMPFS_POSIX_ACL ARM: imx_v4_v5_defconfig: Remove unneeded options ARM: imx_v4_v5_defconfig: Re-sync defconfig ARM: mxs_defconfig: Remove unneeded options ARM: mxs_defconfig: Re-sync defconfig ARM: imx_v6_v7_defconfig: Remove unneeded options ARM: imx_v6_v7_defconfig: Re-sync defconfig ARM: imx_v6_v7_defconfig: select CONFIG_ARM_CPUIDLE by default ARM: imx_v6_v7_defconfig: Make usbnet drivers builtin for boot ARM: imx_v6_v7_defconfig: add CONFIG_FW_LOADER_USER_HELPER ARM: imx_v6_v7_defconfig: Select CONFIG_SENSORS_MC13783_ADC ARM: multi_v7_defconfig: enable CONFIG_MMC_UNIPHIER arm64: defconfig: enable CONFIG_MMC_UNIPHIER ARM: multi_v7_defconfig: Enable USB phys for UniPhier SoCs arm64: defconfig: Enable USB phys for UniPhier SoCs arm64: defconfig: enable Rockchip Innosilicon hdmiphy arm64: defconfig: Enable PCIEPORTBUS arm64: defconfig: enable HiSilicon HNS3 driver ... commit 93335e5911dbffccd3b74c4d214268c0fd2bc1b0 Merge: c38239b4be1a be59a3282cf8 Author: Linus Torvalds Date: Mon Oct 29 15:05:20 2018 -0700 Merge tag 'armsoc-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC device tree updates from Arnd Bergmann: "There are close to 800 indivudal changesets in this branch again, which feels like a lot. There are particularly many changes for the NVIDIA Tegra platform this time, in fact more than it has seen in the two years since the v4.9 merge window. Aside from this, it's been fairly normal, with lots of changes going into Renesas R-CAR, NXP i.MX, Allwinner Sunxi, Samsung Exynos, and TI OMAP. Most of the changes are for adding new features into existing boards, for brevity I'm only mentioning completely new machines and SoCs here. For the first time I think we have (slightly) more new 64-bit hardware than 32-bit: Two boards get added for TI OMAP: Moxa UC-2101 is an industrial computer, see https://www.moxa.com/product/UC-2100.htm; GTA04A5 is a minor variation of the motherboards of the GTA04 phone, see https://shop.goldelico.com/wiki.php?page=GTA04A5 Clearfog is a nice little board for quad-core Marvell Armada 8040 network processor, see https://www.solid-run.com/marvell-armada-family/clearfog-gt-8k/ Two additional server boards come with the Aspeed baseboard management controllers: Stardragon4800 is an arm64 reference platform made by HXT (based on Qualcomm's server chips), and TiogaPass is an Open Compute mainboard with x86 CPUs. Both use the ARM11 based AST2500 chips in the BMC. NXP i.MX usually sees a lot of new boards each release. This time there we only add one minor variant: ConnectCore 6UL SBC Pro uses the same SoM design as the ConnectCore 6UL SBC Express added later. However, there is a new chip, the i.MX6ULZ, which is an even smaller variant of the i.MX6ULL, with features removed. There is also support for the reference board design, the i.MX6ULZ 14x14 EVK. A new Raspberry Pi variant gets added, this one is the CM3 compute module based on bcm2837, it was launched in early 2017 but only now added to the kernel, both as 32-bit and as 64-bit files, as we tend to do for Raspberry Pi. On the Allwinner side, everything is again about cheap development boards, usually of the "Fruit Pi" variety. The new ones this time are: - Orange Pi Zero Plus2: http://www.orangepi.org/OrangePiZeroPlus2/ - Orange Pi One Plus: http://www.orangepi.org/OrangePiOneplus/ - Pine64 LTS: https://www.pine64.org/?product=pine-a64-lts - Banana Pi M2+ H5: http://www.banana-pi.org/m2plus.html The last one of these is now a 64-bit version of the earlier Banana Pi M2+ H3, with the same board layout. Similarly, for Rockchips, get get another variant of the 32-bit Asus Tinker board, the model 'S' based on rk3288, and three now boards based on the popular RK3399 chip: - ROC-RK3399-PC: https://libre.computer/products/boards/roc-rk3399-pc/ - Rock960: https://www.96boards.org/product/rock960/ - RockPro64: https://www.pine64.org/?page_id=61454 These are all quite powerful boards with lots of RAM and I/O, and the RK3399 is the same chip used in several Chromebooks. Finally, we get support for the PX30 (aka rk3326) chip, which is based on the low-end 64-bit Cortex-A35 CPU core. So far, only the evaluation board is supported. One more Banana Pi is added with a Mediatek chip: Banana Pi R64 is based on the MT7622 WiFi router platform, and the first product I've seen with a 64-bit Mediatek chip in that market: http://www.banana-pi.org/r64.html For HiSilicon, we gain support for the Hi3670 SoC and HiKey 370 development board, which are similar to the Hi3660 and Hikey 360 respectively, but add support for an NPU. Amlogic gets initial support for the Meson-G12A chip (S905D2), another quad-core Cortex-A53 SoC, and its evaluation platform. On the 32-bit side, we gain support for an actual end-user product, the Endless Computers Endless Mini based on Meson8b (S805), see https://endlessos.com/computers/ Qualcomm adds support for their MSM8998 SoC and evaluation platform. This chip is commonly known as the Snapdragon 835, and is used in high-end phones as well as low-end laptops. For Renesas, a very bare support for the r8a774a1 (RZ/G2M) is added, but no boards for this one. However, we do add boards for the previously added r8a77965 (R-Car M3-N): the M3NULCB Kingfisher and the M3NULCB Starter Kit Pro. While we have lots of DT changes for NVIDIA to update the existing files, the only board that gets added is the Toradex Colibri T20 on Colibri Evaluation Board for the old Tegra2. Synaptics add support for their AS370 SoC, which is part of the (formerly Marvell) Berlin line of set-top-box chips used e.g. in the various Google Chromecast. Only the .dtsi gets added at this point, no actual machines" * tag 'armsoc-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (721 commits) ARM: dts: socfgpa: remove ethernet aliases from dtsi arm64: dts: stratix10: add ethernet aliases dt-bindings: mediatek: Add bindig for MT7623 IOMMU and SMI dt-bindings: mediatek: Add JPEG Decoder binding for MT7623 dt-bindings: iommu: mediatek: Add binding for MT7623 dt-bindings: clock: mediatek: add support for MT7623 ARM: dts: mvebu: armada-385-db-88f6820-amc: auto-detect nand ECC properites ARM: dts: da850-lego-ev3: slow down A/DC as much as possible ARM: dts: da850-evm: Enable tca6416 on baseboard arm64: dts: uniphier: Add USB2 PHY nodes arm64: dts: uniphier: Add USB3 controller nodes ARM: dts: uniphier: Add USB2 PHY nodes ARM: dts: uniphier: Add USB3 controller nodes arm64: dts: meson-axg: s400: disable emmc arm64: dts: meson-axg: s400: add missing emmc pwrseq arm64: dts: clearfog-gt-8k: add PCIe slot description ARM: dts: at91: sama5d4_xplained: even nand memory partitions ARM: dts: at91: sama5d3_xplained: even nand memory partitions ARM: dts: at91: at91sam9x5cm: even nand memory partitions ARM: dts: at91: sama5d2_ptc_ek: fix bootloader env offsets ... commit c38239b4be1ac7e4bcf5bbd971353bae51525b8f Merge: 57dbde63f288 c9fa406f62ec Author: Linus Torvalds Date: Mon Oct 29 15:02:40 2018 -0700 Merge branch 'parisc-4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc updates from Helge Deller: "Three small patches: - A boot fix for A500 machines, crash was caused by the new alternative patching code from this merge window (Dave) - Change __kernel_suseconds_t to match glibc on 64-bit parisc (Arnd) - Use constants instead of hard-coded numbers (me)" * 'parisc-4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Fix A500 boot crash parisc: Use LINUX_GATEWAY_SPACE constant in entry.S parisc64: change __kernel_suseconds_t to match glibc commit 57dbde63f2888af1be5111d369d124f4e659c0f8 Merge: 134bf98c5596 84de6e96e036 Author: Linus Torvalds Date: Mon Oct 29 14:44:03 2018 -0700 Merge branch 'i2c/for-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: "I2C has not so much stuff this time. Mostly driver enablement for new SoCs, some driver bugfixes, and some cleanups" * 'i2c/for-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (35 commits) MAINTAINERS: add maintainer for Renesas RIIC driver i2c: sh_mobile: Remove dummy runtime PM callbacks i2c: uniphier-f: fix race condition when IRQ is cleared i2c: uniphier-f: fix occasional timeout error i2c: uniphier-f: make driver robust against concurrency i2c: i2c-qcom-geni: Simplify irq handler i2c: i2c-qcom-geni: Simplify tx/rx functions i2c: designware: Set IRQF_NO_SUSPEND flag for all BYT and CHT controllers i2c: mux: mlxcpld: simplify code to reach the adapter i2c: mux: ltc4306: simplify code to reach the adapter i2c: mux: pca954x: simplify code to reach the adapter i2c: core: remove level of indentation in i2c_transfer i2c: core: remove outdated DEBUG output i2c: zx2967: use core to detect 'no zero length' quirk i2c: tegra: use core to detect 'no zero length' quirk i2c: qup: use core to detect 'no zero length' quirk i2c: omap: use core to detect 'no zero length' quirk i2c: Convert to using %pOFn instead of device_node.name i2c: brcmstb: Allow enabling the driver on DSL SoCs eeprom: at24: fix unexpected timeout under high load ... commit 917e2fd2c53eb3c4162f5397555cbd394390d4bc Author: Anton Ivanov Date: Tue Sep 25 08:47:13 2018 +0100 um: Make line/tty semantics use true write IRQ This fixes a long standing bug where large amounts of output could freeze the tty (most commonly seen on stdio console). While the bug has always been there it became more pronounced after moving to the new interrupt controller. The line semantics are now changed to have true IRQ write semantics which should further improve the tty/line subsystem stability and performance Signed-off-by: Anton Ivanov Signed-off-by: Richard Weinberger commit 59fdf91d90e62cc4e2f665d7de963c0d385afd09 Author: Colin Ian King Date: Fri Oct 26 19:02:47 2018 +0100 um: trap: fix spelling mistake, EACCESS -> EACCES Trivial fix to a spelling mistake of the error access name EACCESS, rename to EACCES Signed-off-by: Colin Ian King Signed-off-by: Richard Weinberger commit 9ca19a3a3e2482916c475b90f3d7fa2a03d8e5ed Author: Ritesh Raj Sarraf Date: Thu Sep 20 11:56:38 2018 +0530 um: Don't hardcode path as it is architecture dependent The current code fails to run on amd64 because of hardcoded reference to i386 Signed-off-by: Ritesh Raj Sarraf Signed-off-by: Richard Weinberger commit 134bf98c5596605af90f104716ef912e8f7eb56b Merge: 044ee8902861 3b796aa60af0 Author: Linus Torvalds Date: Mon Oct 29 14:29:58 2018 -0700 Merge tag 'media/v4.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - new dvb frontend driver: lnbh29 - new sensor drivers: imx319 and imx 355 - some old soc_camera driver renames to avoid conflict with new drivers - new i.MX Pixel Pipeline (PXP) mem-to-mem platform driver - a new V4L2 frontend for the FWHT codec - several other improvements, bug fixes, code cleanups, etc * tag 'media/v4.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (289 commits) media: rename soc_camera I2C drivers media: cec: forgot to cancel delayed work media: vivid: Support 480p for webcam capture media: v4l2-tpg: fix kernel oops when enabling HFLIP and OSD media: vivid: Add 16-bit bayer to format list media: v4l2-tpg-core: Add 16-bit bayer media: pvrusb2: replace `printk` with `pr_*` media: venus: vdec: fix decoded data size media: cx231xx: fix potential sign-extension overflow on large shift media: dt-bindings: media: rcar_vin: add device tree support for r8a7744 media: isif: fix a NULL pointer dereference bug media: exynos4-is: make const array config_ids static media: cx23885: make const array addr_list static media: ivtv: make const array addr_list static media: bttv-input: make const array addr_list static media: cx18: Don't check for address of video_dev media: dw9807-vcm: Fix probe error handling media: dw9714: Remove useless error message media: dw9714: Fix error handling in probe function media: cec: name for RC passthrough device does not need 'RC for' ... commit d312a25d477519d5d47f8ce850e80b52cf4113b0 Author: YueHaibing Date: Fri Aug 3 14:39:11 2018 +0800 um: NULL check before kfree is not needed kfree(NULL) is safe,so this removes NULL check before freeing the mem Signed-off-by: YueHaibing Signed-off-by: Richard Weinberger commit 369cca266860db8222c991fced8caa42c3e5b05f Author: Christoph Hellwig Date: Wed Jul 11 09:32:39 2018 +0200 um: remove unused AIO code Signed-off-by: Christoph Hellwig Signed-off-by: Richard Weinberger commit 7ff1e34bbdc15acab823b1ee4240e94623d50ee8 Author: Richard Weinberger Date: Fri Jun 15 16:42:56 2018 +0200 um: Give start_idle_thread() a return code Fixes: arch/um/os-Linux/skas/process.c:613:1: warning: control reaches end of non-void function [-Wreturn-type] longjmp() never returns but gcc still warns that the end of the function can be reached. Add a return code and debug aid to detect this impossible case. Signed-off-by: Richard Weinberger commit 3033998bb8cd5a109c3171f4cde62665e3f5ce63 Author: Richard Weinberger Date: Fri Jun 15 16:42:55 2018 +0200 um: Remove update_debugregs() This function is nowhere used, let's get rid of it. Signed-off-by: Richard Weinberger commit 0676b957c24bfb6e495449ba7b7e72c5b5d79233 Author: Richard Weinberger Date: Fri Jun 15 16:42:54 2018 +0200 um: Drop own definition of PTRACE_SYSEMU/_SINGLESTEP 32bit UML used to define PTRACE_SYSEMU and PTRACE_SYSEMU_SINGLESTEP own its own because many years ago not all libcs had these request codes in their UAPI. These days PTRACE_SYSEMU/_SINGLESTEP is well known and part of glibc and our own define becomes problematic. With change c48831d0eebf ("linux/x86: sync sys/ptrace.h with Linux 4.14 [BZ #22433]") glibc turned PTRACE_SYSEMU/_SINGLESTEP into a enum and UML failed to build. Let's drop our define and rely on the fact that every libc has PTRACE_SYSEMU/_SINGLESTEP. Cc: Cc: Ritesh Raj Sarraf Reported-and-tested-by: Ritesh Raj Sarraf Signed-off-by: Richard Weinberger commit 93f38b6fae0ea8987e22d9e6c38f8dfdccd867ee Author: Amir Goldstein Date: Fri Sep 28 20:41:48 2018 +0300 lockd: fix access beyond unterminated strings in prints printk format used %*s instead of %.*s, so hostname_len does not limit the number of bytes accessed from hostname. Signed-off-by: Amir Goldstein Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields commit bb6ad5572c0022e17e846b382d7413cdcf8055be Author: Trond Myklebust Date: Tue Oct 9 15:54:15 2018 -0400 nfsd: Fix an Oops in free_session() In call_xpt_users(), we delete the entry from the list, but we do not reinitialise it. This triggers the list poisoning when we later call unregister_xpt_user() in nfsd4_del_conns(). Signed-off-by: Trond Myklebust Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields commit bd8d725078867cda250fe94b9c5a067b4a64ca74 Author: Andrew Elble Date: Fri Oct 5 09:32:08 2018 -0400 nfsd: correctly decrement odstate refcount in error path alloc_init_deleg() both allocates an nfs4_delegation, and bumps the refcount on odstate. So after this point, we need to put_clnt_odstate() and nfs4_put_stid() to not leave the odstate refcount inappropriately bumped. Signed-off-by: Andrew Elble Reviewed-by: Jeff Layton Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields commit 3ae2cefb613b00d613677c05ffa384b4f660f468 Author: Chuck Lever Date: Mon Oct 1 14:16:11 2018 -0400 svcrdma: Increase the default connection credit limit Reduce queuing on clients by allowing more credits by default. 64 is the default NFSv4.1 slot table size on Linux clients. This size prevents the credit limit from putting RPC requests to sleep again after they have already slept waiting for a session slot. Signed-off-by: Chuck Lever Reviewed-by: Sagi Grimberg Signed-off-by: J. Bruce Fields commit 07880fa4968b07db9df0f126bb7fbde245ed12ff Author: Chuck Lever Date: Mon Oct 1 14:16:06 2018 -0400 svcrdma: Remove try_module_get from backchannel Since commit ffe1f0df5862 ("rpcrdma: Merge svcrdma and xprtrdma modules into one"), the forward and backchannel components are part of the same kernel module. A separate try_module_get() call in the backchannel code is no longer necessary. Signed-off-by: Chuck Lever Reviewed-by: Sagi Grimberg Signed-off-by: J. Bruce Fields commit 596f2a1950437095fee3062b75935c3bfdda0289 Author: Chuck Lever Date: Mon Oct 1 14:16:01 2018 -0400 svcrdma: Remove ->release_rqst call in bc reply handler Similar to a change made in the client's forward channel reply handler: The xprt_release_rqst_cong() call is not necessary. Also, release xprt->recv_lock when taking xprt->transport_lock to avoid disabling and enabling BH's while holding another spin lock. Signed-off-by: Chuck Lever Reviewed-by: Sagi Grimberg Signed-off-by: J. Bruce Fields commit f3c1fd0ee294abd4367dfa72d89f016c682202f0 Author: Chuck Lever Date: Mon Oct 1 14:15:56 2018 -0400 svcrdma: Reduce max_send_sges There's no need to request a large number of send SGEs because the inline threshold already constrains the number of SGEs per Send. Signed-off-by: Chuck Lever Reviewed-by: Sagi Grimberg Signed-off-by: J. Bruce Fields commit 0ac203cb1f03734606c0674eded43aaefb5a491a Author: Gustavo A. R. Silva Date: Tue Oct 2 12:08:48 2018 +0200 nfsd: fix fall-through annotations Replace "fallthru" with a proper "fall through" annotation. Also, add an annotation were it is expected to fall through. These fixes are part of the ongoing efforts to enabling -Wimplicit-fallthrough Signed-off-by: Gustavo A. R. Silva Signed-off-by: J. Bruce Fields commit 736c6625de666f3fd0b47428f10568154033151a Author: Trond Myklebust Date: Mon Oct 1 10:41:57 2018 -0400 knfsd: Improve lookup performance in the duplicate reply cache using an rbtree Use an rbtree to ensure the lookup/insert of an entry in a DRC bucket is O(log(N)). Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit ed00c2f65267f3a5a8727ac74a90d32470f91679 Author: Trond Myklebust Date: Wed Oct 3 13:11:51 2018 -0400 knfsd: Further simplify the cache lookup Order the structure so that the key can be compared using memcmp(). Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit 76ecec21197ab23bb821d8bf584949013efd0494 Author: Trond Myklebust Date: Mon Oct 1 10:41:55 2018 -0400 knfsd: Simplify NFS duplicate replay cache Simplify the duplicate replay cache by initialising the preallocated cache entry, so that we can use it as a key for the cache lookup. Note that the 99.999% case we want to optimise for is still the one where the lookup fails, and we have to add this entry to the cache, so preinitialising should not cause a performance penalty. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit 3e87da5145fc25e18fb934eb496f4e7c4d038e71 Author: Trond Myklebust Date: Mon Oct 1 10:41:54 2018 -0400 knfsd: Remove dead code from nfsd_cache_lookup The preallocated cache entry is always set to type RC_NOCACHE, and that type isn't changed until we later call nfsd_cache_update(). Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit 4c8e5537bb28f0e4b2ca60ecb0ca1ea12b82adf6 Author: Trond Myklebust Date: Mon Oct 1 10:41:53 2018 -0400 SUNRPC: Simplify TCP receive code Use the fact that the iov iterators already have functionality for skipping a base offset. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit 1863d77f15da0addcd293a1719fa5d3ef8cde3ca Author: Trond Myklebust Date: Mon Oct 1 10:41:52 2018 -0400 SUNRPC: Replace the cache_detail->hash_lock with a regular spinlock Now that the reader functions are all RCU protected, use a regular spinlock rather than a reader/writer lock. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit d48cf356a13073853f19be6ca5ebbecfc2762ebe Author: Trond Myklebust Date: Mon Oct 1 10:41:51 2018 -0400 SUNRPC: Remove non-RCU protected lookup Clean up the cache code by removing the non-RCU protected lookup. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit a6482733bc98aa04b44c91e744bbcbfb29f8d3ee Author: Trond Myklebust Date: Fri Oct 5 10:27:20 2018 -0400 NFS: Fix up a typo in nfs_dns_ent_put call_rcu() needs to take a first argument of type (struct rcu_head *). Fixes: fd497f1e40d9 ("NFS: Lockless DNS lookups") Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit 437f91451349a94d581cb9a928fa3958153f0b71 Author: Trond Myklebust Date: Mon Oct 1 10:41:50 2018 -0400 NFS: Lockless DNS lookups Enable RCU protected lookup in the legacy DNS resolver. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit 9d5afd9491c80779730686159aeec7fa06ead085 Author: Trond Myklebust Date: Mon Oct 1 10:41:49 2018 -0400 knfsd: Lockless lookup of NFSv4 identities. Enable RCU protected lookups of the NFSv4 idmap. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit 6d1616b26cd91f2502111d098cd9c288dbafe5c8 Author: Trond Myklebust Date: Mon Oct 1 10:41:48 2018 -0400 SUNRPC: Lockless server RPCSEC_GSS context lookup Use RCU protection for looking up the RPCSEC_GSS context. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit 9ceddd9da13434a5906255c0fc528c385aded283 Author: Trond Myklebust Date: Mon Oct 1 10:41:47 2018 -0400 knfsd: Allow lockless lookups of the exports Convert structs svc_expkey and svc_export to allow RCU protected lookups. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit fd5d2f78261bedd3a40feb1474323fddb88398b8 Author: Trond Myklebust Date: Mon Oct 1 10:41:46 2018 -0400 SUNRPC: Make server side AUTH_UNIX use lockless lookups Convert structs ip_map and unix_gid to use RCU protected lookups. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit ae74136b4bb64440a55117e12065b8c282ab6c1a Author: Trond Myklebust Date: Wed Oct 3 12:01:22 2018 -0400 SUNRPC: Allow cache lookups to use RCU protection rather than the r/w spinlock Instead of the reader/writer spinlock, allow cache lookups to use RCU for looking up entries. This is more efficient since modifications can occur while other entries are being looked up. Note that for now, we keep the reader/writer spinlock until all users have been converted to use RCU-safe freeing of their cache entries. Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields commit 84de6e96e036dcfb18dded04a506b1dd72ba0e5b Author: Chris Brandt Date: Fri Oct 26 14:57:10 2018 -0500 MAINTAINERS: add maintainer for Renesas RIIC driver The RIIC I2C controller is used in Renesas RZ/A SoCs. Signed-off-by: Chris Brandt [wsa: added documentation file] Signed-off-by: Wolfram Sang commit 7ce6c65b617e64d310fcf18b35e29fd4d28b9c4f Author: Jarkko Nikula Date: Wed Oct 24 16:51:32 2018 +0300 i2c: sh_mobile: Remove dummy runtime PM callbacks Platform drivers don't need dummy runtime PM callbacks that just return success and non-NULL pm pointer in their struct device_driver in order to have runtime PM happening. This has changed since following commits: 05aa55dddb9e ("PM / Runtime: Lenient generic runtime pm callbacks") 543f2503a956 ("PM / platform_bus: Allow runtime PM by default") 8b313a38ecff ("PM / Platform: Use generic runtime PM callbacks directly") Signed-off-by: Jarkko Nikula Reviewed-by: Wolfram Sang Signed-off-by: Wolfram Sang commit eaba68785c2d24ebf1f0d46c24e11b79cc2f94c7 Author: Masahiro Yamada Date: Tue Oct 16 12:01:49 2018 +0900 i2c: uniphier-f: fix race condition when IRQ is cleared The current IRQ handler clears all the IRQ status bits when it bails out. This is dangerous because it might clear away the status bits that have just been set while processing the current handler. If this happens, the IRQ event for the latest transfer is lost forever. The IRQ status bits must be cleared *before* the next transfer is kicked. Fixes: 6a62974b667f ("i2c: uniphier_f: add UniPhier FIFO-builtin I2C driver") Signed-off-by: Masahiro Yamada Signed-off-by: Wolfram Sang commit 39226aaa85f002d695e3cafade3309e12ffdaecd Author: Masahiro Yamada Date: Tue Oct 16 12:01:48 2018 +0900 i2c: uniphier-f: fix occasional timeout error Currently, a timeout error could happen at a repeated START condition. For a (non-repeated) START condition, the controller starts sending data when the UNIPHIER_FI2C_CR_STA bit is set. However, for a repeated START condition, the hardware starts running when the slave address is written to the TX FIFO - the write to the UNIPHIER_FI2C_CR register is actually unneeded. Because the hardware is already running before the IRQ is enabled for a repeated START, the driver may miss the IRQ event. In most cases, this problem does not show up since modern CPUs are much faster than the I2C transfer. However, it is still possible that a context switch happens after the controller starts, but before the IRQ register is set up. To fix this, - Do not write UNIPHIER_FI2C_CR for repeated START conditions. - Enable IRQ *before* writing the slave address to the TX FIFO. - Disable IRQ for the current CPU while queuing up the TX FIFO; If the CPU is interrupted by some task, the interrupt handler might be invoked due to the empty TX FIFO before completing the setup. Fixes: 6a62974b667f ("i2c: uniphier_f: add UniPhier FIFO-builtin I2C driver") Signed-off-by: Masahiro Yamada Signed-off-by: Wolfram Sang commit f1fdcbbdf45d9609f3d4063b67e9ea941ba3a58f Author: Masahiro Yamada Date: Tue Oct 16 12:01:47 2018 +0900 i2c: uniphier-f: make driver robust against concurrency This is unlikely to happen, but it is possible for a CPU to enter the interrupt handler just after wait_for_completion_timeout() has expired. If this happens, the hardware is accessed from multiple contexts concurrently. Disable the IRQ after wait_for_completion_timeout(), and do nothing from the handler when the IRQ is disabled. Fixes: 6a62974b667f ("i2c: uniphier_f: add UniPhier FIFO-builtin I2C driver") Signed-off-by: Masahiro Yamada Signed-off-by: Wolfram Sang commit a560ae55dcc3ae43c0c5764c745d3d1f0257beee Merge: a676973e4501 7451dc608564 Author: Wolfram Sang Date: Mon Oct 29 18:52:46 2018 +0000 Merge branch 'i2c-mux/for-next' of https://github.com/peda-r/i2c-mux into i2c/for-4.20-fixed commit 044ee890286153a1aefb40cb8b6659921aecb38b Author: Linus Torvalds Date: Mon Oct 29 11:25:24 2018 -0700 HID: input: simplify/fix high-res scroll event handling Commit 1ff2e1a44e02 ("HID: input: Create a utility class for counting scroll events") created the helper function hid_scroll_counter_handle_scroll() to handle high-res scroll events and also expose them as regular wheel events. But the resulting algorithm was unstable, and causes scrolling to be very unreliable. When you hit the half-way mark of the highres multiplier, small highres movements will incorrectly translate into big traditional wheel movements, causing odd jitters. Simplify the code and make the output stable. NOTE! I'm pretty sure this will need further tweaking. But this at least turns a unusable mouse wheel on my Logitech MX Anywhere 2S into a usable one. Cc: Jiri Kosina Cc: Harry Cutts Cc: Benjamin Tissoires Cc: Peter Hutterer Signed-off-by: Linus Torvalds commit f77084d96355f5fba8e2c1fb3a51a393b1570de7 Author: Sebastian Andrzej Siewior Date: Wed Oct 17 12:34:32 2018 +0200 x86/mm/pat: Disable preemption around __flush_tlb_all() The WARN_ON_ONCE(__read_cr3() != build_cr3()) in switch_mm_irqs_off() triggers every once in a while during a snapshotted system upgrade. The warning triggers since commit decab0888e6e ("x86/mm: Remove preempt_disable/enable() from __native_flush_tlb()"). The callchain is: get_page_from_freelist() -> post_alloc_hook() -> __kernel_map_pages() with CONFIG_DEBUG_PAGEALLOC enabled. Disable preemption during CR3 reset / __flush_tlb_all() and add a comment why preemption has to be disabled so it won't be removed accidentaly. Add another preemptible() check in __flush_tlb_all() to catch callers with enabled preemption when PGE is enabled, because PGE enabled does not trigger the warning in __native_flush_tlb(). Suggested by Andy Lutomirski. Fixes: decab0888e6e ("x86/mm: Remove preempt_disable/enable() from __native_flush_tlb()") Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Cc: Andy Lutomirski Cc: Dave Hansen Cc: Peter Zijlstra Cc: Borislav Petkov Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20181017103432.zgv46nlu3hc7k4rq@linutronix.de commit 8af1909580595a303b03d5999e410d407b7a6db7 Author: Juergen Gross Date: Mon Oct 29 16:01:16 2018 +0100 x86/paravirt: Remove GPL from pv_ops export Commit 5c83511bdb9832 ("x86/paravirt: Use a single ops structure") introduced a regression for out-of-tree modules using spinlocks, as pv_lock_ops was exported via EXPORT_SYMBOL(), while the new pv_ops structure now containing the pv lock operations is exported via EXPORT_SYMBOL_GPL(). Change that by using EXPORT_SYMBOL(pv_ops). Fixes: 5c83511bdb9832 ("x86/paravirt: Use a single ops structure") Signed-off-by: Juergen Gross Signed-off-by: Thomas Gleixner Cc: xen-devel@lists.xenproject.org Cc: virtualization@lists.linux-foundation.org Cc: akataria@vmware.com Cc: rusty@rustcorp.com.au Cc: boris.ostrovsky@oracle.com Cc: hpa@zytor.com Link: https://lkml.kernel.org/r/20181029150116.25372-1-jgross@suse.com commit 5bd4af34a09a381a0f8b1552684650698937e6b0 Merge: 738b04fba18d 59eaeba63a17 Author: Linus Torvalds Date: Mon Oct 29 10:42:20 2018 -0700 Merge tag 'tty-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial updates from Greg KH: "Here is the big tty and serial pull request for 4.20-rc1 Lots of little things here, including a merge from the SPI tree in order to keep things simpler for everyone to sync around for one platform. Major stuff is: - tty buffer clearing after use - atmel_serial fixes and additions - xilinx uart driver updates and of course, lots of tiny fixes and additions to individual serial drivers. All of these have been in linux-next with no reported issues for a while" * tag 'tty-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (66 commits) of: base: Change logic in of_alias_get_alias_list() of: base: Fix english spelling in of_alias_get_alias_list() serial: sh-sci: do not warn if DMA transfers are not supported serial: uartps: Do not allow use aliases >= MAX_UART_INSTANCES tty: check name length in tty_find_polling_driver() serial: sh-sci: Add r8a77990 support tty: wipe buffer if not echoing data tty: wipe buffer. serial: fsl_lpuart: Remove the alias node dependence TTY: sn_console: Replace spin_is_locked() with spin_trylock() Revert "serial:serial_core: Allow use of CTS for PPS line discipline" serial: 8250_uniphier: add auto-flow-control support serial: 8250_uniphier: flatten probe function serial: 8250_uniphier: remove unused "fifo-size" property dt-bindings: serial: sh-sci: Document r8a7744 bindings serial: uartps: Fix missing unlock on error in cdns_get_id() tty/serial: atmel: add ISO7816 support tty/serial_core: add ISO7816 infrastructure serial:serial_core: Allow use of CTS for PPS line discipline serial: docs: Fix filename for serial reference implementation ... commit 738b04fba18d35cd352b7b15afefb8a7b798648e Merge: fe675d4d3c6b 4ab7e05dd070 Author: Linus Torvalds Date: Mon Oct 29 10:38:10 2018 -0700 Merge tag 'staging-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging/IIO driver updates from Greg KH: "Here is the big staging and IIO driver pull request for 4.20-rc1. There are lots of things here, we ended up adding more lines than removing, thanks to a large influx of Comedi National Instrument device support. Someday soon we need to get comedi out of staging... Other than the comedi drivers, the "big" things here are: - new iio drivers - delete dgnc driver (no one used it and no one had the hardware anymore) - vbox driver updates and fixes - erofs fixes - tons and tons of tiny checkpatch fixes for almost all staging drivers All of these have been in linux-next, with the last few happening a bit "late" due to them getting stuck on my laptop during travel to the Mantainers summit" * tag 'staging-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (690 commits) staging: gasket: Fix sparse "incorrect type in assignment" warnings. staging: gasket: remove debug logs for callback invocation staging: gasket: remove debug logs in page table mapping calls staging: rtl8188eu: core: Use sizeof(*p) instead of sizeof(struct P) for memory allocation staging: ks7010: Remove extra blank line staging: gasket: Remove extra blank line staging: media: davinci_vpfe: Fix spelling mistake in enum staging: speakup: Add a pair of braces staging: wlan-ng: Replace long int with long staging: MAINTAINERS: remove obsolete IPX staging directory staging: MAINTAINERS: remove NCP filesystem entry staging: rtl8188eu: cleanup comparsions to false staging: gasket: Update device virtual address comment staging: gasket: sysfs: fix attribute release comment staging: gasket: apex: fix sysfs_show staging: gasket: page_table: simplify gasket_components_to_dev_address staging: gasket: page_table: fix comment in components_to_dev_address staging: gasket: page table: fixup error path allocating coherent mem staging: gasket: page_table: rearrange gasket_page_table_entry staging: gasket: page_table: remove unnecessary PTE status set to free ... commit fe675d4d3c6b96710d481346821839b4a817c672 Merge: e64433d58763 9f0a0a381c5d Author: Linus Torvalds Date: Mon Oct 29 10:30:44 2018 -0700 Merge tag 'mailbox-v4.20' of git://git.linaro.org/landing-teams/working/fujitsu/integration Pull mailbox updates from Jassi Brar: - convert print users to use the %pOFn format specifier - enable ti-msgmr driver for the K3 platform as well - add QCS404 to compatible list of QCOM's APCS IPC driver - minor spelling fixes toogle -> toggle - kzalloc failure catch in Mediatek driver * tag 'mailbox-v4.20' of git://git.linaro.org/landing-teams/working/fujitsu/integration: mailbox: mediatek: Add check for possible failure of kzalloc mailbox: bcm-flexrm-mailbox: fix spelling mistake "toogle" -> "toggle" mailbox: qcom: Add QCS404 APPS Global compatible drivers: mailbox: Make ti-msgmr driver depend on ARCH_K3 mailbox: Convert to using %pOFn instead of device_node.name commit e64433d587635140fda898365978e6b6fe73ba4e Merge: 79257514f532 2aad26fa0a3d Author: Linus Torvalds Date: Mon Oct 29 10:23:36 2018 -0700 Merge tag 'filesystems_for_v4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull ext2 and udf updates from Jan Kara: "Small ext2 cleanups and a couple of udf fixes" * tag 'filesystems_for_v4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: ext2: remove redundant building macro check udf: Drop pack pragma from udf_sb.h udf: Drop freed bitmap / table support udf: Fix crash during mount udf: Prevent write-unsupported filesystem to be remounted read-write ext2: cache NULL when both default_acl and acl are NULL udf: remove unused variables group_start and nr_groups commit 79257514f532bd6e500267a061ae2cae4e3d28d5 Merge: 7da4221b530f 721fb6fbfd21 Author: Linus Torvalds Date: Mon Oct 29 09:19:53 2018 -0700 Merge tag 'for_v4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify updates from Jan Kara: "Amir's patches to implement superblock fanotify watches, Xiaoming's patch to enable reporting of thread IDs in fanotify events instead of TGIDs (sadly the patch got mis-attributed to Amir and I've noticed only now), and a fix of possible oops on umount caused by fsnotify infrastructure" * tag 'for_v4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fsnotify: Fix busy inodes during unmount fs: group frequently accessed fields of struct super_block together fanotify: support reporting thread id instead of process id fanotify: add BUILD_BUG_ON() to count the bits of fanotify constants fsnotify: convert runtime BUG_ON() to BUILD_BUG_ON() fanotify: deprecate uapi FAN_ALL_* constants fanotify: simplify handling of FAN_ONDIR fsnotify: generalize handling of extra event flags fanotify: fix collision of internal and uapi mark flags fanotify: store fanotify_init() flags in group's fanotify_data fanotify: add API to attach/detach super block mark fsnotify: send path type events to group with super block marks fsnotify: add super block object type commit 7da4221b530f0427cc09bdaa5c5c1bd86d30583d Merge: 673c790e7282 fb488fc1f2b4 Author: Linus Torvalds Date: Mon Oct 29 09:09:47 2018 -0700 Merge tag '9p-for-4.20' of git://github.com/martinetd/linux Pull 9p updates from Dominique Martinet: "Highlights this time around are the end of Matthew's work to remove the custom 9p request cache and use a slab directly for requests, with some extra patches on my end to not degrade performance, but it's a very good cleanup. Tomas and I fixed a few more syzkaller bugs (refcount is the big one), and I had a go at the coverity bugs and at some of the bugzilla reports we had open for a while. I'm a bit disappointed that I couldn't get much reviews for a few of my own patches, but the big ones got some and it's all been soaking in linux-next for quite a while so I think it should be OK. Summary: - Finish removing the custom 9p request cache mechanism - Embed part of the fcall in the request to have better slab performance (msize usually is power of two aligned) - syzkaller fixes: * add a refcount to 9p requests to avoid use after free * a few double free issues - A few coverity fixes - Some old patches that were in the bugzilla: * do not trust pdu content for size header * mount option for lock retry interval" * tag '9p-for-4.20' of git://github.com/martinetd/linux: (21 commits) 9p/trans_fd: put worker reqs on destroy 9p/trans_fd: abort p9_read_work if req status changed 9p: potential NULL dereference 9p locks: fix glock.client_id leak in do_lock 9p: p9dirent_read: check network-provided name length 9p/rdma: remove useless check in cm_event_handler 9p: acl: fix uninitialized iattr access 9p locks: add mount option for lock retry interval 9p: do not trust pdu content for stat item size 9p: Rename req to rreq in trans_fd 9p: fix spelling mistake in fall-through annotation 9p/rdma: do not disconnect on down_interruptible EAGAIN 9p: Add refcount to p9_req_t 9p: rename p9_free_req() function 9p: add a per-client fcall kmem_cache 9p: embed fcall in req to round down buffer allocs 9p: Remove p9_idpool 9p: Use a slab for allocating requests 9p: clear dangling pointers in p9stat_free v9fs_dir_readdir: fix double-free on p9stat_read error ... commit 673c790e72822ee433931ea701e4fceef75a0eac Merge: 83e7e5b54417 381fdd62c383 Author: Linus Torvalds Date: Mon Oct 29 09:04:26 2018 -0700 Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68k nommu fix from Greg Ungerer: "Only a single change to fix an out of bounds array access when parsing boot command line" * 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68k: fix command-line parsing when passed from u-boot commit 83e7e5b54417e20aea7ce571a19af331a539027e Merge: ac435075892e 58c116fb7dc6 Author: Linus Torvalds Date: Mon Oct 29 09:02:15 2018 -0700 Merge tag 'm68k-for-v4.20-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k updates from Geert Uytterhoeven: "Just two small cleanups" * tag 'm68k-for-v4.20-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k/sun3: Remove is_medusa and m68k_pgtable_cachemode m68k/atari: ARAnyM - Remove reference to long-deprecated MODULE_PARM commit ac237c28d5ac1b241d58b1b7b4b9fa10efb22fb5 Author: Alex Stanoev Date: Sun Oct 28 16:55:12 2018 +0000 ALSA: ca0106: Disable IZD on SB0570 DAC to fix audio pops The Creative Audigy SE (SB0570) card currently exhibits an audible pop whenever playback is stopped or resumed, or during silent periods of an audio stream. Initialise the IZD bit to the 0 to eliminate these pops. The Infinite Zero Detection (IZD) feature on the DAC causes the output to be shunted to Vcap after 2048 samples of silence. This discharges the AC coupling capacitor through the output and causes the aforementioned pop/click noise. The behaviour of the IZD bit is described on page 15 of the WM8768GEDS datasheet: "With IZD=1, applying MUTE for 1024 consecutive input samples will cause all outputs to be connected directly to VCAP. This also happens if 2048 consecutive zero input samples are applied to all 6 channels, and IZD=0. It will be removed as soon as any channel receives a non-zero input". I believe the second sentence might be referring to IZD=1 instead of IZD=0 given the observed behaviour of the card. This change should make the DAC initialisation consistent with Creative's Windows driver, as this popping persists when initialising the card in Linux and soft rebooting into Windows, but is not present on a cold boot to Windows. Signed-off-by: Alex Stanoev Cc: Signed-off-by: Takashi Iwai commit 8f054b6f53ff34fb787bde4c5940f86a9c175177 Author: Douglas Anderson Date: Thu Oct 25 15:21:34 2018 -0700 drm/panel: simple: Innolux TV123WAM is actually P120ZDG-BF1 As far as I can tell the panel that was added in commit da50bd4258db ("drm/panel: simple: Add Innolux TV123WAM panel driver support") wasn't actually an Innolux TV123WAM but was actually an Innolux P120ZDG-BF1. As far as I can tell the Innolux TV123WAM isn't a real panel and but it's a mosh between the TI TV123WAM and the Innolux P120ZDG-BF1. Let's unmosh. Here's my evidence: * Searching for TV123WAM on the Internet turns up a TI panel. While it's possible that an Innolux panel has the same model number as the TI Panel, it seems a little doubtful. Looking up the datasheet from the TI Panel shows that it's 1920 x 1280 and 259.2 mm x 172.8 mm. * As far as I know, the patch adding the Innolux Panel was supposed to be for the board that's sitting in front of me as I type this (support for that board is not yet upstream). On the back of that panel I see Innolux P120ZDZ-EZ1 rev B1. * Someone pointed me at a datasheet that's supposed to be for the panel in front of me (sorry, I can't share the datasheet). That datasheet has the string "p120zdg-bf1" * If I search for "P120ZDG-BF1" on the Internet I get hits for panels that are 2160x1440. They don't have datasheets, but the fact that the resolution matches is a good sign. In any case, let's update the name and also the physical size to match the correct panel. Fixes: da50bd4258db ("drm/panel: simple: Add Innolux TV123WAM panel driver support") Cc: Sandeep Panda Reviewed-by: Abhinav Kumar Reviewed-by: Sean Paul Signed-off-by: Douglas Anderson Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20181025222134.174583-6-dianders@chromium.org commit c0e9ab24723cbc0be32993f02b34477929555e0d Author: Douglas Anderson Date: Thu Oct 25 15:21:33 2018 -0700 dt-bindings: drm/panel: simple: Innolux TV123WAM is actually P120ZDG-BF1 As far as I can tell the bindings that were added in commit 9c04400f7ea6 ("dt-bindings: drm/panel: Document Innolux TV123WAM panel bindings") weren't actually for Innolux TV123WAM but were actually for Innolux P120ZDG-BF1. As far as I can tell the Innolux TV123WAM isn't a real panel and but it's a mosh between the TI TV123WAM and the Innolux P120ZDG-BF1. Let's unmosh. Here's my evidence: * Searching for TV123WAM on the Internet turns up a TI panel. While it's possible that an Innolux panel has the same model number as the TI Panel, it seems a little doubtful. Looking up the datasheet from the TI Panel shows that it's 1920 x 1280 and 259.2 mm x 172.8 mm. * As far as I know, the patch adding the Innolux Panel was supposed to be for the board that's sitting in front of me as I type this (support for that board is not yet upstream). On the back of that panel I see Innolux P120ZDZ-EZ1 rev B1. * Someone pointed me at a datasheet that's supposed to be for the panel in front of me (sorry, I can't share the datasheet). That datasheet has the string "p120zdg-bf1" * If I search for "P120ZDG-BF1" on the Internet I get hits for panels that are 2160x1440. They don't have datasheets, but the fact that the resolution matches is a good sign. While we doing the rename, also mention that no-hpd can be used with this panel. See the previous patch in this series ("drm/panel: simple: Add "no-hpd" delay for Innolux TV123WAM"). Fixes: 9c04400f7ea6 ("dt-bindings: drm/panel: Document Innolux TV123WAM panel bindings") Cc: Sandeep Panda Reviewed-by: Rob Herring Reviewed-by: Andrzej Hajda Signed-off-by: Douglas Anderson Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20181025222134.174583-5-dianders@chromium.org commit c2bfc223882d4b9d73be970e00ead6fe7868bdb7 Author: Douglas Anderson Date: Thu Oct 25 15:21:32 2018 -0700 drm/bridge: ti-sn65dsi86: Remove the mystery delay Let's solve the mystery of commit bf1178c98930 ("drm/bridge: ti-sn65dsi86: Add mystery delay to enable()"). Specifically the reason we needed that mystery delay is that we weren't paying attention to HPD. Looking at the datasheet for the same panel that was tested for the original commit, I see there's a timing "t3" that times from power on to the aux channel being operational. This time is specced as 0 - 200 ms. The datasheet says that the aux channel is operational at exactly the same time that HPD is asserted. Scoping the signals on this board showed that HPD was asserted 84 ms after power was asserted. That very closely matches the magic 70 ms delay that we had. ...and actually, in my testing the 70 ms wasn't quite enough of a delay and some percentage of the time the display didn't come up until I bumped it to 100 ms (presumably 84 ms would have worked too). To solve this, we tried to hook up the HPD signal in the bridge. ...but in doing so we found that that the bridge didn't report that HPD was asserted until ~280 ms after we powered it (!). This is explained by looking at the sn65dsi86 datasheet section "8.4.5.1 HPD (Hot Plug/Unplug Detection)". Reading there we see that the bridge isn't even intended to report HPD until 100 ms after it's asserted. ...but that would have left us at 184 ms. The extra 100 ms (presumably) comes from this part in the datasheet: > The HPD state machine operates off an internal ring oscillator. The > ring oscillator frequency will vary [ ... ]. The min/max range in > the HPD State Diagram refers to the possible times based off > variation in the ring oscillator frequency. Given that the 280 ms we'll end up delaying if we hook up HPD is _slower_ than the 200 ms we could just hardcode, for now we'll solve the problem by just hardcoding a 200 ms delay in the panel driver using the patch in this series ("drm/panel: simple: Support panels with HPD where HPD isn't connected"). If we later find a panel that needs to use this bridge where we need HPD then we'll have to come up with some new code to handle it. Given the silly debouncing in the bridge chip, though, it seems unlikely. One last note is that I tried to solve this through another way: In ti_sn_bridge_enable() I tried to use various combinations of dp_dpcd_writeb() and dp_dpcd_readb() to detect when the aux channel was up. In theory that would let me detect _exactly_ when I could continue and do link training. Unfortunately even if I did an aux transfer w/out waiting I couldn't see any errors. Possibly I could keep looping over link training until it came back with success, but that seemed a little overly hacky to me. Reviewed-by: Sean Paul Reviewed-by: Andrzej Hajda Signed-off-by: Douglas Anderson Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20181025222134.174583-4-dianders@chromium.org commit 625d3b5c2ea612e4adf8b289384ad654c207c2bb Author: Douglas Anderson Date: Thu Oct 25 15:21:31 2018 -0700 drm/panel: simple: Add "no-hpd" delay for Innolux TV123WAM If the HPD signal isn't hooked up to this panel we need a 200 ms delay. In the datasheet this is shown as the maximum time that HPD will take to be asserted after power is given to the panel. Reviewed-by: Sean Paul Signed-off-by: Douglas Anderson Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20181025222134.174583-3-dianders@chromium.org commit 2ed3e9510f60d0c097ca492e094eeb376ba4330a Author: Douglas Anderson Date: Thu Oct 25 15:21:30 2018 -0700 drm/panel: simple: Support panels with HPD where HPD isn't connected Some eDP panels that are designed to be always connected to a board use their HPD signal to signal that they've finished powering on and they're ready to be talked to. However, for various reasons it's possible that the HPD signal from the panel isn't actually hooked up. In the case where the HPD isn't hooked up you can look at the timing diagram on the panel datasheet and insert a delay for the maximum amount of time that the HPD might take to come up. Let's add support in simple-panel for this concept. At the moment we will co-opt the existing "prepare" delay to keep track of the delay and we'll use a boolean to specify that a given panel should only apply the delay if the "no-hpd" property was specified. Reviewed-by: Sean Paul Signed-off-by: Douglas Anderson Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20181025222134.174583-2-dianders@chromium.org commit cb028e49129f352d2f2645727ceeeacdd64761f4 Author: Douglas Anderson Date: Thu Oct 25 15:21:29 2018 -0700 dt-bindings: drm/panel: simple: Add no-hpd property Some eDP panels that are designed to be always connected to a board use their HPD signal to signal that they've finished powering on and they're ready to be talked to. However, for various reasons it's possible that the HPD signal from the panel isn't actually hooked up. In the case where the HPD isn't hooked up you can look at the timing diagram on the panel datasheet and insert a delay for the maximum amount of time that the HPD might take to come up. Let's add a property in the device tree for this concept. Reviewed-by: Sean Paul Reviewed-by: Rob Herring Signed-off-by: Douglas Anderson Signed-off-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20181025222134.174583-1-dianders@chromium.org commit 69840466086d2248898020a08dda52732686c4e6 Author: Jianchao Wang Date: Sat Oct 27 19:52:14 2018 +0800 block: fix the DISCARD request merge There are two cases when handle DISCARD merge. If max_discard_segments == 1, the bios/requests need to be contiguous to merge. If max_discard_segments > 1, it takes every bio as a range and different range needn't to be contiguous. But now, attempt_merge screws this up. It always consider contiguity for DISCARD for the case max_discard_segments > 1 and cannot merge contiguous DISCARD for the case max_discard_segments == 1, because rq_attempt_discard_merge always returns false in this case. This patch fixes both of the two cases above. Reviewed-by: Christoph Hellwig Reviewed-by: Ming Lei Signed-off-by: Jianchao Wang Signed-off-by: Jens Axboe commit c6e0bba4ac44fd3d116d763c834dd43f3824f635 Author: Jiri Kosina Date: Sat Oct 27 14:16:13 2018 +0200 HID: moving to group maintainership model Benjamin and myself will from now on be sharing maintainership responsibilities for hid.git. Update maintainers to reflect that change, and also move a git repository to shared space at kernel.org. Signed-off-by: Jiri Kosina Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit ac435075892e3e651c667b4a9f2267cf3ef1d5a2 Merge: 9f51ae62c84a 2347e7e1aea4 Author: Linus Torvalds Date: Mon Oct 29 08:25:00 2018 -0700 Merge tag 'csky-for-linus-4.20' of https://github.com/c-sky/csky-linux Pull C-SKY architecture port from Guo Ren: "This contains the Linux port for C-SKY(csky) based on linux-4.19 Release, which has been through 10 rounds of review on mailing list. More information: http://en.c-sky.com The development repo: https://github.com/c-sky/csky-linux ABI Documentation: https://github.com/c-sky/csky-doc Here is the pre-built cross compiler for fast test from our CI: https://gitlab.com/c-sky/buildroot/-/jobs/101608095/artifacts/file/output/images/csky_toolchain_qemu_csky_ck807f_4.18_glibc_defconfig_482b221e52908be1c9b2ccb444255e1562bb7025.tar.xz We use buildroot as our CI-test enviornment. "LTP, Lmbench ..." will be tested for every commit. See here for more details: https://gitlab.com/c-sky/buildroot/pipelines We'll continouslly improve csky subsystem in future" Arnd acks, and adds the following notes: "I did a thorough review of the ABI, which as usual mainly consists of spotting any files that don't use the asm-generic ABI itself, and having it changed to it matches exactly what we do on other new architectures. I also looked at every other patch and commented on maybe half of them where I saw something that did not quite seem right. Others have reviewed specific patches in greater depth. I'm sure that one could fine more of the minor details, but as long as they are not ABI relevant, they can be fixed later. The only patch that is part of the ABI and that nobody reviewed is the signal handling. This is one of the areas I never worked on in much detail. I did not see anything wrong with it, but I also don't know what the problems with the other architectures are here, and we seem to be hitting issues occasionally, and we never managed to generalize this enough for new architectures to have a trivial implementation. I was originally hoping that we could have the 64-bit time_t interfaces ready in time to completely drop the 32-bit ones, but that did not happen. We might still remove them in the next merge window depending on whether the libc upstream people prefer to keep them or not. One more general comment: I think this may well be the last new CPU architecture we ever add to the kernel. Both nds32 and c-sky are made by companies that also work on risc-v, and generally speaking risc-v seems to be killing off any of the minor licensable instruction set projects, just like ARM has mostly killed off the custom vendor-specific instruction sets already. If we add another architecture in the future, it may instead be something like the LLVM bitcode or WebAssembly, who knows?" To which Geert Uytterhoeven pipes in about another architecture still in the pipeline: Kalray MPPA. * tag 'csky-for-linus-4.20' of https://github.com/c-sky/csky-linux: (24 commits) dt-bindings: interrupt-controller: C-SKY APB intc irqchip: add C-SKY APB bus interrupt controller dt-bindings: interrupt-controller: C-SKY SMP intc irqchip: add C-SKY SMP interrupt controller MAINTAINERS: Add csky dt-bindings: Add vendor prefix for csky dt-bindings: csky CPU Bindings csky: Misc headers csky: SMP support csky: Debug and Ptrace GDB csky: User access csky: Library functions csky: ELF and module probe csky: Atomic operations csky: IRQ handling csky: VDSO and rt_sigreturn csky: Process management and Signal csky: MMU and page table management csky: Cache and TLB routines csky: System Call ... commit 49ad712afa88c502831d37f7089d98eac441fb80 Author: Hans de Goede Date: Sun Oct 14 19:54:27 2018 +0200 platform/x86: Add Intel AtomISP2 dummy / power-management driver The Image Signal Processor found on Cherry Trail devices is brought up in D0 state on devices which have camera sensors attached to it. The ISP will not enter D3 state again without some massaging of its registers beforehand and the ISP not being in D3 state blocks the SoC from entering S0ix modes. There was a driver for the ISP in drivers/staging but that got removed again because it never worked. It does not seem likely that a real driver for the ISP will be added to the mainline kernel anytime soon. This commit adds a dummy driver which contains the necessary magic from the staging driver to powerdown the ISP, so that Cherry Trail devices where the ISP is used will properly use S0ix modes when suspended. Together with other recent S0ix related fixes this allows S0ix modes to be entered on e.g. a Chuwi Hi8 Pro and a HP x2 210. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=196915 Signed-off-by: Hans de Goede Reviewed-by: Alan Cox Signed-off-by: Andy Shevchenko commit 3b9672fff747b31a2204003cab9fe082321edc1b Merge: e901378578c6 b6ae3550c8e2 Author: Michael Ellerman Date: Mon Oct 29 22:31:51 2018 +1100 Merge branch 'next' of https://git.kernel.org/pub/scm/linux/kernel/git/scottwood/linux into next Updates from Scott: "This contains a couple device tree updates, and a fix for a missing prototype warning." commit 4104916d8cad141faa6c24003540e0faeed859fd Author: Hans de Goede Date: Sat Oct 20 12:21:00 2018 +0200 platform/x86: touchscreen_dmi: Add min-x and min-y settings for various models Add min-x and min-y settings now that we've support for this and for some models also update the width/height settings with slighly more accurate values. This fixes touches along the edges registering at the wrong coordinates. While at it also set max-fingers to 10 in a couple of cases where the touchpad can handle 10 fingers (rather then the default 5) and that was missing. Signed-off-by: Hans de Goede Signed-off-by: Andy Shevchenko commit 4269fea768a11a447d8de620ce420f2214d4685c Author: Pablo Neira Ayuso Date: Fri Oct 26 11:14:28 2018 +0200 Revert "netfilter: nft_numgen: add map lookups for numgen random operations" Laura found a better way to do this from userspace without requiring kernel infrastructure, revert this. Fixes: 978d8f9055c3 ("netfilter: nft_numgen: add map lookups for numgen random operations") Signed-off-by: Laura Garcia Liebana Signed-off-by: Pablo Neira Ayuso commit 922dceff8dc1fb4dafc9af78139ba65671408103 Author: Lee, Shawn C Date: Sun Oct 28 22:49:33 2018 -0700 drm/edid: Add 6 bpc quirk for BOE panel. BOE panel (ID: 0x0771) that reports "DFP 1.x compliant TMDS". But it's 6bpc panel only instead of 8 bpc. Add panel ID to edid quirk list and set 6 bpc as default to work around this issue. Cc: Jani Nikula Cc: Maarten Lankhorst Cc: Gustavo Padovan Cc: Cooper Chiou Signed-off-by: Lee, Shawn C > Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/1540792173-7288-1-git-send-email-shawn.c.lee@intel.com commit f0718d792b8a6d4b5ddc929e418ac57cc4897375 Merge: efe8eaf7b525 b59dfdaef173 Author: Ingo Molnar Date: Mon Oct 29 07:20:52 2018 +0100 Merge branch 'linus' into perf/urgent, to pick up fixes Signed-off-by: Ingo Molnar commit 2022cceb4e30f1bb4c84d40ffa705aa8d8d68adb Author: Rasmus Villemoes Date: Sat Oct 27 00:20:04 2018 +0200 x86/traps: Use format string with panic() call Building with -Wformat-nonliteral gives: arch/x86/kernel/traps.c:334:2: warning: format not a string literal and no format arguments [-Wformat-nonliteral] panic(message); handle_stack_overflow() can only be called from two places (kernel/traps.c and via inline asm in mm/fault.c), in both cases with a string not containing format specifiers, so we might as well silence this warning using "%s" as a format string. Signed-off-by: Rasmus Villemoes Cc: Borislav Petkov Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/20181026222004.14193-1-linux@rasmusvillemoes.dk Signed-off-by: Ingo Molnar commit a68d75081aeccfb169575bea6f452a5a12b9f49b Author: Muchun Song Date: Sat Oct 27 11:05:17 2018 +0800 sched/rt: Update comment in pick_next_task_rt() Commit: f4ebcbc0d7e0 ("sched/rt: Substract number of tasks of throttled queues from rq->nr_running") added a new rt_rq->rt_queued field, which is used to indicate the status of rq->rt enqueue or dequeue. So, the ->rt_nr_running check was removed and we now check ->rt_queued instead. Fix the comment in pick_next_task_rt() as well, which was still referencing the old logic. Signed-off-by: Muchun Song Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/20181027030517.23292-1-smuchun@gmail.com Signed-off-by: Ingo Molnar commit 0e96f31ea4249b1e94e266fe4dff908c2983a9b3 Author: Jordan Borgner Date: Sun Oct 28 12:58:28 2018 +0000 x86: Clean up 'sizeof x' => 'sizeof(x)' "sizeof(x)" is the canonical coding style used in arch/x86 most of the time. Fix the few places that didn't follow the convention. (Also do some whitespace cleanups in a few places while at it.) [ mingo: Rewrote the changelog. ] Signed-off-by: Jordan Borgner Cc: Borislav Petkov Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/20181028125828.7rgammkgzep2wpam@JordanDesktop Signed-off-by: Ingo Molnar commit 4b783dd6a4071e0919fa7556462d86a792f518fc Merge: 97ec37c57dd4 d2266bbfa9e3 f4661d293eb2 4a60aa05a063 Author: Ingo Molnar Date: Mon Oct 29 07:13:09 2018 +0100 Merge branches 'x86/early-printk', 'x86/microcode' and 'core/objtool' into x86/urgent, to pick up simple topic branches Signed-off-by: Ingo Molnar commit 97ec37c57dd411d0815455bca07166411c0da1df Merge: ace6485a0326 b59dfdaef173 Author: Ingo Molnar Date: Mon Oct 29 07:12:34 2018 +0100 Merge branch 'linus' into x86/urgent, to refresh the tree Signed-off-by: Ingo Molnar commit 9f51ae62c84a23ade0ba86457d30a30c9db0c50f Merge: 53b3b6bbfde6 747569b0a7c5 Author: Linus Torvalds Date: Sun Oct 28 20:17:49 2018 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) GRO overflow entries are not unlinked properly, resulting in list poison pointers being dereferenced. 2) Fix bridge build with ipv6 disabled, from Nikolay Aleksandrov. 3) Direct packet access and other fixes in BPF from Daniel Borkmann. 4) gred_change_table_def() gets passed the wrong pointer, a pointer to a set of unparsed attributes instead of the attribute itself. From Jakub Kicinski. 5) Allow macsec device to be brought up even if it's lowerdev is down, from Sabrina Dubroca. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: net: diag: document swapped src/dst in udp_dump_one. macsec: let the administrator set UP state even if lowerdev is down macsec: update operstate when lower device changes net: sched: gred: pass the right attribute to gred_change_table_def() ptp: drop redundant kasprintf() to create worker name net: bridge: remove ipv6 zero address check in mcast queries net: Properly unlink GRO packets on overflow. bpf: fix wrong helper enablement in cgroup local storage bpf: add bpf_jit_limit knob to restrict unpriv allocations bpf: make direct packet write unclone more robust bpf: fix leaking uninitialized memory on pop/peek helpers bpf: fix direct packet write into pop/peek helpers bpf: fix cg_skb types to hint access type in may_access_direct_pkt_data bpf: fix direct packet access for flow dissector progs bpf: disallow direct packet access for unpriv in cg_skb bpf: fix test suite to enable all unpriv program types bpf, btf: fix a missing check bug in btf_parse selftests/bpf: add config fragments BPF_STREAM_PARSER and XDP_SOCKETS bpf: devmap: fix wrong interface selection in notifier_call commit 747569b0a7c537d680bc94a988be6caad9960488 Author: Lorenzo Colitti Date: Mon Oct 29 09:15:22 2018 +0900 net: diag: document swapped src/dst in udp_dump_one. Since its inception, udp_dump_one has had a bug where userspace needs to swap src and dst addresses and ports in order to find the socket it wants. This is because it passes the socket source address to __udp[46]_lib_lookup's saddr argument, but those functions are intended to find local sockets matching received packets, so saddr is the remote address, not the local address. This can no longer be fixed for backwards compatibility reasons, so add a brief comment explaining that this is the case. This will avoid confusion and help ensure SOCK_DIAG implementations of new protocols don't have the same problem. Fixes: a925aa00a55 ("udp_diag: Implement the get_exact dumping functionality") Signed-off-by: Lorenzo Colitti Signed-off-by: David S. Miller commit 3bdf6bac58170383465a2fb67cf6e13a27e43b85 Merge: 38b4f18d5637 07bddef98393 Author: David S. Miller Date: Sun Oct 28 19:26:43 2018 -0700 Merge branch 'macsec-fixes' Sabrina Dubroca says: ==================== macsec: linkstate fixes This series fixes issues with handling administrative and operstate of macsec devices. Radu Rendec proposed another version of the first patch [0] but I'd rather not follow the behavior of vlan devices, going with macvlan does instead. Patrick Talbert also reported the same issue to me. The second patch is a follow-up. The restriction on setting the device up is a bit unreasonable, and operstate provides the information we need in this case. [0] https://patchwork.ozlabs.org/patch/971374/ ==================== Signed-off-by: David S. Miller commit 07bddef9839378bd6f95b393cf24c420529b4ef1 Author: Sabrina Dubroca Date: Sun Oct 28 09:33:10 2018 +0100 macsec: let the administrator set UP state even if lowerdev is down Currently, the kernel doesn't let the administrator set a macsec device up unless its lower device is currently up. This is inconsistent, as a macsec device that is up won't automatically go down when its lower device goes down. Now that linkstate propagation works, there's really no reason for this limitation, so let's remove it. Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") Reported-by: Radu Rendec Signed-off-by: Sabrina Dubroca Signed-off-by: David S. Miller commit e6ac075882b2afcdf2d5ab328ce4ab42a1eb9593 Author: Sabrina Dubroca Date: Sun Oct 28 09:33:09 2018 +0100 macsec: update operstate when lower device changes Like all other virtual devices (macvlan, vlan), the operstate of a macsec device should match the state of its lower device. This is done by calling netif_stacked_transfer_operstate from its netdevice notifier. We also need to call netif_stacked_transfer_operstate when a new macsec device is created, so that its operstate is set properly. This is only relevant when we try to bring the device up directly when we create it. Radu Rendec proposed a similar patch, inspired from the 802.1q driver, that included changing the administrative state of the macsec device, instead of just the operstate. This version is similar to what the macvlan driver does, and updates only the operstate. Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") Reported-by: Radu Rendec Reported-by: Patrick Talbert Signed-off-by: Sabrina Dubroca Signed-off-by: David S. Miller commit 38b4f18d56372e1e21771ab7b0357b853330186c Author: Jakub Kicinski Date: Fri Oct 26 15:51:06 2018 -0700 net: sched: gred: pass the right attribute to gred_change_table_def() gred_change_table_def() takes a pointer to TCA_GRED_DPS attribute, and expects it will be able to interpret its contents as struct tc_gred_sopt. Pass the correct gred attribute, instead of TCA_OPTIONS. This bug meant the table definition could never be changed after Qdisc was initialized (unless whatever TCA_OPTIONS contained both passed netlink validation and was a valid struct tc_gred_sopt...). Old behaviour: $ ip link add type dummy $ tc qdisc replace dev dummy0 parent root handle 7: \ gred setup vqs 4 default 0 $ tc qdisc replace dev dummy0 parent root handle 7: \ gred setup vqs 4 default 0 RTNETLINK answers: Invalid argument Now: $ ip link add type dummy $ tc qdisc replace dev dummy0 parent root handle 7: \ gred setup vqs 4 default 0 $ tc qdisc replace dev dummy0 parent root handle 7: \ gred setup vqs 4 default 0 $ tc qdisc replace dev dummy0 parent root handle 7: \ gred setup vqs 4 default 0 Fixes: f62d6b936df5 ("[PKT_SCHED]: GRED: Use central VQ change procedure") Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 822c5f7341366bef761e5e49f05bb8b1b0afccee Author: Rasmus Villemoes Date: Fri Oct 26 23:22:59 2018 +0200 ptp: drop redundant kasprintf() to create worker name Building with -Wformat-nonliteral, gcc complains drivers/ptp/ptp_clock.c: In function ‘ptp_clock_register’: drivers/ptp/ptp_clock.c:239:26: warning: format not a string literal and no format arguments [-Wformat-nonliteral] worker_name : info->name); kthread_create_worker takes fmt+varargs to set the name of the worker, and that happens with a vsnprintf() to a stack buffer (that is then copied into task_comm). So there's no reason not to just pass "ptp%d", ptp->index to kthread_create_worker() and avoid the intermediate worker_name variable. Signed-off-by: Rasmus Villemoes Acked-by: Richard Cochran Reviewed-by: Kees Cook Signed-off-by: David S. Miller commit 0fe5119e267f3e3d8ac206895f5922195ec55a8a Author: Nikolay Aleksandrov Date: Sat Oct 27 12:07:47 2018 +0300 net: bridge: remove ipv6 zero address check in mcast queries Recently a check was added which prevents marking of routers with zero source address, but for IPv6 that cannot happen as the relevant RFCs actually forbid such packets: RFC 2710 (MLDv1): "To be valid, the Query message MUST come from a link-local IPv6 Source Address, be at least 24 octets long, and have a correct MLD checksum." Same goes for RFC 3810. And also it can be seen as a requirement in ipv6_mc_check_mld_query() which is used by the bridge to validate the message before processing it. Thus any queries with :: source address won't be processed anyway. So just remove the check for zero IPv6 source address from the query processing function. Fixes: 5a2de63fd1a5 ("bridge: do not add port to router list when receives query with source 0.0.0.0") Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit 53b3b6bbfde6aae8d1ededc86ad4e0e1e00eb5f8 Merge: 746bb4ed6d62 f2bfc71aee75 Author: Linus Torvalds Date: Sun Oct 28 17:49:53 2018 -0700 Merge tag 'drm-next-2018-10-24' of git://anongit.freedesktop.org/drm/drm Pull drm updates from Dave Airlie: "This is going to rebuild more than drm as it adds a new helper to list.h for doing bulk updates. Seemed like a reasonable addition to me. Otherwise the usual merge window stuff lots of i915 and amdgpu, not so much nouveau, and piles of everything else. Core: - Adds a new list.h helper for doing bulk list updates for TTM. - Don't leak fb address in smem_start to userspace (comes with EXPORT workaround for people using mali out of tree hacks) - udmabuf device to turn memfd regions into dma-buf - Per-plane blend mode property - ref/unref replacements with get/put - fbdev conflicting framebuffers code cleaned up - host-endian format variants - panel orientation quirk for Acer One 10 bridge: - TI SN65DSI86 chip support vkms: - GEM support. - Cursor support amdgpu: - Merge amdkfd and amdgpu into one module - CEC over DP AUX support - Picasso APU support + VCN dynamic powergating - Raven2 APU support - Vega20 enablement + kfd support - ACP powergating improvements - ABGR/XBGR display support - VCN jpeg support - xGMI support - DC i2c/aux cleanup - Ycbcr 4:2:0 support - GPUVM improvements - Powerplay and powerplay endian fixes - Display underflow fixes vmwgfx: - Move vmwgfx specific TTM code to vmwgfx - Split out vmwgfx buffer/resource validation code - Atomic operation rework bochs: - use more helpers - format/byteorder improvements qxl: - use more helpers i915: - GGTT coherency getparam - Turn off resource streamer API - More Icelake enablement + DMC firmware - Full PPGTT for Ivybridge, Haswell and Valleyview - DDB distribution based on resolution - Limited range DP display support nouveau: - CEC over DP AUX support - Initial HDMI 2.0 support virtio-gpu: - vmap support for PRIME objects tegra: - Initial Tegra194 support - DMA/IOMMU integration fixes msm: - a6xx perf improvements + clock prefix - GPU preemption optimisations - a6xx devfreq support - cursor support rockchip: - PX30 support - rgb output interface support mediatek: - HDMI output support on mt2701 and mt7623 rcar-du: - Interlaced modes on Gen3 - LVDS on R8A77980 - D3 and E3 SoC support hisilicon: - misc fixes mxsfb: - runtime pm support sun4i: - R40 TCON support - Allwinner A64 support - R40 HDMI support omapdrm: - Driver rework changing display pipeline ordering to use common code - DMM memory barrier and irq fixes - Errata workarounds exynos: - out-bridge support for LVDS bridge driver - Samsung 16x16 tiled format support - Plane alpha and pixel blend mode support tilcdc: - suspend/resume update mali-dp: - misc updates" * tag 'drm-next-2018-10-24' of git://anongit.freedesktop.org/drm/drm: (1382 commits) firmware/dmc/icl: Add missing MODULE_FIRMWARE() for Icelake. drm/i915/icl: Fix signal_levels drm/i915/icl: Fix DDI/TC port clk_off bits drm/i915/icl: create function to identify combophy port drm/i915/gen9+: Fix initial readout for Y tiled framebuffers drm/i915: Large page offsets for pread/pwrite drm/i915/selftests: Disable shrinker across mmap-exhaustion drm/i915/dp: Link train Fallback on eDP only if fallback link BW can fit panel's native mode drm/i915: Fix intel_dp_mst_best_encoder() drm/i915: Skip vcpi allocation for MSTB ports that are gone drm/i915: Don't unset intel_connector->mst_port drm/i915: Only reset seqno if actually idle drm/i915: Use the correct crtc when sanitizing plane mapping drm/i915: Restore vblank interrupts earlier drm/i915: Check fb stride against plane max stride drm/amdgpu/vcn:Fix uninitialized symbol error drm: panel-orientation-quirks: Add quirk for Acer One 10 (S1003) drm/amd/amdgpu: Fix debugfs error handling drm/amdgpu: Update gc_9_0 golden settings. drm/amd/powerplay: update PPtable with DC BTC and Tvr SocLimit fields ... commit 746bb4ed6d626f3f9e431a7f9b20504538e62ded Merge: ac747c0715f2 0bb95f80a38f Author: Linus Torvalds Date: Sun Oct 28 13:26:45 2018 -0700 Merge tag 'vla-v4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull VLA removal from Kees Cook: "Globally warn on VLA use. This turns on "-Wvla" globally now that the last few trees with their VLA removals have landed (crypto, block, net, and powerpc). Arnd mentioned that there may be a couple more VLAs hiding in hard-to-find randconfigs, but nothing big has shaken out in the last month or so in linux-next. We should be basically VLA-free now! Wheee. :) Summary: - Remove unused fallback for BUILD_BUG_ON (which technically contains a VLA) - Lift -Wvla to the top-level Makefile" * tag 'vla-v4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: Makefile: Globally enable VLA warning compiler.h: give up __compiletime_assert_fallback() commit ac747c0715f29c2be3848b719a1b7e65b07f7b21 Merge: f8cab69be0a8 c2b1a9226fe7 Author: Linus Torvalds Date: Sun Oct 28 13:22:35 2018 -0700 Merge tag 'kbuild-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild updates from Masahiro Yamada: - optimize kallsyms slightly - remove check for old CFLAGS usage - add some compiler flags unconditionally instead of evaluating $(call cc-option,...) - fix variable shadowing in host tools - refactor scripts/mkmakefile - refactor various makefiles * tag 'kbuild-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: modpost: Create macro to avoid variable shadowing ASN.1: Remove unnecessary shadowed local variable kbuild: use 'else ifeq' for checksrc to improve readability kbuild: remove unneeded link_multi_deps kbuild: add -Wno-unused-but-set-variable flag unconditionally kbuild: add -Wdeclaration-after-statement flag unconditionally kbuild: add -Wno-pointer-sign flag unconditionally modpost: remove leftover symbol prefix handling for module device table kbuild: simplify command line creation in scripts/mkmakefile kbuild: do not pass $(objtree) to scripts/mkmakefile kbuild: remove user ID check in scripts/mkmakefile kbuild: remove VERSION and PATCHLEVEL from $(objtree)/Makefile kbuild: add --include-dir flag only for out-of-tree build kbuild: remove dead code in cmd_files calculation in top Makefile kbuild: hide most of targets when running config or mixed targets kbuild: remove old check for CFLAGS use kbuild: prefix Makefile.dtbinst path with $(srctree) unconditionally kallsyms: remove left-over Blackfin code kallsyms: reduce size a little on 64-bit commit f8cab69be0a8a756a7409f6d2bd1e6e96ce46482 Merge: dad4f140edaa f73581f8d9a3 Author: Linus Torvalds Date: Sun Oct 28 12:58:42 2018 -0700 Merge tag 'linux-kselftest-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest updates from Shuah Khan: "This Kselftest update for Linux 4.20-rc1 consists of: - Improvements to ftrace test suite from Masami Hiramatsu. - Color coded ftrace PASS / FAIL results from Steven Rostedt (VMware) to improve readability of reports. - watchdog Fixes and enhancement to add gettimeout and get|set pretimeout options from Jerry Hoemann. - Several fixes to warnings and spelling etc" * tag 'linux-kselftest-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: (40 commits) selftests/ftrace: Strip escape sequences for log file selftests/ftrace: Use colored output when available selftests: fix warning: "_GNU_SOURCE" redefined selftests: kvm: Fix -Wformat warnings selftests/ftrace: Add color to the PASS / FAIL results kvm: selftests: fix spelling mistake "Insufficent" -> "Insufficient" selftests: gpio: Fix OUTPUT directory in Makefile selftests: gpio: restructure Makefile selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path selftests: watchdog: Add gettimeout and get|set pretimeout selftests: watchdog: Fix error message. selftests: watchdog: fix message when /dev/watchdog open fails selftests/ftrace: Add ftrace cpumask testcase selftests/ftrace: Add wakeup_rt tracer testcase selftests/ftrace: Add wakeup tracer testcase selftests/ftrace: Add stacktrace ftrace filter command testcase selftests/ftrace: Add trace_pipe testcase selftests/ftrace: Add function filter on module testcase selftests/ftrace: Add max stack tracer testcase selftests/ftrace: Add function profiling stat testcase ... commit 0d0352d8b3d6d7ca9a710b40e194cbbaeb841c88 Author: Masami Hiramatsu Date: Mon Oct 22 00:08:48 2018 +0900 selftests/ftrace: Fix synthetic event test to delete event correctly Fix the synthetic event test case to remove event correctly. If redirecting command to synthetic_event file without append mode, it cleans up all existing events and execute (parse) the command. This means "delete event" always fails to find the target event. Since previous synthetic event has a bug which doesn't return -ENOENT even if it fails to find the deleting event, this test passed. But fixing that bug, this test fails because this test itself has a bug. This fixes that bug by trying to delete event right after adding an event, and use append mode redirection ('>>') instead of normal redirection ('>'). Link: http://lkml.kernel.org/r/154013452832.25576.2305459545429386517.stgit@devbox Acked-by: Shuah Khan Acked-by: Tom Zanussi Tested-by: Tom Zanussi Cc: Tom Zanussi Cc: Tom Zanussi Cc: Rajvi Jingar Cc: Shuah Khan Cc: stable@vger.kernel.org Fixes: f06eec4d0f2c ('selftests: ftrace: Add inter-event hist triggers testcases') Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit dad4f140edaa3f6bb452b6913d41af1ffd672e45 Merge: 69d5b97c5973 3a08cd52c37c Author: Linus Torvalds Date: Sun Oct 28 11:35:40 2018 -0700 Merge branch 'xarray' of git://git.infradead.org/users/willy/linux-dax Pull XArray conversion from Matthew Wilcox: "The XArray provides an improved interface to the radix tree data structure, providing locking as part of the API, specifying GFP flags at allocation time, eliminating preloading, less re-walking the tree, more efficient iterations and not exposing RCU-protected pointers to its users. This patch set 1. Introduces the XArray implementation 2. Converts the pagecache to use it 3. Converts memremap to use it The page cache is the most complex and important user of the radix tree, so converting it was most important. Converting the memremap code removes the only other user of the multiorder code, which allows us to remove the radix tree code that supported it. I have 40+ followup patches to convert many other users of the radix tree over to the XArray, but I'd like to get this part in first. The other conversions haven't been in linux-next and aren't suitable for applying yet, but you can see them in the xarray-conv branch if you're interested" * 'xarray' of git://git.infradead.org/users/willy/linux-dax: (90 commits) radix tree: Remove multiorder support radix tree test: Convert multiorder tests to XArray radix tree tests: Convert item_delete_rcu to XArray radix tree tests: Convert item_kill_tree to XArray radix tree tests: Move item_insert_order radix tree test suite: Remove multiorder benchmarking radix tree test suite: Remove __item_insert memremap: Convert to XArray xarray: Add range store functionality xarray: Move multiorder_check to in-kernel tests xarray: Move multiorder_shrink to kernel tests xarray: Move multiorder account test in-kernel radix tree test suite: Convert iteration test to XArray radix tree test suite: Convert tag_tagged_items to XArray radix tree: Remove radix_tree_clear_tags radix tree: Remove radix_tree_maybe_preload_order radix tree: Remove split/join code radix tree: Remove radix_tree_update_node_t page cache: Finish XArray conversion dax: Convert page fault handlers to XArray ... commit ece23711dd956cd5053c9cb03e9fe0668f9c8894 Author: David S. Miller Date: Sun Oct 28 10:35:12 2018 -0700 net: Properly unlink GRO packets on overflow. Just like with normal GRO processing, we have to initialize skb->next to NULL when we unlink overflow packets from the GRO hash lists. Fixes: d4546c2509b1 ("net: Convert GRO SKB handling to list_head.") Reported-by: Oleksandr Natalenko Tested-by: Oleksandr Natalenko Signed-off-by: David S. Miller commit 4d8106f0299c7942c5f13a22da6d553d28127ef5 Author: Mike Rapoport Date: Mon Jun 25 12:02:34 2018 +0300 c6x: switch to NO_BOOTMEM The c6x is already using memblock and does most of early memory reservations with it, so it was only a matter of removing the bootmem initialization and handover of the memory from memblock to bootmem. Signed-off-by: Mike Rapoport Signed-off-by: Mark Salter commit c2b1a9226fe7c1cee8f0ae42496f3eb282d73ebb Author: Leonardo Bras Date: Wed Oct 24 01:03:52 2018 -0300 modpost: Create macro to avoid variable shadowing Create DEF_FIELD_ADDR_VAR as a more generic version of the DEF_FIELD_ADD macro, allowing usage of a variable name other than the struct element name. Also, sets DEF_FIELD_ADDR as a specific usage of DEF_FILD_ADDR_VAR in which the var name is the same as the struct element name. Then, makes use of DEF_FIELD_ADDR_VAR to create a variable of another name, in order to avoid variable shadowing. Signed-off-by: Leonardo Bras Signed-off-by: Masahiro Yamada commit 9e1e8194332fa4c453bcbad434b5da17c1c7e4c5 Author: Leonardo Bras Date: Wed Oct 24 01:03:51 2018 -0300 ASN.1: Remove unnecessary shadowed local variable Remove an unnecessary shadowed local variable (start). It was used only once, with the same value it was started before the if block. Signed-off-by: Leonardo Bras Signed-off-by: Masahiro Yamada commit 533555e5cbb6aa2d77598917871ae5b579fe724b Author: Wei Yongjun Date: Sat Oct 27 06:12:06 2018 +0000 xfrm: Fix error return code in xfrm_output_one() xfrm_output_one() does not return a error code when there is no dst_entry attached to the skb, it is still possible crash with a NULL pointer dereference in xfrm_output_resume(). Fix it by return error code -EHOSTUNREACH. Fixes: 9e1437937807 ("xfrm: Fix NULL pointer dereference when skb_dst_force clears the dst_entry.") Signed-off-by: Wei Yongjun Signed-off-by: Steffen Klassert commit c9fa406f62ec952bc4689b5120a02759ce42a68d Author: John David Anglin Date: Sat Oct 27 18:03:25 2018 -0400 parisc: Fix A500 boot crash I believe the following change will fix the cache/TLB inconsistency observed by Meelis. After changing the page table entries, we need to flush the cache and TLB to ensure that we don't have any stale PTE values in the cache or TLB. The alternative patching is done after all CPUs are running. Thus, we need to flush the whole cache and TLB. I included the init section in the range modified by map_pages as suggested by Helge. Some routines in the init section may require patching. Signed-off-by: John David Anglin Signed-off-by: Helge Deller commit 18858511fd8a877303cc34c06efa461b26a0e070 Author: Masami Hiramatsu Date: Mon Oct 22 00:08:20 2018 +0900 tracing: Return -ENOENT if there is no target synthetic event Return -ENOENT error if there is no target synthetic event. This notices an operation failure to user as below; # echo 'wakeup_latency u64 lat; pid_t pid;' > synthetic_events # echo '!wakeup' >> synthetic_events sh: write error: No such file or directory Link: http://lkml.kernel.org/r/154013449986.25576.9487131386597290172.stgit@devbox Acked-by: Tom Zanussi Tested-by: Tom Zanussi Cc: Shuah Khan Cc: Rajvi Jingar Cc: stable@vger.kernel.org Fixes: 4b147936fa50 ('tracing: Add support for 'synthetic' events') Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) commit 69d5b97c597307773fe6c59775a5d5a88bb7e6b3 Author: Linus Torvalds Date: Sat Oct 27 11:03:27 2018 -0700 HID: we do not randomly make new drivers 'default y' .. even when that "default y" is hidden syntactically as a default !EXPERT it's wrong. The only reason something should be 'default y' is if it used to be built-in, and it was made configurable, and the 'default y' is just retaining the status quo. Altheratively, the hardware for the driver has become _so_ common that it really makes sense for everybody to build it. Finally, one possible reason for 'default y' is because the option is not enabling any new code at all, but is just enabling other options (the networking people do this for vendor options, for example, so that you can disable whole vendors at a time). Clearly, none of these cases hold for the BigBen Interactive Kids' gamepad, and HID_BIGBEN_FF should thus most definitely not default to on for everybody. Cc: Hanno Zulla Cc: Jiri Kosina Signed-off-by: Linus Torvalds commit 5ecf3e110c32c5756351eed067cdf6a91c308e62 Merge: ed3f4e239834 cd6ba41c192d Author: Linus Torvalds Date: Sat Oct 27 10:25:22 2018 -0700 Merge tag 'linux-watchdog-4.20-rc1' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog updates from Wim Van Sebroeck: - Add Armada 37xx CPU watchdog - w83627hf_wdt: Add Support for NCT6796D, NCT6797D, NCT6798D - hpwdt: several improvements - renesas_wdt: SPDX identifiers, stop when unregistering, support for R7S9210 - rza_wdt: SPDX identifiers, support longer timeouts - core: fix null pointer dereference when releasing cdev - iTCO_wdt: Drop option vendorsupport=2 - sama5d4: fix timeout-sec usage - lantiq_wdt: convert to watchdog framework - several small fixes * tag 'linux-watchdog-4.20-rc1' of git://www.linux-watchdog.org/linux-watchdog: (30 commits) watchdog: ts4800: release syscon device node in ts4800_wdt_probe() watchdog: armada_37xx_wdt: use do_div for u64 division documentation: watchdog: add documentation for armada-37xx-wdt dt-bindings: watchdog: Document armada-37xx-wdt binding watchdog: Add support for Armada 37xx CPU watchdog dt-bindings: watchdog: add mpc8xxx-wdt support watchdog: mpc8xxx: provide boot status MAINTAINERS: Fix file pattern for MEN Z069 watchdog driver dt-bindings: watchdog: renesas-wdt: Add support for R7S9210 watchdog: rza_wdt: Support longer timeouts watchdog: hpwdt: Disable PreTimeout when Timeout is smaller watchdog: w83627hf_wdt: Support NCT6796D, NCT6797D, NCT6798D watchdog: mpc8xxx: use dev_xxxx() instead of pr_xxxx() watchdog: lantiq: add get_timeleft callback watchdog: lantiq: Convert to watchdog_device watchdog: lantiq: update register names to better match spec watchdog: sama5d4: fix timeout-sec usage watchdog: fix a small number of "watchog" typos in comments watchdog: rza_wdt: convert to SPDX identifiers watchdog: iTCO_wdt: Remove unused hooks ... commit ed3f4e239834317934cc73a187e27e44b217056b Merge: c7b7eefa57ae cacd9759eea2 Author: Linus Torvalds Date: Sat Oct 27 10:20:39 2018 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: "Just random driver fixups, nothing exiting" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: synaptics - avoid using uninitialized variable when probing Input: xen-kbdfront - mark expected switch fall-through Input: atmel_mxt_ts - mark expected switch fall-through Input: cyapa - mark expected switch fall-throughs Input: wm97xx-ts - fix exit path Input: of_touchscreen - add support for touchscreen-min-x|y Input: Fix DIR-685 touchkeys MAINTAINERS entry Input: elants_i2c - use DMA safe i2c when possible Input: silead - try firmware reload after unsuccessful resume Input: st1232 - set INPUT_PROP_DIRECT property Input: xilinx_ps2 - convert to using %pOFn instead of device_node.name Input: atmel_mxt_ts - fix multiple includes Input: sun4i-lradc - convert to using %pOFn instead of device_node.name Input: pwm-vibrator - correct pwms in DT binding example commit c7b7eefa57ae3c8802fdec7d07ac4df6c49d1e7a Merge: e55854534989 3822d1bb0df1 Author: Linus Torvalds Date: Sat Oct 27 09:24:24 2018 -0700 Merge tag 'rtc-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "This cycle, there were mostly non urgent fixes in drivers. I also finally unexported the non managed registration. Subsystem: - non devm managed registration is now removed from the driver API - all the unnecessary rtc_valid_tm() calls have been removed Drivers: - abx80X: watchdog support - cmos: fix non ACPI support - sc27xx: fix alarm support - Remove a possible sysfs race condition for ab8500, ds1307, ds1685, isl1208 - Fix a possible race condition where an irq handler may be called before the rtc_device struct is allocated for mt6397, pl030, menelaus, armada38x" * tag 'rtc-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (54 commits) rtc: sc27xx: Always read normal alarm when registering RTC device rtc: sc27xx: Add check to see if need to enable the alarm interrupt rtc: sc27xx: Remove interrupts disable and clear in probe() rtc: sc27xx: Clear SPG value update interrupt status rtc: sc27xx: Set wakeup capability before registering rtc device rtc: s35390a: Change buf's type to u8 in s35390a_init rtc: ds1307: fix ds1339 wakealarm support rtc: ds1685: simplify getting .driver_data rtc: m41t80: mark expected switch fall-through rtc: tegra: Propagate errors from platform_get_irq() rtc: cmos: Remove the `use_acpi_alarm' module parameter for !ACPI rtc: cmos: Fix non-ACPI undefined reference to `hpet_rtc_interrupt' rtc: mv: let the core handle invalid alarms rtc: vr41xx: switch to rtc_time64_to_tm/rtc_tm_to_time64 rtc: ab8500: remove useless check rtc: ab8500: let the core handle range rtc: ab8500: use rtc_add_group rtc: rs5c348: report error when time is invalid rtc: rs5c348: remove forward declaration rtc: rs5c348: remove useless label ... commit e5585453498907080c456ec5b51131867ed6d095 Merge: b59dfdaef173 72b8ad40e143 Author: Linus Torvalds Date: Sat Oct 27 09:20:42 2018 -0700 Merge tag 'led-fix-for-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds Pull LED fix from Jacek Anaszewski. * tag 'led-fix-for-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds: leds: gpio: set led_dat->gpiod pointer for OF defined GPIO leds commit b59dfdaef173677b0b7e10f375226c0a1114fd20 Author: Linus Torvalds Date: Sat Oct 27 09:10:48 2018 -0700 i2c-hid: properly terminate i2c_hid_dmi_desc_override_table[] array Commit 9ee3e06610fd ("HID: i2c-hid: override HID descriptors for certain devices") added a new dmi_system_id quirk table to override certain HID report descriptors for some systems that lack them. But the table wasn't properly terminated, causing the dmi matching to walk off into la-la-land, and starting to treat random data as dmi descriptor pointers, causing boot-time oopses if you were at all unlucky. Terminate the array. We really should have some way to just statically check that arrays that should be terminated by an empty entry actually are so. But the HID people really should have caught this themselves, rather than have me deal with an oops during the merge window. Tssk, tssk. Cc: Julian Sax Cc: Benjamin Tissoires Cc: Jiri Kosina Signed-off-by: Linus Torvalds commit a2acce536921bd793bae13fa344fcea157638e72 Author: Steven Rostedt (VMware) Date: Mon Oct 15 23:14:28 2018 -0400 tracing: Have stack tracer trace full stack The stack tracer traces every function call checking the current stack (in non interrupt context), looking for the deepest stack, and saving it when it finds a new max depth. The problem is that it calls save_stack_trace(), and with the new ORC unwinder, it can skip too much. As it looks at the ip of the function call in the backtrace to find where it should start, it doesn't need to skip anything. The stack trace selftest would fail when the kernel was complied with the ORC UNDWINDER enabled. Without skipping functions when doing the stack trace, it now passes again. Signed-off-by: Steven Rostedt (VMware) commit da387e5c930f43d9f3b011a6fbb33bdf43d9714c Author: Nikolay Borisov Date: Wed Oct 17 09:51:43 2018 +0300 tracing: Export trace_dump_stack to modules There is no reason for this function to be unexprted and it's a useful debugging aid. Link: http://lkml.kernel.org/r/1539759103-5923-1-git-send-email-nborisov@suse.com Signed-off-by: Nikolay Borisov Signed-off-by: Steven Rostedt (VMware) commit aedef16a63d5d330afde4fcb54e0e73980e4a116 Author: Takashi Sakamoto Date: Sat Oct 27 17:13:31 2018 +0900 ALSA: dice: fix to wait for releases of all ALSA character devices In a development period for Linux kernel v4.20, drivers in ALSA firewire stack were changed to wait for releases of all ALSA character devices at .remove callback of bus driver. However, ALSA dice driver is partly out of this change. This bug can bring fault to user process which holds the last of character device in unplugging. This commit fixes the driver to wait in the callback. Fixes: 61ccc6f6b27c ('ALSA: firewire: block .remove callback of bus driver till all of ALSA character devices are released') Signed-off-by: Takashi Sakamoto Signed-off-by: Takashi Iwai commit 6788fac82001ed1944b5da976bcec4a7b9accf51 Merge: 345671ea0f92 d8fd9e106fbc Author: David S. Miller Date: Fri Oct 26 21:41:49 2018 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2018-10-27 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) Fix toctou race in BTF header validation, from Martin and Wenwen. 2) Fix devmap interface comparison in notifier call which was neglecting netns, from Taehee. 3) Several fixes in various places, for example, correcting direct packet access and helper function availability, from Daniel. 4) Fix BPF kselftest config fragment to include af_xdp and sockmap, from Naresh. ==================== Signed-off-by: David S. Miller commit 345671ea0f9258f410eb057b9ced9cefbbe5dc78 Merge: 4904008165c8 22146c3ce989 Author: Linus Torvalds Date: Fri Oct 26 19:33:41 2018 -0700 Merge branch 'akpm' (patches from Andrew) Merge updates from Andrew Morton: - a few misc things - ocfs2 updates - most of MM * emailed patches from Andrew Morton : (132 commits) hugetlbfs: dirty pages as they are added to pagecache mm: export add_swap_extent() mm: split SWP_FILE into SWP_ACTIVATED and SWP_FS tools/testing/selftests/vm/map_fixed_noreplace.c: add test for MAP_FIXED_NOREPLACE mm: thp: relocate flush_cache_range() in migrate_misplaced_transhuge_page() mm: thp: fix mmu_notifier in migrate_misplaced_transhuge_page() mm: thp: fix MADV_DONTNEED vs migrate_misplaced_transhuge_page race condition mm/kasan/quarantine.c: make quarantine_lock a raw_spinlock_t mm/gup: cache dev_pagemap while pinning pages Revert "x86/e820: put !E820_TYPE_RAM regions into memblock.reserved" mm: return zero_resv_unavail optimization mm: zero remaining unavailable struct pages tools/testing/selftests/vm/gup_benchmark.c: add MAP_HUGETLB option tools/testing/selftests/vm/gup_benchmark.c: add MAP_SHARED option tools/testing/selftests/vm/gup_benchmark.c: allow user specified file tools/testing/selftests/vm/gup_benchmark.c: fix 'write' flag usage mm/gup_benchmark.c: add additional pinning methods mm/gup_benchmark.c: time put_page() mm: don't raise MEMCG_OOM event due to failed high-order allocation mm/page-writeback.c: fix range_cyclic writeback vs writepages deadlock ... commit 4904008165c8a1c48602b8316139691b8c735e6e Merge: a45dcff7489f aab456dfa404 Author: Linus Torvalds Date: Fri Oct 26 19:25:07 2018 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: "What better way to start off a weekend than with some networking bug fixes: 1) net namespace leak in dump filtering code of ipv4 and ipv6, fixed by David Ahern and Bjørn Mork. 2) Handle bad checksums from hardware when using CHECKSUM_COMPLETE properly in UDP, from Sean Tranchetti. 3) Remove TCA_OPTIONS from policy validation, it turns out we don't consistently use nested attributes for this across all packet schedulers. From David Ahern. 4) Fix SKB corruption in cadence driver, from Tristram Ha. 5) Fix broken WoL handling in r8169 driver, from Heiner Kallweit. 6) Fix OOPS in pneigh_dump_table(), from Eric Dumazet" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (28 commits) net/neigh: fix NULL deref in pneigh_dump_table() net: allow traceroute with a specified interface in a vrf bridge: do not add port to router list when receives query with source 0.0.0.0 net/smc: fix smc_buf_unuse to use the lgr pointer ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are called net/{ipv4,ipv6}: Do not put target net if input nsid is invalid lan743x: Remove SPI dependency from Microchip group. drivers: net: remove inclusion when not needed net: phy: genphy_10g_driver: Avoid NULL pointer dereference r8169: fix broken Wake-on-LAN from S5 (poweroff) octeontx2-af: Use GFP_ATOMIC under spin lock net: ethernet: cadence: fix socket buffer corruption problem net/ipv6: Allow onlink routes to have a device mismatch if it is the default route net: sched: Remove TCA_OPTIONS from policy ice: Poll for link status change ice: Allocate VF interrupts and set queue map ice: Introduce ice_dev_onetime_setup net: hns3: Fix for warning uninitialized symbol hw_err_lst3 octeontx2-af: Copy the right amount of memory net: udp: fix handling of CHECKSUM_COMPLETE packets ... commit a45dcff7489f7cb21a3a8e967a90ea41b31c1559 Merge: cc10ad25bbca 6c2fc9cddc1f Author: Linus Torvalds Date: Fri Oct 26 17:15:49 2018 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc Pull sparc fixes from David Miller: "Some more sparc fixups, mostly aimed at getting the allmodconfig build up and clean again" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: sparc64: Rework xchg() definition to avoid warnings. sparc64: Export __node_distance. sparc64: Make corrupted user stacks more debuggable. commit 22146c3ce98962436e401f7b7016a6f664c9ffb5 Author: Mike Kravetz Date: Fri Oct 26 15:10:58 2018 -0700 hugetlbfs: dirty pages as they are added to pagecache Some test systems were experiencing negative huge page reserve counts and incorrect file block counts. This was traced to /proc/sys/vm/drop_caches removing clean pages from hugetlbfs file pagecaches. When non-hugetlbfs explicit code removes the pages, the appropriate accounting is not performed. This can be recreated as follows: fallocate -l 2M /dev/hugepages/foo echo 1 > /proc/sys/vm/drop_caches fallocate -l 2M /dev/hugepages/foo grep -i huge /proc/meminfo AnonHugePages: 0 kB ShmemHugePages: 0 kB HugePages_Total: 2048 HugePages_Free: 2047 HugePages_Rsvd: 18446744073709551615 HugePages_Surp: 0 Hugepagesize: 2048 kB Hugetlb: 4194304 kB ls -lsh /dev/hugepages/foo 4.0M -rw-r--r--. 1 root root 2.0M Oct 17 20:05 /dev/hugepages/foo To address this issue, dirty pages as they are added to pagecache. This can easily be reproduced with fallocate as shown above. Read faulted pages will eventually end up being marked dirty. But there is a window where they are clean and could be impacted by code such as drop_caches. So, just dirty them all as they are added to the pagecache. Link: http://lkml.kernel.org/r/b5be45b8-5afe-56cd-9482-28384699a049@oracle.com Fixes: 6bda666a03f0 ("hugepages: fold find_or_alloc_pages into huge_no_page()") Signed-off-by: Mike Kravetz Acked-by: Mihcla Hocko Reviewed-by: Khalid Aziz Cc: Hugh Dickins Cc: Naoya Horiguchi Cc: "Aneesh Kumar K . V" Cc: Andrea Arcangeli Cc: "Kirill A . Shutemov" Cc: Davidlohr Bueso Cc: Alexander Viro Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aa8aa8a331d27fcef3e60dabb918eb8c5c9a2ad9 Author: Omar Sandoval Date: Fri Oct 26 15:10:55 2018 -0700 mm: export add_swap_extent() Btrfs currently does not support swap files because swap's use of bmap does not work with copy-on-write and multiple devices. See 35054394c4b3 ("Btrfs: stop providing a bmap operation to avoid swapfile corruptions"). However, the swap code has a mechanism for the filesystem to manually add swap extents using add_swap_extent() from the ->swap_activate() aop. iomap has done this since 67482129cdab ("iomap: add a swapfile activation function"). Btrfs will do the same in a later patch, so export add_swap_extent(). Link: http://lkml.kernel.org/r/bb1208575e02829aae51b538709476964f97b1ea.1536704650.git.osandov@fb.com Signed-off-by: Omar Sandoval Reviewed-by: Andrew Morton Cc: David Sterba Cc: Johannes Weiner Cc: Nikolay Borisov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bc4ae27d817a4e92071ef67cb6368120cfabe7ec Author: Omar Sandoval Date: Fri Oct 26 15:10:51 2018 -0700 mm: split SWP_FILE into SWP_ACTIVATED and SWP_FS The SWP_FILE flag serves two purposes: to make swap_{read,write}page() go through the filesystem, and to make swapoff() call ->swap_deactivate(). For Btrfs, we want the latter but not the former, so split this flag into two. This makes us always call ->swap_deactivate() if ->swap_activate() succeeded, not just if it didn't add any swap extents itself. This also resolves the issue of the very misleading name of SWP_FILE, which is only used for swap files over NFS. Link: http://lkml.kernel.org/r/6d63d8668c4287a4f6d203d65696e96f80abdfc7.1536704650.git.osandov@fb.com Signed-off-by: Omar Sandoval Reviewed-by: Nikolay Borisov Reviewed-by: Andrew Morton Cc: Johannes Weiner Cc: David Sterba Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 91cbacc34512e37c9bb89125ca4b224ca6459245 Author: Michael Ellerman Date: Fri Oct 26 15:10:48 2018 -0700 tools/testing/selftests/vm/map_fixed_noreplace.c: add test for MAP_FIXED_NOREPLACE Add a test for MAP_FIXED_NOREPLACE, based on some code originally by Jann Horn. This would have caught the overlap bug reported by Daniel Micay. I originally suggested to Michal that we create MAP_FIXED_NOREPLACE, but instead of writing a selftest I spent my time bike-shedding whether it should be called MAP_FIXED_SAFE/NOCLOBBER/WEAK/NEW .. mea culpa. Link: http://lkml.kernel.org/r/20181013133929.28653-1-mpe@ellerman.id.au Signed-off-by: Michael Ellerman Reviewed-by: Kees Cook Reviewed-by: Khalid Aziz Acked-by: Michal Hocko Cc: Jann Horn Cc: Andrea Arcangeli Cc: Florian Weimer Cc: John Hubbard Cc: Matthew Wilcox Cc: Abdul Haleem Cc: Joel Stanley Cc: Jason Evans Cc: David Goldblatt Cc: Daniel Micay Cc: Shuah Khan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7eef5f97c1f94c7b72520b42d372037e97a81b95 Author: Andrea Arcangeli Date: Fri Oct 26 15:10:43 2018 -0700 mm: thp: relocate flush_cache_range() in migrate_misplaced_transhuge_page() There should be no cache left by the time we overwrite the old transhuge pmd with the new one. It's already too late to flush through the virtual address because we already copied the page data to the new physical address. So flush the cache before the data copy. Also delete the "end" variable to shutoff a "unused variable" warning on x86 where flush_cache_range() is a noop. Link: http://lkml.kernel.org/r/20181015202311.7209-1-aarcange@redhat.com Signed-off-by: Andrea Arcangeli Acked-by: Kirill A. Shutemov Cc: Aaron Tomlin Cc: Jerome Glisse Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7066f0f933a1fd707bb38781866657769cff7efc Author: Andrea Arcangeli Date: Fri Oct 26 15:10:40 2018 -0700 mm: thp: fix mmu_notifier in migrate_misplaced_transhuge_page() change_huge_pmd() after arming the numa/protnone pmd doesn't flush the TLB right away. do_huge_pmd_numa_page() flushes the TLB before calling migrate_misplaced_transhuge_page(). By the time do_huge_pmd_numa_page() runs some CPU could still access the page through the TLB. change_huge_pmd() before arming the numa/protnone transhuge pmd calls mmu_notifier_invalidate_range_start(). So there's no need of mmu_notifier_invalidate_range_start()/mmu_notifier_invalidate_range_only_end() sequence in migrate_misplaced_transhuge_page() too, because by the time migrate_misplaced_transhuge_page() runs, the pmd mapping has already been invalidated in the secondary MMUs. It has to or if a secondary MMU can still write to the page, the migrate_page_copy() would lose data. However an explicit mmu_notifier_invalidate_range() is needed before migrate_misplaced_transhuge_page() starts copying the data of the transhuge page or the below can happen for MMU notifier users sharing the primary MMU pagetables and only implementing ->invalidate_range: CPU0 CPU1 GPU sharing linux pagetables using only ->invalidate_range ----------- ------------ --------- GPU secondary MMU writes to the page mapped by the transhuge pmd change_pmd_range() mmu..._range_start() ->invalidate_range_start() noop change_huge_pmd() set_pmd_at(numa/protnone) pmd_unlock() do_huge_pmd_numa_page() CPU TLB flush globally (1) CPU cannot write to page migrate_misplaced_transhuge_page() GPU writes to the page... migrate_page_copy() ...GPU stops writing to the page CPU TLB flush (2) mmu..._range_end() (3) ->invalidate_range_stop() noop ->invalidate_range() GPU secondary MMU is invalidated and cannot write to the page anymore (too late) Just like we need a CPU TLB flush (1) because the TLB flush (2) arrives too late, we also need a mmu_notifier_invalidate_range() before calling migrate_misplaced_transhuge_page(), because the ->invalidate_range() in (3) also arrives too late. This requirement is the result of the lazy optimization in change_huge_pmd() that releases the pmd_lock without first flushing the TLB and without first calling mmu_notifier_invalidate_range(). Even converting the removed mmu_notifier_invalidate_range_only_end() into a mmu_notifier_invalidate_range_end() would not have been enough to fix this, because it run after migrate_page_copy(). After the hugepage data copy is done migrate_misplaced_transhuge_page() can proceed and call set_pmd_at without having to flush the TLB nor any secondary MMUs because the secondary MMU invalidate, just like the CPU TLB flush, has to happen before the migrate_page_copy() is called or it would be a bug in the first place (and it was for drivers using ->invalidate_range()). KVM is unaffected because it doesn't implement ->invalidate_range(). The standard PAGE_SIZEd migrate_misplaced_page is less accelerated and uses the generic migrate_pages which transitions the pte from numa/protnone to a migration entry in try_to_unmap_one() and flushes TLBs and all mmu notifiers there before copying the page. Link: http://lkml.kernel.org/r/20181013002430.698-3-aarcange@redhat.com Signed-off-by: Andrea Arcangeli Acked-by: Mel Gorman Acked-by: Kirill A. Shutemov Reviewed-by: Aaron Tomlin Cc: Jerome Glisse Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d7c3393413fe7e7dc54498ea200ea94742d61e18 Author: Andrea Arcangeli Date: Fri Oct 26 15:10:36 2018 -0700 mm: thp: fix MADV_DONTNEED vs migrate_misplaced_transhuge_page race condition Patch series "migrate_misplaced_transhuge_page race conditions". Aaron found a new instance of the THP MADV_DONTNEED race against pmdp_clear_flush* variants, that was apparently left unfixed. While looking into the race found by Aaron, I may have found two more issues in migrate_misplaced_transhuge_page. These race conditions would not cause kernel instability, but they'd corrupt userland data or leave data non zero after MADV_DONTNEED. I did only minor testing, and I don't expect to be able to reproduce this (especially the lack of ->invalidate_range before migrate_page_copy, requires the latest iommu hardware or infiniband to reproduce). The last patch is noop for x86 and it needs further review from maintainers of archs that implement flush_cache_range() (not in CC yet). To avoid confusion, it's not the first patch that introduces the bug fixed in the second patch, even before removing the pmdp_huge_clear_flush_notify, that _notify suffix was called after migrate_page_copy already run. This patch (of 3): This is a corollary of ced108037c2aa ("thp: fix MADV_DONTNEED vs. numa balancing race"), 58ceeb6bec8 ("thp: fix MADV_DONTNEED vs. MADV_FREE race") and 5b7abeae3af8c ("thp: fix MADV_DONTNEED vs clear soft dirty race). When the above three fixes where posted Dave asked https://lkml.kernel.org/r/929b3844-aec2-0111-fef7-8002f9d4e2b9@intel.com but apparently this was missed. The pmdp_clear_flush* in migrate_misplaced_transhuge_page() was introduced in a54a407fbf7 ("mm: Close races between THP migration and PMD numa clearing"). The important part of such commit is only the part where the page lock is not released until the first do_huge_pmd_numa_page() finished disarming the pagenuma/protnone. The addition of pmdp_clear_flush() wasn't beneficial to such commit and there's no commentary about such an addition either. I guess the pmdp_clear_flush() in such commit was added just in case for safety, but it ended up introducing the MADV_DONTNEED race condition found by Aaron. At that point in time nobody thought of such kind of MADV_DONTNEED race conditions yet (they were fixed later) so the code may have looked more robust by adding the pmdp_clear_flush(). This specific race condition won't destabilize the kernel, but it can confuse userland because after MADV_DONTNEED the memory won't be zeroed out. This also optimizes the code and removes a superfluous TLB flush. [akpm@linux-foundation.org: reflow comment to 80 cols, fix grammar and typo (beacuse)] Link: http://lkml.kernel.org/r/20181013002430.698-2-aarcange@redhat.com Signed-off-by: Andrea Arcangeli Reported-by: Aaron Tomlin Acked-by: Mel Gorman Acked-by: Kirill A. Shutemov Cc: Jerome Glisse Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 026d1eaf5ef1a5d6258b46e4e411cd9f5ab8c41d Author: Clark Williams Date: Fri Oct 26 15:10:32 2018 -0700 mm/kasan/quarantine.c: make quarantine_lock a raw_spinlock_t The static lock quarantine_lock is used in quarantine.c to protect the quarantine queue datastructures. It is taken inside quarantine queue manipulation routines (quarantine_put(), quarantine_reduce() and quarantine_remove_cache()), with IRQs disabled. This is not a problem on a stock kernel but is problematic on an RT kernel where spin locks are sleeping spinlocks, which can sleep and can not be acquired with disabled interrupts. Convert the quarantine_lock to a raw spinlock_t. The usage of quarantine_lock is confined to quarantine.c and the work performed while the lock is held is used for debug purpose. [bigeasy@linutronix.de: slightly altered the commit message] Link: http://lkml.kernel.org/r/20181010214945.5owshc3mlrh74z4b@linutronix.de Signed-off-by: Clark Williams Signed-off-by: Sebastian Andrzej Siewior Acked-by: Sebastian Andrzej Siewior Acked-by: Dmitry Vyukov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit df06b37ffe5a442503b7095b77b0a970df515459 Author: Keith Busch Date: Fri Oct 26 15:10:28 2018 -0700 mm/gup: cache dev_pagemap while pinning pages Getting pages from ZONE_DEVICE memory needs to check the backing device's live-ness, which is tracked in the device's dev_pagemap metadata. This metadata is stored in a radix tree and looking it up adds measurable software overhead. This patch avoids repeating this relatively costly operation when dev_pagemap is used by caching the last dev_pagemap while getting user pages. The gup_benchmark kernel self test reports this reduces time to get user pages to as low as 1/3 of the previous time. Link: http://lkml.kernel.org/r/20181012173040.15669-1-keith.busch@intel.com Signed-off-by: Keith Busch Reviewed-by: Dan Williams Acked-by: Kirill A. Shutemov Cc: Dave Hansen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9fd61bc95130d4971568b89c9548b5e0a4e18e0e Author: Masayoshi Mizuma Date: Fri Oct 26 15:10:24 2018 -0700 Revert "x86/e820: put !E820_TYPE_RAM regions into memblock.reserved" commit 124049decbb1 ("x86/e820: put !E820_TYPE_RAM regions into memblock.reserved") breaks movable_node kernel option because it changed the memory gap range to reserved memblock. So, the node is marked as Normal zone even if the SRAT has Hot pluggable affinity. ===================================================================== kernel: BIOS-e820: [mem 0x0000180000000000-0x0000180fffffffff] usable kernel: BIOS-e820: [mem 0x00001c0000000000-0x00001c0fffffffff] usable ... kernel: reserved[0x12]#011[0x0000181000000000-0x00001bffffffffff], 0x000003f000000000 bytes flags: 0x0 ... kernel: ACPI: SRAT: Node 2 PXM 6 [mem 0x180000000000-0x1bffffffffff] hotplug kernel: ACPI: SRAT: Node 3 PXM 7 [mem 0x1c0000000000-0x1fffffffffff] hotplug ... kernel: Movable zone start for each node kernel: Node 3: 0x00001c0000000000 kernel: Early memory node ranges ... ===================================================================== The original issue is fixed by the former patches, so let's revert commit 124049decbb1 ("x86/e820: put !E820_TYPE_RAM regions into memblock.reserved"). Link: http://lkml.kernel.org/r/20181002143821.5112-4-msys.mizuma@gmail.com Signed-off-by: Masayoshi Mizuma Reviewed-by: Pavel Tatashin Acked-by: Ingo Molnar Cc: Naoya Horiguchi Cc: Michal Hocko Cc: Thomas Gleixner Cc: Oscar Salvador Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ec393a0f014eaf688a3dbe8c8a4cbb52d7f535f9 Author: Pavel Tatashin Date: Fri Oct 26 15:10:21 2018 -0700 mm: return zero_resv_unavail optimization When checking for valid pfns in zero_resv_unavail(), it is not necessary to verify that pfns within pageblock_nr_pages ranges are valid, only the first one needs to be checked. This is because memory for pages are allocated in contiguous chunks that contain pageblock_nr_pages struct pages. Link: http://lkml.kernel.org/r/20181002143821.5112-3-msys.mizuma@gmail.com Signed-off-by: Pavel Tatashin Signed-off-by: Masayoshi Mizuma Reviewed-by: Masayoshi Mizuma Acked-by: Naoya Horiguchi Reviewed-by: Oscar Salvador Cc: Ingo Molnar Cc: Michal Hocko Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 907ec5fca3dc38d37737de826f06f25b063aa08e Author: Naoya Horiguchi Date: Fri Oct 26 15:10:15 2018 -0700 mm: zero remaining unavailable struct pages Patch series "mm: Fix for movable_node boot option", v3. This patch series contains a fix for the movable_node boot option issue which was introduced by commit 124049decbb1 ("x86/e820: put !E820_TYPE_RAM regions into memblock.reserved"). The commit breaks the option because it changed the memory gap range to reserved memblock. So, the node is marked as Normal zone even if the SRAT has Hot pluggable affinity. First and second patch fix the original issue which the commit tried to fix, then revert the commit. This patch (of 3): There is a kernel panic that is triggered when reading /proc/kpageflags on the kernel booted with kernel parameter 'memmap=nn[KMG]!ss[KMG]': BUG: unable to handle kernel paging request at fffffffffffffffe PGD 9b20e067 P4D 9b20e067 PUD 9b210067 PMD 0 Oops: 0000 [#1] SMP PTI CPU: 2 PID: 1728 Comm: page-types Not tainted 4.17.0-rc6-mm1-v4.17-rc6-180605-0816-00236-g2dfb086ef02c+ #160 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.fc28 04/01/2014 RIP: 0010:stable_page_flags+0x27/0x3c0 Code: 00 00 00 0f 1f 44 00 00 48 85 ff 0f 84 a0 03 00 00 41 54 55 49 89 fc 53 48 8b 57 08 48 8b 2f 48 8d 42 ff 83 e2 01 48 0f 44 c7 <48> 8b 00 f6 c4 01 0f 84 10 03 00 00 31 db 49 8b 54 24 08 4c 89 e7 RSP: 0018:ffffbbd44111fde0 EFLAGS: 00010202 RAX: fffffffffffffffe RBX: 00007fffffffeff9 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000202 RDI: ffffed1182fff5c0 RBP: ffffffffffffffff R08: 0000000000000001 R09: 0000000000000001 R10: ffffbbd44111fed8 R11: 0000000000000000 R12: ffffed1182fff5c0 R13: 00000000000bffd7 R14: 0000000002fff5c0 R15: ffffbbd44111ff10 FS: 00007efc4335a500(0000) GS:ffff93a5bfc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffffffffffffe CR3: 00000000b2a58000 CR4: 00000000001406e0 Call Trace: kpageflags_read+0xc7/0x120 proc_reg_read+0x3c/0x60 __vfs_read+0x36/0x170 vfs_read+0x89/0x130 ksys_pread64+0x71/0x90 do_syscall_64+0x5b/0x160 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7efc42e75e23 Code: 09 00 ba 9f 01 00 00 e8 ab 81 f4 ff 66 2e 0f 1f 84 00 00 00 00 00 90 83 3d 29 0a 2d 00 00 75 13 49 89 ca b8 11 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 34 c3 48 83 ec 08 e8 db d3 01 00 48 89 04 24 According to kernel bisection, this problem became visible due to commit f7f99100d8d9 which changes how struct pages are initialized. Memblock layout affects the pfn ranges covered by node/zone. Consider that we have a VM with 2 NUMA nodes and each node has 4GB memory, and the default (no memmap= given) memblock layout is like below: MEMBLOCK configuration: memory size = 0x00000001fff75c00 reserved size = 0x000000000300c000 memory.cnt = 0x4 memory[0x0] [0x0000000000001000-0x000000000009efff], 0x000000000009e000 bytes on node 0 flags: 0x0 memory[0x1] [0x0000000000100000-0x00000000bffd6fff], 0x00000000bfed7000 bytes on node 0 flags: 0x0 memory[0x2] [0x0000000100000000-0x000000013fffffff], 0x0000000040000000 bytes on node 0 flags: 0x0 memory[0x3] [0x0000000140000000-0x000000023fffffff], 0x0000000100000000 bytes on node 1 flags: 0x0 ... If you give memmap=1G!4G (so it just covers memory[0x2]), the range [0x100000000-0x13fffffff] is gone: MEMBLOCK configuration: memory size = 0x00000001bff75c00 reserved size = 0x000000000300c000 memory.cnt = 0x3 memory[0x0] [0x0000000000001000-0x000000000009efff], 0x000000000009e000 bytes on node 0 flags: 0x0 memory[0x1] [0x0000000000100000-0x00000000bffd6fff], 0x00000000bfed7000 bytes on node 0 flags: 0x0 memory[0x2] [0x0000000140000000-0x000000023fffffff], 0x0000000100000000 bytes on node 1 flags: 0x0 ... This causes shrinking node 0's pfn range because it is calculated by the address range of memblock.memory. So some of struct pages in the gap range are left uninitialized. We have a function zero_resv_unavail() which does zeroing the struct pages outside memblock.memory, but currently it covers only the reserved unavailable range (i.e. memblock.memory && !memblock.reserved). This patch extends it to cover all unavailable range, which fixes the reported issue. Link: http://lkml.kernel.org/r/20181002143821.5112-2-msys.mizuma@gmail.com Fixes: f7f99100d8d9 ("mm: stop zeroing memory during allocation in vmemmap") Signed-off-by: Naoya Horiguchi Signed-off-by-by: Masayoshi Mizuma Tested-by: Oscar Salvador Tested-by: Masayoshi Mizuma Reviewed-by: Pavel Tatashin Cc: Ingo Molnar Cc: Michal Hocko Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3821b76c3cdb5f2c5ef1b082de79829e8ff50a7d Author: Keith Busch Date: Fri Oct 26 15:10:12 2018 -0700 tools/testing/selftests/vm/gup_benchmark.c: add MAP_HUGETLB option Add a new option '-H' to the gup benchmark to help understand how hugetlb mapping pages compare with the default. Link: http://lkml.kernel.org/r/20181010195605.10689-6-keith.busch@intel.com Signed-off-by: Keith Busch Reviewed-by: Andrew Morton Cc: Kirill Shutemov Cc: Dave Hansen Cc: Dan Williams Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0dd8666afb99c71d124e0c2abf1ad7d934a242a0 Author: Keith Busch Date: Fri Oct 26 15:10:08 2018 -0700 tools/testing/selftests/vm/gup_benchmark.c: add MAP_SHARED option Add a new benchmark option, -S, to request MAP_SHARED. This can be used to compare with MAP_PRIVATE, or for files that require this option, like dax. Link: http://lkml.kernel.org/r/20181010195605.10689-5-keith.busch@intel.com Signed-off-by: Keith Busch Reviewed-by: Andrew Morton Cc: Kirill Shutemov Cc: Dave Hansen Cc: Dan Williams Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aeb85ed4f41a8c0f5c4606d69f5da75e2348d984 Author: Keith Busch Date: Fri Oct 26 15:10:02 2018 -0700 tools/testing/selftests/vm/gup_benchmark.c: allow user specified file Allow a user to specify a file to map by adding a new option, '-f', providing a means to test various file backings. If not specified, the benchmark will use a private mapping of /dev/zero, which produces an anonymous mapping as before. [akpm@linux-foundation.org: avoid using comma operator] Link: http://lkml.kernel.org/r/20181010195605.10689-4-keith.busch@intel.com Signed-off-by: Keith Busch Reviewed-by: Andrew Morton Cc: Kirill Shutemov Cc: Dave Hansen Cc: Dan Williams Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 319e0bec1aecb36c5ac6d23812af487ff2c8f47f Author: Keith Busch Date: Fri Oct 26 15:09:59 2018 -0700 tools/testing/selftests/vm/gup_benchmark.c: fix 'write' flag usage If the '-w' parameter was provided, the benchmark would exit due to a mssing 'break'. Link: http://lkml.kernel.org/r/20181010195605.10689-3-keith.busch@intel.com Signed-off-by: Keith Busch Acked-by: Kirill A. Shutemov Reviewed-by: Andrew Morton Cc: Dave Hansen Cc: Dan Williams Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 714a3a1ebafe6e23af55a5c694c308f4044a7e00 Author: Keith Busch Date: Fri Oct 26 15:09:56 2018 -0700 mm/gup_benchmark.c: add additional pinning methods Provide new gup benchmark ioctl commands to run different user page pinning methods, get_user_pages_longterm() and get_user_pages(), in addition to the existing get_user_pages_fast(). Link: http://lkml.kernel.org/r/20181010195605.10689-2-keith.busch@intel.com Signed-off-by: Keith Busch Acked-by: Kirill A. Shutemov Reviewed-by: Andrew Morton Cc: Dave Hansen Cc: Dan Williams Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 26db3d09d9e1963c9db77cb275bd2d36e56ef57a Author: Keith Busch Date: Fri Oct 26 15:09:52 2018 -0700 mm/gup_benchmark.c: time put_page() We'd like to measure time to unpin user pages, so this adds a second benchmark timer on put_page, separate from get_page. Adding the field breaks this ioctl ABI, but should be okay since this an in-tree kernel selftest. [akpm@linux-foundation.org: add expansion to struct gup_benchmark for future use] Link: http://lkml.kernel.org/r/20181010195605.10689-1-keith.busch@intel.com Signed-off-by: Keith Busch Acked-by: Kirill A. Shutemov Reviewed-by: Andrew Morton Cc: Dave Hansen Cc: Dan Williams Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7a1adfddaf0d11a39fdcaf6e82a88e9c0586e08b Author: Roman Gushchin Date: Fri Oct 26 15:09:48 2018 -0700 mm: don't raise MEMCG_OOM event due to failed high-order allocation It was reported that on some of our machines containers were restarted with OOM symptoms without an obvious reason. Despite there were almost no memory pressure and plenty of page cache, MEMCG_OOM event was raised occasionally, causing the container management software to think, that OOM has happened. However, no tasks have been killed. The following investigation showed that the problem is caused by a failing attempt to charge a high-order page. In such case, the OOM killer is never invoked. As shown below, it can happen under conditions, which are very far from a real OOM: e.g. there is plenty of clean page cache and no memory pressure. There is no sense in raising an OOM event in this case, as it might confuse a user and lead to wrong and excessive actions (e.g. restart the workload, as in my case). Let's look at the charging path in try_charge(). If the memory usage is about memory.max, which is absolutely natural for most memory cgroups, we try to reclaim some pages. Even if we were able to reclaim enough memory for the allocation, the following check can fail due to a race with another concurrent allocation: if (mem_cgroup_margin(mem_over_limit) >= nr_pages) goto retry; For regular pages the following condition will save us from triggering the OOM: if (nr_reclaimed && nr_pages <= (1 << PAGE_ALLOC_COSTLY_ORDER)) goto retry; But for high-order allocation this condition will intentionally fail. The reason behind is that we'll likely fall to regular pages anyway, so it's ok and even preferred to return ENOMEM. In this case the idea of raising MEMCG_OOM looks dubious. Fix this by moving MEMCG_OOM raising to mem_cgroup_oom() after allocation order check, so that the event won't be raised for high order allocations. This change doesn't affect regular pages allocation and charging. Link: http://lkml.kernel.org/r/20181004214050.7417-1-guro@fb.com Signed-off-by: Roman Gushchin Acked-by: David Rientjes Acked-by: Michal Hocko Acked-by: Johannes Weiner Cc: Vladimir Davydov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 64081362e8ff4587b4554087f3cfc73d3e0a4cd7 Author: Dave Chinner Date: Fri Oct 26 15:09:45 2018 -0700 mm/page-writeback.c: fix range_cyclic writeback vs writepages deadlock We've recently seen a workload on XFS filesystems with a repeatable deadlock between background writeback and a multi-process application doing concurrent writes and fsyncs to a small range of a file. range_cyclic writeback Process 1 Process 2 xfs_vm_writepages write_cache_pages writeback_index = 2 cycled = 0 .... find page 2 dirty lock Page 2 ->writepage page 2 writeback page 2 clean page 2 added to bio no more pages write() locks page 1 dirties page 1 locks page 2 dirties page 1 fsync() .... xfs_vm_writepages write_cache_pages start index 0 find page 1 towrite lock Page 1 ->writepage page 1 writeback page 1 clean page 1 added to bio find page 2 towrite lock Page 2 page 2 is writeback write() locks page 1 dirties page 1 fsync() .... xfs_vm_writepages write_cache_pages start index 0 !done && !cycled sets index to 0, restarts lookup find page 1 dirty find page 1 towrite lock Page 1 page 1 is writeback lock Page 1 DEADLOCK because: - process 1 needs page 2 writeback to complete to make enough progress to issue IO pending for page 1 - writeback needs page 1 writeback to complete so process 2 can progress and unlock the page it is blocked on, then it can issue the IO pending for page 2 - process 2 can't make progress until process 1 issues IO for page 1 The underlying cause of the problem here is that range_cyclic writeback is processing pages in descending index order as we hold higher index pages in a structure controlled from above write_cache_pages(). The write_cache_pages() caller needs to be able to submit these pages for IO before write_cache_pages restarts writeback at mapping index 0 to avoid wcp inverting the page lock/writeback wait order. generic_writepages() is not susceptible to this bug as it has no private context held across write_cache_pages() - filesystems using this infrastructure always submit pages in ->writepage immediately and so there is no problem with range_cyclic going back to mapping index 0. However: mpage_writepages() has a private bio context, exofs_writepages() has page_collect fuse_writepages() has fuse_fill_wb_data nfs_writepages() has nfs_pageio_descriptor xfs_vm_writepages() has xfs_writepage_ctx All of these ->writepages implementations can hold pages under writeback in their private structures until write_cache_pages() returns, and hence they are all susceptible to this deadlock. Also worth noting is that ext4 has it's own bastardised version of write_cache_pages() and so it /may/ have an equivalent deadlock. I looked at the code long enough to understand that it has a similar retry loop for range_cyclic writeback reaching the end of the file and then promptly ran away before my eyes bled too much. I'll leave it for the ext4 developers to determine if their code is actually has this deadlock and how to fix it if it has. There's a few ways I can see avoid this deadlock. There's probably more, but these are the first I've though of: 1. get rid of range_cyclic altogether 2. range_cyclic always stops at EOF, and we start again from writeback index 0 on the next call into write_cache_pages() 2a. wcp also returns EAGAIN to ->writepages implementations to indicate range cyclic has hit EOF. writepages implementations can then flush the current context and call wpc again to continue. i.e. lift the retry into the ->writepages implementation 3. range_cyclic uses trylock_page() rather than lock_page(), and it skips pages it can't lock without blocking. It will already do this for pages under writeback, so this seems like a no-brainer 3a. all non-WB_SYNC_ALL writeback uses trylock_page() to avoid blocking as per pages under writeback. I don't think #1 is an option - range_cyclic prevents frequently dirtied lower file offset from starving background writeback of rarely touched higher file offsets. #2 is simple, and I don't think it will have any impact on performance as going back to the start of the file implies an immediate seek. We'll have exactly the same number of seeks if we switch writeback to another inode, and then come back to this one later and restart from index 0. #2a is pretty much "status quo without the deadlock". Moving the retry loop up into the wcp caller means we can issue IO on the pending pages before calling wcp again, and so avoid locking or waiting on pages in the wrong order. I'm not convinced we need to do this given that we get the same thing from #2 on the next writeback call from the writeback infrastructure. #3 is really just a band-aid - it doesn't fix the access/wait inversion problem, just prevents it from becoming a deadlock situation. I'd prefer we fix the inversion, not sweep it under the carpet like this. #3a is really an optimisation that just so happens to include the band-aid fix of #3. So it seems that the simplest way to fix this issue is to implement solution #2 Link: http://lkml.kernel.org/r/20181005054526.21507-1-david@fromorbit.com Signed-off-by: Dave Chinner Reviewed-by: Jan Kara Cc: Nicholas Piggin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a9a9e77fbf2784ae2694696eb772419c0a96159e Author: Pavel Tatashin Date: Fri Oct 26 15:09:40 2018 -0700 mm: move mirrored memory specific code outside of memmap_init_zone memmap_init_zone, is getting complex, because it is called from different contexts: hotplug, and during boot, and also because it must handle some architecture quirks. One of them is mirrored memory. Move the code that decides whether to skip mirrored memory outside of memmap_init_zone, into a separate function. [pasha.tatashin@oracle.com: uninline overlap_memmap_init()] Link: http://lkml.kernel.org/r/20180726193509.3326-4-pasha.tatashin@oracle.com Link: http://lkml.kernel.org/r/20180724235520.10200-4-pasha.tatashin@oracle.com Signed-off-by: Pavel Tatashin Reviewed-by: Oscar Salvador Cc: Pasha Tatashin Cc: Abdul Haleem Cc: Baoquan He Cc: Daniel Jordan Cc: Dan Williams Cc: Dave Hansen Cc: David Rientjes Cc: Greg Kroah-Hartman Cc: Ingo Molnar Cc: Jan Kara Cc: Jérôme Glisse Cc: Kirill A. Shutemov Cc: Michael Ellerman Cc: Michal Hocko Cc: Souptick Joarder Cc: Steven Sistare Cc: Vlastimil Babka Cc: Wei Yang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d3035be4ce2345d98633a45f93a74e526e94b802 Author: Pavel Tatashin Date: Fri Oct 26 15:09:37 2018 -0700 mm: calculate deferred pages after skipping mirrored memory update_defer_init() should be called only when struct page is about to be initialized. Because it counts number of initialized struct pages, but there we may skip struct pages if there is some mirrored memory. So move, update_defer_init() after checking for mirrored memory. Also, rename update_defer_init() to defer_init() and reverse the return boolean to emphasize that this is a boolean function, that tells that the reset of memmap initialization should be deferred. Make this function self-contained: do not pass number of already initialized pages in this zone by using static counters. I found this bug by reading the code. The effect is that fewer than expected struct pages are initialized early in boot, and it is possible that in some corner cases we may fail to boot when mirrored pages are used. The deferred on demand code should somewhat mitigate this. But this still brings some inconsistencies compared to when booting without mirrored pages, so it is better to fix. [pasha.tatashin@oracle.com: add comment about defer_init's lack of locking] Link: http://lkml.kernel.org/r/20180726193509.3326-3-pasha.tatashin@oracle.com [akpm@linux-foundation.org: make defer_init non-inline, __meminit] Link: http://lkml.kernel.org/r/20180724235520.10200-3-pasha.tatashin@oracle.com Signed-off-by: Pavel Tatashin Reviewed-by: Oscar Salvador Cc: Abdul Haleem Cc: Baoquan He Cc: Daniel Jordan Cc: Dan Williams Cc: Dave Hansen Cc: David Rientjes Cc: Greg Kroah-Hartman Cc: Ingo Molnar Cc: Jan Kara Cc: Jérôme Glisse Cc: Kirill A. Shutemov Cc: Michael Ellerman Cc: Michal Hocko Cc: Souptick Joarder Cc: Steven Sistare Cc: Vlastimil Babka Cc: Wei Yang Cc: Pasha Tatashin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dfb3ccd00a06d71171961022019bb0f210d2cdc1 Author: Pavel Tatashin Date: Fri Oct 26 15:09:32 2018 -0700 mm: make memmap_init a proper function memmap_init is sometimes a macro sometimes a function based on __HAVE_ARCH_MEMMAP_INIT. It is only a function on ia64. Make memmap_init a weak function instead, and let ia64 redefine it. Link: http://lkml.kernel.org/r/20180724235520.10200-2-pasha.tatashin@oracle.com Signed-off-by: Pavel Tatashin Reviewed-by: Andrew Morton Reviewed-by: Oscar Salvador Cc: Steven Sistare Cc: Daniel Jordan Cc: Kirill A. Shutemov Cc: Michal Hocko Cc: Dan Williams Cc: Jan Kara Cc: Jérôme Glisse Cc: Souptick Joarder Cc: Baoquan He Cc: Greg Kroah-Hartman Cc: Vlastimil Babka Cc: Wei Yang Cc: Dave Hansen Cc: David Rientjes Cc: Ingo Molnar Cc: Pavel Tatashin Cc: Abdul Haleem Cc: Michael Ellerman Cc: Pasha Tatashin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1c2d479a119b84feacbe4de782016f1bf1ad16dc Author: Kirill Tkhai Date: Fri Oct 26 15:09:28 2018 -0700 mm/memcontrol.c: convert mem_cgroup_id::ref to refcount_t type This will allow to use generic refcount_t interfaces to check counters overflow instead of currently existing VM_BUG_ON(). The only difference after the patch is VM_BUG_ON() may cause BUG(), while refcount_t fires with WARN(). But this seems not to be significant here, since such the problems are usually caught by syzbot with panic-on-warn enabled. Link: http://lkml.kernel.org/r/153910718919.7006.13400779039257185427.stgit@localhost.localdomain Signed-off-by: Kirill Tkhai Reviewed-by: Andrew Morton Acked-by: Michal Hocko Cc: Johannes Weiner Cc: Vladimir Davydov Cc: Andrea Parri Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4a222127f3631e6cdde228e3bb6b599f52b96d14 Author: David Rientjes Date: Fri Oct 26 15:09:24 2018 -0700 mm/page_alloc.c: initialize num_movable in move_freepages() If move_freepages_block() returns 0 because !zone_spans_pfn(), *num_movable can hold the value from the stack because it does not get initialized in move_freepages(). Move the initialization to move_freepages_block() to guarantee the value actually makes sense. This currently doesn't affect its only caller where num_movable != NULL, so no bug fix, but just more robust. Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1810051355490.212229@chino.kir.corp.google.com Signed-off-by: David Rientjes Reviewed-by: Andrew Morton Acked-by: Vlastimil Babka Cc: Greg Thelen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 61855f021c3ae2ccc244111e2a321690f9786aed Author: Gustavo A. R. Silva Date: Fri Oct 26 15:09:20 2018 -0700 mm/zsmalloc.c: fix fall-through annotation Replace "fallthru" with a proper "fall through" annotation. This fix is part of the ongoing efforts to enabling -Wimplicit-fallthrough Link: http://lkml.kernel.org/r/20181003105114.GA24423@embeddedor.com Signed-off-by: Gustavo A. R. Silva Reviewed-by: Sergey Senozhatsky Cc: Minchan Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7eaa8c969efa77127de9a05856eef9e5d22cf487 Author: Peter Xu Date: Fri Oct 26 15:09:17 2018 -0700 userfaultfd: selftest: recycle lock threads first Now we recycle the uffd servicing threads earlier than the lock threads. It might happen that when the lock thread is still blocked at a pthread mutex lock while the servicing thread has already quitted for the cpu so the lock thread will be blocked forever and hang the test program. To fix the possible race, recycle the lock threads first. This never happens with current missing-only tests, but when I start to run the write-protection tests (the feature is not yet posted upstream) it happens every time of the run possibly because in that new test we'll need to service two page faults for each lock operation. Link: http://lkml.kernel.org/r/20180930074259.18229-4-peterx@redhat.com Signed-off-by: Peter Xu Acked-by: Mike Rapoport Cc: Shuah Khan Cc: Mike Kravetz Cc: Jerome Glisse Cc: Zi Yan Cc: "Kirill A . Shutemov" Cc: Shaohua Li Cc: Andrea Arcangeli Cc: "Dr . David Alan Gilbert" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 04d877319e2aa3895cc7998adb32de0967d3927b Author: Peter Xu Date: Fri Oct 26 15:09:13 2018 -0700 userfaultfd: selftest: generalize read and poll We do very similar things in read and poll modes, but we're copying the codes around. Share the codes properly on reading the message and handling the page fault to make the code cleaner. Meanwhile this solves previous mismatch of behaviors between the two modes on that the old code: - did not check EAGAIN case in read() mode - ignored BOUNCE_VERIFY check in read() mode Link: http://lkml.kernel.org/r/20180930074259.18229-3-peterx@redhat.com Signed-off-by: Peter Xu Acked-by: Mike Rapoport Cc: Shuah Khan Cc: Mike Kravetz Cc: Jerome Glisse Cc: Zi Yan Cc: "Kirill A . Shutemov" Cc: Shaohua Li Cc: Andrea Arcangeli Cc: "Dr . David Alan Gilbert" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 439de0d7443789c688428429874b8e27f693c00e Author: Peter Xu Date: Fri Oct 26 15:09:09 2018 -0700 userfaultfd: selftest: cleanup help messages Firstly, the help in the comment region is obsolete, now we support three parameters. Since at it, change it and move it into the help message of the program. Also, the help messages dumped here and there is obsolete too. Use a single usage() helper. Link: http://lkml.kernel.org/r/20180930074259.18229-2-peterx@redhat.com Signed-off-by: Peter Xu Acked-by: Mike Rapoport Cc: Shuah Khan Cc: Mike Kravetz Cc: Jerome Glisse Cc: Zi Yan Cc: "Kirill A . Shutemov" Cc: Shaohua Li Cc: Andrea Arcangeli Cc: "Dr . David Alan Gilbert" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f0ecf25a093fc0589f0a6bc4c1ea068bbb67d220 Author: Jann Horn Date: Fri Oct 26 15:09:05 2018 -0700 mm/vmstat.c: assert that vmstat_text is in sync with stat_items_size Having two gigantic arrays that must manually be kept in sync, including ifdefs, isn't exactly robust. To make it easier to catch such issues in the future, add a BUILD_BUG_ON(). Link: http://lkml.kernel.org/r/20181001143138.95119-3-jannh@google.com Signed-off-by: Jann Horn Reviewed-by: Kees Cook Reviewed-by: Andrew Morton Acked-by: Roman Gushchin Acked-by: Michal Hocko Cc: Davidlohr Bueso Cc: Oleg Nesterov Cc: Christoph Lameter Cc: Kemi Wang Cc: Andy Lutomirski Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ff09d7ec9786be4ad7589aa987d7dc66e2dd9160 Author: Aneesh Kumar K.V Date: Fri Oct 26 15:09:01 2018 -0700 mm/memory.c: recheck page table entry with page table lock held We clear the pte temporarily during read/modify/write update of the pte. If we take a page fault while the pte is cleared, the application can get SIGBUS. One such case is with remap_pfn_range without a backing vm_ops->fault callback. do_fault will return SIGBUS in that case. cpu 0 cpu1 mprotect() ptep_modify_prot_start()/pte cleared. . . page fault. . . prep_modify_prot_commit() Fix this by taking page table lock and rechecking for pte_none. [aneesh.kumar@linux.ibm.com: fix crash observed with syzkaller run] Link: http://lkml.kernel.org/r/87va6bwlfg.fsf@linux.ibm.com Link: http://lkml.kernel.org/r/20180926031858.9692-1-aneesh.kumar@linux.ibm.com Signed-off-by: Aneesh Kumar K.V Acked-by: Kirill A. Shutemov Cc: Willem de Bruijn Cc: Eric Dumazet Cc: Ido Schimmel Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cc4b8c794f476076c9ce19f43eb4d98dc4b5e155 Author: Yang Shi Date: Fri Oct 26 15:08:57 2018 -0700 mm: dax: add comment for PFN_SPECIAL The comment for PFN_SPECIAL is missed in pfn_t.h. Add comment to get consistent with other pfn flags. Link: http://lkml.kernel.org/r/1538086549-100536-1-git-send-email-yang.shi@linux.alibaba.com Signed-off-by: Yang Shi Suggested-by: Dan Williams Reviewed-by: Dan Williams Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9bc8039e715da3b53dbac89525323a9f2f69b7b5 Author: Yang Shi Date: Fri Oct 26 15:08:54 2018 -0700 mm: brk: downgrade mmap_sem to read when shrinking brk might be used to shrink memory mapping too other than munmap(). So, it may hold write mmap_sem for long time when shrinking large mapping, as what commit ("mm: mmap: zap pages with read mmap_sem in munmap") described. The brk() will not manipulate vmas anymore after __do_munmap() call for the mapping shrink use case. But, it may set mm->brk after __do_munmap(), which needs hold write mmap_sem. However, a simple trick can workaround this by setting mm->brk before __do_munmap(). Then restore the original value if __do_munmap() fails. With this trick, it is safe to downgrade to read mmap_sem. So, the same optimization, which downgrades mmap_sem to read for zapping pages, is also feasible and reasonable to this case. The period of holding exclusive mmap_sem for shrinking large mapping would be reduced significantly with this optimization. [akpm@linux-foundation.org: tweak comment] [yang.shi@linux.alibaba.com: fix unsigned compare against 0 issue] Link: http://lkml.kernel.org/r/1538687672-17795-1-git-send-email-yang.shi@linux.alibaba.com Link: http://lkml.kernel.org/r/1538067582-60038-2-git-send-email-yang.shi@linux.alibaba.com Signed-off-by: Yang Shi Acked-by: Vlastimil Babka Acked-by: Kirill A. Shutemov Cc: Michal Hocko Cc: Matthew Wilcox Cc: Laurent Dufour Cc: Colin Ian King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 85a06835f6f1ba79f0f00838ccd5ad840dd1eafb Author: Yang Shi Date: Fri Oct 26 15:08:50 2018 -0700 mm: mremap: downgrade mmap_sem to read when shrinking Other than munmap, mremap might be used to shrink memory mapping too. So, it may hold write mmap_sem for long time when shrinking large mapping, as what commit ("mm: mmap: zap pages with read mmap_sem in munmap") described. The mremap() will not manipulate vmas anymore after __do_munmap() call for the mapping shrink use case, so it is safe to downgrade to read mmap_sem. So, the same optimization, which downgrades mmap_sem to read for zapping pages, is also feasible and reasonable to this case. The period of holding exclusive mmap_sem for shrinking large mapping would be reduced significantly with this optimization. MREMAP_FIXED and MREMAP_MAYMOVE are more complicated to adopt this optimization since they need manipulate vmas after do_munmap(), downgrading mmap_sem may create race window. Simple mapping shrink is the low hanging fruit, and it may cover the most cases of unmap with munmap together. [akpm@linux-foundation.org: tweak comment] [yang.shi@linux.alibaba.com: fix unsigned compare against 0 issue] Link: http://lkml.kernel.org/r/1538687672-17795-2-git-send-email-yang.shi@linux.alibaba.com Link: http://lkml.kernel.org/r/1538067582-60038-1-git-send-email-yang.shi@linux.alibaba.com Signed-off-by: Yang Shi Acked-by: Vlastimil Babka Acked-by: Kirill A. Shutemov Cc: Michal Hocko Cc: Matthew Wilcox Cc: Laurent Dufour Cc: Colin Ian King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3c0513243a4a07ebad2d59f3d972bef483818ec6 Author: Souptick Joarder Date: Fri Oct 26 15:08:47 2018 -0700 mm/filemap.c: use vmf_error() These codes can be replaced with new inline vmf_error(). Link: http://lkml.kernel.org/r/20180927171411.GA23331@jordon-HP-15-Notebook-PC Signed-off-by: Souptick Joarder Reviewed-by: Andrew Morton Reviewed-by: Jan Kara Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 544db7597ad0fd1ceebf656e2808a209d46ccd9e Author: Alexandre Ghiti Date: Fri Oct 26 15:08:43 2018 -0700 hugetlb: introduce generic version of huge_ptep_get ia64, mips, parisc, powerpc, sh, sparc, x86 architectures use the same version of huge_ptep_get, so move this generic implementation into asm-generic/hugetlb.h. [arnd@arndb.de: fix ARM 3level page tables] Link: http://lkml.kernel.org/r/20181005161722.904274-1-arnd@arndb.de Link: http://lkml.kernel.org/r/20180920060358.16606-12-alex@ghiti.fr Signed-off-by: Alexandre Ghiti Reviewed-by: Luiz Capitulino Reviewed-by: Mike Kravetz Tested-by: Helge Deller [parisc] Acked-by: Catalin Marinas [arm64] Acked-by: Paul Burton [MIPS] Acked-by: Ingo Molnar [x86] Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: David S. Miller Cc: Fenghua Yu Cc: Heiko Carstens Cc: H. Peter Anvin Cc: Ingo Molnar Cc: James E.J. Bottomley Cc: James Hogan Cc: Martin Schwidefsky Cc: Michael Ellerman Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Russell King Cc: Thomas Gleixner Cc: Tony Luck Cc: Will Deacon Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit facf6d5b8b6c4212519acfefbf3a0e0aeeb5b77e Author: Alexandre Ghiti Date: Fri Oct 26 15:08:39 2018 -0700 hugetlb: introduce generic version of huge_ptep_set_access_flags() arm, ia64, sh, x86 architectures use the same version of huge_ptep_set_access_flags, so move this generic implementation into asm-generic/hugetlb.h. Link: http://lkml.kernel.org/r/20180920060358.16606-11-alex@ghiti.fr Signed-off-by: Alexandre Ghiti Reviewed-by: Luiz Capitulino Reviewed-by: Mike Kravetz Tested-by: Helge Deller [parisc] Acked-by: Catalin Marinas [arm64] Acked-by: Paul Burton [MIPS] Acked-by: Ingo Molnar [x86] Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: David S. Miller Cc: Fenghua Yu Cc: Heiko Carstens Cc: H. Peter Anvin Cc: Ingo Molnar Cc: James E.J. Bottomley Cc: James Hogan Cc: Martin Schwidefsky Cc: Michael Ellerman Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Russell King Cc: Thomas Gleixner Cc: Tony Luck Cc: Will Deacon Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8e581d433bf796738181e865878a130b4e98f1b9 Author: Alexandre Ghiti Date: Fri Oct 26 15:08:35 2018 -0700 hugetlb: introduce generic version of huge_ptep_set_wrprotect() arm, ia64, mips, powerpc, sh, x86 architectures use the same version of huge_ptep_set_wrprotect, so move this generic implementation into asm-generic/hugetlb.h. Link: http://lkml.kernel.org/r/20180920060358.16606-10-alex@ghiti.fr Signed-off-by: Alexandre Ghiti Reviewed-by: Luiz Capitulino Reviewed-by: Mike Kravetz Tested-by: Helge Deller [parisc] Acked-by: Catalin Marinas [arm64] Acked-by: Paul Burton [MIPS] Acked-by: Ingo Molnar [x86] Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: David S. Miller Cc: Fenghua Yu Cc: Heiko Carstens Cc: H. Peter Anvin Cc: Ingo Molnar Cc: James E.J. Bottomley Cc: James Hogan Cc: Martin Schwidefsky Cc: Michael Ellerman Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Russell King Cc: Thomas Gleixner Cc: Tony Luck Cc: Will Deacon Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 78d6e4e8ea8700fb3973661eb3774f632bab5842 Author: Alexandre Ghiti Date: Fri Oct 26 15:08:31 2018 -0700 hugetlb: introduce generic version of prepare_hugepage_range arm, arm64, powerpc, sparc, x86 architectures use the same version of prepare_hugepage_range, so move this generic implementation into asm-generic/hugetlb.h. Link: http://lkml.kernel.org/r/20180920060358.16606-9-alex@ghiti.fr Signed-off-by: Alexandre Ghiti Reviewed-by: Luiz Capitulino Reviewed-by: Mike Kravetz Tested-by: Helge Deller [parisc] Acked-by: Catalin Marinas [arm64] Acked-by: Paul Burton [MIPS] Acked-by: Ingo Molnar [x86] Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: David S. Miller Cc: Fenghua Yu Cc: Heiko Carstens Cc: H. Peter Anvin Cc: Ingo Molnar Cc: James E.J. Bottomley Cc: James Hogan Cc: Martin Schwidefsky Cc: Michael Ellerman Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Russell King Cc: Thomas Gleixner Cc: Tony Luck Cc: Will Deacon Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c4916a008665a6650834a736f80559a7f90e5857 Author: Alexandre Ghiti Date: Fri Oct 26 15:08:26 2018 -0700 hugetlb: introduce generic version of huge_pte_wrprotect arm, arm64, ia64, mips, parisc, powerpc, sh, sparc, x86 architectures use the same version of huge_pte_wrprotect, so move this generic implementation into asm-generic/hugetlb.h. Link: http://lkml.kernel.org/r/20180920060358.16606-8-alex@ghiti.fr Signed-off-by: Alexandre Ghiti Reviewed-by: Luiz Capitulino Reviewed-by: Mike Kravetz Tested-by: Helge Deller [parisc] Acked-by: Catalin Marinas [arm64] Acked-by: Paul Burton [MIPS] Acked-by: Ingo Molnar [x86] Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: David S. Miller Cc: Fenghua Yu Cc: Heiko Carstens Cc: H. Peter Anvin Cc: Ingo Molnar Cc: James E.J. Bottomley Cc: James Hogan Cc: Martin Schwidefsky Cc: Michael Ellerman Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Russell King Cc: Thomas Gleixner Cc: Tony Luck Cc: Will Deacon Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cae72abc1af0c1ef4cb39e7187c5af44a7ce17a4 Author: Alexandre Ghiti Date: Fri Oct 26 15:08:22 2018 -0700 hugetlb: introduce generic version of huge_pte_none() arm, arm64, ia64, mips, parisc, powerpc, sh, sparc, x86 architectures use the same version of huge_pte_none, so move this generic implementation into asm-generic/hugetlb.h. Link: http://lkml.kernel.org/r/20180920060358.16606-7-alex@ghiti.fr Signed-off-by: Alexandre Ghiti Reviewed-by: Luiz Capitulino Reviewed-by: Mike Kravetz Tested-by: Helge Deller [parisc] Acked-by: Catalin Marinas [arm64] Acked-by: Paul Burton [MIPS] Acked-by: Ingo Molnar [x86] Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: David S. Miller Cc: Fenghua Yu Cc: Heiko Carstens Cc: H. Peter Anvin Cc: Ingo Molnar Cc: James E.J. Bottomley Cc: James Hogan Cc: Martin Schwidefsky Cc: Michael Ellerman Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Russell King Cc: Thomas Gleixner Cc: Tony Luck Cc: Will Deacon Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fe632225bdbd49f5620e7ccfa03268fec9a3e370 Author: Alexandre Ghiti Date: Fri Oct 26 15:08:17 2018 -0700 hugetlb: introduce generic version of huge_ptep_clear_flush arm, x86 architectures use the same version of huge_ptep_clear_flush, so move this generic implementation into asm-generic/hugetlb.h. Link: http://lkml.kernel.org/r/20180920060358.16606-6-alex@ghiti.fr Signed-off-by: Alexandre Ghiti Reviewed-by: Luiz Capitulino Reviewed-by: Mike Kravetz Tested-by: Helge Deller [parisc] Acked-by: Catalin Marinas [arm64] Acked-by: Paul Burton [MIPS] Acked-by: Ingo Molnar [x86] Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: David S. Miller Cc: Fenghua Yu Cc: Heiko Carstens Cc: H. Peter Anvin Cc: Ingo Molnar Cc: James E.J. Bottomley Cc: James Hogan Cc: Martin Schwidefsky Cc: Michael Ellerman Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Russell King Cc: Thomas Gleixner Cc: Tony Luck Cc: Will Deacon Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a4d838536c6e5c1807a863c860d9e767d55ba681 Author: Alexandre Ghiti Date: Fri Oct 26 15:08:12 2018 -0700 hugetlb: introduce generic version of huge_ptep_get_and_clear() arm, ia64, sh, x86 architectures use the same version of huge_ptep_get_and_clear, so move this generic implementation into asm-generic/hugetlb.h. Link: http://lkml.kernel.org/r/20180920060358.16606-5-alex@ghiti.fr Signed-off-by: Alexandre Ghiti Reviewed-by: Luiz Capitulino Reviewed-by: Mike Kravetz Tested-by: Helge Deller [parisc] Acked-by: Catalin Marinas [arm64] Acked-by: Paul Burton [MIPS] Acked-by: Ingo Molnar [x86] Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: David S. Miller Cc: Fenghua Yu Cc: Heiko Carstens Cc: H. Peter Anvin Cc: Ingo Molnar Cc: James E.J. Bottomley Cc: James Hogan Cc: Martin Schwidefsky Cc: Michael Ellerman Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Russell King Cc: Thomas Gleixner Cc: Tony Luck Cc: Will Deacon Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cea685d556330b0265ca62c0d820f687cc9a38d6 Author: Alexandre Ghiti Date: Fri Oct 26 15:08:07 2018 -0700 hugetlb: introduce generic version of set_huge_pte_at() arm, ia64, mips, powerpc, sh, x86 architectures use the same version of set_huge_pte_at, so move this generic implementation into asm-generic/hugetlb.h. Link: http://lkml.kernel.org/r/20180920060358.16606-4-alex@ghiti.fr Signed-off-by: Alexandre Ghiti Reviewed-by: Luiz Capitulino Reviewed-by: Mike Kravetz Tested-by: Helge Deller [parisc] Acked-by: Catalin Marinas [arm64] Acked-by: Paul Burton [MIPS] Acked-by: Ingo Molnar [x86] Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: David S. Miller Cc: Fenghua Yu Cc: Heiko Carstens Cc: H. Peter Anvin Cc: Ingo Molnar Cc: James E.J. Bottomley Cc: James Hogan Cc: Martin Schwidefsky Cc: Michael Ellerman Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Russell King Cc: Thomas Gleixner Cc: Tony Luck Cc: Will Deacon Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1e5f50fc9d0a653c910df2291f245a8fa7beed11 Author: Alexandre Ghiti Date: Fri Oct 26 15:08:03 2018 -0700 hugetlb: introduce generic version of hugetlb_free_pgd_range arm, arm64, mips, parisc, sh, x86 architectures use the same version of hugetlb_free_pgd_range, so move this generic implementation into asm-generic/hugetlb.h. Link: http://lkml.kernel.org/r/20180920060358.16606-3-alex@ghiti.fr Signed-off-by: Alexandre Ghiti Reviewed-by: Luiz Capitulino Reviewed-by: Mike Kravetz Tested-by: Helge Deller [parisc] Acked-by: Catalin Marinas [arm64] Acked-by: Paul Burton [MIPS] Acked-by: Ingo Molnar [x86] Cc: Arnd Bergmann Cc: Benjamin Herrenschmidt Cc: David S. Miller Cc: Fenghua Yu Cc: Heiko Carstens Cc: H. Peter Anvin Cc: Ingo Molnar Cc: James E.J. Bottomley Cc: James Hogan Cc: Martin Schwidefsky Cc: Michael Ellerman Cc: Paul Mackerras Cc: Ralf Baechle Cc: Rich Felker Cc: Russell King Cc: Thomas Gleixner Cc: Tony Luck Cc: Will Deacon Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d018498ccc92775dd593432ba6f3ef92d4d2a782 Author: Alexandre Ghiti Date: Fri Oct 26 15:07:59 2018 -0700 hugetlb: harmonize hugetlb.h arch specific defines with pgtable.h In order to reduce copy/paste of functions across architectures and then make riscv hugetlb port (and future ports) simpler and smaller, this patchset intends to factorize the numerous hugetlb primitives that are defined across all the architectures. Except for prepare_hugepage_range, this patchset moves the versions that are just pass-through to standard pte primitives into asm-generic/hugetlb.h by using the same #ifdef semantic that can be found in asm-generic/pgtable.h, i.e. __HAVE_ARCH_***. s390 architecture has not been tackled in this serie since it does not use asm-generic/hugetlb.h at all. This patchset has been compiled on all addressed architectures with success (except for parisc, but the problem does not come from this series). This patch (of 11): asm-generic/hugetlb.h proposes generic implementations of hugetlb related functions: use __HAVE_ARCH_HUGE* defines in order to make arch specific implementations of hugetlb functions consistent with pgtable.h scheme. Link: http://lkml.kernel.org/r/20180920060358.16606-2-alex@ghiti.fr Signed-off-by: Alexandre Ghiti Reviewed-by: Luiz Capitulino Reviewed-by: Mike Kravetz Acked-by: Catalin Marinas [arm64] Cc: Russell King Cc: Will Deacon Cc: Tony Luck Cc: Fenghua Yu Cc: Ralf Baechle Cc: Paul Burton Cc: James Hogan Cc: James E.J. Bottomley Cc: Helge Deller Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Michael Ellerman Cc: Yoshinori Sato Cc: Rich Felker Cc: David S. Miller Cc: Thomas Gleixner Cc: Ingo Molnar Cc: H. Peter Anvin Cc: Arnd Bergmann Cc: Martin Schwidefsky Cc: Heiko Carstens Cc: Ingo Molnar [x86] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d4faa40259b8524a09c1b0fcd38a446db0c0b770 Author: Wei Yang Date: Fri Oct 26 15:07:55 2018 -0700 mm: remove unnecessary local variable addr in __get_user_pages_fast() The local variable `addr' in __get_user_pages_fast() is just a shadow of `start'. Since `start' never changes after assignment to `addr', it is fine to replace `start' with it. Also the meaning of [start, end] is more obvious than [addr, end] when passed to gup_pgd_range(). Link: http://lkml.kernel.org/r/20180925021448.20265-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 966cf44f637e6aeea7e3d01ba004bf8b5beac78f Author: Alexander Duyck Date: Fri Oct 26 15:07:52 2018 -0700 mm: defer ZONE_DEVICE page initialization to the point where we init pgmap The ZONE_DEVICE pages were being initialized in two locations. One was with the memory_hotplug lock held and another was outside of that lock. The problem with this is that it was nearly doubling the memory initialization time. Instead of doing this twice, once while holding a global lock and once without, I am opting to defer the initialization to the one outside of the lock. This allows us to avoid serializing the overhead for memory init and we can instead focus on per-node init times. One issue I encountered is that devm_memremap_pages and hmm_devmmem_pages_create were initializing only the pgmap field the same way. One wasn't initializing hmm_data, and the other was initializing it to a poison value. Since this is something that is exposed to the driver in the case of hmm I am opting for a third option and just initializing hmm_data to 0 since this is going to be exposed to unknown third party drivers. [alexander.h.duyck@linux.intel.com: fix reference count for pgmap in devm_memremap_pages] Link: http://lkml.kernel.org/r/20181008233404.1909.37302.stgit@localhost.localdomain Link: http://lkml.kernel.org/r/20180925202053.3576.66039.stgit@localhost.localdomain Signed-off-by: Alexander Duyck Reviewed-by: Pavel Tatashin Tested-by: Dan Williams Cc: Dave Hansen Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d483da5bc78b86fe4200d2947f193a745f711713 Author: Alexander Duyck Date: Fri Oct 26 15:07:48 2018 -0700 mm: create non-atomic version of SetPageReserved for init use It doesn't make much sense to use the atomic SetPageReserved at init time when we are using memset to clear the memory and manipulating the page flags via simple "&=" and "|=" operations in __init_single_page. This patch adds a non-atomic version __SetPageReserved that can be used during page init and shows about a 10% improvement in initialization times on the systems I have available for testing. On those systems I saw initialization times drop from around 35 seconds to around 32 seconds to initialize a 3TB block of persistent memory. I believe the main advantage of this is that it allows for more compiler optimization as the __set_bit operation can be reordered whereas the atomic version cannot. I tried adding a bit of documentation based on f1dd2cd13c4 ("mm, memory_hotplug: do not associate hotadded memory to zones until online"). Ideally the reserved flag should be set earlier since there is a brief window where the page is initialization via __init_single_page and we have not set the PG_Reserved flag. I'm leaving that for a future patch set as that will require a more significant refactor. Link: http://lkml.kernel.org/r/20180925202018.3576.11607.stgit@localhost.localdomain Signed-off-by: Alexander Duyck Reviewed-by: Pavel Tatashin Acked-by: Michal Hocko Cc: Dave Hansen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f682a97a00591def7cefbb5003dc04045028e405 Author: Alexander Duyck Date: Fri Oct 26 15:07:45 2018 -0700 mm: provide kernel parameter to allow disabling page init poisoning Patch series "Address issues slowing persistent memory initialization", v5. The main thing this patch set achieves is that it allows us to initialize each node worth of persistent memory independently. As a result we reduce page init time by about 2 minutes because instead of taking 30 to 40 seconds per node and going through each node one at a time, we process all 4 nodes in parallel in the case of a 12TB persistent memory setup spread evenly over 4 nodes. This patch (of 3): On systems with a large amount of memory it can take a significant amount of time to initialize all of the page structs with the PAGE_POISON_PATTERN value. I have seen it take over 2 minutes to initialize a system with over 12TB of RAM. In order to work around the issue I had to disable CONFIG_DEBUG_VM and then the boot time returned to something much more reasonable as the arch_add_memory call completed in milliseconds versus seconds. However in doing that I had to disable all of the other VM debugging on the system. In order to work around a kernel that might have CONFIG_DEBUG_VM enabled on a system that has a large amount of memory I have added a new kernel parameter named "vm_debug" that can be set to "-" in order to disable it. Link: http://lkml.kernel.org/r/20180925201921.3576.84239.stgit@localhost.localdomain Reviewed-by: Pavel Tatashin Signed-off-by: Alexander Duyck Cc: Dave Hansen Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 85cfb245060e45640fa3447f8b0bad5e8bd3bdaf Author: Shakeel Butt Date: Fri Oct 26 15:07:41 2018 -0700 memcg: remove memcg_kmem_skip_account The flag memcg_kmem_skip_account was added during the era of opt-out kmem accounting. There is no need for such flag in the opt-in world as there aren't any __GFP_ACCOUNT allocations within memcg_create_cache_enqueue(). Link: http://lkml.kernel.org/r/20180919004501.178023-1-shakeelb@google.com Signed-off-by: Shakeel Butt Acked-by: Johannes Weiner Cc: Michal Hocko Cc: Vladimir Davydov Cc: Greg Thelen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 86b27beae59685a42f81bcda9d502b5aebddfab8 Author: Oscar Salvador Date: Fri Oct 26 15:07:38 2018 -0700 mm/memory_hotplug.c: clean up node_states_check_changes_offline() This patch, as the previous one, gets rid of the wrong if statements. While at it, I realized that the comments are sometimes very confusing, to say the least, and wrong. For example: ___ zone_last = ZONE_MOVABLE; /* * check whether node_states[N_HIGH_MEMORY] will be changed * If we try to offline the last present @nr_pages from the node, * we can determind we will need to clear the node from * node_states[N_HIGH_MEMORY]. */ for (; zt <= zone_last; zt++) present_pages += pgdat->node_zones[zt].present_pages; if (nr_pages >= present_pages) arg->status_change_nid = zone_to_nid(zone); else arg->status_change_nid = -1; ___ In case the node gets empry, it must be removed from N_MEMORY. We already check N_HIGH_MEMORY a bit above within the CONFIG_HIGHMEM ifdef code. Not to say that status_change_nid is for N_MEMORY, and not for N_HIGH_MEMORY. So I re-wrote some of the comments to what I think is better. [osalvador@suse.de: address feedback from Pavel] Link: http://lkml.kernel.org/r/20180921132634.10103-5-osalvador@techadventures.net Link: http://lkml.kernel.org/r/20180919100819.25518-6-osalvador@techadventures.net Signed-off-by: Oscar Salvador Reviewed-by: Pavel Tatashin Cc: Michal Hocko Cc: Dan Williams Cc: David Hildenbrand Cc: Jonathan Cameron Cc: Cc: Mathieu Malaterre Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8efe33f40f3e69ac6069ed46666d2d527ddc2c04 Author: Oscar Salvador Date: Fri Oct 26 15:07:34 2018 -0700 mm/memory_hotplug.c: simplify node_states_check_changes_online While looking at node_states_check_changes_online, I stumbled upon some confusing things. Right after entering the function, we find this: if (N_MEMORY == N_NORMAL_MEMORY) zone_last = ZONE_MOVABLE; This is wrong. N_MEMORY cannot really be equal to N_NORMAL_MEMORY. My guess is that this wanted to be something like: if (N_NORMAL_MEMORY == N_HIGH_MEMORY) to check if we have CONFIG_HIGHMEM. Later on, in the CONFIG_HIGHMEM block, we have: if (N_MEMORY == N_HIGH_MEMORY) zone_last = ZONE_MOVABLE; Again, this is wrong, and will never be evaluated to true. Besides removing these wrong if statements, I simplified the function a bit. [osalvador@suse.de: address feedback from Pavel] Link: http://lkml.kernel.org/r/20180921132634.10103-4-osalvador@techadventures.net Link: http://lkml.kernel.org/r/20180919100819.25518-5-osalvador@techadventures.net Signed-off-by: Oscar Salvador Reviewed-by: Pavel Tatashin Cc: Dan Williams Cc: David Hildenbrand Cc: Jonathan Cameron Cc: Mathieu Malaterre Cc: Michal Hocko Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cf01f6f5e398a74f00fa9ac490ec98c12e63e4b1 Author: Oscar Salvador Date: Fri Oct 26 15:07:28 2018 -0700 mm/memory_hotplug.c: tidy up node_states_clear_node() node_states_clear has the following if statements: if ((N_MEMORY != N_NORMAL_MEMORY) && (arg->status_change_nid_high >= 0)) ... if ((N_MEMORY != N_HIGH_MEMORY) && (arg->status_change_nid >= 0)) ... N_MEMORY can never be equal to neither N_NORMAL_MEMORY nor N_HIGH_MEMORY. Similar problem was found in [1]. Since this is wrong, let us get rid of it. [1] https://patchwork.kernel.org/patch/10579155/ Link: http://lkml.kernel.org/r/20180919100819.25518-4-osalvador@techadventures.net Signed-off-by: Oscar Salvador Reviewed-by: Pavel Tatashin Cc: Dan Williams Cc: David Hildenbrand Cc: Jonathan Cameron Cc: Mathieu Malaterre Cc: Michal Hocko Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 83d83612d707c3709e030c745e3df8d4e17bbfa2 Author: Oscar Salvador Date: Fri Oct 26 15:07:25 2018 -0700 mm/memory_hotplug.c: spare unnecessary calls to node_set_state In node_states_check_changes_online, we check if the node will have to be set for any of the N_*_MEMORY states after the pages have been onlined. Later on, we perform the activation in node_states_set_node. Currently, in node_states_set_node we set the node to N_MEMORY unconditionally. This means that we call node_set_state for N_MEMORY every time pages go online, but we only need to do it if the node has not yet been set for N_MEMORY. Fix this by checking status_change_nid. Link: http://lkml.kernel.org/r/20180919100819.25518-2-osalvador@techadventures.net Signed-off-by: Oscar Salvador Reviewed-by: Pavel Tatashin Cc: Michal Hocko Cc: Dan Williams Cc: David Hildenbrand Cc: Jonathan Cameron Cc: Cc: Mathieu Malaterre Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3cb7b121ff4dfbf202845b8ea27d9a437eae210f Author: haiqing.shq Date: Fri Oct 26 15:07:22 2018 -0700 mm/filemap.c: Use existing variable Use the variable write_len instead of ov_iter_count(from). Link: http://lkml.kernel.org/r/1537375855-2088-1-git-send-email-leviathan0992@gmail.com Signed-off-by: haiqing.shq Reviewed-by: Andrew Morton Cc: Jan Kara Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cb4922496ae40a775a1b17025eaa1060e8991253 Author: Yang Shi Date: Fri Oct 26 15:07:18 2018 -0700 mm: unmap VM_PFNMAP mappings with optimized path When unmapping VM_PFNMAP mappings, vm flags need to be updated. Since the vmas have been detached, so it sounds safe to update vm flags with read mmap_sem. Link: http://lkml.kernel.org/r/1537376621-51150-4-git-send-email-yang.shi@linux.alibaba.com Signed-off-by: Yang Shi Reviewed-by: Matthew Wilcox Acked-by: Kirill A. Shutemov Acked-by: Vlastimil Babka Cc: Michal Hocko Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b4cefb36051244bcb5651026d862c332a6cac7df Author: Yang Shi Date: Fri Oct 26 15:07:15 2018 -0700 mm: unmap VM_HUGETLB mappings with optimized path When unmapping VM_HUGETLB mappings, vm flags need to be updated. Since the vmas have been detached, so it sounds safe to update vm flags with read mmap_sem. Link: http://lkml.kernel.org/r/1537376621-51150-3-git-send-email-yang.shi@linux.alibaba.com Signed-off-by: Yang Shi Reviewed-by: Matthew Wilcox Acked-by: Kirill A. Shutemov Acked-by: Vlastimil Babka Cc: Michal Hocko Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dd2283f2605e3b3e9c61bcae844b34f2afa4813f Author: Yang Shi Date: Fri Oct 26 15:07:11 2018 -0700 mm: mmap: zap pages with read mmap_sem in munmap Patch series "mm: zap pages with read mmap_sem in munmap for large mapping", v11. Background: Recently, when we ran some vm scalability tests on machines with large memory, we ran into a couple of mmap_sem scalability issues when unmapping large memory space, please refer to https://lkml.org/lkml/2017/12/14/733 and https://lkml.org/lkml/2018/2/20/576. History: Then akpm suggested to unmap large mapping section by section and drop mmap_sem at a time to mitigate it (see https://lkml.org/lkml/2018/3/6/784). V1 patch series was submitted to the mailing list per Andrew's suggestion (see https://lkml.org/lkml/2018/3/20/786). Then I received a lot great feedback and suggestions. Then this topic was discussed on LSFMM summit 2018. In the summit, Michal Hocko suggested (also in the v1 patches review) to try "two phases" approach. Zapping pages with read mmap_sem, then doing via cleanup with write mmap_sem (for discussion detail, see https://lwn.net/Articles/753269/) Approach: Zapping pages is the most time consuming part, according to the suggestion from Michal Hocko [1], zapping pages can be done with holding read mmap_sem, like what MADV_DONTNEED does. Then re-acquire write mmap_sem to cleanup vmas. But, we can't call MADV_DONTNEED directly, since there are two major drawbacks: * The unexpected state from PF if it wins the race in the middle of munmap. It may return zero page, instead of the content or SIGSEGV. * Can't handle VM_LOCKED | VM_HUGETLB | VM_PFNMAP and uprobe mappings, which is a showstopper from akpm But, some part may need write mmap_sem, for example, vma splitting. So, the design is as follows: acquire write mmap_sem lookup vmas (find and split vmas) deal with special mappings detach vmas downgrade_write zap pages free page tables release mmap_sem The vm events with read mmap_sem may come in during page zapping, but since vmas have been detached before, they, i.e. page fault, gup, etc, will not be able to find valid vma, then just return SIGSEGV or -EFAULT as expected. If the vma has VM_HUGETLB | VM_PFNMAP, they are considered as special mappings. They will be handled by falling back to regular do_munmap() with exclusive mmap_sem held in this patch since they may update vm flags. But, with the "detach vmas first" approach, the vmas have been detached when vm flags are updated, so it sounds safe to update vm flags with read mmap_sem for this specific case. So, VM_HUGETLB and VM_PFNMAP will be handled by using the optimized path in the following separate patches for bisectable sake. Unmapping uprobe areas may need update mm flags (MMF_RECALC_UPROBES). However it is fine to have false-positive MMF_RECALC_UPROBES according to uprobes developer. So, uprobe unmap will not be handled by the regular path. With the "detach vmas first" approach we don't have to re-acquire mmap_sem again to clean up vmas to avoid race window which might get the address space changed since downgrade_write() doesn't release the lock to lead regression, which simply downgrades to read lock. And, since the lock acquire/release cost is managed to the minimum and almost as same as before, the optimization could be extended to any size of mapping without incurring significant penalty to small mappings. For the time being, just do this in munmap syscall path. Other vm_munmap() or do_munmap() call sites (i.e mmap, mremap, etc) remain intact due to some implementation difficulties since they acquire write mmap_sem from very beginning and hold it until the end, do_munmap() might be called in the middle. But, the optimized do_munmap would like to be called without mmap_sem held so that we can do the optimization. So, if we want to do the similar optimization for mmap/mremap path, I'm afraid we would have to redesign them. mremap might be called on very large area depending on the usecases, the optimization to it will be considered in the future. This patch (of 3): When running some mmap/munmap scalability tests with large memory (i.e. > 300GB), the below hung task issue may happen occasionally. INFO: task ps:14018 blocked for more than 120 seconds. Tainted: G E 4.9.79-009.ali3000.alios7.x86_64 #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. ps D 0 14018 1 0x00000004 ffff885582f84000 ffff885e8682f000 ffff880972943000 ffff885ebf499bc0 ffff8828ee120000 ffffc900349bfca8 ffffffff817154d0 0000000000000040 00ffffff812f872a ffff885ebf499bc0 024000d000948300 ffff880972943000 Call Trace: [] ? __schedule+0x250/0x730 [] schedule+0x36/0x80 [] rwsem_down_read_failed+0xf0/0x150 [] call_rwsem_down_read_failed+0x18/0x30 [] down_read+0x20/0x40 [] proc_pid_cmdline_read+0xd9/0x4e0 [] ? do_filp_open+0xa5/0x100 [] __vfs_read+0x37/0x150 [] ? security_file_permission+0x9b/0xc0 [] vfs_read+0x96/0x130 [] SyS_read+0x55/0xc0 [] entry_SYSCALL_64_fastpath+0x1a/0xc5 It is because munmap holds mmap_sem exclusively from very beginning to all the way down to the end, and doesn't release it in the middle. When unmapping large mapping, it may take long time (take ~18 seconds to unmap 320GB mapping with every single page mapped on an idle machine). Zapping pages is the most time consuming part, according to the suggestion from Michal Hocko [1], zapping pages can be done with holding read mmap_sem, like what MADV_DONTNEED does. Then re-acquire write mmap_sem to cleanup vmas. But, some part may need write mmap_sem, for example, vma splitting. So, the design is as follows: acquire write mmap_sem lookup vmas (find and split vmas) deal with special mappings detach vmas downgrade_write zap pages free page tables release mmap_sem The vm events with read mmap_sem may come in during page zapping, but since vmas have been detached before, they, i.e. page fault, gup, etc, will not be able to find valid vma, then just return SIGSEGV or -EFAULT as expected. If the vma has VM_HUGETLB | VM_PFNMAP, they are considered as special mappings. They will be handled by without downgrading mmap_sem in this patch since they may update vm flags. But, with the "detach vmas first" approach, the vmas have been detached when vm flags are updated, so it sounds safe to update vm flags with read mmap_sem for this specific case. So, VM_HUGETLB and VM_PFNMAP will be handled by using the optimized path in the following separate patches for bisectable sake. Unmapping uprobe areas may need update mm flags (MMF_RECALC_UPROBES). However it is fine to have false-positive MMF_RECALC_UPROBES according to uprobes developer. With the "detach vmas first" approach we don't have to re-acquire mmap_sem again to clean up vmas to avoid race window which might get the address space changed since downgrade_write() doesn't release the lock to lead regression, which simply downgrades to read lock. And, since the lock acquire/release cost is managed to the minimum and almost as same as before, the optimization could be extended to any size of mapping without incurring significant penalty to small mappings. For the time being, just do this in munmap syscall path. Other vm_munmap() or do_munmap() call sites (i.e mmap, mremap, etc) remain intact due to some implementation difficulties since they acquire write mmap_sem from very beginning and hold it until the end, do_munmap() might be called in the middle. But, the optimized do_munmap would like to be called without mmap_sem held so that we can do the optimization. So, if we want to do the similar optimization for mmap/mremap path, I'm afraid we would have to redesign them. mremap might be called on very large area depending on the usecases, the optimization to it will be considered in the future. With the patches, exclusive mmap_sem hold time when munmap a 80GB address space on a machine with 32 cores of E5-2680 @ 2.70GHz dropped to us level from second. munmap_test-15002 [008] 594.380138: funcgraph_entry: | __vm_munmap() { munmap_test-15002 [008] 594.380146: funcgraph_entry: !2485684 us | unmap_region(); munmap_test-15002 [008] 596.865836: funcgraph_exit: !2485692 us | } Here the execution time of unmap_region() is used to evaluate the time of holding read mmap_sem, then the remaining time is used with holding exclusive lock. [1] https://lwn.net/Articles/753269/ Link: http://lkml.kernel.org/r/1537376621-51150-2-git-send-email-yang.shi@linux.alibaba.com Signed-off-by: Yang Shi Suggested-by: Michal Hocko Suggested-by: Kirill A. Shutemov Suggested-by: Matthew Wilcox Reviewed-by: Matthew Wilcox Acked-by: Kirill A. Shutemov Acked-by: Vlastimil Babka Cc: Laurent Dufour Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a8dda165ec34fac2b4119654330150e2c896e531 Author: Andrey Ryabinin Date: Fri Oct 26 15:07:07 2018 -0700 vfree: add debug might_sleep() Add might_sleep() call to vfree() to catch potential sleep-in-atomic bugs earlier. [aryabinin@virtuozzo.com: drop might_sleep_if() from kvfree()] Link: http://lkml.kernel.org/r/7e19e4df-b1a6-29bd-9ae7-0266d50bef1d@virtuozzo.com Link: http://lkml.kernel.org/r/20180914130512.10394-3-aryabinin@virtuozzo.com Signed-off-by: Andrey Ryabinin Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3ca4ea3a7a78a243ee9edf71a2736bc8fb26d70f Author: Andrey Ryabinin Date: Fri Oct 26 15:07:03 2018 -0700 mm/vmalloc.c: improve vfree() kerneldoc vfree() might sleep if called not in interrupt context. Explain that in the comment. Link: http://lkml.kernel.org/r/20180914130512.10394-2-aryabinin@virtuozzo.com Signed-off-by: Andrey Ryabinin Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 52414d3302577bb60e4ba3c21b7957da7c7a8d21 Author: Andrey Ryabinin Date: Fri Oct 26 15:07:00 2018 -0700 kvfree(): fix misleading comment vfree() might sleep if called not in interrupt context. So does kvfree() too. Fix misleading kvfree()'s comment about allowed context. Link: http://lkml.kernel.org/r/20180914130512.10394-1-aryabinin@virtuozzo.com Fixes: 04b8e946075d ("mm/util.c: improve kvfree() kerneldoc") Signed-off-by: Andrey Ryabinin Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dedf2c73b80b4566dfcae8ebe9ed46a38b63a1f9 Author: zhong jiang Date: Fri Oct 26 15:06:57 2018 -0700 mm/mempolicy.c: use match_string() helper to simplify the code match_string() returns the index of an array for a matching string, which can be used intead of open coded implementation. Link: http://lkml.kernel.org/r/1536988365-50310-1-git-send-email-zhongjiang@huawei.com Signed-off-by: zhong jiang Reviewed-by: Andrew Morton Acked-by: Michal Hocko Cc: Vlastimil Babka Cc: Andrey Ryabinin Cc: Andrea Arcangeli Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c3df29d13044d885695067fa0b1386824942557a Author: YueHaibing Date: Fri Oct 26 15:06:53 2018 -0700 mm/swap.c: remove duplicated include Remove duplicated include linux/memremap.h Link: http://lkml.kernel.org/r/20180917131308.16420-1-yuehaibing@huawei.com Signed-off-by: YueHaibing Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2c029a1ea3aac296cd5b47584a579defcc4b4aa0 Author: Michal Hocko Date: Fri Oct 26 15:06:49 2018 -0700 mm, page_alloc: drop should_suppress_show_mem should_suppress_show_mem() was introduced to reduce the overhead of show_mem on large NUMA systems. Things have changed since then though. Namely c78e93630d15 ("mm: do not walk all of system memory during show_mem") has reduced the overhead considerably. Moreover warn_alloc_show_mem clears SHOW_MEM_FILTER_NODES when called from the IRQ context already so we are not printing per node stats. Remove should_suppress_show_mem because we are losing potentially interesting information about allocation failures. We have seen a bug report where system gets unresponsive under memory pressure and there is only kernel: [2032243.696888] qlge 0000:8b:00.1 ql1: Could not get a page chunk, i=8, clean_idx =200 . kernel: [2032243.710725] swapper/7: page allocation failure: order:1, mode:0x1084120(GFP_ATOMIC|__GFP_COLD|__GFP_COMP) without an additional information for debugging. It would be great to see the state of the page allocator at the moment. Link: http://lkml.kernel.org/r/20180907114334.7088-1-mhocko@kernel.org Signed-off-by: Michal Hocko Acked-by: Vlastimil Babka Cc: David Rientjes Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e9b257ed150c1f43912bd66031185598451f68a9 Author: Johannes Weiner Date: Fri Oct 26 15:06:45 2018 -0700 mm/memcontrol.c: fix memory.stat item ordering The refault stats go better with the page fault stats, and are of higher interest than the stats on LRU operations. In fact they used to be grouped together; when the LRU operation stats were added later on, they were wedged in between. Move them back together. Documentation/admin-guide/cgroup-v2.rst already lists them in the right order. Link: http://lkml.kernel.org/r/20181010140239.GA2527@cmpxchg.org Signed-off-by: Johannes Weiner Cc: Rik van Riel Cc: Michal Hocko Cc: Peter Zijlstra (Intel) Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4b85afbdacd290c7a22c96df40a6433fdcacb509 Author: Johannes Weiner Date: Fri Oct 26 15:06:42 2018 -0700 mm: zero-seek shrinkers The page cache and most shrinkable slab caches hold data that has been read from disk, but there are some caches that only cache CPU work, such as the dentry and inode caches of procfs and sysfs, as well as the subset of radix tree nodes that track non-resident page cache. Currently, all these are shrunk at the same rate: using DEFAULT_SEEKS for the shrinker's seeks setting tells the reclaim algorithm that for every two page cache pages scanned it should scan one slab object. This is a bogus setting. A virtual inode that required no IO to create is not twice as valuable as a page cache page; shadow cache entries with eviction distances beyond the size of memory aren't either. In most cases, the behavior in practice is still fine. Such virtual caches don't tend to grow and assert themselves aggressively, and usually get picked up before they cause problems. But there are scenarios where that's not true. Our database workloads suffer from two of those. For one, their file workingset is several times bigger than available memory, which has the kernel aggressively create shadow page cache entries for the non-resident parts of it. The workingset code does tell the VM that most of these are expendable, but the VM ends up balancing them 2:1 to cache pages as per the seeks setting. This is a huge waste of memory. These workloads also deal with tens of thousands of open files and use /proc for introspection, which ends up growing the proc_inode_cache to absurdly large sizes - again at the cost of valuable cache space, which isn't a reasonable trade-off, given that proc inodes can be re-created without involving the disk. This patch implements a "zero-seek" setting for shrinkers that results in a target ratio of 0:1 between their objects and IO-backed caches. This allows such virtual caches to grow when memory is available (they do cache/avoid CPU work after all), but effectively disables them as soon as IO-backed objects are under pressure. It then switches the shrinkers for procfs and sysfs metadata, as well as excess page cache shadow nodes, to the new zero-seek setting. Link: http://lkml.kernel.org/r/20181009184732.762-5-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Reported-by: Domas Mituzas Reviewed-by: Andrew Morton Reviewed-by: Rik van Riel Acked-by: Peter Zijlstra (Intel) Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 68d48e6a2df575b935edd420396c3cb8b6aa6ad3 Author: Johannes Weiner Date: Fri Oct 26 15:06:39 2018 -0700 mm: workingset: add vmstat counter for shadow nodes Make it easier to catch bugs in the shadow node shrinker by adding a counter for the shadow nodes in circulation. [akpm@linux-foundation.org: assert that irqs are disabled, for __inc_lruvec_page_state()] [akpm@linux-foundation.org: s/WARN_ON_ONCE/VM_WARN_ON_ONCE/, per Johannes] Link: http://lkml.kernel.org/r/20181009184732.762-4-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Reviewed-by: Andrew Morton Acked-by: Peter Zijlstra (Intel) Cc: Rik van Riel Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 505802a53510e54ad5fbbd655a68893df83bfb91 Author: Johannes Weiner Date: Fri Oct 26 15:06:35 2018 -0700 mm: workingset: use cheaper __inc_lruvec_state in irqsafe node reclaim No need to use the preemption-safe lruvec state function inside the reclaim region that has irqs disabled. Link: http://lkml.kernel.org/r/20181009184732.762-3-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Reviewed-by: Andrew Morton Reviewed-by: Rik van Riel Acked-by: Peter Zijlstra (Intel) Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2ce7135adc9ad081aa3c49744144376ac74fea60 Author: Johannes Weiner Date: Fri Oct 26 15:06:31 2018 -0700 psi: cgroup support On a system that executes multiple cgrouped jobs and independent workloads, we don't just care about the health of the overall system, but also that of individual jobs, so that we can ensure individual job health, fairness between jobs, or prioritize some jobs over others. This patch implements pressure stall tracking for cgroups. In kernels with CONFIG_PSI=y, cgroup2 groups will have cpu.pressure, memory.pressure, and io.pressure files that track aggregate pressure stall times for only the tasks inside the cgroup. Link: http://lkml.kernel.org/r/20180828172258.3185-10-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Tejun Heo Acked-by: Peter Zijlstra (Intel) Tested-by: Daniel Drake Tested-by: Suren Baghdasaryan Cc: Christopher Lameter Cc: Ingo Molnar Cc: Johannes Weiner Cc: Mike Galbraith Cc: Peter Enderborg Cc: Randy Dunlap Cc: Shakeel Butt Cc: Vinayak Menon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit eb414681d5a07d28d2ff90dc05f69ec6b232ebd2 Author: Johannes Weiner Date: Fri Oct 26 15:06:27 2018 -0700 psi: pressure stall information for CPU, memory, and IO When systems are overcommitted and resources become contended, it's hard to tell exactly the impact this has on workload productivity, or how close the system is to lockups and OOM kills. In particular, when machines work multiple jobs concurrently, the impact of overcommit in terms of latency and throughput on the individual job can be enormous. In order to maximize hardware utilization without sacrificing individual job health or risk complete machine lockups, this patch implements a way to quantify resource pressure in the system. A kernel built with CONFIG_PSI=y creates files in /proc/pressure/ that expose the percentage of time the system is stalled on CPU, memory, or IO, respectively. Stall states are aggregate versions of the per-task delay accounting delays: cpu: some tasks are runnable but not executing on a CPU memory: tasks are reclaiming, or waiting for swapin or thrashing cache io: tasks are waiting for io completions These percentages of walltime can be thought of as pressure percentages, and they give a general sense of system health and productivity loss incurred by resource overcommit. They can also indicate when the system is approaching lockup scenarios and OOMs. To do this, psi keeps track of the task states associated with each CPU and samples the time they spend in stall states. Every 2 seconds, the samples are averaged across CPUs - weighted by the CPUs' non-idle time to eliminate artifacts from unused CPUs - and translated into percentages of walltime. A running average of those percentages is maintained over 10s, 1m, and 5m periods (similar to the loadaverage). [hannes@cmpxchg.org: doc fixlet, per Randy] Link: http://lkml.kernel.org/r/20180828205625.GA14030@cmpxchg.org [hannes@cmpxchg.org: code optimization] Link: http://lkml.kernel.org/r/20180907175015.GA8479@cmpxchg.org [hannes@cmpxchg.org: rename psi_clock() to psi_update_work(), per Peter] Link: http://lkml.kernel.org/r/20180907145404.GB11088@cmpxchg.org [hannes@cmpxchg.org: fix build] Link: http://lkml.kernel.org/r/20180913014222.GA2370@cmpxchg.org Link: http://lkml.kernel.org/r/20180828172258.3185-9-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Peter Zijlstra (Intel) Tested-by: Daniel Drake Tested-by: Suren Baghdasaryan Cc: Christopher Lameter Cc: Ingo Molnar Cc: Johannes Weiner Cc: Mike Galbraith Cc: Peter Enderborg Cc: Randy Dunlap Cc: Shakeel Butt Cc: Tejun Heo Cc: Vinayak Menon Cc: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 246b3b3342c9b0a2e24cda2178be87bc36e1c874 Author: Johannes Weiner Date: Fri Oct 26 15:06:23 2018 -0700 sched: introduce this_rq_lock_irq() do_sched_yield() disables IRQs, looks up this_rq() and locks it. The next patch is adding another site with the same pattern, so provide a convenience function for it. Link: http://lkml.kernel.org/r/20180828172258.3185-8-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Peter Zijlstra (Intel) Tested-by: Suren Baghdasaryan Tested-by: Daniel Drake Cc: Christopher Lameter Cc: Ingo Molnar Cc: Johannes Weiner Cc: Mike Galbraith Cc: Peter Enderborg Cc: Randy Dunlap Cc: Shakeel Butt Cc: Tejun Heo Cc: Vinayak Menon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1f351d7f7590857ea281579c26e6045b4c548ef4 Author: Johannes Weiner Date: Fri Oct 26 15:06:19 2018 -0700 sched: sched.h: make rq locking and clock functions available in stats.h kernel/sched/sched.h includes "stats.h" half-way through the file. The next patch introduces users of sched.h's rq locking functions and update_rq_clock() in kernel/sched/stats.h. Move those definitions up in the file so they are available in stats.h. Link: http://lkml.kernel.org/r/20180828172258.3185-7-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Peter Zijlstra (Intel) Tested-by: Suren Baghdasaryan Tested-by: Daniel Drake Cc: Christopher Lameter Cc: Ingo Molnar Cc: Johannes Weiner Cc: Mike Galbraith Cc: Peter Enderborg Cc: Randy Dunlap Cc: Shakeel Butt Cc: Tejun Heo Cc: Vinayak Menon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5c54f5b9edb1aa2eabbb1091c458f1b6776a1896 Author: Johannes Weiner Date: Fri Oct 26 15:06:16 2018 -0700 sched: loadavg: make calc_load_n() public It's going to be used in a later patch. Keep the churn separate. Link: http://lkml.kernel.org/r/20180828172258.3185-6-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Peter Zijlstra (Intel) Tested-by: Suren Baghdasaryan Tested-by: Daniel Drake Cc: Christopher Lameter Cc: Ingo Molnar Cc: Johannes Weiner Cc: Mike Galbraith Cc: Peter Enderborg Cc: Randy Dunlap Cc: Shakeel Butt Cc: Tejun Heo Cc: Vinayak Menon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8508cf3ffad4defa202b303e5b6379efc4cd9054 Author: Johannes Weiner Date: Fri Oct 26 15:06:11 2018 -0700 sched: loadavg: consolidate LOAD_INT, LOAD_FRAC, CALC_LOAD There are several definitions of those functions/macros in places that mess with fixed-point load averages. Provide an official version. [akpm@linux-foundation.org: fix missed conversion in block/blk-iolatency.c] Link: http://lkml.kernel.org/r/20180828172258.3185-5-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Peter Zijlstra (Intel) Tested-by: Suren Baghdasaryan Tested-by: Daniel Drake Cc: Christopher Lameter Cc: Ingo Molnar Cc: Johannes Weiner Cc: Mike Galbraith Cc: Peter Enderborg Cc: Randy Dunlap Cc: Shakeel Butt Cc: Tejun Heo Cc: Vinayak Menon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b1d29ba82cf2bc784f4c963ddd6a2cf29e229b33 Author: Johannes Weiner Date: Fri Oct 26 15:06:08 2018 -0700 delayacct: track delays from thrashing cache pages Delay accounting already measures the time a task spends in direct reclaim and waiting for swapin, but in low memory situations tasks spend can spend a significant amount of their time waiting on thrashing page cache. This isn't tracked right now. To know the full impact of memory contention on an individual task, measure the delay when waiting for a recently evicted active cache page to read back into memory. Also update tools/accounting/getdelays.c: [hannes@computer accounting]$ sudo ./getdelays -d -p 1 print delayacct stats ON PID 1 CPU count real total virtual total delay total delay average 50318 745000000 847346785 400533713 0.008ms IO count delay total delay average 435 122601218 0ms SWAP count delay total delay average 0 0 0ms RECLAIM count delay total delay average 0 0 0ms THRASHING count delay total delay average 19 12621439 0ms Link: http://lkml.kernel.org/r/20180828172258.3185-4-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Peter Zijlstra (Intel) Tested-by: Daniel Drake Tested-by: Suren Baghdasaryan Cc: Christopher Lameter Cc: Ingo Molnar Cc: Johannes Weiner Cc: Mike Galbraith Cc: Peter Enderborg Cc: Randy Dunlap Cc: Shakeel Butt Cc: Tejun Heo Cc: Vinayak Menon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1899ad18c6072d689896badafb81267b0a1092a4 Author: Johannes Weiner Date: Fri Oct 26 15:06:04 2018 -0700 mm: workingset: tell cache transitions from workingset thrashing Refaults happen during transitions between workingsets as well as in-place thrashing. Knowing the difference between the two has a range of applications, including measuring the impact of memory shortage on the system performance, as well as the ability to smarter balance pressure between the filesystem cache and the swap-backed workingset. During workingset transitions, inactive cache refaults and pushes out established active cache. When that active cache isn't stale, however, and also ends up refaulting, that's bonafide thrashing. Introduce a new page flag that tells on eviction whether the page has been active or not in its lifetime. This bit is then stored in the shadow entry, to classify refaults as transitioning or thrashing. How many page->flags does this leave us with on 32-bit? 20 bits are always page flags 21 if you have an MMU 23 with the zone bits for DMA, Normal, HighMem, Movable 29 with the sparsemem section bits 30 if PAE is enabled 31 with this patch. So on 32-bit PAE, that leaves 1 bit for distinguishing two NUMA nodes. If that's not enough, the system can switch to discontigmem and re-gain the 6 or 7 sparsemem section bits. Link: http://lkml.kernel.org/r/20180828172258.3185-3-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Peter Zijlstra (Intel) Tested-by: Daniel Drake Tested-by: Suren Baghdasaryan Cc: Christopher Lameter Cc: Ingo Molnar Cc: Johannes Weiner Cc: Mike Galbraith Cc: Peter Enderborg Cc: Randy Dunlap Cc: Shakeel Butt Cc: Tejun Heo Cc: Vinayak Menon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 95f9ab2d596e8cbb388315e78c82b9a131bf2928 Author: Johannes Weiner Date: Fri Oct 26 15:05:59 2018 -0700 mm: workingset: don't drop refault information prematurely Patch series "psi: pressure stall information for CPU, memory, and IO", v4. Overview PSI reports the overall wallclock time in which the tasks in a system (or cgroup) wait for (contended) hardware resources. This helps users understand the resource pressure their workloads are under, which allows them to rootcause and fix throughput and latency problems caused by overcommitting, underprovisioning, suboptimal job placement in a grid; as well as anticipate major disruptions like OOM. Real-world applications We're using the data collected by PSI (and its previous incarnation, memdelay) quite extensively at Facebook, and with several success stories. One usecase is avoiding OOM hangs/livelocks. The reason these happen is because the OOM killer is triggered by reclaim not being able to free pages, but with fast flash devices there is *always* some clean and uptodate cache to reclaim; the OOM killer never kicks in, even as tasks spend 90% of the time thrashing the cache pages of their own executables. There is no situation where this ever makes sense in practice. We wrote a <100 line POC python script to monitor memory pressure and kill stuff way before such pathological thrashing leads to full system losses that would require forcible hard resets. We've since extended and deployed this code into other places to guarantee latency and throughput SLAs, since they're usually violated way before the kernel OOM killer would ever kick in. It is available here: https://github.com/facebookincubator/oomd Eventually we probably want to trigger the in-kernel OOM killer based on extreme sustained pressure as well, so that Linux can avoid memory livelocks - which technically aren't deadlocks, but to the user indistinguishable from them - out of the box. We'd continue using OOMD as the first line of defense to ensure workload health and implement complex kill policies that are beyond the scope of the kernel. We also use PSI memory pressure for loadshedding. Our batch job infrastructure used to use heuristics based on various VM stats to anticipate OOM situations, with lackluster success. We switched it to PSI and managed to anticipate and avoid OOM kills and lockups fairly reliably. The reduction of OOM outages in the worker pool raised the pool's aggregate productivity, and we were able to switch that service to smaller machines. Lastly, we use cgroups to isolate a machine's main workload from maintenance crap like package upgrades, logging, configuration, as well as to prevent multiple workloads on a machine from stepping on each others' toes. We were not able to configure this properly without the pressure metrics; we would see latency or bandwidth drops, but it would often be hard to impossible to rootcause it post-mortem. We now log and graph pressure for the containers in our fleet and can trivially link latency spikes and throughput drops to shortages of specific resources after the fact, and fix the job config/scheduling. PSI has also received testing, feedback, and feature requests from Android and EndlessOS for the purpose of low-latency OOM killing, to intervene in pressure situations before the UI starts hanging. How do you use this feature? A kernel with CONFIG_PSI=y will create a /proc/pressure directory with 3 files: cpu, memory, and io. If using cgroup2, cgroups will also have cpu.pressure, memory.pressure and io.pressure files, which simply aggregate task stalls at the cgroup level instead of system-wide. The cpu file contains one line: some avg10=2.04 avg60=0.75 avg300=0.40 total=157656722 The averages give the percentage of walltime in which one or more tasks are delayed on the runqueue while another task has the CPU. They're recent averages over 10s, 1m, 5m windows, so you can tell short term trends from long term ones, similarly to the load average. The total= value gives the absolute stall time in microseconds. This allows detecting latency spikes that might be too short to sway the running averages. It also allows custom time averaging in case the 10s/1m/5m windows aren't adequate for the usecase (or are too coarse with future hardware). What to make of this "some" metric? If CPU utilization is at 100% and CPU pressure is 0, it means the system is perfectly utilized, with one runnable thread per CPU and nobody waiting. At two or more runnable tasks per CPU, the system is 100% overcommitted and the pressure average will indicate as much. From a utilization perspective this is a great state of course: no CPU cycles are being wasted, even when 50% of the threads were to go idle (as most workloads do vary). From the perspective of the individual job it's not great, however, and they would do better with more resources. Depending on what your priority and options are, raised "some" numbers may or may not require action. The memory file contains two lines: some avg10=70.24 avg60=68.52 avg300=69.91 total=3559632828 full avg10=57.59 avg60=58.06 avg300=60.38 total=3300487258 The some line is the same as for cpu, the time in which at least one task is stalled on the resource. In the case of memory, this includes waiting on swap-in, page cache refaults and page reclaim. The full line, however, indicates time in which *nobody* is using the CPU productively due to pressure: all non-idle tasks are waiting for memory in one form or another. Significant time spent in there is a good trigger for killing things, moving jobs to other machines, or dropping incoming requests, since neither the jobs nor the machine overall are making too much headway. The io file is similar to memory. Because the block layer doesn't have a concept of hardware contention right now (how much longer is my IO request taking due to other tasks?), it reports CPU potential lost on all IO delays, not just the potential lost due to competition. FAQ Q: How is PSI's CPU component different from the load average? A: There are several quirks in the load average that make it hard to impossible to tell how overcommitted the CPU really is. 1. The load average is reported as a raw number of active tasks. You need to know how many CPUs there are in the system, how many CPUs the workload is allowed to use, then think about what the proportion between load and the number of CPUs mean for the tasks trying to run. PSI reports the percentage of wallclock time in which tasks are waiting for a CPU to run on. It doesn't matter how many CPUs are present or usable. The number always tells the quality of life of tasks in the system or in a particular cgroup. 2. The shortest averaging window is 1m, which is extremely coarse, and it's sampled in 5s intervals. A *lot* can happen on a CPU in 5 seconds. This *may* be able to identify persistent long-term trends and very clear and obvious overloads, but it's unusable for latency spikes and more subtle overutilization. PSI's shortest window is 10s. It also exports the cumulative stall times (in microseconds) of synchronously recorded events. 3. On Linux, the load average for historical reasons includes all TASK_UNINTERRUPTIBLE tasks. This gives a broader sense of how busy the system is, but on the flipside it doesn't distinguish whether tasks are likely to contend over the CPU or IO - which obviously requires very different interventions from a sys admin or a job scheduler. PSI reports independent metrics for CPU and IO. You can tell which resource is making the tasks wait, but in conjunction still see how overloaded the system is overall. Q: What's the cost / performance impact of this feature? A: PSI's primary cost is in the scheduler, in particular task wakeups and sleeps. I benchmarked this code using Facebook's two most scheduling sensitive workloads: memcache and webserver. They handle a ton of small requests - lots of wakeups and sleeps with little actual work in between - so they tend to be canaries for scheduler regressions. In the tests, the boxes were handling live traffic over the course of several hours. Half the machines, the control, ran with CONFIG_PSI=n. For memcache I used eight machines total. They're 2-socket, 14 core, 56 thread boxes. The test runs for half the test period, flips the test and control kernels on the hardware to rule out HW factors, DC location etc., then runs the other half of the test. For the webservers, I used 32 machines total. They're single socket, 16 core, 32 thread machines. During the memcache test, CPU load was nopsi=78.05% psi=78.98% in the first half and nopsi=77.52% psi=78.25%, so PSI added between 0.7 and 0.9 percentage points to the CPU load, a difference of about 1%. UPDATE: I re-ran this test with the v3 version of this patch set and the CPU utilization was equivalent between test and control. UPDATE: v4 is on par with v3. As far as end-to-end request latency from the client perspective goes, we don't sample those finely enough to capture the requests going to those particular machines during the test, but we know the p50 turnaround time in this workload is 54us, and perf bench sched pipe on those machines show nopsi=5.232666 us/op and psi=5.587347 us/op, so this doesn't add much here either. The profile for the pipe benchmark shows: 0.87% sched-pipe [kernel.vmlinux] [k] psi_group_change 0.83% perf.real [kernel.vmlinux] [k] psi_group_change 0.82% perf.real [kernel.vmlinux] [k] psi_task_change 0.58% sched-pipe [kernel.vmlinux] [k] psi_task_change The webserver load is running inside 4 nested cgroup levels. The CPU load with both nopsi and psi kernels was indistinguishable at 81%. For comparison, we had to disable the cgroup cpu controller on the webservers because it added 4 percentage points to the CPU% during this same exact test. Versions of this accounting code now run on 80% of our fleet. None of our workloads have reported regressions during the rollout. Daniel Drake said: : I just retested the latest version at : http://git.cmpxchg.org/cgit.cgi/linux-psi.git (Linux 4.18) and the results : are great. : : Test setup: : Endless OS : GeminiLake N4200 low end laptop : 2GB RAM : swap (and zram swap) disabled : : Baseline test: open a handful of large-ish apps and several website : tabs in Google Chrome. : : Results: after a couple of minutes, system is excessively thrashing, mouse : cursor can barely be moved, UI is not responding to mouse clicks, so it's : impractical to recover from this situation as an ordinary user : : Add my simple killer: : https://gist.github.com/dsd/a8988bf0b81a6163475988120fe8d9cd : : Results: when the thrashing causes the UI to become sluggish, the killer : steps in and kills something (usually a chrome tab), and the system : remains usable. I repeatedly opened more apps and more websites over a 15 : minute period but I wasn't able to get the system to a point of UI : unresponsiveness. Suren said: : Backported to 4.9 and retested on ARMv8 8 code system running Android. : Signals behave as expected reacting to memory pressure, no jumps in : "total" counters that would indicate an overflow/underflow issues. Nicely : done! This patch (of 9): If we keep just enough refault information to match the *current* page cache during reclaim time, we could lose a lot of events when there is only a temporary spike in non-cache memory consumption that pushes out all the cache. Once cache comes back, we won't see those refaults. They might not be actionable for LRU aging, but we want to know about them for measuring memory pressure. [hannes@cmpxchg.org: switch to NUMA-aware lru and slab counters] Link: http://lkml.kernel.org/r/20181009184732.762-2-hannes@cmpxchg.org Link: http://lkml.kernel.org/r/20180828172258.3185-2-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Peter Zijlstra (Intel) Reviewed-by: Rik van Riel Tested-by: Daniel Drake Tested-by: Suren Baghdasaryan Cc: Ingo Molnar Cc: Tejun Heo Cc: Vinayak Menon Cc: Christopher Lameter Cc: Peter Enderborg Cc: Shakeel Butt Cc: Mike Galbraith Cc: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f0d77874143df90f9831f30254eb149fc4d76b40 Author: Vlastimil Babka Date: Fri Oct 26 15:05:55 2018 -0700 mm, slab: shorten kmalloc cache names for large sizes Kmalloc cache names can get quite long for large object sizes, when the sizes are expressed in bytes. Use 'k' and 'M' prefixes to make the names as short as possible e.g. in /proc/slabinfo. This works, as we mostly use power-of-two sizes, with exceptions only below 1k. Example: 'kmalloc-4194304' becomes 'kmalloc-4M' Link: http://lkml.kernel.org/r/20180731090649.16028-7-vbabka@suse.cz Suggested-by: Matthew Wilcox Signed-off-by: Vlastimil Babka Acked-by: Mel Gorman Acked-by: Christoph Lameter Acked-by: Roman Gushchin Cc: David Rientjes Cc: Johannes Weiner Cc: Joonsoo Kim Cc: Laura Abbott Cc: Michal Hocko Cc: Sumit Semwal Cc: Vijayanand Jitta Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 61f94e18de94f79abaad3bb83549ff78923ac785 Author: Vlastimil Babka Date: Fri Oct 26 15:05:50 2018 -0700 mm, proc: add KReclaimable to /proc/meminfo The vmstat NR_KERNEL_MISC_RECLAIMABLE counter is for kernel non-slab allocations that can be reclaimed via shrinker. In /proc/meminfo, we can show the sum of all reclaimable kernel allocations (including slab) as "KReclaimable". Add the same counter also to per-node meminfo under /sys With this counter, users will have more complete information about kernel memory usage. Non-slab reclaimable pages (currently just the ION allocator) will not be missing from /proc/meminfo, making users wonder where part of their memory went. More precisely, they already appear in MemAvailable, but without the new counter, it's not obvious why the value in MemAvailable doesn't fully correspond with the sum of other counters participating in it. Link: http://lkml.kernel.org/r/20180731090649.16028-6-vbabka@suse.cz Signed-off-by: Vlastimil Babka Acked-by: Roman Gushchin Cc: Christoph Lameter Cc: David Rientjes Cc: Johannes Weiner Cc: Joonsoo Kim Cc: Laura Abbott Cc: Matthew Wilcox Cc: Mel Gorman Cc: Michal Hocko Cc: Sumit Semwal Cc: Vijayanand Jitta Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b29940c1abd7a4c3abeb926df0a5ec84d6902d47 Author: Vlastimil Babka Date: Fri Oct 26 15:05:46 2018 -0700 mm: rename and change semantics of nr_indirectly_reclaimable_bytes The vmstat counter NR_INDIRECTLY_RECLAIMABLE_BYTES was introduced by commit eb59254608bc ("mm: introduce NR_INDIRECTLY_RECLAIMABLE_BYTES") with the goal of accounting objects that can be reclaimed, but cannot be allocated via a SLAB_RECLAIM_ACCOUNT cache. This is now possible via kmalloc() with __GFP_RECLAIMABLE flag, and the dcache external names user is converted. The counter is however still useful for accounting direct page allocations (i.e. not slab) with a shrinker, such as the ION page pool. So keep it, and: - change granularity to pages to be more like other counters; sub-page allocations should be able to use kmalloc - rename the counter to NR_KERNEL_MISC_RECLAIMABLE - expose the counter again in vmstat as "nr_kernel_misc_reclaimable"; we can again remove the check for not printing "hidden" counters Link: http://lkml.kernel.org/r/20180731090649.16028-5-vbabka@suse.cz Signed-off-by: Vlastimil Babka Acked-by: Christoph Lameter Acked-by: Roman Gushchin Cc: Vijayanand Jitta Cc: Laura Abbott Cc: Sumit Semwal Cc: David Rientjes Cc: Johannes Weiner Cc: Joonsoo Kim Cc: Matthew Wilcox Cc: Mel Gorman Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2e03b4bc4ae84fcc0eee00e5ba5d228901d38809 Author: Vlastimil Babka Date: Fri Oct 26 15:05:41 2018 -0700 dcache: allocate external names from reclaimable kmalloc caches We can use the newly introduced kmalloc-reclaimable-X caches, to allocate external names in dcache, which will take care of the proper accounting automatically, and also improve anti-fragmentation page grouping. This effectively reverts commit f1782c9bc547 ("dcache: account external names as indirectly reclaimable memory") and instead passes __GFP_RECLAIMABLE to kmalloc(). The accounting thus moves from NR_INDIRECTLY_RECLAIMABLE_BYTES to NR_SLAB_RECLAIMABLE, which is also considered in MemAvailable calculation and overcommit decisions. Link: http://lkml.kernel.org/r/20180731090649.16028-4-vbabka@suse.cz Signed-off-by: Vlastimil Babka Acked-by: Mel Gorman Acked-by: Roman Gushchin Cc: Christoph Lameter Cc: David Rientjes Cc: Johannes Weiner Cc: Joonsoo Kim Cc: Laura Abbott Cc: Matthew Wilcox Cc: Michal Hocko Cc: Sumit Semwal Cc: Vijayanand Jitta Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1291523f2c1d631fea34102fd241fb54a4e8f7a0 Author: Vlastimil Babka Date: Fri Oct 26 15:05:38 2018 -0700 mm, slab/slub: introduce kmalloc-reclaimable caches Kmem caches can be created with a SLAB_RECLAIM_ACCOUNT flag, which indicates they contain objects which can be reclaimed under memory pressure (typically through a shrinker). This makes the slab pages accounted as NR_SLAB_RECLAIMABLE in vmstat, which is reflected also the MemAvailable meminfo counter and in overcommit decisions. The slab pages are also allocated with __GFP_RECLAIMABLE, which is good for anti-fragmentation through grouping pages by mobility. The generic kmalloc-X caches are created without this flag, but sometimes are used also for objects that can be reclaimed, which due to varying size cannot have a dedicated kmem cache with SLAB_RECLAIM_ACCOUNT flag. A prominent example are dcache external names, which prompted the creation of a new, manually managed vmstat counter NR_INDIRECTLY_RECLAIMABLE_BYTES in commit f1782c9bc547 ("dcache: account external names as indirectly reclaimable memory"). To better handle this and any other similar cases, this patch introduces SLAB_RECLAIM_ACCOUNT variants of kmalloc caches, named kmalloc-rcl-X. They are used whenever the kmalloc() call passes __GFP_RECLAIMABLE among gfp flags. They are added to the kmalloc_caches array as a new type. Allocations with both __GFP_DMA and __GFP_RECLAIMABLE will use a dma type cache. This change only applies to SLAB and SLUB, not SLOB. This is fine, since SLOB's target are tiny system and this patch does add some overhead of kmem management objects. Link: http://lkml.kernel.org/r/20180731090649.16028-3-vbabka@suse.cz Signed-off-by: Vlastimil Babka Acked-by: Mel Gorman Acked-by: Christoph Lameter Acked-by: Roman Gushchin Cc: David Rientjes Cc: Johannes Weiner Cc: Joonsoo Kim Cc: Laura Abbott Cc: Matthew Wilcox Cc: Michal Hocko Cc: Sumit Semwal Cc: Vijayanand Jitta Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cc252eae85e09552f9c1e7ac0c3227f835efdf2d Author: Vlastimil Babka Date: Fri Oct 26 15:05:34 2018 -0700 mm, slab: combine kmalloc_caches and kmalloc_dma_caches Patch series "kmalloc-reclaimable caches", v4. As discussed at LSF/MM [1] here's a patchset that introduces kmalloc-reclaimable caches (more details in the second patch) and uses them for dcache external names. That allows us to repurpose the NR_INDIRECTLY_RECLAIMABLE_BYTES counter later in the series. With patch 3/6, dcache external names are allocated from kmalloc-rcl-* caches, eliminating the need for manual accounting. More importantly, it also ensures the reclaimable kmalloc allocations are grouped in pages separate from the regular kmalloc allocations. The need for proper accounting of dcache external names has shown it's easy for misbehaving process to allocate lots of them, causing premature OOMs. Without the added grouping, it's likely that a similar workload can interleave the dcache external names allocations with regular kmalloc allocations (note: I haven't searched myself for an example of such regular kmalloc allocation, but I would be very surprised if there wasn't some). A pathological case would be e.g. one 64byte regular allocations with 63 external dcache names in a page (64x64=4096), which means the page is not freed even after reclaiming after all dcache names, and the process can thus "steal" the whole page with single 64byte allocation. If other kmalloc users similar to dcache external names become identified, they can also benefit from the new functionality simply by adding __GFP_RECLAIMABLE to the kmalloc calls. Side benefits of the patchset (that could be also merged separately) include removed branch for detecting __GFP_DMA kmalloc(), and shortening kmalloc cache names in /proc/slabinfo output. The latter is potentially an ABI break in case there are tools parsing the names and expecting the values to be in bytes. This is how /proc/slabinfo looks like after booting in virtme: ... kmalloc-rcl-4M 0 0 4194304 1 1024 : tunables 1 1 0 : slabdata 0 0 0 ... kmalloc-rcl-96 7 32 128 32 1 : tunables 120 60 8 : slabdata 1 1 0 kmalloc-rcl-64 25 128 64 64 1 : tunables 120 60 8 : slabdata 2 2 0 kmalloc-rcl-32 0 0 32 124 1 : tunables 120 60 8 : slabdata 0 0 0 kmalloc-4M 0 0 4194304 1 1024 : tunables 1 1 0 : slabdata 0 0 0 kmalloc-2M 0 0 2097152 1 512 : tunables 1 1 0 : slabdata 0 0 0 kmalloc-1M 0 0 1048576 1 256 : tunables 1 1 0 : slabdata 0 0 0 ... /proc/vmstat with renamed nr_indirectly_reclaimable_bytes counter: ... nr_slab_reclaimable 2817 nr_slab_unreclaimable 1781 ... nr_kernel_misc_reclaimable 0 ... /proc/meminfo with new KReclaimable counter: ... Shmem: 564 kB KReclaimable: 11260 kB Slab: 18368 kB SReclaimable: 11260 kB SUnreclaim: 7108 kB KernelStack: 1248 kB ... This patch (of 6): The kmalloc caches currently mainain separate (optional) array kmalloc_dma_caches for __GFP_DMA allocations. There are tests for __GFP_DMA in the allocation hotpaths. We can avoid the branches by combining kmalloc_caches and kmalloc_dma_caches into a single two-dimensional array where the outer dimension is cache "type". This will also allow to add kmalloc-reclaimable caches as a third type. Link: http://lkml.kernel.org/r/20180731090649.16028-2-vbabka@suse.cz Signed-off-by: Vlastimil Babka Acked-by: Mel Gorman Acked-by: Christoph Lameter Acked-by: Roman Gushchin Cc: Michal Hocko Cc: Johannes Weiner Cc: David Rientjes Cc: Joonsoo Kim Cc: Matthew Wilcox Cc: Laura Abbott Cc: Sumit Semwal Cc: Vijayanand Jitta Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3b9aadf7278d16d7bed4d5d808501065f70898d8 Author: Andrea Arcangeli Date: Fri Oct 26 15:05:16 2018 -0700 userfaultfd: allow get_mempolicy(MPOL_F_NODE|MPOL_F_ADDR) to trigger userfaults get_mempolicy(MPOL_F_NODE|MPOL_F_ADDR) called a get_user_pages that would not be waiting for userfaults before failing and it would hit on a SIGBUS instead. Using get_user_pages_locked/unlocked instead will allow get_mempolicy to allow userfaults to resolve the fault and fill the hole, before grabbing the node id of the page. If the user calls get_mempolicy() with MPOL_F_ADDR | MPOL_F_NODE for an address inside an area managed by uffd and there is no page at that address, the page allocation from within get_mempolicy() will fail because get_user_pages() does not allow for page fault retry required for uffd; the user will get SIGBUS. With this patch, the page fault will be resolved by the uffd and the get_mempolicy() will continue normally. Background: Via code review, previously the syscall would have returned -EFAULT (vm_fault_to_errno), now it will block and wait for an userfault (if it's waken before the fault is resolved it'll still -EFAULT). This way get_mempolicy will give a chance to an "unaware" app to be compliant with userfaults. The reason this visible change is that becoming "userfault compliant" cannot regress anything: all other syscalls including read(2)/write(2) had to become "userfault compliant" long time ago (that's one of the things userfaultfd can do that PROT_NONE and trapping segfaults can't). So this is just one more syscall that become "userfault compliant" like all other major ones already were. This has been happening on virtio-bridge dpdk process which just called get_mempolicy on the guest space post live migration, but before the memory had a chance to be migrated to destination. I didn't run an strace to be able to show the -EFAULT going away, but I've the confirmation of the below debug aid information (only visible with CONFIG_DEBUG_VM=y) going away with the patch: [20116.371461] FAULT_FLAG_ALLOW_RETRY missing 0 [20116.371464] CPU: 1 PID: 13381 Comm: vhost-events Not tainted 4.17.12-200.fc28.x86_64 #1 [20116.371465] Hardware name: LENOVO 20FAS2BN0A/20FAS2BN0A, BIOS N1CET54W (1.22 ) 02/10/2017 [20116.371466] Call Trace: [20116.371473] dump_stack+0x5c/0x80 [20116.371476] handle_userfault.cold.37+0x1b/0x22 [20116.371479] ? remove_wait_queue+0x20/0x60 [20116.371481] ? poll_freewait+0x45/0xa0 [20116.371483] ? do_sys_poll+0x31c/0x520 [20116.371485] ? radix_tree_lookup_slot+0x1e/0x50 [20116.371488] shmem_getpage_gfp+0xce7/0xe50 [20116.371491] ? page_add_file_rmap+0x1a/0x2c0 [20116.371493] shmem_fault+0x78/0x1e0 [20116.371495] ? filemap_map_pages+0x3a1/0x450 [20116.371498] __do_fault+0x1f/0xc0 [20116.371500] __handle_mm_fault+0xe2e/0x12f0 [20116.371502] handle_mm_fault+0xda/0x200 [20116.371504] __get_user_pages+0x238/0x790 [20116.371506] get_user_pages+0x3e/0x50 [20116.371510] kernel_get_mempolicy+0x40b/0x700 [20116.371512] ? vfs_write+0x170/0x1a0 [20116.371515] __x64_sys_get_mempolicy+0x21/0x30 [20116.371517] do_syscall_64+0x5b/0x160 [20116.371520] entry_SYSCALL_64_after_hwframe+0x44/0xa9 The above harmless debug message (not a kernel crash, just a dump_stack()) is shown with CONFIG_DEBUG_VM=y to more quickly identify and improve kernel spots that may have to become "userfaultfd compliant" like this one (without having to run an strace and search for syscall misbehavior). Spots like the above are more closer to a kernel bug for the non-cooperative usages that Mike focuses on, than for for dpdk qemu-cooperative usages that reproduced it, but it's still nicer to get this fixed for dpdk too. The part of the patch that caused me to think is only the implementation issue of mpol_get, but it looks like it should work safe no matter the kind of mempolicy structure that is (the default static policy also starts at 1 so it'll go to 2 and back to 1 without crashing everything at 0). [rppt@linux.vnet.ibm.com: changelog addition] http://lkml.kernel.org/r/20180904073718.GA26916@rapoport-lnx Link: http://lkml.kernel.org/r/20180831214848.23676-1-aarcange@redhat.com Signed-off-by: Andrea Arcangeli Reported-by: Maxime Coquelin Tested-by: Dr. David Alan Gilbert Reviewed-by: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6471f52af786fc9cb82bf1af9d086fb09c62f99b Author: Mike Rapoport Date: Fri Oct 26 15:05:10 2018 -0700 alpha: switch to NO_BOOTMEM Replace bootmem allocator with memblock and enable use of NO_BOOTMEM like on most other architectures. Alpha gets the description of the physical memory from the firmware as an array of memory clusters. Each cluster that is not reserved by the firmware is added to memblock.memory. Once the memblock.memory is set up, we reserve the kernel and initrd pages with memblock reserve. Since we don't need the bootmem bitmap anymore, the code that finds an appropriate place is removed. The conversion does not take care of NUMA support which is marked broken for more than 10 years now. Link: http://lkml.kernel.org/r/1535952894-10967-1-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Cc: Richard Henderson Cc: Ivan Kokshaysky Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e92d39cdb120219a16502ca646d407d61cd7adf4 Author: Mike Rapoport Date: Fri Oct 26 15:05:05 2018 -0700 unicore32: switch to NO_BOOTMEM The unicore32 architecture already supports memblock and uses it for some early memory reservations, e.g initrd and the page tables. At some point unicore32 allocates the bootmem bitmap from the memblock and then hands over the memory reservations from memblock to bootmem. This patch removes the bootmem initialization and leaves memblock as the only boot time memory manager for unicore32. Link: http://lkml.kernel.org/r/1533326330-31677-8-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Guan Xuetao Cc: Ley Foon Tan Cc: Richard Kuo Cc: Richard Weinberger Cc: Rob Herring Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ddf63983576ac2520d13a49f03f2d382ac60e2c7 Author: Mike Rapoport Date: Fri Oct 26 15:05:02 2018 -0700 um: switch to NO_BOOTMEM Replace bootmem initialization with memblock_add and memblock_reserve calls and explicit initialization of {min,max}_low_pfn. Link: http://lkml.kernel.org/r/1533326330-31677-7-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Richard Weinberger Cc: Guan Xuetao Cc: Ley Foon Tan Cc: Richard Kuo Cc: Rob Herring Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit be6ec5b1eecf1c5e985831540b90a320a9ed3aa5 Author: Mike Rapoport Date: Fri Oct 26 15:04:58 2018 -0700 um: setup_physmem: stop using global variables The setup_physmem() function receives uml_physmem and uml_reserved as parameters and still used these global variables. Replace such usage with local variables. Link: http://lkml.kernel.org/r/1533326330-31677-6-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Richard Weinberger Cc: Guan Xuetao Cc: Ley Foon Tan Cc: Richard Kuo Cc: Rob Herring Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0042379279bcac871d2a60172f942a3a255ec611 Author: Mike Rapoport Date: Fri Oct 26 15:04:55 2018 -0700 nios2: switch to NO_BOOTMEM Remove bootmem bitmap initialization and replace reserve_bootmem() with memblock_reserve(). Link: http://lkml.kernel.org/r/1533326330-31677-5-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Ley Foon Tan Cc: Guan Xuetao Cc: Richard Kuo Cc: Richard Weinberger Cc: Rob Herring Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a811c05c16b53ff89e9cfc029ec77a0aae846881 Author: Mike Rapoport Date: Fri Oct 26 15:04:51 2018 -0700 nios2: use generic early_init_dt_add_memory_arch All we have to do is to enable memblock, the generic FDT code will take care of the rest. Link: http://lkml.kernel.org/r/1533326330-31677-4-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Ley Foon Tan Cc: Guan Xuetao Cc: Richard Kuo Cc: Richard Weinberger Cc: Rob Herring Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6072cf567a2be7f13fb3522156409ca0e7a27ff9 Author: Mike Rapoport Date: Fri Oct 26 15:04:48 2018 -0700 of: ignore sub-page memory regions Memory region size is rounded down to page boundary and with sub-page region it becomes 0 and there is no point to add an empty region. Moreover, when the base is less than PAGE_SIZE we get a bogus size as (base + size - 1) evaluates to -1. 8cccffc52694 ("of: check for size < 0 after rounding in early_init_dt_add_memory_arch") introduced a test for wrap around for the case when base is not page aligned, the same test can be used to ignore sub-page region sizes. Link: http://lkml.kernel.org/r/1533326330-31677-3-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Reviewed-by: Rob Herring Cc: Guan Xuetao Cc: Ley Foon Tan Cc: Richard Kuo Cc: Richard Weinberger Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 426dcd4b600f72d9f797eae385d85af4128589cc Author: Mike Rapoport Date: Fri Oct 26 15:04:44 2018 -0700 hexagon: switch to NO_BOOTMEM Patch series "switch several architectures NO_BOOTMEM". These patches perform conversion to NO_BOOTMEM of hexagon, nios2, uml and unicore32. This patch (of 7): Add registration of the system memory with memblock, eliminate bootmem initialization and convert early memory reservations from bootmem to memblock. Link: http://lkml.kernel.org/r/1533326330-31677-2-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Acked-by: Richard Kuo Cc: Guan Xuetao Cc: Ley Foon Tan Cc: Richard Weinberger Cc: Rob Herring Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9b5a8e00d479bb5e55f6902bf50877c080d9506d Author: Matthew Wilcox Date: Fri Oct 26 15:04:40 2018 -0700 mm: convert insert_pfn() to vm_fault_t All callers convert its errno into a vm_fault_t, so convert it to return a vm_fault_t directly. Link: http://lkml.kernel.org/r/20180828145728.11873-11-willy@infradead.org Signed-off-by: Matthew Wilcox Reviewed-by: Andrew Morton Cc: Nicolas Pitre Cc: Souptick Joarder Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 79f3aa5ba989a1fa6e2ef189f2abdfcee25ba663 Author: Matthew Wilcox Date: Fri Oct 26 15:04:37 2018 -0700 mm: convert __vm_insert_mixed() to vm_fault_t Both of its callers currently convert its errno return into a vm_fault_t, so move the conversion into __vm_insert_mixed(). Link: http://lkml.kernel.org/r/20180828145728.11873-10-willy@infradead.org Signed-off-by: Matthew Wilcox Reviewed-by: Andrew Morton Cc: Nicolas Pitre Cc: Souptick Joarder Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6d958546ff611c9ae09b181e628c1c5d5da5ebda Author: Matthew Wilcox Date: Fri Oct 26 15:04:33 2018 -0700 mm: inline vm_insert_pfn_prot() into caller vm_insert_pfn_prot() is only called from vmf_insert_pfn_prot(), so inline it and convert some of the errnos into vm_fault codes earlier. Link: http://lkml.kernel.org/r/20180828145728.11873-9-willy@infradead.org Signed-off-by: Matthew Wilcox Reviewed-by: Andrew Morton Cc: Nicolas Pitre Cc: Souptick Joarder Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ae2b01f37044c10e975d22116755df56252b09d8 Author: Matthew Wilcox Date: Fri Oct 26 15:04:29 2018 -0700 mm: remove vm_insert_pfn() All callers are now converted to vmf_insert_pfn() so convert vmf_insert_pfn() from being a compatibility wrapper around vm_insert_pfn() to being a compatibility wrapper around vmf_insert_pfn_prot(). Link: http://lkml.kernel.org/r/20180828145728.11873-8-willy@infradead.org Signed-off-by: Matthew Wilcox Reviewed-by: Andrew Morton Cc: Nicolas Pitre Cc: Souptick Joarder Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 67fa1666223d7c825f6651add97f0011fe155f36 Author: Matthew Wilcox Date: Fri Oct 26 15:04:26 2018 -0700 mm: remove references to vm_insert_pfn() Documentation and comments. Link: http://lkml.kernel.org/r/20180828145728.11873-7-willy@infradead.org Signed-off-by: Matthew Wilcox Reviewed-by: Andrew Morton Cc: Nicolas Pitre Cc: Souptick Joarder Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bc12e6ad9617831727e4201e7cbf5c3b868cc8fd Author: Matthew Wilcox Date: Fri Oct 26 15:04:21 2018 -0700 mm: make vm_insert_pfn_prot() static Now this is no longer used outside mm/memory.c, make it static. Link: http://lkml.kernel.org/r/20180828145728.11873-6-willy@infradead.org Signed-off-by: Matthew Wilcox Reviewed-by: Andrew Morton Cc: Nicolas Pitre Cc: Souptick Joarder Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b13fd1dc9f853835784c4c7e09f2059128986adb Author: Matthew Wilcox Date: Fri Oct 26 15:04:16 2018 -0700 x86: convert vdso to use vm_fault_t Return vm_fault_t codes directly from the appropriate mm routines instead of converting from errnos ourselves. Fixes a minor bug where we'd return SIGBUS instead of the correct OOM code if we ran out of memory allocating page tables. Link: http://lkml.kernel.org/r/20180828145728.11873-5-willy@infradead.org Signed-off-by: Matthew Wilcox Reviewed-by: Thomas Gleixner Reviewed-by: Andrew Morton Cc: Nicolas Pitre Cc: Souptick Joarder Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f5e6d1d5f8f3080aa7a51acea1f77085f45abe9c Author: Matthew Wilcox Date: Fri Oct 26 15:04:13 2018 -0700 mm: introduce vmf_insert_pfn_prot() Like vm_insert_pfn_prot(), but returns a vm_fault_t instead of an errno. Also unexport vm_insert_pfn_prot as it has no modular users. Link: http://lkml.kernel.org/r/20180828145728.11873-4-willy@infradead.org Signed-off-by: Matthew Wilcox Reviewed-by: Andrew Morton Cc: Nicolas Pitre Cc: Souptick Joarder Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5d7476374564645b1a2d299e242ad7b17b1104ee Author: Matthew Wilcox Date: Fri Oct 26 15:04:10 2018 -0700 mm: remove vm_insert_mixed() All callers are now converted to vmf_insert_mixed() so convert vmf_insert_mixed() from being a compatibility wrapper into the real function. Link: http://lkml.kernel.org/r/20180828145728.11873-3-willy@infradead.org Signed-off-by: Matthew Wilcox Reviewed-by: Andrew Morton Cc: Nicolas Pitre Cc: Souptick Joarder Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7f2764cfbd85a18170f9d7a4cf01454dead8b0bc Author: Nicolas Pitre Date: Fri Oct 26 15:04:06 2018 -0700 cramfs: convert to use vmf_insert_mixed cramfs is the only remaining user of vm_insert_mixed() and should be converted to vmf_insert_mixed(). Based on a previous patch from Matthew Wilcox. Link: http://lkml.kernel.org/r/nycvar.YSQ.7.76.1808290945450.10215@knanqh.ubzr Signed-off-by: Nicolas Pitre Reviewed-by: Andrew Morton Cc: Souptick Joarder a Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4b96a37d1c684f12468f436c0d79b5e6830d0b0b Author: Souptick Joarder Date: Fri Oct 26 15:04:03 2018 -0700 mm: convert to use vm_fault_t As part of vm_fault_t conversion filemap_page_mkwrite() for the NOMMU case was missed. Now converted. Link: http://lkml.kernel.org/r/20180828174952.GA29229@jordon-HP-15-Notebook-PC Signed-off-by: Souptick Joarder Reviewed-by: Andrew Morton Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7b0e0c0e35f5c7eca719404ca0e38bc964657330 Author: Oscar Salvador Date: Fri Oct 26 15:03:58 2018 -0700 mm/page_alloc.c: clean up check_for_memory() check_for_memory() looks a bit confusing. First of all, we have this: if (N_MEMORY == N_NORMAL_MEMORY) return; Checking the ENUM declaration, looks like N_MEMORY canot be equal to N_NORMAL_MEMORY. I could not find where N_MEMORY is set to N_NORMAL_MEMORY, or the other way around either, so unless I am missing something, this condition will never evaluate to true. It makes sense to get rid of it. Moving forward, the operations within the loop look a bit confusing as well. We set N_HIGH_MEMORY unconditionally, and then we set N_NORMAL_MEMORY in case we have CONFIG_HIGHMEM (N_NORMAL_MEMORY != N_HIGH_MEMORY) and zone <= ZONE_NORMAL. (N_HIGH_MEMORY falls back to N_NORMAL_MEMORY on !CONFIG_HIGHMEM systems, and that is why we can just go ahead and set N_HIGH_MEMORY unconditionally) Although this works, it is a bit subtle. I think that this could be easier to follow: First, we should only set N_HIGH_MEMORY in case we have CONFIG_HIGHMEM. And then we should set N_NORMAL_MEMORY in case zone <= ZONE_NORMAL, without further checking whether we have CONFIG_HIGHMEM or not. Link: http://lkml.kernel.org/r/20180828210158.4617-1-osalvador@techadventures.net Signed-off-by: Oscar Salvador Reviewed-by: Andrew Morton Cc: Michael Hocko Cc: Vlastimil Babka Cc: Pavel Tatashin Cc: Joonsoo Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 979aafa5919b106a65646ac5f73f8354c0164e63 Author: Huang Ying Date: Fri Oct 26 15:03:53 2018 -0700 mm/swapfile.c: clear si->swap_map[] in swap_free_cluster() si->swap_map[] of the swap entries in cluster needs to be cleared during freeing. Previously, this is done in the caller of swap_free_cluster(). This may cause code duplication (one user now, will add more users later) and lock/unlock cluster unnecessarily. In this patch, the clearing code is moved to swap_free_cluster() to avoid the downside. Link: http://lkml.kernel.org/r/20180827075535.17406-4-ying.huang@intel.com Signed-off-by: "Huang, Ying" Reviewed-by: Andrew Morton Cc: Dave Hansen Cc: Michal Hocko Cc: Johannes Weiner Cc: Shaohua Li Cc: Hugh Dickins Cc: Minchan Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 10e364da10d73ce4e3b61e1c53319ce93ee51c63 Author: Huang Ying Date: Fri Oct 26 15:03:49 2018 -0700 mm/swapfile.c: call free_swap_slot() in __swap_entry_free() This is a code cleanup patch without functionality change. Originally, when __swap_entry_free() is called, and its return value is 0, free_swap_slot() will always be called to free the swap entry to the per-CPU pool. So move the call to free_swap_slot() to __swap_entry_free() to simplify the code. Link: http://lkml.kernel.org/r/20180827075535.17406-3-ying.huang@intel.com Signed-off-by: "Huang, Ying" Reviewed-by: Andrew Morton Cc: Dave Hansen Cc: Michal Hocko Cc: Johannes Weiner Cc: Shaohua Li Cc: Hugh Dickins Cc: Minchan Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bcd49e86710b42f15c7512de594d23b3ae0b21d7 Author: Huang Ying Date: Fri Oct 26 15:03:46 2018 -0700 mm/swapfile.c: use __try_to_reclaim_swap() in free_swap_and_cache() The code path to reclaim the swap entry in free_swap_and_cache() is almost same as that of __try_to_reclaim_swap(). The largest difference is just coding style. So the support to the additional requirement of free_swap_and_cache() is added into __try_to_reclaim_swap(). free_swap_and_cache() is changed to call __try_to_reclaim_swap(), and delete the duplicated code. This will improve code readability and reduce the potential bugs. There are 2 functionality differences between __try_to_reclaim_swap() and swap entry reclaim code of free_swap_and_cache(). - free_swap_and_cache() only reclaims the swap entry if the page is unmapped or swap is getting full. The support has been added into __try_to_reclaim_swap(). - try_to_free_swap() (called by __try_to_reclaim_swap()) checks pm_suspended_storage(), while free_swap_and_cache() not. I think this is OK. Because the page and the swap entry can be reclaimed later eventually. Link: http://lkml.kernel.org/r/20180827075535.17406-2-ying.huang@intel.com Signed-off-by: "Huang, Ying" Reviewed-by: Andrew Morton Cc: Dave Hansen Cc: Michal Hocko Cc: Johannes Weiner Cc: Shaohua Li Cc: Hugh Dickins Cc: Minchan Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 154221c3e52083d9f54fa58b4e1090264969f6bc Author: Vincent Whitchurch Date: Fri Oct 26 15:03:42 2018 -0700 kmemleak: add module param to print warnings to dmesg Currently, kmemleak only prints the number of suspected leaks to dmesg but requires the user to read a debugfs file to get the actual stack traces of the objects' allocation points. Add a module option to print the full object information to dmesg too. It can be enabled with kmemleak.verbose=1 on the kernel command line, or "echo 1 > /sys/module/kmemleak/parameters/verbose": This allows easier integration of kmemleak into test systems: We have automated test infrastructure to test our Linux systems. With this option, running our tests with kmemleak is as simple as enabling kmemleak and passing this command line option; the test infrastructure knows how to save kernel logs, which will now include kmemleak reports. Without this option, the test infrastructure needs to be specifically taught to read out the kmemleak debugfs file. Removing this need for special handling makes kmemleak more similar to other kernel debug options (slab debugging, debug objects, etc). Link: http://lkml.kernel.org/r/20180903144046.21023-1-vincent.whitchurch@axis.com Signed-off-by: Vincent Whitchurch Acked-by: Catalin Marinas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4e15a073a168b62311db911a55c4d4f1500c2821 Author: Michal Hocko Date: Fri Oct 26 15:03:39 2018 -0700 Revert "mm, mmu_notifier: annotate mmu notifiers with blockable invalidate callbacks" Revert 5ff7091f5a2ca ("mm, mmu_notifier: annotate mmu notifiers with blockable invalidate callbacks"). MMU_INVALIDATE_DOES_NOT_BLOCK flags was the only one used and it is no longer needed since 93065ac753e4 ("mm, oom: distinguish blockable mode for mmu notifiers"). We now have a full support for per range !blocking behavior so we can drop the stop gap workaround which the per notifier flag was used for. Link: http://lkml.kernel.org/r/20180827112623.8992-4-mhocko@kernel.org Signed-off-by: Michal Hocko Cc: David Rientjes Cc: Boris Ostrovsky Cc: Jerome Glisse Cc: Juergen Gross Cc: Tetsuo Handa Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 33490af3f5c15757448b6c454ca93b48a333aa1b Author: Michal Hocko Date: Fri Oct 26 15:03:35 2018 -0700 mm, mmu_notifier: be explicit about range invalition non-blocking mode If invalidate_range_start() is called for !blocking mode then all callbacks have to guarantee they will no block/sleep. The same obviously applies to invalidate_range_end because this operation pairs with the former and they are called from the same context. Make sure this is appropriately documented. Link: http://lkml.kernel.org/r/20180827112623.8992-3-mhocko@kernel.org Signed-off-by: Michal Hocko Reviewed-by: Jerome Glisse Cc: Boris Ostrovsky Cc: David Rientjes Cc: Juergen Gross Cc: Tetsuo Handa Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 15f570bf3d13aa94a97234538a5110d18df03aa3 Author: Michal Hocko Date: Fri Oct 26 15:03:31 2018 -0700 mm,page_alloc: PF_WQ_WORKER threads must sleep at should_reclaim_retry() Tetsuo Handa has reported that it is possible to bypass the short sleep for PF_WQ_WORKER threads which was introduced by commit 373ccbe5927034b5 ("mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress") and lock up the system if OOM. The primary reason is that WQ_MEM_RECLAIM WQs are not guaranteed to run even when they have a rescuer available. Those workers might be essential for reclaim to make a forward progress, however. If we are too unlucky all the allocations requests can get stuck waiting for a WQ_MEM_RECLAIM work item and the system is essentially stuck in an OOM condition without much hope to move on. Tetsuo has seen the reclaim stuck on drain_local_pages_wq or xlog_cil_push_work (xfs). There might be others. Since should_reclaim_retry() should be a natural reschedule point, let's do the short sleep for PF_WQ_WORKER threads unconditionally in order to guarantee that other pending work items are started. This will workaround this problem and it is less fragile than hunting down when the sleep is missed. Having a single sleeping point is more robust. [akpm@linux-foundation.org: reflow comment to 80 cols to save a couple of lines] Link: http://lkml.kernel.org/r/20180827135101.15700-1-mhocko@kernel.org Signed-off-by: Michal Hocko Debugged-by: Tetsuo Handa Reported-by: Tetsuo Handa Reviewed-by: Andrew Morton Cc: Roman Gushchin Cc: Johannes Weiner Cc: Vladimir Davydov Cc: David Rientjes Cc: Tejun Heo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 68600f623d69da428c6163275f97ca126e1a8ec5 Author: Roman Gushchin Date: Fri Oct 26 15:03:27 2018 -0700 mm: don't miss the last page because of round-off error I've noticed, that dying memory cgroups are often pinned in memory by a single pagecache page. Even under moderate memory pressure they sometimes stayed in such state for a long time. That looked strange. My investigation showed that the problem is caused by applying the LRU pressure balancing math: scan = div64_u64(scan * fraction[lru], denominator), where denominator = fraction[anon] + fraction[file] + 1. Because fraction[lru] is always less than denominator, if the initial scan size is 1, the result is always 0. This means the last page is not scanned and has no chances to be reclaimed. Fix this by rounding up the result of the division. In practice this change significantly improves the speed of dying cgroups reclaim. [guro@fb.com: prevent double calculation of DIV64_U64_ROUND_UP() arguments] Link: http://lkml.kernel.org/r/20180829213311.GA13501@castle Link: http://lkml.kernel.org/r/20180827162621.30187-3-guro@fb.com Signed-off-by: Roman Gushchin Reviewed-by: Andrew Morton Cc: Johannes Weiner Cc: Michal Hocko Cc: Tejun Heo Cc: Rik van Riel Cc: Konstantin Khlebnikov Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 591edfb10a949d635ed770c6e85ec5286206c07e Author: Roman Gushchin Date: Fri Oct 26 15:03:23 2018 -0700 mm: drain memcg stocks on css offlining Memcg charge is batched using per-cpu stocks, so an offline memcg can be pinned by a cached charge up to a moment, when a process belonging to some other cgroup will charge some memory on the same cpu. In other words, cached charges can prevent a memory cgroup from being reclaimed for some time, without any clear need. Let's optimize it by explicit draining of all stocks on css offlining. As draining is performed asynchronously, and is skipped if any parallel draining is happening, it's cheap. Link: http://lkml.kernel.org/r/20180827162621.30187-2-guro@fb.com Signed-off-by: Roman Gushchin Reviewed-by: Shakeel Butt Acked-by: Michal Hocko Cc: Johannes Weiner Cc: Konstantin Khlebnikov Cc: Tejun Heo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9b6f7e163cd0f468d1b9696b785659d3c27c8667 Author: Roman Gushchin Date: Fri Oct 26 15:03:19 2018 -0700 mm: rework memcg kernel stack accounting If CONFIG_VMAP_STACK is set, kernel stacks are allocated using __vmalloc_node_range() with __GFP_ACCOUNT. So kernel stack pages are charged against corresponding memory cgroups on allocation and uncharged on releasing them. The problem is that we do cache kernel stacks in small per-cpu caches and do reuse them for new tasks, which can belong to different memory cgroups. Each stack page still holds a reference to the original cgroup, so the cgroup can't be released until the vmap area is released. To make this happen we need more than two subsequent exits without forks in between on the current cpu, which makes it very unlikely to happen. As a result, I saw a significant number of dying cgroups (in theory, up to 2 * number_of_cpu + number_of_tasks), which can't be released even by significant memory pressure. As a cgroup structure can take a significant amount of memory (first of all, per-cpu data like memcg statistics), it leads to a noticeable waste of memory. Link: http://lkml.kernel.org/r/20180827162621.30187-1-guro@fb.com Fixes: ac496bf48d97 ("fork: Optimize task creation by caching two thread stacks per CPU if CONFIG_VMAP_STACK=y") Signed-off-by: Roman Gushchin Reviewed-by: Shakeel Butt Acked-by: Michal Hocko Cc: Johannes Weiner Cc: Andy Lutomirski Cc: Konstantin Khlebnikov Cc: Tejun Heo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c5fd3ca06b4699e251b4a1fb808c2d5124494101 Author: Aaron Tomlin Date: Fri Oct 26 15:03:15 2018 -0700 slub: extend slub debug to handle multiple slabs Extend the slub_debug syntax to "slub_debug=[,]*", where may contain an asterisk at the end. For example, the following would poison all kmalloc slabs: slub_debug=P,kmalloc* and the following would apply the default flags to all kmalloc and all block IO slabs: slub_debug=,bio*,kmalloc* Please note that a similar patch was posted by Iliyan Malchev some time ago but was never merged: https://marc.info/?l=linux-mm&m=131283905330474&w=2 Link: http://lkml.kernel.org/r/20180928111139.27962-1-atomlin@redhat.com Signed-off-by: Aaron Tomlin Acked-by: Christoph Lameter Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Cc: Iliyan Malchev Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 61448479a9f2c954cde0cfe778cb6bec5d0a748d Author: Dmitry Vyukov Date: Fri Oct 26 15:03:12 2018 -0700 mm: don't warn about large allocations for slab Slub does not call kmalloc_slab() for sizes > KMALLOC_MAX_CACHE_SIZE, instead it falls back to kmalloc_large(). For slab KMALLOC_MAX_CACHE_SIZE == KMALLOC_MAX_SIZE and it calls kmalloc_slab() for all allocations relying on NULL return value for over-sized allocations. This inconsistency leads to unwanted warnings from kmalloc_slab() for over-sized allocations for slab. Returning NULL for failed allocations is the expected behavior. Make slub and slab code consistent by checking size > KMALLOC_MAX_CACHE_SIZE in slab before calling kmalloc_slab(). While we are here also fix the check in kmalloc_slab(). We should check against KMALLOC_MAX_CACHE_SIZE rather than KMALLOC_MAX_SIZE. It all kinda worked because for slab the constants are the same, and slub always checks the size against KMALLOC_MAX_CACHE_SIZE before kmalloc_slab(). But if we get there with size > KMALLOC_MAX_CACHE_SIZE anyhow bad things will happen. For example, in case of a newly introduced bug in slub code. Also move the check in kmalloc_slab() from function entry to the size > 192 case. This partially compensates for the additional check in slab code and makes slub code a bit faster (at least theoretically). Also drop __GFP_NOWARN in the warning check. This warning means a bug in slab code itself, user-passed flags have nothing to do with it. Nothing of this affects slob. Link: http://lkml.kernel.org/r/20180927171502.226522-1-dvyukov@gmail.com Signed-off-by: Dmitry Vyukov Reported-by: syzbot+87829a10073277282ad1@syzkaller.appspotmail.com Reported-by: syzbot+ef4e8fc3a06e9019bb40@syzkaller.appspotmail.com Reported-by: syzbot+6e438f4036df52cbb863@syzkaller.appspotmail.com Reported-by: syzbot+8574471d8734457d98aa@syzkaller.appspotmail.com Reported-by: syzbot+af1504df0807a083dbd9@syzkaller.appspotmail.com Acked-by: Christoph Lameter Acked-by: Vlastimil Babka Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0684e6526edfb4debf0a0a884834bb1a104085dc Author: Andy Shevchenko Date: Fri Oct 26 15:03:06 2018 -0700 mm/slub.c: switch to bitmap_zalloc() Switch to bitmap_zalloc() to show clearly what we are allocating. Besides that it returns pointer of bitmap type instead of opaque void *. Link: http://lkml.kernel.org/r/20180830104301.61649-1-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Acked-by: Christoph Lameter Reviewed-by: Andrew Morton Tested-by: David Rientjes Cc: Pekka Enberg Cc: Joonsoo Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 253cc22fc6a1245472b12e2162df00c5817402b7 Author: Jiri Slaby Date: Fri Oct 26 15:03:02 2018 -0700 xtensa: use generic vga.h What xtensa has in asm/vga.h is the same as what can be found in asm-generic/vga.h. So use the latter header. Link: http://lkml.kernel.org/r/20180907132219.12979-1-jslaby@suse.cz Signed-off-by: Jiri Slaby Acked-by: Max Filippov Cc: Chris Zankel Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5780a02fd1e87641ad6a8dd6891a1e890cf45c5d Author: Souptick Joarder Date: Fri Oct 26 15:02:59 2018 -0700 fs/iomap.c: change return type to vm_fault_t Change iomap_page_mkwrite() return type to vm_fault_t. see commit 1c8f422059ae ("mm: change return type to vm_fault_t") for reference. Link: http://lkml.kernel.org/r/20180827172050.GA18673@jordon-HP-15-Notebook-PC Signed-off-by: Souptick Joarder Reviewed-by: Matthew Wilcox Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 867632d6a6126a9ef3e8d8015423d90f8613f2ef Author: YueHaibing Date: Fri Oct 26 15:02:56 2018 -0700 ocfs2: remove set but not used variable 'rb' Fixes gcc '-Wunused-but-set-variable' warning: fs/ocfs2/refcounttree.c: In function 'ocfs2_create_reflink_node': fs/ocfs2/refcounttree.c:4138:31: warning: variable 'rb' set but not used [-Wunused-but-set-variable] Link: http://lkml.kernel.org/r/1536198443-113047-1-git-send-email-yuehaibing@huawei.com Signed-off-by: YueHaibing Reviewed-by: Andrew Morton Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Cc: Changwei Ge Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 999865764f5f128896402572b439269acb471022 Author: Jia-Ju Bai Date: Fri Oct 26 15:02:52 2018 -0700 fs/ocfs2/dlm/dlmdebug.c: fix a sleep-in-atomic-context bug in dlm_print_one_mle() The kernel module may sleep with holding a spinlock. The function call paths (from bottom to top) in Linux-4.16 are: [FUNC] get_zeroed_page(GFP_NOFS) fs/ocfs2/dlm/dlmdebug.c, 332: get_zeroed_page in dlm_print_one_mle fs/ocfs2/dlm/dlmmaster.c, 240: dlm_print_one_mle in __dlm_put_mle fs/ocfs2/dlm/dlmmaster.c, 255: __dlm_put_mle in dlm_put_mle fs/ocfs2/dlm/dlmmaster.c, 254: spin_lock in dlm_put_ml [FUNC] get_zeroed_page(GFP_NOFS) fs/ocfs2/dlm/dlmdebug.c, 332: get_zeroed_page in dlm_print_one_mle fs/ocfs2/dlm/dlmmaster.c, 240: dlm_print_one_mle in __dlm_put_mle fs/ocfs2/dlm/dlmmaster.c, 222: __dlm_put_mle in dlm_put_mle_inuse fs/ocfs2/dlm/dlmmaster.c, 219: spin_lock in dlm_put_mle_inuse To fix this bug, GFP_NOFS is replaced with GFP_ATOMIC. This bug is found by my static analysis tool DSAC. Link: http://lkml.kernel.org/r/20180901112528.27025-1-baijiaju1990@gmail.com Signed-off-by: Jia-Ju Bai Reviewed-by: Andrew Morton Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Cc: Changwei Ge Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0ae1c2dbdccc090762eb3c89183d7fc80dafca76 Author: Ding Xiang Date: Fri Oct 26 15:02:48 2018 -0700 ocfs2: remove unneeded null check Null check for kfree is unnecessary, so remove it. Link: http://lkml.kernel.org/r/1535704514-26559-1-git-send-email-dingxiang@cmss.chinamobile.com Signed-off-by: Ding Xiang Reviewed-by: Andrew Morton Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Cc: Changwei Ge Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2de24cb742d4f0c41358aa078bed7f089c827ac7 Author: Colin Ian King Date: Fri Oct 26 15:02:45 2018 -0700 ocfs2: remove unused pointer 'eb' Pointer 'eb' is being assigned but is never used hence it is redundant and can be removed. Cleans up clang warning: warning: variable 'eb' set but not used [-Wunused-but-set-variable] Link: http://lkml.kernel.org/r/20180828141907.10826-1-colin.king@canonical.com Signed-off-by: Colin Ian King Reviewed-by: Andrew Morton Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Cc: Changwei Ge Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 32c1b90dcd90c7f6343e1b328801f7be5f7da88d Author: Nathan Chancellor Date: Fri Oct 26 15:02:41 2018 -0700 ocfs2/dlm: remove unnecessary parentheses Clang warns when more than one set of parentheses is used for a single conditional statement: fs/ocfs2/dlm/dlmthread.c:534:18: warning: equality comparison with extraneous parentheses [-Wparentheses-equality] if ((res->owner == dlm->node_num)) { ~~~~~~~~~~~^~~~~~~~~~~~~~~~ fs/ocfs2/dlm/dlmthread.c:534:18: note: remove extraneous parentheses around the comparison to silence this warning if ((res->owner == dlm->node_num)) { ~ ^ ~ Link: http://lkml.kernel.org/r/20180924181929.6853-1-natechancellor@gmail.com Signed-off-by: Nathan Chancellor Reported-by: Nick Desaulniers Reviewed-by: Nick Desaulniers Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1f6904f72937d1867a5d62b124231069d7e71ca9 Author: Kirill Tkhai Date: Fri Oct 26 15:02:38 2018 -0700 scripts/tags.sh: add DECLARE_HASHTABLE() In addition to DEFINE_HASHTABLE() add DECLARE_ variant. Link: http://lkml.kernel.org/r/153683203215.13678.11468076350083405643.stgit@localhost.localdomain Signed-off-by: Kirill Tkhai Reviewed-by: Andrew Morton Cc: Masahiro Yamada Cc: Constantine Shulyupin Cc: Arend van Spriel Cc: Daniel Borkmann Cc: Joey Pabalinas Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0c96350a2d2f64fe777b444c995f6bb633c5d069 Author: Andrey Ryabinin Date: Fri Oct 26 15:02:34 2018 -0700 lib/test_kasan.c: add tests for several string/memory API functions Arch code may have asm implementation of string/memory API functions instead of using generic one from lib/string.c. KASAN don't see memory accesses in asm code, thus can miss many bugs. E.g. on ARM64 KASAN don't see bugs in memchr(), memcmp(), str[r]chr(), str[n]cmp(), str[n]len(). Add tests for these functions to be sure that we notice the problem on other architectures. Link: http://lkml.kernel.org/r/20180920135631.23833-3-aryabinin@virtuozzo.com Signed-off-by: Andrey Ryabinin Cc: Alexander Potapenko Cc: Ard Biesheuvel Cc: Dmitry Vyukov Cc: Kyeongdon Kim Cc: Mark Rutland Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 19a2ca0fb560fd7be7b5293c6b652c6d6078dcde Author: Andrey Ryabinin Date: Fri Oct 26 15:02:30 2018 -0700 arm64: lib: use C string functions with KASAN enabled ARM64 has asm implementation of memchr(), memcmp(), str[r]chr(), str[n]cmp(), str[n]len(). KASAN don't see memory accesses in asm code, thus it can potentially miss many bugs. Ifdef out __HAVE_ARCH_* defines of these functions when KASAN is enabled, so the generic implementations from lib/string.c will be used. We can't just remove the asm functions because efistub uses them. And we can't have two non-weak functions either, so declare the asm functions as weak. Link: http://lkml.kernel.org/r/20180920135631.23833-2-aryabinin@virtuozzo.com Signed-off-by: Andrey Ryabinin Reported-by: Kyeongdon Kim Cc: Alexander Potapenko Cc: Ard Biesheuvel Cc: Dmitry Vyukov Cc: Mark Rutland Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 74f213ea25b99fddcf34cbe07dabdb01136bcd86 Author: Andrey Ryabinin Date: Fri Oct 26 15:02:27 2018 -0700 include/linux/linkage.h: align weak symbols Since WEAK() supposed to be used instead of ENTRY() to define weak symbols, but unlike ENTRY() it doesn't have ALIGN directive. It seems there is no actual reason to not have, so let's add ALIGN to WEAK() too. Link: http://lkml.kernel.org/r/20180920135631.23833-1-aryabinin@virtuozzo.com Signed-off-by: Andrey Ryabinin Will Deacon , Catalin Marinas Cc: Kyeongdon Kim Cc: Ard Biesheuvel Cc: Alexander Potapenko Cc: Dmitry Vyukov Cc: Mark Rutland Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4d54954a197175c0dcb3c82af0c0740d0c5f827a Author: Sebastien Boisvert Date: Fri Oct 26 15:02:23 2018 -0700 include/linux/pfn_t.h: force '~' to be parsed as an unary operator Tracing the event "fs_dax:dax_pmd_insert_mapping" with perf produces this warning: [fs_dax:dax_pmd_insert_mapping] unknown op '~' It is printed in process_op (tools/lib/traceevent/event-parse.c) because '~' is parsed as a binary operator. perf reads the format of fs_dax:dax_pmd_insert_mapping ("print fmt") from /sys/kernel/debug/tracing/events/fs_dax/dax_pmd_insert_mapping/format . The format contains: ~(((u64) ~(~(((1UL) << 12)-1))) ^ \ interpreted as a binary operator by process_op(). This part is generated in the declaration of the event class dax_pmd_insert_mapping_class in include/trace/events/fs_dax.h : __print_flags_u64(__entry->pfn_val & PFN_FLAGS_MASK, "|", PFN_FLAGS_TRACE), This patch adds a pair of parentheses in the declaration of PFN_FLAGS_MASK to make sure that '~' is parsed as a unary operator by perf. The part of the format that was problematic is now: ~(((u64) (~(~(((1UL) << 12)-1)))) Now, all the '~' are parsed as unary operators. Link: http://lkml.kernel.org/r/20181021145939.8760-1-sebhtml@videotron.qc.ca Signed-off-by: Sebastien Boisvert Acked-by: Dan Williams Cc: "Steven Rostedt (VMware)" Cc: Arnaldo Carvalho de Melo Cc: "Tzvetomir Stoyanov (VMware)" Cc: Namhyung Kim Cc: Ross Zwisler Cc: Elenie Godzaridis Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ae62c16e105a869524afcf8a07ee85c5ae5d0479 Author: Christoph Hellwig Date: Fri Oct 26 15:02:19 2018 -0700 userfaultfd: disable irqs when taking the waitqueue lock userfaultfd contains howe-grown locking of the waitqueue lock, and does not disable interrupts. This relies on the fact that no one else takes it from interrupt context and violates an invariat of the normal waitqueue locking scheme. With aio poll it is easy to trigger other locks that disable interrupts (or are called from interrupt context). Link: http://lkml.kernel.org/r/20181018154101.18750-1-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Andrea Arcangeli Reviewed-by: Andrew Morton Cc: [4.19.x] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fa76da461bb0be13c8339d984dcf179151167c8f Author: Vlastimil Babka Date: Fri Oct 26 15:02:16 2018 -0700 mm: /proc/pid/smaps_rollup: fix NULL pointer deref in smaps_pte_range() Leonardo reports an apparent regression in 4.19-rc7: BUG: unable to handle kernel NULL pointer dereference at 00000000000000f0 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 3 PID: 6032 Comm: python Not tainted 4.19.0-041900rc7-lowlatency #201810071631 Hardware name: LENOVO 80UG/Toronto 4A2, BIOS 0XCN45WW 08/09/2018 RIP: 0010:smaps_pte_range+0x32d/0x540 Code: 80 00 00 00 00 74 a9 48 89 de 41 f6 40 52 40 0f 85 04 02 00 00 49 2b 30 48 c1 ee 0c 49 03 b0 98 00 00 00 49 8b 80 a0 00 00 00 <48> 8b b8 f0 00 00 00 e8 b7 ef ec ff 48 85 c0 0f 84 71 ff ff ff a8 RSP: 0018:ffffb0cbc484fb88 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000560ddb9e9000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000560ddb9e9 RDI: 0000000000000001 RBP: ffffb0cbc484fbc0 R08: ffff94a5a227a578 R09: ffff94a5a227a578 R10: 0000000000000000 R11: 0000560ddbbe7000 R12: ffffe903098ba728 R13: ffffb0cbc484fc78 R14: ffffb0cbc484fcf8 R15: ffff94a5a2e9cf48 FS: 00007f6dfb683740(0000) GS:ffff94a5aaf80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000f0 CR3: 000000011c118001 CR4: 00000000003606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __walk_page_range+0x3c2/0x6f0 walk_page_vma+0x42/0x60 smap_gather_stats+0x79/0xe0 ? gather_pte_stats+0x320/0x320 ? gather_hugetlb_stats+0x70/0x70 show_smaps_rollup+0xcd/0x1c0 seq_read+0x157/0x400 __vfs_read+0x3a/0x180 ? security_file_permission+0x93/0xc0 ? security_file_permission+0x93/0xc0 vfs_read+0x8f/0x140 ksys_read+0x55/0xc0 __x64_sys_read+0x1a/0x20 do_syscall_64+0x5a/0x110 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Decoded code matched to local compilation+disassembly points to smaps_pte_entry(): } else if (unlikely(IS_ENABLED(CONFIG_SHMEM) && mss->check_shmem_swap && pte_none(*pte))) { page = find_get_entry(vma->vm_file->f_mapping, linear_page_index(vma, addr)); Here, vma->vm_file is NULL. mss->check_shmem_swap should be false in that case, however for smaps_rollup, smap_gather_stats() can set the flag true for one vma and leave it true for subsequent vma's where it should be false. To fix, reset the check_shmem_swap flag to false. There's also related bug which sets mss->swap to shmem_swapped, which in the context of smaps_rollup overwrites any value accumulated from previous vma's. Fix that as well. Note that the report suggests a regression between 4.17.19 and 4.19-rc7, which makes the 4.19 series ending with commit 258f669e7e88 ("mm: /proc/pid/smaps_rollup: convert to single value seq_file") suspicious. But the mss was reused for rollup since 493b0e9d945f ("mm: add /proc/pid/smaps_rollup") so let's play it safe with the stable backport. Link: http://lkml.kernel.org/r/555fbd1f-4ac9-0b58-dcd4-5dc4380ff7ca@suse.cz Link: https://bugzilla.kernel.org/show_bug.cgi?id=201377 Fixes: 493b0e9d945f ("mm: add /proc/pid/smaps_rollup") Signed-off-by: Vlastimil Babka Reported-by: Leonardo Soares Müller Tested-by: Leonardo Soares Müller Cc: Greg Kroah-Hartman Cc: Daniel Colascione Cc: Alexey Dobriyan Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aab456dfa404f3a16d6f1780e62a6a8533c4d008 Author: Eric Dumazet Date: Fri Oct 26 09:33:27 2018 -0700 net/neigh: fix NULL deref in pneigh_dump_table() pneigh can have NULL device pointer, so we need to make neigh_master_filtered() and neigh_ifindex_filtered() more robust. syzbot report : kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 15867 Comm: syz-executor2 Not tainted 4.19.0+ #276 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__read_once_size include/linux/compiler.h:179 [inline] RIP: 0010:list_empty include/linux/list.h:203 [inline] RIP: 0010:netdev_master_upper_dev_get+0xa1/0x250 net/core/dev.c:6467 RSP: 0018:ffff8801bfaf7220 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc90005e92000 RDX: 0000000000000016 RSI: ffffffff860b44d9 RDI: 0000000000000005 RBP: ffff8801bfaf72b0 R08: ffff8801c4c84080 R09: fffffbfff139a580 R10: fffffbfff139a580 R11: ffffffff89cd2c07 R12: 1ffff10037f5ee45 R13: 0000000000000000 R14: ffff8801bfaf7288 R15: 00000000000000b0 FS: 00007f65cc68d700(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b33a21000 CR3: 00000001c6116000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: neigh_master_filtered net/core/neighbour.c:2367 [inline] pneigh_dump_table net/core/neighbour.c:2456 [inline] neigh_dump_info+0x7a9/0x1ce0 net/core/neighbour.c:2577 netlink_dump+0x606/0x1080 net/netlink/af_netlink.c:2244 __netlink_dump_start+0x59a/0x7c0 net/netlink/af_netlink.c:2352 netlink_dump_start include/linux/netlink.h:216 [inline] rtnetlink_rcv_msg+0x809/0xc20 net/core/rtnetlink.c:4898 netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2477 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4953 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline] netlink_unicast+0x5a5/0x760 net/netlink/af_netlink.c:1336 netlink_sendmsg+0xa18/0xfc0 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg+0xd5/0x120 net/socket.c:631 sock_write_iter+0x35e/0x5c0 net/socket.c:900 call_write_iter include/linux/fs.h:1808 [inline] new_sync_write fs/read_write.c:474 [inline] __vfs_write+0x6b8/0x9f0 fs/read_write.c:487 vfs_write+0x1fc/0x560 fs/read_write.c:549 ksys_write+0x101/0x260 fs/read_write.c:598 __do_sys_write fs/read_write.c:610 [inline] __se_sys_write fs/read_write.c:607 [inline] __x64_sys_write+0x73/0xb0 fs/read_write.c:607 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457569 Fixes: 6f52f80e8530 ("net/neigh: Extend dump filter to proxy neighbor dumps") Signed-off-by: Eric Dumazet Cc: David Ahern Reported-by: syzbot Reviewed-by: David Ahern Tested-by: David Ahern Signed-off-by: David S. Miller commit d8fd9e106fbc291167ebb675ad69234597d0fd98 Author: Daniel Borkmann Date: Sat Oct 27 00:49:02 2018 +0200 bpf: fix wrong helper enablement in cgroup local storage Commit cd3394317653 ("bpf: introduce the bpf_get_local_storage() helper function") enabled the bpf_get_local_storage() helper also for BPF program types where it does not make sense to use them. They have been added both in sk_skb_func_proto() and sk_msg_func_proto() even though both program types are not invoked in combination with cgroups, and neither through BPF_PROG_RUN_ARRAY(). In the latter the bpf_cgroup_storage_set() is set shortly before BPF program invocation. Later, the helper bpf_get_local_storage() retrieves this prior set up per-cpu pointer and hands the buffer to the BPF program. The map argument in there solely retrieves the enum bpf_cgroup_storage_type from a local storage map associated with the program and based on the type returns either the global or per-cpu storage. However, there is no specific association between the program's map and the actual content in bpf_cgroup_storage[]. Meaning, any BPF program that would have been properly run from the cgroup side through BPF_PROG_RUN_ARRAY() where bpf_cgroup_storage_set() was performed, and that is later unloaded such that prog / maps are teared down will cause a use after free if that pointer is retrieved from programs that are not run through BPF_PROG_RUN_ARRAY() but have the cgroup local storage helper enabled in their func proto. Lets just remove it from the two sock_map program types to fix it. Auditing through the types where this helper is enabled, it appears that these are the only ones where it was mistakenly allowed. Fixes: cd3394317653 ("bpf: introduce the bpf_get_local_storage() helper function") Signed-off-by: Daniel Borkmann Cc: Roman Gushchin Acked-by: John Fastabend Acked-by: Roman Gushchin Signed-off-by: Alexei Starovoitov commit f64bf6b8ae802e93231155b0d92a619d896cd0bd Author: Mike Manning Date: Fri Oct 26 12:24:35 2018 +0100 net: allow traceroute with a specified interface in a vrf Traceroute executed in a vrf succeeds if no device is given or if the vrf is given as the device, but fails if the interface is given as the device. This is for default UDP probes, it succeeds for TCP SYN or ICMP ECHO probes. As the skb bound dev is the interface and the sk dev is the vrf, sk lookup fails for ICMP_DEST_UNREACH and ICMP_TIME_EXCEEDED messages. The solution is for the secondary dev to be passed so that the interface is available for the device match to succeed, in the same way as is already done for non-error cases. Signed-off-by: Mike Manning Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 5a2de63fd1a59c30c02526d427bc014b98adf508 Author: Hangbin Liu Date: Fri Oct 26 10:28:43 2018 +0800 bridge: do not add port to router list when receives query with source 0.0.0.0 Based on RFC 4541, 2.1.1. IGMP Forwarding Rules The switch supporting IGMP snooping must maintain a list of multicast routers and the ports on which they are attached. This list can be constructed in any combination of the following ways: a) This list should be built by the snooping switch sending Multicast Router Solicitation messages as described in IGMP Multicast Router Discovery [MRDISC]. It may also snoop Multicast Router Advertisement messages sent by and to other nodes. b) The arrival port for IGMP Queries (sent by multicast routers) where the source address is not 0.0.0.0. We should not add the port to router list when receives query with source 0.0.0.0. Reported-by: Ying Xu Signed-off-by: Hangbin Liu Acked-by: Nikolay Aleksandrov Acked-by: Roopa Prabhu Signed-off-by: David S. Miller commit fb692ec4117f6fd25044cfb5720d6b79d400dc65 Author: Karsten Graul Date: Thu Oct 25 13:25:28 2018 +0200 net/smc: fix smc_buf_unuse to use the lgr pointer The pointer to the link group is unset in the smc connection structure right before the call to smc_buf_unuse. Provide the lgr pointer to smc_buf_unuse explicitly. And move the call to smc_lgr_schedule_free_work to the end of smc_conn_free. Fixes: a6920d1d130c ("net/smc: handle unregistered buffers") Signed-off-by: Karsten Graul Signed-off-by: Ursula Braun Signed-off-by: David S. Miller commit ee1abcf689353f36d9322231b4320926096bdee0 Author: Stefano Brivio Date: Wed Oct 24 14:37:21 2018 +0200 ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are called Commit a61bbcf28a8c ("[NET]: Store skb->timestamp as offset to a base timestamp") introduces a neighbour control buffer and zeroes it out in ndisc_rcv(), as ndisc_recv_ns() uses it. Commit f2776ff04722 ("[IPV6]: Fix address/interface handling in UDP and DCCP, according to the scoping architecture.") introduces the usage of the IPv6 control buffer in protocol error handlers (e.g. inet6_iif() in present-day __udp6_lib_err()). Now, with commit b94f1c0904da ("ipv6: Use icmpv6_notify() to propagate redirect, instead of rt6_redirect()."), we call protocol error handlers from ndisc_redirect_rcv(), after the control buffer is already stolen and some parts are already zeroed out. This implies that inet6_iif() on this path will always return zero. This gives unexpected results on UDP socket lookup in __udp6_lib_err(), as we might actually need to match sockets for a given interface. Instead of always claiming the control buffer in ndisc_rcv(), do that only when needed. Fixes: b94f1c0904da ("ipv6: Use icmpv6_notify() to propagate redirect, instead of rt6_redirect().") Signed-off-by: Stefano Brivio Reviewed-by: Sabrina Dubroca Signed-off-by: David S. Miller commit 6c2fc9cddc1ffdef8ada1dc8404e5affae849953 Author: David S. Miller Date: Fri Oct 26 15:39:49 2018 -0700 sparc64: Rework xchg() definition to avoid warnings. Such as: fs/ocfs2/file.c: In function ‘ocfs2_file_write_iter’: ./arch/sparc/include/asm/cmpxchg_64.h:55:22: warning: value computed is not used [-Wunused-value] #define xchg(ptr,x) ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr)))) and drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c: In function ‘ixgbevf_xdp_setup’: ./arch/sparc/include/asm/cmpxchg_64.h:55:22: warning: value computed is not used [-Wunused-value] #define xchg(ptr,x) ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr)))) Signed-off-by: David S. Miller commit 2b4792eaa9f553764047d157365ed8b7787751a3 Author: David S. Miller Date: Fri Oct 26 15:11:56 2018 -0700 sparc64: Export __node_distance. Some drivers reference it via node_distance(), for example the NVME host driver core. ERROR: "__node_distance" [drivers/nvme/host/nvme-core.ko] undefined! make[1]: *** [scripts/Makefile.modpost:92: __modpost] Error 1 Signed-off-by: David S. Miller commit 5b4fc3882a649c9411dd0dcad2ddb78e911d340e Author: David Miller Date: Thu Oct 25 20:36:46 2018 -0700 sparc64: Make corrupted user stacks more debuggable. Right now if we get a corrupted user stack frame we do a do_exit(SIGILL) which is not helpful. If under a debugger, this behavior causes the inferior process to exit. So the register and other state cannot be examined at the time of the event. Instead, conditionally log a rate limited kernel log message and then force a SIGSEGV. With bits and ideas borrowed (as usual) from powerpc. Signed-off-by: David S. Miller commit cc10ad25bbca3d2925adc32d51cb7a10b837d32c Merge: ec9c16643459 edbb4233e7ef Author: Linus Torvalds Date: Fri Oct 26 14:43:48 2018 -0700 Merge tag 'mips_4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS updates from Paul Burton: - kexec support for the generic MIPS platform when running on a CPU including the MIPS Coherence Manager & related hardware. - Improvements to the definition of memory barriers used around MMIO accesses, and fixes in their use. - Switch to CONFIG_NO_BOOTMEM from Mike Rapoport, finally dropping reliance on the old bootmem code. - A number of fixes & improvements for Loongson 3 systems. - DT & config updates for the Microsemi Ocelot platform. - Workaround to enable USB power on the Netgear WNDR3400v3. - Various cleanups & fixes. * tag 'mips_4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (51 commits) MIPS: Cleanup DSP ASE detection MIPS: dts: Change upper case to lower case MIPS: generic: Add Network, SPI and I2C to ocelot_defconfig MIPS: Loongson-3: Fix BRIDGE irq delivery problem MIPS: Loongson-3: Fix CPU UART irq delivery problem MIPS: Remove unused PREF, PREFE & PREFX macros MIPS: lib: Use kernel_pref & user_pref in memcpy() MIPS: Remove unused CAT macro MIPS: Add kernel_pref & user_pref helpers MIPS: Remove unused TTABLE macro MIPS: Remove unused PIC macros MIPS: Remove unused MOVN & MOVZ macros MIPS: Provide actually relaxed MMIO accessors MIPS: Enforce strong ordering for MMIO accessors MIPS: Correct `mmiowb' barrier for `wbflush' platforms MIPS: Define MMIO ordering barriers MIPS: mscc: add PCB120 to the ocelot fitImage MIPS: mscc: add DT for Ocelot PCB120 MIPS: memset: Limit excessive `noreorder' assembly mode use MIPS: memset: Fix CPU_DADDI_WORKAROUNDS `small_fixup' regression ... commit ec9c166434595382be3babf266febf876327774d Merge: 685f7e4f1614 c61c7def1fa0 Author: Linus Torvalds Date: Fri Oct 26 14:39:22 2018 -0700 Merge tag 'mips_fixes_4.20_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Paul Burton: "A couple of MIPS fixes that should have ideally made it for v4.19, but hey-ho here they are now: - A fix for potential poor stack placement introduced in v4.19-rc8. - A fix for a warning introduced in use of TURBOchannel devices by DMA changes in v4.16" * tag 'mips_fixes_4.20_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: VDSO: Reduce VDSO_RANDOMIZE_SIZE to 64MB for 64bit TC: Set DMA masks for devices commit 685f7e4f161425b137056abe35ba8ef7b669d83d Merge: c7a2c49ea6c9 58cfbac25b1f Author: Linus Torvalds Date: Fri Oct 26 14:36:21 2018 -0700 Merge tag 'powerpc-4.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates from Michael Ellerman: "Notable changes: - A large series to rewrite our SLB miss handling, replacing a lot of fairly complicated asm with much fewer lines of C. - Following on from that, we now maintain a cache of SLB entries for each process and preload them on context switch. Leading to a 27% speedup for our context switch benchmark on Power9. - Improvements to our handling of SLB multi-hit errors. We now print more debug information when they occur, and try to continue running by flushing the SLB and reloading, rather than treating them as fatal. - Enable THP migration on 64-bit Book3S machines (eg. Power7/8/9). - Add support for physical memory up to 2PB in the linear mapping on 64-bit Book3S. We only support up to 512TB as regular system memory, otherwise the percpu allocator runs out of vmalloc space. - Add stack protector support for 32 and 64-bit, with a per-task canary. - Add support for PTRACE_SYSEMU and PTRACE_SYSEMU_SINGLESTEP. - Support recognising "big cores" on Power9, where two SMT4 cores are presented to us as a single SMT8 core. - A large series to cleanup some of our ioremap handling and PTE flags. - Add a driver for the PAPR SCM (storage class memory) interface, allowing guests to operate on SCM devices (acked by Dan). - Changes to our ftrace code to handle very large kernels, where we need to use a trampoline to get to ftrace_caller(). And many other smaller enhancements and cleanups. Thanks to: Alan Modra, Alistair Popple, Aneesh Kumar K.V, Anton Blanchard, Aravinda Prasad, Bartlomiej Zolnierkiewicz, Benjamin Herrenschmidt, Breno Leitao, Cédric Le Goater, Christophe Leroy, Christophe Lombard, Dan Carpenter, Daniel Axtens, Finn Thain, Gautham R. Shenoy, Gustavo Romero, Haren Myneni, Hari Bathini, Jia Hongtao, Joel Stanley, John Allen, Laurent Dufour, Madhavan Srinivasan, Mahesh Salgaonkar, Mark Hairgrove, Masahiro Yamada, Michael Bringmann, Michael Neuling, Michal Suchanek, Murilo Opsfelder Araujo, Nathan Fontenot, Naveen N. Rao, Nicholas Piggin, Nick Desaulniers, Oliver O'Halloran, Paul Mackerras, Petr Vorel, Rashmica Gupta, Reza Arbab, Rob Herring, Sam Bobroff, Samuel Mendoza-Jonas, Scott Wood, Stan Johnson, Stephen Rothwell, Stewart Smith, Suraj Jitindar Singh, Tyrel Datwyler, Vaibhav Jain, Vasant Hegde, YueHaibing, zhong jiang" * tag 'powerpc-4.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (221 commits) Revert "selftests/powerpc: Fix out-of-tree build errors" powerpc/msi: Fix compile error on mpc83xx powerpc: Fix stack protector crashes on CPU hotplug powerpc/traps: restore recoverability of machine_check interrupts powerpc/64/module: REL32 relocation range check powerpc/64s/radix: Fix radix__flush_tlb_collapsed_pmd double flushing pmd selftests/powerpc: Add a test of wild bctr powerpc/mm: Fix page table dump to work on Radix powerpc/mm/radix: Display if mappings are exec or not powerpc/mm/radix: Simplify split mapping logic powerpc/mm/radix: Remove the retry in the split mapping logic powerpc/mm/radix: Fix small page at boundary when splitting powerpc/mm/radix: Fix overuse of small pages in splitting logic powerpc/mm/radix: Fix off-by-one in split mapping logic powerpc/ftrace: Handle large kernel configs powerpc/mm: Fix WARN_ON with THP NUMA migration selftests/powerpc: Fix out-of-tree build errors powerpc/time: no steal_time when CONFIG_PPC_SPLPAR is not selected powerpc/time: Only set CONFIG_ARCH_HAS_SCALED_CPUTIME on PPC64 powerpc/time: isolate scaled cputime accounting in dedicated functions. ... commit 14fa085640a7eb55431eec8a0273bbf0c463ce46 Author: Chengguang Xu Date: Fri Jun 22 09:49:36 2018 +0800 ovl: using posix_acl_xattr_size() to get size instead of posix_acl_to_xattr() There is no functional change but it seems better to get size by calling posix_acl_xattr_size() instead of calling posix_acl_to_xattr() with NULL buffer argument. Additionally, remove unnecessary assignments. Signed-off-by: Chengguang Xu Signed-off-by: Miklos Szeredi commit 1e92e3072c1456abedf51c9dedd245d2ba0daa4f Author: Amir Goldstein Date: Thu Oct 18 18:37:14 2018 +0300 ovl: abstract ovl_inode lock with a helper The abstraction improves code readabilty (to some). Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit 0e32992f7faccd50d1b00032de83e87a35fed247 Author: Amir Goldstein Date: Thu Oct 18 18:37:13 2018 +0300 ovl: remove the 'locked' argument of ovl_nlink_{start,end} It just makes the interface strange without adding any significant value. The only case where locked is false and return value is 0 is in ovl_rename() when new is negative, so handle that case explicitly in ovl_rename(). Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit 9df085f3c9a2d4658a9fe323d70c200aa00ede93 Author: Amir Goldstein Date: Mon Sep 3 09:12:09 2018 +0300 ovl: relax requirement for non null uuid of lower fs We use uuid to associate an overlay lower file handle with a lower layer, so we can accept lower fs with null uuid as long as all lower layers with null uuid are on the same fs. This change allows enabling index and nfs_export features for the setup of single lower fs of type squashfs - squashfs supports file handles, but has a null uuid. This change also allows enabling index and nfs_export features for nested overlayfs, where the lower overlay has nfs_export enabled. Enabling the index feature with single lower squashfs fixes the unionmount-testsuite test: ./run --ov --squashfs --verify As a by-product, if, like the lower squashfs, upper fs also uses the generic export_encode_fh() implementation to export 32bit inode file handles (e.g. ext4), then the xino_auto config/module/mount option will enable unique overlay inode numbers. Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit 6b52243f633eb5521e427bf78c85ccf646795f46 Author: Miklos Szeredi Date: Fri Oct 26 23:34:39 2018 +0200 ovl: fold copy-up helpers into callers Now that the workdir and tmpfile copy up modes have been untagled, the functions become simple enough that the helpers can be folded into the callers. Add new helpers where there is any duplication remaining: preparing creds for creating the object. Signed-off-by: Miklos Szeredi commit b10cdcdc2012b2c199077a0a648e8a7067e573bf Author: Amir Goldstein Date: Mon Oct 8 07:25:23 2018 +0300 ovl: untangle copy up call chain In an attempt to dedup ~100 LOC, we ended up creating a tangled call chain, whose branches merge and diverge in several points according to the immutable c->tmpfile copy up mode. This call chain was hard to analyse for locking correctness because the locking requirements for the c->tmpfile flow were very different from the locking requirements for the !c->tmpfile flow (i.e. directory vs. regulare file copy up). Split the copy up helpers of the c->tmpfile flow from those of the !c->tmpfile (i.e. workdir) flow and remove the c->tmpfile mode from copy up context. Suggested-by: Al Viro Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit 007ea44892e6fa963a0876a979e34890325c64eb Author: Miklos Szeredi Date: Fri Oct 26 23:34:39 2018 +0200 ovl: relax permission checking on underlying layers Make permission checking more consistent: - special files don't need any access check on underling fs - exec permission check doesn't need to be performed on underlying fs Reported-by: "J. Bruce Fields" Signed-off-by: Miklos Szeredi commit 6cd078702f2f33cb6b19a682de3e9184112f1a46 Author: Amir Goldstein Date: Thu Oct 18 09:45:49 2018 +0300 ovl: fix recursive oi->lock in ovl_link() linking a non-copied-up file into a non-copied-up parent results in a nested call to mutex_lock_interruptible(&oi->lock). Fix this by copying up target parent before ovl_nlink_start(), same as done in ovl_rename(). ~/unionmount-testsuite$ ./run --ov -s ~/unionmount-testsuite$ ln /mnt/a/foo100 /mnt/a/dir100/ WARNING: possible recursive locking detected -------------------------------------------- ln/1545 is trying to acquire lock: 00000000bcce7c4c (&ovl_i_lock_key[depth]){+.+.}, at: ovl_copy_up_start+0x28/0x7d but task is already holding lock: 0000000026d73d5b (&ovl_i_lock_key[depth]){+.+.}, at: ovl_nlink_start+0x3c/0xc1 [SzM: this seems to be a false positive, but doing the copy-up first is harmless and removes the lockdep splat] Reported-by: syzbot+3ef5c0d1a5cb0b21e6be@syzkaller.appspotmail.com Fixes: 5f8415d6b87e ("ovl: persistent overlay inode nlink for...") Cc: # v4.13 Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit 8f97d1e99149a7f1aa19e47a51b09764382a482e Author: Amir Goldstein Date: Thu Oct 11 17:38:14 2018 +0300 vfs: fix FIGETBSZ ioctl on an overlayfs file Some anon_bdev filesystems (e.g. overlayfs, ceph) don't have s_blocksize set. Returning zero from FIGETBSZ ioctl results in a Floating point exception from the e2fsprogs utility filefrag, which divides the size of the file with the value returned by FIGETBSZ. Fix the interface by returning -EINVAL for these filesystems. Fixes: d1d04ef8572b ("ovl: stack file ops") Cc: # v4.19 Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit 1f244dc5213960f76e7463bbb5719c331045bbc9 Author: Miklos Szeredi Date: Fri Oct 26 23:34:39 2018 +0200 ovl: clean up error handling in ovl_get_tmpfile() If security_inode_copy_up() fails, it should not set new_creds, so no need for the cleanup (which would've Oops-ed anyway, due to old_creds being NULL). Signed-off-by: Miklos Szeredi commit babf4770be0adc69e6d2de150f4040f175e24beb Author: Amir Goldstein Date: Wed Oct 10 19:10:06 2018 +0300 ovl: fix error handling in ovl_verify_set_fh() We hit a BUG on kfree of an ERR_PTR()... Reported-by: syzbot+ff03fe05c717b82502d0@syzkaller.appspotmail.com Fixes: 8b88a2e64036 ("ovl: verify upper root dir matches lower root dir") Cc: # v4.13 Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit c7a2c49ea6c9eebbe44ff2c08b663b2905ee2c13 Merge: 033078a9afe5 331bc71cb175 Author: Linus Torvalds Date: Fri Oct 26 13:05:26 2018 -0700 Merge tag 'nfs-for-4.20-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client updates from Trond Myklebust: "Highlights include: Stable fixes: - Fix the NFSv4.1 r/wsize sanity checking - Reset the RPC/RDMA credit grant properly after a disconnect - Fix a missed page unlock after pg_doio() Features and optimisations: - Overhaul of the RPC client socket code to eliminate a locking bottleneck and reduce the latency when transmitting lots of requests in parallel. - Allow parallelisation of the RPCSEC_GSS encoding of an RPC request. - Convert the RPC client socket receive code to use iovec_iter() for improved efficiency. - Convert several NFS and RPC lookup operations to use RCU instead of taking global locks. - Avoid the need for BH-safe locks in the RPC/RDMA back channel. Bugfixes and cleanups: - Fix lock recovery during NFSv4 delegation recalls - Fix the NFSv4 + NFSv4.1 "lookup revalidate + open file" case. - Fixes for the RPC connection metrics - Various RPC client layer cleanups to consolidate stream based sockets - RPC/RDMA connection cleanups - Simplify the RPC/RDMA cleanup after memory operation failures - Clean ups for NFS v4.2 copy completion and NFSv4 open state reclaim" * tag 'nfs-for-4.20-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: (97 commits) SUNRPC: Convert the auth cred cache to use refcount_t SUNRPC: Convert auth creds to use refcount_t SUNRPC: Simplify lookup code SUNRPC: Clean up the AUTH cache code NFS: change sign of nfs_fh length sunrpc: safely reallow resvport min/max inversion nfs: remove redundant call to nfs_context_set_write_error() nfs: Fix a missed page unlock after pg_doio() SUNRPC: Fix a compile warning for cmpxchg64() NFSv4.x: fix lock recovery during delegation recall SUNRPC: use cmpxchg64() in gss_seq_send64_fetch_and_inc() xprtrdma: Squelch a sparse warning xprtrdma: Clean up xprt_rdma_disconnect_inject xprtrdma: Add documenting comments xprtrdma: Report when there were zero posted Receives xprtrdma: Move rb_flags initialization xprtrdma: Don't disable BH's in backchannel server xprtrdma: Remove memory address of "ep" from an error message xprtrdma: Rename rpcrdma_qp_async_error_upcall xprtrdma: Simplify RPC wake-ups on connect ... commit 033078a9afe504ac9e615d10c4b35d634450b637 Merge: 7abe849315c8 38f876bb2d62 Author: Linus Torvalds Date: Fri Oct 26 13:02:38 2018 -0700 Merge tag '4.20-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs updates from Steve French: "Three smb3 fixes for stable, patches for improved debugging and perf gathering, and much improved performance for most metadata operations (expanded use of compounding)" * tag '4.20-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: (46 commits) cifs: update internal module version number for cifs.ko to 2.14 smb3: add debug for unexpected mid cancellation cifs: allow calling SMB2_xxx_free(NULL) smb3 - clean up debug output displaying network interfaces smb3: show number of current open files in /proc/fs/cifs/Stats cifs: add support for ioctl on directories cifs: fallback to older infolevels on findfirst queryinfo retry smb3: do not attempt cifs operation in smb3 query info error path smb3: send backup intent on compounded query info cifs: track writepages in vfs operation counters smb2: fix uninitialized variable bug in smb2_ioctl_query_info cifs: add IOCTL for QUERY_INFO passthrough to userspace cifs: minor clarification in comments CIFS: Print message when attempting a mount CIFS: Adds information-level logging function cifs: OFD locks do not conflict with eachothers CIFS: SMBD: Do not call ib_dereg_mr on invalidated memory registration CIFS: pass page offsets on SMB1 read/write fs/cifs: fix uninitialised variable warnings smb3: add tracepoint for sending lease break responses to server ... commit 7abe849315c870c1d3f3cb4b302e827aaa28348e Merge: 71f4d95b2365 af9b926de9c5 Author: Linus Torvalds Date: Fri Oct 26 13:00:44 2018 -0700 Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md Pull md updates from Shaohua Li: "This mainly improves raid10 cluster and fixes some bugs: - raid10 cluster improvements from Guoqing - Memory leak fixes from Jack and Xiao - raid10 hang fix from Alex - raid5 block faulty device fix from Mariusz - metadata update fix from Neil - Invalid disk role fix from Me - Other clearnups" * 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md: MD: Memory leak when flush bio size is zero md: fix memleak for mempool md-cluster: remove suspend_info md-cluster: send BITMAP_NEEDS_SYNC message if reshaping is interrupted md-cluster/bitmap: don't call md_bitmap_sync_with_cluster during reshaping stage md-cluster/raid10: don't call remove_and_add_spares during reshaping stage md-cluster/raid10: call update_size in md_reap_sync_thread md-cluster: introduce resync_info_get interface for sanity check md-cluster/raid10: support add disk under grow mode md-cluster/raid10: resize all the bitmaps before start reshape MD: fix invalid stored role for a disk - try2 md/bitmap: use mddev_suspend/resume instead of ->quiesce() md: remove redundant code that is no longer reachable md: allow metadata updates while suspending an array - fix MD: fix invalid stored role for a disk md/raid10: Fix raid10 replace hang when new added disk faulty raid5: block failing device if raid will be failed commit 71f4d95b23654ec2b347bd15b1260d68ca9ea5ea Merge: 6080ad3a9941 da4ad3a23af3 Author: Linus Torvalds Date: Fri Oct 26 12:57:38 2018 -0700 Merge tag 'for-4.20/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mike Snitzer: - The biggest change this cycle is to remove support for the legacy IO path (.request_fn) from request-based DM. Jens has already started preparing for complete removal of the legacy IO path in 4.21 but this earlier removal of support from DM has been coordinated with Jens (as evidenced by the commit being attributed to him). Making request-based DM exclussively blk-mq only cleans up that portion of DM core quite nicely. - Convert the thinp and zoned targets over to using refcount_t where applicable. - A couple fixes to the DM zoned target for refcounting and other races buried in the implementation of metadata block creation and use. - Small cleanups to remove redundant unlikely() around a couple WARN_ON_ONCE(). - Simplify how dm-ioctl copies from userspace, eliminating some potential for a malicious user trying to change the executed ioctl after its processing has begun. - Tweaked DM crypt target to use the DM device name when naming the various workqueues created for a particular DM crypt device (makes the N workqueues for a DM crypt device more easily understood and enhances user's accounting capabilities at a glance via "ps") - Small fixup to remove dead branch in DM writecache's memory_entry(). * tag 'for-4.20/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm writecache: remove disabled code in memory_entry() dm zoned: fix various dmz_get_mblock() issues dm zoned: fix metadata block ref counting dm raid: avoid bitmap with raid4/5/6 journal device dm crypt: make workqueue names device-specific dm: add dm_table_device_name() dm ioctl: harden copy_params()'s copy_from_user() from malicious users dm: remove unnecessary unlikely() around WARN_ON_ONCE() dm zoned: target: use refcount_t for dm zoned reference counters dm thin: use refcount_t for thin_c reference counting dm table: require that request-based DM be layered on blk-mq devices dm: rename DM_TYPE_MQ_REQUEST_BASED to DM_TYPE_REQUEST_BASED dm: remove legacy request-based IO path commit 6080ad3a9941e4707bb929445b813fadca9a27ff Merge: b27186abb37b a435ab4f80f9 Author: Linus Torvalds Date: Fri Oct 26 12:43:13 2018 -0700 Merge tag 'for-linus-20181026' of git://git.kernel.dk/linux-block Pull more block layer updates from Jens Axboe: - Set of patches improving support for zoned devices. This was ready before the merge window, but I was late in picking it up and hence it missed the original pull request (Damien, Christoph) - libata no link power management quirk addition for a Samsung drive (Diego Viola) - Fix for a performance regression in BFQ that went into this merge window (Federico Motta) - Fix for a missing dma mask setting return value check (Gustavo) - Typo in the gdrom queue failure case (me) - NULL pointer deref fix for xen-blkfront (Vasilis Liaskovitis) - Fixing the get_rq trace point placement in blk-mq (Xiaoguang Wang) - Removal of a set-but-not-read variable in cdrom (zhong jiang) * tag 'for-linus-20181026' of git://git.kernel.dk/linux-block: libata: Apply NOLPM quirk for SAMSUNG MZ7TD256HAFV-000L9 block, bfq: fix asymmetric scenarios detection gdrom: fix mistake in assignment of error blk-mq: place trace_block_getrq() in correct place block: Introduce blk_revalidate_disk_zones() block: add a report_zones method block: Expose queue nr_zones in sysfs block: Improve zone reset execution block: Introduce BLKGETNRZONES ioctl block: Introduce BLKGETZONESZ ioctl block: Limit allocation of zone descriptors for report zones block: Introduce blkdev_nr_zones() helper scsi: sd_zbc: Fix sd_zbc_check_zones() error checks scsi: sd_zbc: Reduce boot device scan and revalidate time scsi: sd_zbc: Rearrange code cdrom: remove set but not used variable 'tocuse' skd: fix unchecked return values xen/blkfront: avoid NULL blkfront_info dereference on device removal commit b27186abb37b7bd19e0ca434f4f425c807dbd708 Merge: 0ef7791e2bfb d061864b89c3 Author: Linus Torvalds Date: Fri Oct 26 12:09:58 2018 -0700 Merge tag 'devicetree-for-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull Devicetree updates from Rob Herring: "A bit bigger than normal as I've been busy this cycle. There's a few things with dependencies and a few things subsystem maintainers didn't pick up, so I'm taking them thru my tree. The fixes from Johan didn't get into linux-next, but they've been waiting for some time now and they are what's left of what subsystem maintainers didn't pick up. Summary: - Sync dtc with upstream version v1.4.7-14-gc86da84d30e4 - Work to get rid of direct accesses to struct device_node name and type pointers in preparation for removing them. New helpers for parsing DT cpu nodes and conversions to use the helpers. printk conversions to %pOFn for printing DT node names. Most went thru subystem trees, so this is the remainder. - Fixes to DT child node lookups to actually be restricted to child nodes instead of treewide. - Refactoring of dtb targets out of arch code. This makes the support more uniform and enables building all dtbs on c6x, microblaze, and powerpc. - Various DT binding updates for Renesas r8a7744 SoC - Vendor prefixes for Facebook, OLPC - Restructuring of some ARM binding docs moving some peripheral bindings out of board/SoC binding files - New "secure-chosen" binding for secure world settings on ARM - Dual licensing of 2 DT IRQ binding headers" * tag 'devicetree-for-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (78 commits) ARM: dt: relicense two DT binding IRQ headers power: supply: twl4030-charger: fix OF sibling-node lookup NFC: nfcmrvl_uart: fix OF child-node lookup net: stmmac: dwmac-sun8i: fix OF child-node lookup net: bcmgenet: fix OF child-node lookup drm/msm: fix OF child-node lookup drm/mediatek: fix OF sibling-node lookup of: Add missing exports of node name compare functions dt-bindings: Add OLPC vendor prefix dt-bindings: misc: bk4: Add device tree binding for Liebherr's BK4 SPI bus dt-bindings: thermal: samsung: Add SPDX license identifier dt-bindings: clock: samsung: Add SPDX license identifiers dt-bindings: timer: ostm: Add R7S9210 support dt-bindings: phy: rcar-gen2: Add r8a7744 support dt-bindings: can: rcar_can: Add r8a7744 support dt-bindings: timer: renesas, cmt: Document r8a7744 CMT support dt-bindings: watchdog: renesas-wdt: Document r8a7744 support dt-bindings: thermal: rcar: Add device tree support for r8a7744 Documentation: dt: Add binding for /secure-chosen/stdout-path dt-bindings: arm: zte: Move sysctrl bindings to their own doc ... commit 0ef7791e2bfb2e10aa95dc492eab72074cef9942 Merge: befa93633193 760eea43f8c6 Author: Linus Torvalds Date: Fri Oct 26 12:04:29 2018 -0700 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal Pull thermal SoC updates from Eduardo Valentin: "Several new things coming up. Specifics: - Rework of tsens and hisi thermal drivers - OF-thermal now allows sharing multiple cooling devices on maps - Added support for r8a7744 and R8A77970 on rcar thermal driver - Added support for r8a774a1 on rcar_gen3 thermal driver - New thermal driver stm32 - Fixes on multiple thermal drivers: of-thermal, imx, qoriq, armada, qcom-spmi, rcar, da9062/61" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal: (41 commits) thermal: da9062/61: Prevent hardware access during system suspend thermal: rcar_thermal: Prevent doing work after unbind thermal: rcar_thermal: Prevent hardware access during system suspend thermal: rcar_gen3_thermal: add R8A77980 support dt-bindings: thermal: rcar-gen3-thermal: document R8A77980 bindings thermal: add stm32 thermal driver dt-bindings: stm32-thermal: add binding documentation thermal: rcar_thermal: add R8A77970 support dt-bindings: thermal: rcar-thermal: document R8A77970 bindings thermal: rcar_thermal: fix duplicate IRQ request dt-bindings: thermal: rcar: Add device tree support for r8a7744 thermal/drivers/hisi: Add the dual clusters sensors for hi3660 thermal/drivers/hisi: Add more sensors channel thermal/drivers/hisi: Remove pointless irq field thermal/drivers/hisi: Use platform_get_irq_byname thermal/drivers/hisi: Replace macro name with relevant sensor location thermal/drivers/hisi: Add multiple sensors support thermal/drivers/hisi: Prepare to support multiple sensors thermal/drivers/hisi: Factor out the probe functions thermal/drivers/hisi: Set the thermal zone private data to the sensor pointer ... commit 72b8ad40e14302f869382656a914bb803796b4ed Author: Liviu Dudau Date: Thu Oct 18 01:14:32 2018 +0100 leds: gpio: set led_dat->gpiod pointer for OF defined GPIO leds Commit 45d4c6de4e49 ("leds: gpio: Try to lookup gpiod from device") removed the common code path that set the led_dat->gpiod pointer in create_gpio_led(), but only added it back for the devices that have a valid gpio_led_platform_data structure. Calling gpio_leds_create() in gpio_led_probe() is not enough to get a valid gpiod pointer. Fortunately enough, gpio_leds_create() already gets the needed pointer, we just need to assign it to the relevant gpio_led_data structure. Fixes: 45d4c6de4e49 ("leds: gpio: Try to lookup gpiod from device") Signed-off-by: Liviu Dudau Reviewed-by: Linus Walleij Acked-by: Pavel Machek Signed-off-by: Jacek Anaszewski commit cb899a615be6c42e186e0e71862ebbd5a5c15533 Author: Shirish S Date: Fri Oct 26 02:38:58 2018 +0530 drm/amdgpu: fix reporting of failed msg sent to SMU (v2) Currently send_msg_to_smc_async() only report which message failed, but the actual failing message is the previous one, which SMU is unable to service. This patch reads the contents of register where the SMU is stuck and report appropriately. v2: fix the build (Alex) Signed-off-by: Shirish S Reviewed-by: Rex Zhu Signed-off-by: Alex Deucher commit befa93633193e5327e4045d1e5fa29114580fa5d Merge: d1f2b1710d92 886643b76632 Author: Linus Torvalds Date: Fri Oct 26 11:29:17 2018 -0700 Merge tag 'dma-mapping-4.20-1' of git://git.infradead.org/users/hch/dma-mapping Pull more dma-mapping updates from Christoph Hellwig: - various swiotlb cleanups - do not dip into the ѕwiotlb pool for dma coherent allocations - add support for not cache coherent DMA to swiotlb - switch ARM64 to use the generic swiotlb_dma_ops * tag 'dma-mapping-4.20-1' of git://git.infradead.org/users/hch/dma-mapping: arm64: use the generic swiotlb_dma_ops swiotlb: add support for non-coherent DMA swiotlb: don't dip into swiotlb pool for coherent allocations swiotlb: refactor swiotlb_map_page swiotlb: use swiotlb_map_page in swiotlb_map_sg_attrs swiotlb: merge swiotlb_unmap_page and unmap_single swiotlb: remove the overflow buffer swiotlb: do not panic on mapping failures swiotlb: mark is_swiotlb_buffer static swiotlb: remove a pointless comment commit 31e3aad62ab8039581d621403b7905aa19fb30af Author: Andrey Grodzovsky Date: Thu Oct 25 15:47:02 2018 -0400 drm/amdgpu: Fix compute ring 1.0.0 failure after reset Problem: After GPU reset on dGPUs with gfx8 compute ring 1.0.0 fails to pass the ring test. Ring registers inspection shows that it's active and no hang is observed (rptr == wptr) No significant diffs were observed between CP_HQD* registers for the ring in good and bad shape. Fix: No clear reason why but reversing the order of ring tests fixes the problem. Signed-off-by: Andrey Grodzovsky Acked-by: Christian König Signed-off-by: Alex Deucher commit 4faaaa762328cfb8579b9c908999ca189e2ea474 Author: Christian König Date: Wed Oct 24 16:25:23 2018 +0200 drm/amdgpu: fix VM leaf walking Make sure we don't try to go down further after the leave walk already ended. This fixes a crash with a new VM test. Signed-off-by: Christian König Reviewed-by: Felix Kuehling Acked-by: Alex Deucher Tested-by: Rex Zhu Rex.Zhu@amd.com Signed-off-by: Alex Deucher commit d1f2b1710d92a80d60351503bbf41cdac95ed7a8 Merge: 18d0eae30e6a 2f2fbfb71ecc Author: Linus Torvalds Date: Fri Oct 26 10:50:10 2018 -0700 Merge tag 'iommu-updates-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull IOMMU updates from Joerg Roedel: - Debugfs support for the Intel VT-d driver. When enabled, it now also exposes some of its internal data structures to user-space for debugging purposes. - ARM-SMMU driver now uses the generic deferred flushing and fast-path iova allocation code. This is expected to be a major performance improvement, as this allocation path scales a lot better. - Support for r8a7744 in the Renesas iommu driver - Couple of minor fixes and improvements all over the place * tag 'iommu-updates-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: (39 commits) iommu/arm-smmu-v3: Remove unnecessary wrapper function iommu/arm-smmu-v3: Add SPDX header iommu/amd: Add default branch in amd_iommu_capable() dt-bindings: iommu: ipmmu-vmsa: Add r8a7744 support iommu/amd: Move iommu_init_pci() to .init section iommu/arm-smmu: Support non-strict mode iommu/io-pgtable-arm-v7s: Add support for non-strict mode iommu/arm-smmu-v3: Add support for non-strict mode iommu/io-pgtable-arm: Add support for non-strict mode iommu: Add "iommu.strict" command line option iommu/dma: Add support for non-strict mode iommu/arm-smmu: Ensure that page-table updates are visible before TLBI iommu/arm-smmu-v3: Implement flush_iotlb_all hook iommu/arm-smmu-v3: Avoid back-to-back CMD_SYNC operations iommu/arm-smmu-v3: Fix unexpected CMD_SYNC timeout iommu/io-pgtable-arm: Fix race handling in split_blk_unmap() iommu/arm-smmu-v3: Fix a couple of minor comment typos iommu: Fix a typo iommu: Remove .domain_{get,set}_windows iommu: Tidy up window attributes ... commit 18d0eae30e6a4f8644d589243d7ac1d70d29203d Merge: 26873acacbdb 14fdc2c5318a Author: Linus Torvalds Date: Fri Oct 26 09:11:43 2018 -0700 Merge tag 'char-misc-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver updates from Greg KH: "Here is the big set of char/misc patches for 4.20-rc1. Loads of things here, we have new code in all of these driver subsystems: - fpga - stm - extcon - nvmem - eeprom - hyper-v - gsmi - coresight - thunderbolt - vmw_balloon - goldfish - soundwire along with lots of fixes and minor changes to other small drivers. All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (245 commits) Documentation/security-bugs: Clarify treatment of embargoed information lib: Fix ia64 bootloader linkage MAINTAINERS: Clarify UIO vs UIOVEC maintainer docs/uio: fix a grammar nitpick docs: fpga: document programming fpgas using regions fpga: add devm_fpga_region_create fpga: bridge: add devm_fpga_bridge_create fpga: mgr: add devm_fpga_mgr_create hv_balloon: Replace spin_is_locked() with lockdep sgi-xp: Replace spin_is_locked() with lockdep eeprom: New ee1004 driver for DDR4 memory eeprom: at25: remove unneeded 'at25_remove' w1: IAD Register is yet readable trough iad sys file. Fix snprintf (%u for unsigned, count for max size). misc: mic: scif: remove set but not used variables 'src_dma_addr, dst_dma_addr' misc: mic: fix a DMA pool free failure platform: goldfish: pipe: Add a blank line to separate varibles and code platform: goldfish: pipe: Remove redundant casting platform: goldfish: pipe: Call misc_deregister if init fails platform: goldfish: pipe: Move the file-scope goldfish_pipe_dev variable into the driver state platform: goldfish: pipe: Move the file-scope goldfish_pipe_miscdev variable into the driver state ... commit 26873acacbdbb4e4b444f5dd28dcc4853f0e8ba2 Merge: 9703fc8caf36 09d1ea1c7309 Author: Linus Torvalds Date: Fri Oct 26 08:42:25 2018 -0700 Merge tag 'driver-core-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core updates from Greg KH: "Here is a small number of driver core patches for 4.20-rc1. Not much happened here this merge window, only a very tiny number of patches that do: - add BUS_ATTR_WO() for use by drivers - component error path fixes - kernfs range check fix - other tiny error path fixes and const changes All of these have been in linux-next with no reported issues for a while" * tag 'driver-core-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: devres: provide devm_kstrdup_const() mm: move is_kernel_rodata() to asm-generic/sections.h devres: constify p in devm_kfree() driver core: add BUS_ATTR_WO() macro kernfs: Fix range checks in kernfs_get_target_path component: fix loop condition to call unbind() if bind() fails drivers/base/devtmpfs.c: don't pretend path is const in delete_path kernfs: update comment about kernfs_path() return value commit 7dd8db68949a7acc5bd528ee0ecb8f8720f49921 Author: Benjamin Tissoires Date: Fri Oct 12 16:05:25 2018 +0200 HID: alps: allow incoming reports when only the trackstick is opened If userspace only reads the trackstick node, and no one is listening to the touchpad nor the hidraw node then, the device is not powered on. Add open/close callbacks to allow users to disable the touchpad in Gnome while keeping the trackstick active. Link: https://bugzilla.redhat.com/show_bug.cgi?id=1559632 Link: https://gitlab.gnome.org/GNOME/mutter/issues/128 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 9703fc8caf36ac65dca1538b23dd137de0b53233 Merge: da19a102ce87 b8d9ee24493d Author: Linus Torvalds Date: Fri Oct 26 08:14:13 2018 -0700 Merge tag 'usb-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB/PHY updates from Greg KH: "Here is the big USB/PHY driver patches for 4.20-rc1 Lots of USB changes in here, primarily in these areas: - typec updates and new drivers - new PHY drivers - dwc2 driver updates and additions (this old core keeps getting added to new devices.) - usbtmc major update based on the industry group coming together and working to add new features and performance to the driver. - USB gadget additions for new features - USB gadget configfs updates - chipidea driver updates - other USB gadget updates - USB serial driver updates - renesas driver updates - xhci driver updates - other tiny USB driver updates All of these have been in linux-next for a while with no reported issues" * tag 'usb-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (229 commits) usb: phy: ab8500: silence some uninitialized variable warnings usb: xhci: tegra: Add genpd support usb: xhci: tegra: Power-off power-domains on removal usbip:vudc: BUG kmalloc-2048 (Not tainted): Poison overwritten usbip: tools: fix atoi() on non-null terminated string USB: misc: appledisplay: fix backlight update_status return code phy: phy-pxa-usb: add a new driver usb: host: add DT bindings for faraday fotg2 usb: host: ohci-at91: fix request of irq for optional gpio usb/early: remove set but not used variable 'remain_length' usb: typec: Fix copy/paste on typec_set_vconn_role() kerneldoc usb: typec: tcpm: Report back negotiated PPS voltage and current USB: core: remove set but not used variable 'udev' usb: core: fix memory leak on port_dev_path allocation USB: net2280: Remove ->disconnect() callback from net2280_pullup() usb: dwc2: disable power_down on rockchip devices usb: gadget: udc: renesas_usb3: add support for r8a77990 dt-bindings: usb: renesas_usb3: add bindings for r8a77990 usb: gadget: udc: renesas_usb3: Add r8a774a1 support USB: serial: cypress_m8: remove set but not used variable 'iflag' ... commit 6298944d8f57f40ee2a3e6dcea1253e78d7a9969 Author: Benjamin Tissoires Date: Wed Oct 17 09:01:53 2018 +0200 Revert "HID: add NOGET quirk for Eaton Ellipse MAX UPS" This reverts commit 67ddbb3e6568fb1820b2cc45b00c50702b114801. 67ddbb3e656 ("HID: add NOGET quirk for Eaton Ellipse MAX UPS") was reported by Laurent Bigonville. It turns out that a later model Laurent got doesn't need the quirk after all. My take is that Eaton upgraded their firmwares, so we don't need it anymore. The old model was from 2012, so better make sure the new line works properly by removing the quirk. This allows upower to actually fetch the current data. Reported-by: Laurent Bigonville Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 00b790ea545b6ef30221adef6e9c3707e03b82b5 Author: Kai-Heng Feng Date: Fri Oct 5 12:46:29 2018 +0800 HID: i2c-hid: Add a small delay after sleep command for Raydium touchpanel Raydium touchpanel (2386:4B33) sometimes does not work in desktop session although it works in display manager. During user logging, the display manager exits, close the HID device, then the device gets runtime suspended and powered off. The desktop session begins shortly after, opens the HID device, then the device gets runtime resumed and powered on. If the trasition from display manager to desktop sesesion is fast, the touchpanel cannot switch from powered off to powered on in short timeframe. So add a small delay to workaround the issue. Signed-off-by: Kai-Heng Feng Reviewed-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit f11274396a538b31bc010f782e05c2ce3f804c13 Author: Breno Leitao Date: Fri Oct 19 17:01:33 2018 -0300 HID: hiddev: fix potential Spectre v1 uref->usage_index can be indirectly controlled by userspace, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This field is used as an array index by the hiddev_ioctl_usage() function, when 'cmd' is either HIDIOCGCOLLECTIONINDEX, HIDIOCGUSAGES or HIDIOCSUSAGES. For cmd == HIDIOCGCOLLECTIONINDEX case, uref->usage_index is compared to field->maxusage and then used as an index to dereference field->usage array. The same thing happens to the cmd == HIDIOC{G,S}USAGES cases, where uref->usage_index is checked against an array maximum value and then it is used as an index in an array. This is a summary of the HIDIOCGCOLLECTIONINDEX case, which matches the traditional Spectre V1 first load: copy_from_user(uref, user_arg, sizeof(*uref)) if (uref->usage_index >= field->maxusage) goto inval; i = field->usage[uref->usage_index].collection_index; return i; This patch fixes this by sanitizing field uref->usage_index before using it to index field->usage (HIDIOCGCOLLECTIONINDEX) or field->value in HIDIOC{G,S}USAGES arrays, thus, avoiding speculation in the first load. Cc: Signed-off-by: Breno Leitao -- v2: Contemplate cmd == HIDIOC{G,S}USAGES case Signed-off-by: Jiri Kosina commit da19a102ce87bf3e0a7fe277a659d1fc35330d6d Merge: e5f6d9afa341 a60109dc9a95 Author: Linus Torvalds Date: Fri Oct 26 07:38:19 2018 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma updates from Jason Gunthorpe: "This has been a smaller cycle with many of the commits being smallish code fixes and improvements across the drivers. - Driver updates for bnxt_re, cxgb4, hfi1, hns, mlx5, nes, qedr, and rxe - Memory window support in hns - mlx5 user API 'flow mutate/steering' allows accessing the full packet mangling and matching machinery from user space - Support inter-working with verbs API calls in the 'devx' mlx5 user API, and provide options to use devx with less privilege - Modernize the use of syfs and the device interface to use attribute groups and cdev properly for uverbs, and clean up some of the core code's device list management - More progress on net namespaces for RDMA devices - Consolidate driver BAR mmapping support into core code helpers and rework how RDMA holds poitners to mm_struct for get_user_pages cases - First pass to use 'dev_name' instead of ib_device->name - Device renaming for RDMA devices" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (242 commits) IB/mlx5: Add support for extended atomic operations RDMA/core: Fix comment for hw stats init for port == 0 RDMA/core: Refactor ib_register_device() function RDMA/core: Fix unwinding flow in case of error to register device ib_srp: Remove WARN_ON in srp_terminate_io() IB/mlx5: Allow scatter to CQE without global signaled WRs IB/mlx5: Verify that driver supports user flags IB/mlx5: Support scatter to CQE for DC transport type RDMA/drivers: Use core provided API for registering device attributes RDMA/core: Allow existing drivers to set one sysfs group per device IB/rxe: Remove unnecessary enum values RDMA/umad: Use kernel API to allocate umad indexes RDMA/uverbs: Use kernel API to allocate uverbs indexes RDMA/core: Increase total number of RDMA ports across all devices IB/mlx4: Add port and TID to MAD debug print IB/mlx4: Enable debug print of SMPs RDMA/core: Rename ports_parent to ports_kobj RDMA/core: Do not expose unsupported counters IB/mlx4: Refer to the device kobject instead of ports_parent RDMA/nldev: Allow IB device rename through RDMA netlink ... commit a435ab4f80f983c53b4ca4f8c12b3ddd3ca17670 Author: Diego Viola Date: Fri Oct 26 10:45:16 2018 -0300 libata: Apply NOLPM quirk for SAMSUNG MZ7TD256HAFV-000L9 med_power_with_dipm causes my T450 to freeze with a SAMSUNG MZ7TD256HAFV-000L9 SSD (firmware DXT02L5Q). Switching the LPM to max_performance fixes this issue. Acked-by: Hans de Goede Signed-off-by: Diego Viola Signed-off-by: Jens Axboe commit d061864b89c3234b53d8884027b0cd6f06bd3149 Author: Stephen Warren Date: Wed Oct 24 11:05:13 2018 -0600 ARM: dt: relicense two DT binding IRQ headers Files in include/dt-bindings/ may be useful to any OS that uses DT, when building the OS binary itself, not just when building DTB files. Since some OSs are not GPL, they need non-GPL headers. This change relicenses two of the useful files so that they can be used under the MIT license when desired. I wrote these files and NVIDIA legal has approved this change. Geert also ack'd the change; he fixed some spelling issues in the comments. Cc: Geert Uytterhoeven Signed-off-by: Stephen Warren Signed-off-by: Rob Herring commit e901378578c62202594cba0f6c076f3df365ec91 Author: Felipe Rechia Date: Wed Oct 24 10:57:22 2018 -0300 powerpc/process: Fix flush_all_to_thread for SPE Fix a bug introduced by the creation of flush_all_to_thread() for processors that have SPE (Signal Processing Engine) and use it to compute floating-point operations. >From userspace perspective, the problem was seen in attempts of computing floating-point operations which should generate exceptions. For example: fork(); float x = 0.0 / 0.0; isnan(x); // forked process returns False (should be True) The operation above also should always cause the SPEFSCR FINV bit to be set. However, the SPE floating-point exceptions were turned off after a fork(). Kernel versions prior to the bug used flush_spe_to_thread(), which first saves SPEFSCR register values in tsk->thread and then calls giveup_spe(tsk). After commit 579e633e764e, the save_all() function was called first to giveup_spe(), and then the SPEFSCR register values were saved in tsk->thread. This would save the SPEFSCR register values after disabling SPE for that thread, causing the bug described above. Fixes 579e633e764e ("powerpc: create flush_all_to_thread()") Signed-off-by: Felipe Rechia Signed-off-by: Michael Ellerman commit 58cfbac25b1fd2b76f94566aed28a3662b0ff8c6 Author: Michael Ellerman Date: Fri Oct 26 04:24:15 2018 +1100 Revert "selftests/powerpc: Fix out-of-tree build errors" This reverts commit d8a2fe29d3c97038c8efcc328d5e7940c5310565. That commit, by me, fixed the out of tree build errors by causing some of the tests not to build at all. commit 8dce6b2215eaa91dbf04463e11098a48748da5ab Author: Tyrel Datwyler Date: Mon Oct 22 20:32:12 2018 -0500 powerpc/pseries: add missing cpumask.h include file Build error is encountered when inlcuding if no explicit or implicit include of cpumask.h exists in the including file. In file included from arch/powerpc/platforms/pseries/hotplug-pci.c:3:0: ./arch/powerpc/include/asm/rtas.h:360:34: error: unknown type name 'cpumask_var_t' extern int rtas_online_cpus_mask(cpumask_var_t cpus); ^ ./arch/powerpc/include/asm/rtas.h:361:35: error: unknown type name 'cpumask_var_t' extern int rtas_offline_cpus_mask(cpumask_var_t cpus); Fixes: 120496ac2d2d ("powerpc: Bring all threads online prior to migration/hibernation") Signed-off-by: Tyrel Datwyler Signed-off-by: Michael Ellerman commit 48dc0ef19044bfb69193302fbe3a834e3331b7ae Author: Breno Leitao Date: Mon Oct 22 18:16:26 2018 -0300 selftests/powerpc: Fix ptrace tm failure Test ptrace-tm-spd-gpr fails on current kernel (4.19) due to a segmentation fault that happens on the child process prior to setting cptr[2] = 1. This causes the parent process to wait forever at 'while (!pptr[2])' and the test to be killed by the test harness framework by timeout, thus, failing. The segmentation fault happens because of a inline assembly being generated as: 0x10000355c lfs f0, 0(0) This is reading memory position 0x0 and causing the segmentation fault. This code is being generated by ASM_LOAD_FPR_SINGLE_PRECISION(flt_4), where flt_4 is passed to the inline assembly block as: [flt_4] "r" (&d) Since the inline assembly 'r' constraint means any GPR, gpr0 is being chosen, thus causing this issue when issuing a Load Floating-Point Single instruction. This patch simply changes the constraint to 'b', which specify that this register will be used as base, and r0 is not allowed to be used, avoiding this issue. Other than that, removing flt_2 register from the input operands, since it is not used by the inline assembly code at all. Cc: stable@vger.kernel.org Signed-off-by: Breno Leitao Acked-by: Segher Boessenkool Signed-off-by: Michael Ellerman commit c43befca86ae35cc82bd889484bd179bff27b6c6 Author: Paul Mackerras Date: Sat Oct 20 20:54:55 2018 +1100 KVM: PPC: Use exported tb_to_ns() function in decrementer emulation This changes the KVM code that emulates the decrementer function to do the conversion of decrementer values to time intervals in nanoseconds by calling the tb_to_ns() function exported by the powerpc timer code, in preference to open-coded arithmetic using values from the decrementer_clockevent struct. Similarly, the HV-KVM code that did the same conversion using arithmetic on tb_ticks_per_sec also now uses tb_to_ns(). Signed-off-by: Paul Mackerras Signed-off-by: Michael Ellerman commit 772b039fd9a7e12d5fc80e6f649341934ad51fbe Author: Aravinda Prasad Date: Wed Oct 10 15:52:59 2018 +0530 powerpc/pseries: Export maximum memory value This patch exports the maximum possible amount of memory configured on the system via /proc/powerpc/lparcfg. Signed-off-by: Aravinda Prasad Signed-off-by: Michael Ellerman commit 709cf19c5749308603ffa12557d8bd152a926783 Author: Christophe Leroy Date: Fri Oct 19 06:55:08 2018 +0000 powerpc/8xx: Use patch_site for perf counters setup The 8xx TLB miss routines are patched when (de)activating perf counters. This patch uses the new patch_site functionality in order to get a better code readability and avoid a label mess when dumping the code with 'objdump -d' Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 1a210878bf21de3f60646c13001d04bd4f57dfe1 Author: Christophe Leroy Date: Fri Oct 19 06:55:06 2018 +0000 powerpc/8xx: Use patch_site for memory setup patching The 8xx TLB miss routines are patched at startup at several places. This patch uses the new patch_site functionality in order to get a better code readability and avoid a label mess when dumping the code with 'objdump -d' Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 082e2869fc022de4db9977e06558da78384ea98c Author: Christophe Leroy Date: Fri Oct 19 06:55:04 2018 +0000 powerpc/code-patching: Add a helper to get the address of a patch_site This patch adds a helper to get the address of a patch_site. Signed-off-by: Christophe Leroy [mpe: Call it "patch site" addr] Signed-off-by: Michael Ellerman commit cc4ebf5c0a3440ed0a32d25c55ebdb6ce5f3c0bc Author: Christophe Leroy Date: Fri Oct 19 06:54:54 2018 +0000 Revert "powerpc/8xx: Use L1 entry APG to handle _PAGE_ACCESSED for CONFIG_SWAP" This reverts commit 4f94b2c7462d9720b2afa7e8e8d4c19446bb31ce. That commit was buggy, as it used rlwinm instead of rlwimi. Instead of fixing that bug, we revert the previous commit in order to reduce the dependency between L1 entries and L2 entries Fixes: 4f94b2c7462d9 ("powerpc/8xx: Use L1 entry APG to handle _PAGE_ACCESSED for CONFIG_SWAP") Cc: stable@vger.kernel.org Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 64ae16dfeefec670276607fa789ce096c7ebd7c4 Author: Denis Kenzior Date: Tue Oct 9 17:49:35 2018 +0100 KEYS: asym_tpm: Add support for the sign operation [ver #2] The sign operation can operate in a non-hashed mode by running the RSA sign operation directly on the input. This assumes that the input is less than key_size_in_bytes - 11. Since the TPM performs its own PKCS1 padding, it isn't possible to support 'raw' mode, only 'pkcs1'. Alternatively, a hashed version is also possible. In this variant the input is hashed (by userspace) via the selected hash function first. Then this implementation takes care of converting the hash to ASN.1 format and the sign operation is performed on the result. This is similar to the implementation inside crypto/rsa-pkcs1pad.c. ASN1 templates were copied from crypto/rsa-pkcs1pad.c. There seems to be no easy way to expose that functionality, but likely the templates should be shared somehow. The sign operation is implemented via TPM_Sign operation on the TPM. It is assumed that the TPM wrapped key provided uses TPM_SS_RSASSAPKCS1v15_DER signature scheme. This allows the TPM_Sign operation to work on data up to key_len_in_bytes - 11 bytes long. In theory, we could also use TPM_Unbind instead of TPM_Sign, but we would have to manually pkcs1 pad the digest first. Signed-off-by: Denis Kenzior Signed-off-by: David Howells Tested-by: Marcel Holtmann Reviewed-by: Marcel Holtmann Signed-off-by: James Morris commit e73d170f6c77e7006b48c5e9c325fe520f6012ca Author: Denis Kenzior Date: Tue Oct 9 17:49:28 2018 +0100 KEYS: asym_tpm: Implement tpm_sign [ver #2] Signed-off-by: Denis Kenzior Signed-off-by: David Howells Tested-by: Marcel Holtmann Reviewed-by: Marcel Holtmann Signed-off-by: James Morris commit e08e6891231f5fae82a6ffb4affdfa2ced8c1a77 Author: Denis Kenzior Date: Tue Oct 9 17:49:20 2018 +0100 KEYS: asym_tpm: Implement signature verification [ver #2] This patch implements the verify_signature operation. The public key portion extracted from the TPM key blob is used. The operation is performed entirely in software using the crypto API. Signed-off-by: Denis Kenzior Signed-off-by: David Howells Tested-by: Marcel Holtmann Reviewed-by: Marcel Holtmann Signed-off-by: James Morris commit a335974ae0883e045151a2160093a22aa02c3626 Author: Denis Kenzior Date: Tue Oct 9 17:49:13 2018 +0100 KEYS: asym_tpm: Implement the decrypt operation [ver #2] This patch implements the pkey_decrypt operation using the private key blob. The blob is first loaded into the TPM via tpm_loadkey2. Once the handle is obtained, tpm_unbind operation is used to decrypt the data on the TPM and the result is returned. The key loaded by tpm_loadkey2 is then evicted via tpm_flushspecific operation. This patch assumes that the SRK authorization is a well known 20-byte of zeros and the same holds for the key authorization of the provided key. Signed-off-by: Denis Kenzior Signed-off-by: David Howells Tested-by: Marcel Holtmann Reviewed-by: Marcel Holtmann Signed-off-by: James Morris commit f884fe5a158f750e232b029e1fac0283e388e062 Author: Denis Kenzior Date: Tue Oct 9 17:49:05 2018 +0100 KEYS: asym_tpm: Implement tpm_unbind [ver #2] Signed-off-by: Denis Kenzior Reviewed-by: James Morris Signed-off-by: David Howells Tested-by: Marcel Holtmann Reviewed-by: Marcel Holtmann Signed-off-by: James Morris commit 0c36264aa1d5b77eb21f646f83223134e4528cfe Author: Denis Kenzior Date: Tue Oct 9 17:48:58 2018 +0100 KEYS: asym_tpm: Add loadkey2 and flushspecific [ver #2] This commit adds TPM_LoadKey2 and TPM_FlushSpecific operations. Signed-off-by: Denis Kenzior Signed-off-by: David Howells Reviewed-by: James Morris Tested-by: Marcel Holtmann Reviewed-by: Marcel Holtmann Signed-off-by: James Morris commit 22447981fc050b5f1bdd0e7cbee89b4152a2b2d8 Author: Denis Kenzior Date: Tue Oct 9 17:48:49 2018 +0100 KEYS: Move trusted.h to include/keys [ver #2] Signed-off-by: Denis Kenzior Signed-off-by: David Howells Tested-by: Marcel Holtmann Reviewed-by: Marcel Holtmann Signed-off-by: James Morris commit e1ea9f86023e7668604cc6456a818e5e4d0361c9 Author: Denis Kenzior Date: Tue Oct 9 17:48:41 2018 +0100 KEYS: trusted: Expose common functionality [ver #2] This patch exposes some common functionality needed to send TPM commands. Several functions from keys/trusted.c are exposed for use by the new tpm key subtype and a module dependency is introduced. In the future, common functionality between the trusted key type and the asym_tpm subtype should be factored out into a common utility library. Signed-off-by: Denis Kenzior Signed-off-by: David Howells Tested-by: Marcel Holtmann Reviewed-by: Marcel Holtmann Signed-off-by: James Morris commit ad4b1eb5fb3350c979a4f86eacfe7aac0595f335 Author: Denis Kenzior Date: Tue Oct 9 17:48:33 2018 +0100 KEYS: asym_tpm: Implement encryption operation [ver #2] This patch impelements the pkey_encrypt operation. The public key portion extracted from the TPM key blob is used. The operation is performed entirely in software using the crypto API. Signed-off-by: Denis Kenzior Signed-off-by: David Howells Tested-by: Marcel Holtmann Reviewed-by: Marcel Holtmann Signed-off-by: James Morris commit dff5a61a59614c110d06a5dc1466cdb762b6affd Author: Denis Kenzior Date: Tue Oct 9 17:48:25 2018 +0100 KEYS: asym_tpm: Implement pkey_query [ver #2] This commit implements the pkey_query operation. This is accomplished by utilizing the public key portion to obtain max encryption size information for the operations that utilize the public key (encrypt, verify). The private key size extracted from the TPM_Key data structure is used to fill the information where the private key is used (decrypt, sign). The kernel uses a DER/BER format for public keys and does not support setting the key via the raw binary form. To get around this a simple DER/BER formatter is implemented which stores the DER/BER formatted key and exponent in a temporary buffer for use by the crypto API. The only exponent supported currently is 65537. This holds true for other Linux TPM tools such as 'create_tpm_key' and trousers-openssl_tpm_engine. Signed-off-by: Denis Kenzior Signed-off-by: David Howells Tested-by: Marcel Holtmann Reviewed-by: Marcel Holtmann Signed-off-by: James Morris commit d5e72745ca121459f68c598dac7b374a76322b94 Author: Denis Kenzior Date: Tue Oct 9 17:48:17 2018 +0100 KEYS: Add parser for TPM-based keys [ver #2] For TPM based keys, the only standard seems to be described here: http://david.woodhou.se/draft-woodhouse-cert-best-practice.html#rfc.section.4.4 Quote from the relevant section: "Rather, a common form of storage for "wrapped" keys is to encode the binary TCPA_KEY structure in a single ASN.1 OCTET-STRING, and store the result in PEM format with the tag "-----BEGIN TSS KEY BLOB-----". " This patch implements the above behavior. It is assumed that the PEM encoding is stripped out by userspace and only the raw DER/BER format is provided. This is similar to how PKCS7, PKCS8 and X.509 keys are handled. Signed-off-by: Denis Kenzior Signed-off-by: David Howells Tested-by: Marcel Holtmann Reviewed-by: Marcel Holtmann Signed-off-by: James Morris commit f8c54e1ac4b82933dfcf88c37892da8ae35ccbe4 Author: Denis Kenzior Date: Tue Oct 9 17:48:10 2018 +0100 KEYS: asym_tpm: extract key size & public key [ver #2] The parsed BER/DER blob obtained from user space contains a TPM_Key structure. This structure has some information about the key as well as the public key portion. This patch extracts this information for future use. Signed-off-by: Denis Kenzior Signed-off-by: David Howells Tested-by: Marcel Holtmann Reviewed-by: Marcel Holtmann Signed-off-by: James Morris commit 903be6bb84c544551150a6f5aab9fda1ed9a6895 Author: Denis Kenzior Date: Tue Oct 9 17:48:02 2018 +0100 KEYS: asym_tpm: add skeleton for asym_tpm [ver #2] This patch adds the basic skeleton for the asym_tpm asymmetric key subtype. Signed-off-by: Denis Kenzior Signed-off-by: David Howells Tested-by: Marcel Holtmann Reviewed-by: Marcel Holtmann Signed-off-by: James Morris commit b3a8c8a5ebb5b4c3eb7b104364e63c453cc85f14 Author: Denis Kenzior Date: Tue Oct 9 17:47:53 2018 +0100 crypto: rsa-pkcs1pad: Allow hash to be optional [ver #2] The original pkcs1pad implementation allowed to pad/unpad raw RSA output. However, this has been taken out in commit: commit c0d20d22e0ad ("crypto: rsa-pkcs1pad - Require hash to be present") This patch restored this ability as it is needed by the asymmetric key implementation. Signed-off-by: Denis Kenzior Signed-off-by: David Howells Tested-by: Marcel Holtmann Reviewed-by: Marcel Holtmann Signed-off-by: James Morris commit 3c58b2362ba828ee2970c66c6a6fd7b04fde4413 Author: David Howells Date: Tue Oct 9 17:47:46 2018 +0100 KEYS: Implement PKCS#8 RSA Private Key parser [ver #2] Implement PKCS#8 RSA Private Key format [RFC 5208] parser for the asymmetric key type. For the moment, this will only support unencrypted DER blobs. PEM and decryption can be added later. PKCS#8 keys can be loaded like this: openssl pkcs8 -in private_key.pem -topk8 -nocrypt -outform DER | \ keyctl padd asymmetric foo @s Signed-off-by: David Howells Tested-by: Marcel Holtmann Reviewed-by: Marcel Holtmann Reviewed-by: Denis Kenzior Tested-by: Denis Kenzior Signed-off-by: James Morris commit c08fed73712620eb0a19244dbbbbdf00edbe5e47 Author: David Howells Date: Tue Oct 9 17:47:38 2018 +0100 KEYS: Implement encrypt, decrypt and sign for software asymmetric key [ver #2] Implement the encrypt, decrypt and sign operations for the software asymmetric key subtype. This mostly involves offloading the call to the crypto layer. Note that the decrypt and sign operations require a private key to be supplied. Encrypt (and also verify) will work with either a public or a private key. A public key can be supplied with an X.509 certificate and a private key can be supplied using a PKCS#8 blob: # j=`openssl pkcs8 -in ~/pkcs7/firmwarekey2.priv -topk8 -nocrypt -outform DER | keyctl padd asymmetric foo @s` # keyctl pkey_query $j - enc=pkcs1 key_size=4096 max_data_size=512 max_sig_size=512 max_enc_size=512 max_dec_size=512 encrypt=y decrypt=y sign=y verify=y # keyctl pkey_encrypt $j 0 data enc=pkcs1 >/tmp/enc # keyctl pkey_decrypt $j 0 /tmp/enc enc=pkcs1 >/tmp/dec # cmp data /tmp/dec # keyctl pkey_sign $j 0 data enc=pkcs1 hash=sha1 >/tmp/sig # keyctl pkey_verify $j 0 data /tmp/sig enc=pkcs1 hash=sha1 # Signed-off-by: David Howells Tested-by: Marcel Holtmann Reviewed-by: Marcel Holtmann Reviewed-by: Denis Kenzior Tested-by: Denis Kenzior Signed-off-by: James Morris commit f7c4e06e066c3df282e6e3d4e7d8c498be9e1e46 Author: David Howells Date: Tue Oct 9 17:47:31 2018 +0100 KEYS: Allow the public_key struct to hold a private key [ver #2] Put a flag in the public_key struct to indicate if the structure is holding a private key. The private key must be held ASN.1 encoded in the format specified in RFC 3447 A.1.2. This is the form required by crypto/rsa.c. The software encryption subtype's verification and query functions then need to select the appropriate crypto function to set the key. Signed-off-by: David Howells Tested-by: Marcel Holtmann Reviewed-by: Marcel Holtmann Reviewed-by: Denis Kenzior Tested-by: Denis Kenzior Signed-off-by: James Morris commit 82f94f24475c89c6d5cb673e1277b5b4394499c8 Author: David Howells Date: Tue Oct 9 17:47:23 2018 +0100 KEYS: Provide software public key query function [ver #2] Provide a query function for the software public key implementation. This permits information about such a key to be obtained using query_asymmetric_key() or KEYCTL_PKEY_QUERY. Signed-off-by: David Howells Tested-by: Marcel Holtmann Reviewed-by: Marcel Holtmann Reviewed-by: Denis Kenzior Tested-by: Denis Kenzior Signed-off-by: James Morris commit 039884907787e55166e84e0b654a5342cc8a04ab Author: David Howells Date: Tue Oct 9 17:47:15 2018 +0100 KEYS: Make the X.509 and PKCS7 parsers supply the sig encoding type [ver #2] Make the X.509 and PKCS7 parsers fill in the signature encoding type field recently added to the public_key_signature struct. Signed-off-by: David Howells Tested-by: Marcel Holtmann Reviewed-by: Marcel Holtmann Reviewed-by: Denis Kenzior Tested-by: Denis Kenzior Signed-off-by: James Morris commit 5a30771832aab228e0863e414f9182f86797429e Author: David Howells Date: Tue Oct 9 17:47:07 2018 +0100 KEYS: Provide missing asymmetric key subops for new key type ops [ver #2] Provide the missing asymmetric key subops for new key type ops. This include query, encrypt, decrypt and create signature. Verify signature already exists. Also provided are accessor functions for this: int query_asymmetric_key(const struct key *key, struct kernel_pkey_query *info); int encrypt_blob(struct kernel_pkey_params *params, const void *data, void *enc); int decrypt_blob(struct kernel_pkey_params *params, const void *enc, void *data); int create_signature(struct kernel_pkey_params *params, const void *data, void *enc); The public_key_signature struct gains an encoding field to carry the encoding for verify_signature(). Signed-off-by: David Howells Tested-by: Marcel Holtmann Reviewed-by: Marcel Holtmann Reviewed-by: Denis Kenzior Tested-by: Denis Kenzior Signed-off-by: James Morris commit 00d60fd3b93219ea854220f0fd264b86398cbc53 Author: David Howells Date: Tue Oct 9 17:46:59 2018 +0100 KEYS: Provide keyctls to drive the new key type ops for asymmetric keys [ver #2] Provide five keyctl functions that permit userspace to make use of the new key type ops for accessing and driving asymmetric keys. (*) Query an asymmetric key. long keyctl(KEYCTL_PKEY_QUERY, key_serial_t key, unsigned long reserved, struct keyctl_pkey_query *info); Get information about an asymmetric key. The information is returned in the keyctl_pkey_query struct: __u32 supported_ops; A bit mask of flags indicating which ops are supported. This is constructed from a bitwise-OR of: KEYCTL_SUPPORTS_{ENCRYPT,DECRYPT,SIGN,VERIFY} __u32 key_size; The size in bits of the key. __u16 max_data_size; __u16 max_sig_size; __u16 max_enc_size; __u16 max_dec_size; The maximum sizes in bytes of a blob of data to be signed, a signature blob, a blob to be encrypted and a blob to be decrypted. reserved must be set to 0. This is intended for future use to hand over one or more passphrases needed unlock a key. If successful, 0 is returned. If the key is not an asymmetric key, EOPNOTSUPP is returned. (*) Encrypt, decrypt, sign or verify a blob using an asymmetric key. long keyctl(KEYCTL_PKEY_ENCRYPT, const struct keyctl_pkey_params *params, const char *info, const void *in, void *out); long keyctl(KEYCTL_PKEY_DECRYPT, const struct keyctl_pkey_params *params, const char *info, const void *in, void *out); long keyctl(KEYCTL_PKEY_SIGN, const struct keyctl_pkey_params *params, const char *info, const void *in, void *out); long keyctl(KEYCTL_PKEY_VERIFY, const struct keyctl_pkey_params *params, const char *info, const void *in, const void *in2); Use an asymmetric key to perform a public-key cryptographic operation a blob of data. The parameter block pointed to by params contains a number of integer values: __s32 key_id; __u32 in_len; __u32 out_len; __u32 in2_len; For a given operation, the in and out buffers are used as follows: Operation ID in,in_len out,out_len in2,in2_len ======================= =============== =============== =========== KEYCTL_PKEY_ENCRYPT Raw data Encrypted data - KEYCTL_PKEY_DECRYPT Encrypted data Raw data - KEYCTL_PKEY_SIGN Raw data Signature - KEYCTL_PKEY_VERIFY Raw data - Signature info is a string of key=value pairs that supply supplementary information. The __spare space in the parameter block must be set to 0. This is intended, amongst other things, to allow the passing of passphrases required to unlock a key. If successful, encrypt, decrypt and sign all return the amount of data written into the output buffer. Verification returns 0 on success. Signed-off-by: David Howells Tested-by: Marcel Holtmann Reviewed-by: Marcel Holtmann Reviewed-by: Denis Kenzior Tested-by: Denis Kenzior Signed-off-by: James Morris commit 70025f84e5b79627a6739533c4fe7cef5b605886 Author: David Howells Date: Tue Oct 9 17:46:51 2018 +0100 KEYS: Provide key type operations for asymmetric key ops [ver #2] Provide five new operations in the key_type struct that can be used to provide access to asymmetric key operations. These will be implemented for the asymmetric key type in a later patch and may refer to a key retained in RAM by the kernel or a key retained in crypto hardware. int (*asym_query)(const struct kernel_pkey_params *params, struct kernel_pkey_query *info); int (*asym_eds_op)(struct kernel_pkey_params *params, const void *in, void *out); int (*asym_verify_signature)(struct kernel_pkey_params *params, const void *in, const void *in2); Since encrypt, decrypt and sign are identical in their interfaces, they're rolled together in the asym_eds_op() operation and there's an operation ID in the params argument to distinguish them. Verify is different in that we supply the data and the signature instead and get an error value (or 0) as the only result on the expectation that this may well be how a hardware crypto device may work. Signed-off-by: David Howells Tested-by: Marcel Holtmann Reviewed-by: Marcel Holtmann Reviewed-by: Denis Kenzior Tested-by: Denis Kenzior Signed-off-by: James Morris commit 5a2e1853d68904c4b26706dba2884cbeb77bc3ee Author: Vasily Gorbik Date: Wed Oct 17 13:59:46 2018 +0200 s390: avoid vmlinux segments overlap Currently .vmlinux.info section of uncompressed vmlinux elf image is included into the data segment and load address specified as 0. That extends data segment to address 0 and makes "text" and "data" segments overlap. Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align LOAD 0x0000000000001000 0x0000000000100000 0x0000000000100000 0x0000000000ead03c 0x0000000000ead03c R E 0x1000 LOAD 0x0000000000eaf000 0x0000000000000000 0x0000000000000000 0x0000000001a13400 0x000000000233b520 RWE 0x1000 NOTE 0x0000000000eae000 0x0000000000fad000 0x0000000000fad000 0x000000000000003c 0x000000000000003c 0x4 Section to Segment mapping: Segment Sections... 00 .text .notes 01 .rodata __ksymtab __ksymtab_gpl __ksymtab_strings __param __modver .data..ro_after_init __ex_table .data __bug_table .init.text .exit.text .exit.data .altinstructions .altinstr_replacement .nospec_call_table .nospec_return_table .boot.data .init.data .data..percpu .bss .vmlinux.info 02 .notes Later when vmlinux.bin is produced from vmlinux, .vmlinux.info section is removed. But elf vmlinux file, even though it is not bootable anymore, used for debugging and loadable segments overlap should be avoided. Utilize special ":NONE" phdr specification to avoid adding .vmlinux.info into loadable data segment. Also set .vmlinux.info section type to INFO, which allows to get a not-loadable info CONTENTS section. Since minimal supported version of binutils 2.20 does not have --dump-section objcopy option, make .vmlinux.info section loadable during info.bin creation to get actual section contents. Reported-by: Philipp Rudo Signed-off-by: Vasily Gorbik Signed-off-by: Martin Schwidefsky commit b44b136a3773d8a9c7853f8df716bd1483613cbb Author: Vasily Gorbik Date: Fri Oct 19 15:37:01 2018 +0200 s390/vdso: add missing FORCE to build targets According to Documentation/kbuild/makefiles.txt all build targets using if_changed should use FORCE as well. Add missing FORCE to make sure vdso targets are rebuild properly when not just immediate prerequisites have changed but also when build command differs. Reviewed-by: Philipp Rudo Signed-off-by: Vasily Gorbik Signed-off-by: Martin Schwidefsky commit ef5febae1543f35a45f01614123e829d77326d0f Author: Vasily Gorbik Date: Fri Oct 19 13:37:46 2018 +0200 s390/decompressor: add missing FORCE to build targets According to Documentation/kbuild/makefiles.txt all build targets using if_changed should use FORCE as well. Add missing FORCE to make sure vmlinux decompressor targets are rebuild properly when not just immediate prerequisites have changed but also when build command differs. Reviewed-by: Philipp Rudo Signed-off-by: Vasily Gorbik Signed-off-by: Martin Schwidefsky commit efe8eaf7b525f1be26fe20d723d2bfbfcd7455fd Merge: 034bda1cd5ab fe57120e18a1 Author: Ingo Molnar Date: Fri Oct 26 09:22:45 2018 +0200 Merge tag 'perf-core-for-mingo-4.20-20181025' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/core improvements and fixes from Arnaldo Carvalho de Melo: - Introduce 'perf trace --max-events' for stopping 'perf trace' when that many syscalls (enter+exit), tracepoints or other events such as page faults take place. Support that as well on a per-event basis, e.g.: perf trace -e sched:*switch/nr=2/,block:*_plug/nr=4/,block:*_unplug/nr=1/,net:*dev_queue/nr=3,max-stack=16/ Will stop when 2 context switches, 4 block plugs, 1 block unplug and 3 net_dev_queue tracepoints take place. (Arnaldo Carvalho de Melo) - Poll for monitored tasks being alive in 'perf stat -p/-t', exiting when those tasks all terminate (Jiri Olsa) - Encode -k clockid frequency into perf.data to enable timestamps derived metrics conversion into wall clock time on reporting stage. (Alexey Budankov) - Improve Intel PT call graph from SQL database and GUI python scripts, including adopting the Qt MDI interface to allow for multiple subwindows for all the tables, helping in better visualizing the data in the SQL tables, also uses, when available, the Intel XED disassembler libraries to present the Intel PT data as x86 asm mnemonics. This last feature is not currently working in some cases, fix is being discussed (Adrian Hunter) - Implement a ftrace function_graph view in 'perf script' when processing hardware trace data such as Intel PT (Andi Kleen) - Better integration with the Intel XED disassembler, when available, in 'perf script' (Andi Kleen) - Some 'perf trace' drop refcount fixes (Arnaldo Carvalho de Melo) - Add Sparc support to 'perf annotate', jitdump (David Miller) - Fix PLT symbols entry/header sizes properly on Sparc (David Miller) - Fix generation of system call table failure with /tmp mounted with 'noexec' in arm64 (Hongxu Jia) - Allow extended console debug output in 'perf script' (Milian Wolff) - Flush output stream after events in 'perf script' verbose mode (Milian Wolff) Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit 7a048cec598e1761cdcd63eb3a3c6e390b7661c7 Author: Juergen Gross Date: Tue Oct 9 18:09:59 2018 +0200 xen: drop writing error messages to xenstore xenbus_va_dev_error() will try to write error messages to Xenstore under the error//error node (with something like "device/vbd/51872"). This will fail normally and another message about this failure is added to dmesg. I believe this is a remnant from very ancient times, as it was added in the first pvops rush of commits in 2007. So remove the additional message when writing to Xenstore failed as a minimum step. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit e6111161c0a02d58919d776eec94b313bb57911f Author: Juergen Gross Date: Thu Oct 25 09:54:15 2018 +0200 xen/pvh: don't try to unplug emulated devices A Xen PVH guest has no associated qemu device model, so trying to unplug any emulated devices is making no sense at all. Bail out early from xen_unplug_emulated_devices() when running as PVH guest. This will avoid issuing the boot message: [ 0.000000] Xen Platform PCI: unrecognised magic value Cc: # 4.11 Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit 87613bb9d20c556b5eeae04f4caf40701189f07b Author: Helge Deller Date: Thu Oct 25 08:31:16 2018 +0200 parisc: Use LINUX_GATEWAY_SPACE constant in entry.S Use and mention the predefined LINUX_GATEWAY_SPACE constant in the various important code sections which deal with the gateway page. Signed-off-by: Helge Deller commit 9a298b445514b3de08252c71833f9273b7727355 Author: Arnd Bergmann Date: Thu Sep 13 17:59:50 2018 +0200 parisc64: change __kernel_suseconds_t to match glibc There are only two 64-bit architecture ports that have a 32-bit suseconds_t: sparc64 and parisc64. I've encountered a number of problems with this, while trying to get a proper 64-bit time_t working on 32-bit architectures. Having a 32-bit suseconds_t combined with a 64-bit time_t means that we get extra padding in data structures that may leak kernel stack data to user space, and it breaks all code that assumes that timespec and timeval have the same layout. While we can't change sparc64, it seems that glibc on parisc64 has always set suseconds_t to 'long', and the current version would give incorrect results for gettimeofday() and many other interfaces: timestamps passed from user space into the kernel result in tv_usec being always zero (the lower bits contain the intended value but are ignored) while data passed from the kernel to user space contains either zeroes or random data in tv_usec. Based on that, it seems best to change the user API in the kernel in an incompatible way to match what glibc expects. Note that the distros I could find (gentoo and debian) all just have 32-bit user space, which does not suffer from this problem. Signed-off-by: Arnd Bergmann Signed-off-by: Helge Deller commit e5f6d9afa3415104e402cd69288bb03f7165eeba Merge: c300af28572d caf539cd1087 Author: Linus Torvalds Date: Thu Oct 25 18:14:31 2018 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc Pull sparc fix from David Miller: "Build regression fix" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: sparc: Fix VDSO build with older binutils. commit c300af28572d05ae6891c359a7c8c2c81f01dccf Merge: 0d1e8b8d2bcd d26c4bbf9924 Author: Linus Torvalds Date: Thu Oct 25 18:01:29 2018 -0700 Merge tag 'riscv-for-linus-4.20-mw0' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux Pull RISC-V updates from Palmer Dabbelt: "This patch set contains a lot (at least, for me) of improvements to the RISC-V kernel port: - The removal of some cacheinfo values that were bogus. - On systems with F but without D the kernel will not show the F extension to userspace, as it isn't actually supported. - Support for futexes. - Removal of some unused code. - Cleanup of some menuconfig entries. - Support for systems without a floating-point unit, and for building kernels that will never use the floating-point unit. - More fixes to the RV32I port, which regressed again. It's really time to get this into a regression test somewhere so I stop breaking it. Thanks to Zong for resurrecting it again! - Various fixes that resulted from a year old review of our original patch set that I finally got around to. - Various improvements to SMP support, largely based around having switched to logical hart numbering, as well as some interrupt improvements. This one is in the same patch set as above, thanks to Atish for sheparding everything though as my patch set was a bit of a mess. I'm pretty sure this is our largest patch set since the original kernel contribution, and it's certainly the one with the most contributors. While I don't have anything else I know I'm going to submit for the merge window, I would be somewhat surprised if I didn't screw anything up. Thanks for the help, everyone!" * tag 'riscv-for-linus-4.20-mw0' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux: (31 commits) RISC-V: Cosmetic menuconfig changes riscv: move GCC version check for ARCH_SUPPORTS_INT128 to Kconfig RISC-V: remove the unused return_to_handler export RISC-V: Add futex support. RISC-V: Add FP register ptrace support for gdb. RISC-V: Mask out the F extension on systems without D RISC-V: Don't set cacheinfo.{physical_line_partition,attributes} RISC-V: Show IPI stats RISC-V: Show CPU ID and Hart ID separately in /proc/cpuinfo RISC-V: Use Linux logical CPU number instead of hartid RISC-V: Add logical CPU indexing for RISC-V RISC-V: Use WRITE_ONCE instead of direct access RISC-V: Use mmgrab() RISC-V: Rename im_okay_therefore_i_am to found_boot_cpu RISC-V: Rename riscv_of_processor_hart to riscv_of_processor_hartid RISC-V: Provide a cleaner raw_smp_processor_id() RISC-V: Disable preemption before enabling interrupts RISC-V: Comment on the TLB flush in smp_callin() RISC-V: Filter ISA and MMU values in cpuinfo RISC-V: Don't set cacheinfo.{physical_line_partition,attributes} ... commit 0d1e8b8d2bcd3150d51754d8d0fdbf44dc88b0d3 Merge: 83c4087ce468 22a7cdcae6a4 Author: Linus Torvalds Date: Thu Oct 25 17:57:35 2018 -0700 Merge tag 'kvm-4.20-1' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM updates from Radim Krčmář: "ARM: - Improved guest IPA space support (32 to 52 bits) - RAS event delivery for 32bit - PMU fixes - Guest entry hardening - Various cleanups - Port of dirty_log_test selftest PPC: - Nested HV KVM support for radix guests on POWER9. The performance is much better than with PR KVM. Migration and arbitrary level of nesting is supported. - Disable nested HV-KVM on early POWER9 chips that need a particular hardware bug workaround - One VM per core mode to prevent potential data leaks - PCI pass-through optimization - merge ppc-kvm topic branch and kvm-ppc-fixes to get a better base s390: - Initial version of AP crypto virtualization via vfio-mdev - Improvement for vfio-ap - Set the host program identifier - Optimize page table locking x86: - Enable nested virtualization by default - Implement Hyper-V IPI hypercalls - Improve #PF and #DB handling - Allow guests to use Enlightened VMCS - Add migration selftests for VMCS and Enlightened VMCS - Allow coalesced PIO accesses - Add an option to perform nested VMCS host state consistency check through hardware - Automatic tuning of lapic_timer_advance_ns - Many fixes, minor improvements, and cleanups" * tag 'kvm-4.20-1' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (204 commits) KVM/nVMX: Do not validate that posted_intr_desc_addr is page aligned Revert "kvm: x86: optimize dr6 restore" KVM: PPC: Optimize clearing TCEs for sparse tables x86/kvm/nVMX: tweak shadow fields selftests/kvm: add missing executables to .gitignore KVM: arm64: Safety check PSTATE when entering guest and handle IL KVM: PPC: Book3S HV: Don't use streamlined entry path on early POWER9 chips arm/arm64: KVM: Enable 32 bits kvm vcpu events support arm/arm64: KVM: Rename function kvm_arch_dev_ioctl_check_extension() KVM: arm64: Fix caching of host MDCR_EL2 value KVM: VMX: enable nested virtualization by default KVM/x86: Use 32bit xor to clear registers in svm.c kvm: x86: Introduce KVM_CAP_EXCEPTION_PAYLOAD kvm: vmx: Defer setting of DR6 until #DB delivery kvm: x86: Defer setting of CR2 until #PF delivery kvm: x86: Add payload operands to kvm_multiple_exception kvm: x86: Add exception payload fields to kvm_vcpu_events kvm: x86: Add has_payload and payload to kvm_queued_exception KVM: Documentation: Fix omission in struct kvm_vcpu_events KVM: selftests: add Enlightened VMCS test ... commit 83c4087ce468601501ecde4d0ec5b2abd5f57c31 Merge: a67eefad996f a90e90b7d55e Author: Linus Torvalds Date: Thu Oct 25 17:15:46 2018 -0700 Merge branch 'for-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup updates from Tejun Heo: "All trivial changes - simplification, typo fix and adding cond_resched() in a netclassid update loop" * 'for-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup, netclassid: add a preemption point to write_classid rdmacg: fix a typo in rdmacg documentation cgroup: Simplify cgroup_ancestor commit a67eefad996f007afc7c38efe8f45257fb1e3994 Merge: 62606c224d72 54edeb0327d7 Author: Linus Torvalds Date: Thu Oct 25 17:11:52 2018 -0700 Merge tag 'printk-for-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk Pull printk updates from Petr Mladek: - Fix two more locations where printf formatting leaked pointers - Better log_buf_len parameter handling - Add prefix to messages from printk code - Do not miss messages on other consoles when the log is replayed on a new one - Reduce race between console registration and panic() when the log might get replayed on all consoles - Some cont buffer code clean up - Call console only when there is something to do (log vs cont buffer) * tag 'printk-for-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk: lib/vsprintf: Hash printed address for netdev bits fallback lib/vsprintf: Hash legacy clock addresses lib/vsprintf: Prepare for more general use of ptr_to_id() lib/vsprintf: Make ptr argument conts in ptr_to_id() printk: fix integer overflow in setup_log_buf() printk: do not preliminary split up cont buffer printk: lock/unlock console only for new logbuf entries printk: keep kernel cont support always enabled printk: Give error on attempt to set log buffer length to over 2G printk: Add KBUILD_MODNAME and remove a redundant print prefix printk: Correct wrong casting printk: Fix panic caused by passing log_buf_len to command line printk: CON_PRINTBUFFER console registration is a bit racy printk: Do not miss new messages when replaying the log commit ede95a63b5e84ddeea6b0c473b36ab8bfd8c6ce3 Author: Daniel Borkmann Date: Tue Oct 23 01:11:04 2018 +0200 bpf: add bpf_jit_limit knob to restrict unpriv allocations Rick reported that the BPF JIT could potentially fill the entire module space with BPF programs from unprivileged users which would prevent later attempts to load normal kernel modules or privileged BPF programs, for example. If JIT was enabled but unsuccessful to generate the image, then before commit 290af86629b2 ("bpf: introduce BPF_JIT_ALWAYS_ON config") we would always fall back to the BPF interpreter. Nowadays in the case where the CONFIG_BPF_JIT_ALWAYS_ON could be set, then the load will abort with a failure since the BPF interpreter was compiled out. Add a global limit and enforce it for unprivileged users such that in case of BPF interpreter compiled out we fail once the limit has been reached or we fall back to BPF interpreter earlier w/o using module mem if latter was compiled in. In a next step, fair share among unprivileged users can be resolved in particular for the case where we would fail hard once limit is reached. Fixes: 290af86629b2 ("bpf: introduce BPF_JIT_ALWAYS_ON config") Fixes: 0a14842f5a3c ("net: filter: Just In Time compiler for x86-64") Co-Developed-by: Rick Edgecombe Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Cc: Eric Dumazet Cc: Jann Horn Cc: Kees Cook Cc: LKML Signed-off-by: Alexei Starovoitov commit 4d716e10e3c59df6a2252353edb774dc819eb8f5 Merge: 4a6998aff82a b09928b97628 Author: Alexei Starovoitov Date: Thu Oct 25 17:02:06 2018 -0700 Merge branch 'pkt-access-fixes' Daniel Borkmann says: ==================== Several fixes to get direct packet access in order from verifier side. Also test suite fix to run cg_skb as unpriv and an improvement to make direct packet write less error prone in future. ==================== Acked-by: Song Liu Signed-off-by: Alexei Starovoitov commit b09928b976280d64060d7bee146d7df5c5a29bef Author: Daniel Borkmann Date: Wed Oct 24 22:05:49 2018 +0200 bpf: make direct packet write unclone more robust Given this seems to be quite fragile and can easily slip through the cracks, lets make direct packet write more robust by requiring that future program types which allow for such write must provide a prologue callback. In case of XDP and sk_msg it's noop, thus add a generic noop handler there. The latter starts out with NULL data/data_end unconditionally when sg pages are shared. Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Acked-by: Song Liu Signed-off-by: Alexei Starovoitov commit d3f66e4116aff8dd0d5bd4067295b9ddb5e2c29c Author: Daniel Borkmann Date: Wed Oct 24 22:05:48 2018 +0200 bpf: fix leaking uninitialized memory on pop/peek helpers Commit f1a2e44a3aec ("bpf: add queue and stack maps") added helpers with ARG_PTR_TO_UNINIT_MAP_VALUE. Meaning, the helper is supposed to fill the map value buffer with data instead of reading from it like in other helpers such as map update. However, given the buffer is allowed to be uninitialized (since we fill it in the helper anyway), it also means that the helper is obliged to wipe the memory in case of an error in order to not allow for leaking uninitialized memory. Given pop/peek is both handled inside __{stack,queue}_map_get(), lets wipe it there on error case, that is, empty stack/queue. Fixes: f1a2e44a3aec ("bpf: add queue and stack maps") Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Cc: Mauricio Vasquez B Acked-by: Mauricio Vasquez B Signed-off-by: Alexei Starovoitov commit 80b0d86a176cab6201719b8dfd806902b0c6e046 Author: Daniel Borkmann Date: Wed Oct 24 22:05:47 2018 +0200 bpf: fix direct packet write into pop/peek helpers Commit f1a2e44a3aec ("bpf: add queue and stack maps") probably just copy-pasted .pkt_access for bpf_map_{pop,peek}_elem() helpers, but this is buggy in this context since it would allow writes into cloned skbs which is invalid. Therefore, disable .pkt_access for the two. Fixes: f1a2e44a3aec ("bpf: add queue and stack maps") Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Cc: Mauricio Vasquez B Acked-by: Mauricio Vasquez B Signed-off-by: Alexei Starovoitov commit d5563d367c2ce48ea3d675c77f7109f37311943d Author: Daniel Borkmann Date: Wed Oct 24 22:05:46 2018 +0200 bpf: fix cg_skb types to hint access type in may_access_direct_pkt_data Commit b39b5f411dcf ("bpf: add cg_skb_is_valid_access for BPF_PROG_TYPE_CGROUP_SKB") added direct packet access for skbs in cg_skb program types, however allowed access type was not added to the may_access_direct_pkt_data() helper. Therefore the latter always returns false. This is not directly an issue, it just means writes are unconditionally disabled (which is correct) but also reads. Latter is relevant in this function when BPF helpers may read direct packet data which is unconditionally disabled then. Fix it by properly adding BPF_PROG_TYPE_CGROUP_SKB to may_access_direct_pkt_data(). Fixes: b39b5f411dcf ("bpf: add cg_skb_is_valid_access for BPF_PROG_TYPE_CGROUP_SKB") Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Cc: Song Liu Signed-off-by: Alexei Starovoitov commit 5d66fa7d9e9e9399ddfdc530f352dd6f7c724485 Author: Daniel Borkmann Date: Wed Oct 24 22:05:45 2018 +0200 bpf: fix direct packet access for flow dissector progs Commit d58e468b1112 ("flow_dissector: implements flow dissector BPF hook") added direct packet access for skbs in may_access_direct_pkt_data() function where this enables read and write access to the skb->data. This is buggy because without a prologue generator such as bpf_unclone_prologue() we would allow for writing into cloned skbs. Original intention might have been to only allow read access where this is not needed (similar as the flow_dissector_func_proto() indicates which enables only bpf_skb_load_bytes() as well), therefore this patch fixes it to restrict to read-only. Fixes: d58e468b1112 ("flow_dissector: implements flow dissector BPF hook") Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Cc: Petar Penkov Signed-off-by: Alexei Starovoitov commit ab21c1b5f799395232b838e98981cfed6d647905 Author: Daniel Borkmann Date: Wed Oct 24 22:05:44 2018 +0200 bpf: disallow direct packet access for unpriv in cg_skb Commit b39b5f411dcf ("bpf: add cg_skb_is_valid_access for BPF_PROG_TYPE_CGROUP_SKB") added support for returning pkt pointers for direct packet access. Given this program type is allowed for both unprivileged and privileged users, we shouldn't allow unprivileged ones to use it, e.g. besides others one reason would be to avoid any potential speculation on the packet test itself, thus guard this for root only. Fixes: b39b5f411dcf ("bpf: add cg_skb_is_valid_access for BPF_PROG_TYPE_CGROUP_SKB") Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Cc: Song Liu Signed-off-by: Alexei Starovoitov commit 36641ad61db5ce9befd5eb0071abb36eaff16cfc Author: Daniel Borkmann Date: Wed Oct 24 22:05:43 2018 +0200 bpf: fix test suite to enable all unpriv program types Given BPF_PROG_TYPE_CGROUP_SKB program types are also valid in an unprivileged setting, lets not omit these tests and potentially have issues fall through the cracks. Make this more obvious by adding a small test_as_unpriv() helper. Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: Alexei Starovoitov commit 62606c224d72a98c35d21a849f95cccf95b0a252 Merge: 24ed334f3366 a1c6fd4308d3 Author: Linus Torvalds Date: Thu Oct 25 16:43:35 2018 -0700 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto updates from Herbert Xu: "API: - Remove VLA usage - Add cryptostat user-space interface - Add notifier for new crypto algorithms Algorithms: - Add OFB mode - Remove speck Drivers: - Remove x86/sha*-mb as they are buggy - Remove pcbc(aes) from x86/aesni - Improve performance of arm/ghash-ce by up to 85% - Implement CTS-CBC in arm64/aes-blk, faster by up to 50% - Remove PMULL based arm64/crc32 driver - Use PMULL in arm64/crct10dif - Add aes-ctr support in s5p-sss - Add caam/qi2 driver Others: - Pick better transform if one becomes available in crc-t10dif" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (124 commits) crypto: chelsio - Update ntx queue received from cxgb4 crypto: ccree - avoid implicit enum conversion crypto: caam - add SPDX license identifier to all files crypto: caam/qi - simplify CGR allocation, freeing crypto: mxs-dcp - make symbols 'sha1_null_hash' and 'sha256_null_hash' static crypto: arm64/aes-blk - ensure XTS mask is always loaded crypto: testmgr - fix sizeof() on COMP_BUF_SIZE crypto: chtls - remove set but not used variable 'csk' crypto: axis - fix platform_no_drv_owner.cocci warnings crypto: x86/aes-ni - fix build error following fpu template removal crypto: arm64/aes - fix handling sub-block CTS-CBC inputs crypto: caam/qi2 - avoid double export crypto: mxs-dcp - Fix AES issues crypto: mxs-dcp - Fix SHA null hashes and output length crypto: mxs-dcp - Implement sha import/export crypto: aegis/generic - fix for big endian systems crypto: morus/generic - fix for big endian systems crypto: lrw - fix rebase error after out of bounds fix crypto: cavium/nitrox - use pci_alloc_irq_vectors() while enabling MSI-X. crypto: cavium/nitrox - NITROX command queue changes. ... commit bf4cc40e9343bbe6c7400ff6f4feb46fb9338087 Author: Bjørn Mork Date: Thu Oct 25 21:18:25 2018 +0200 net/{ipv4,ipv6}: Do not put target net if input nsid is invalid The cleanup path will put the target net when netnsid is set. So we must reset netnsid if the input is invalid. Fixes: d7e38611b81e ("net/ipv4: Put target net when address dump fails due to bad attributes") Fixes: 242afaa6968c ("net/ipv6: Put target net when address dump fails due to bad attributes") Cc: David Ahern Signed-off-by: Bjørn Mork Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 863d4187d05aafd53f13fe1f358e9eb42bb0dbc1 Author: Bryan Whitehead Date: Thu Oct 25 13:09:38 2018 -0400 lan743x: Remove SPI dependency from Microchip group. The SPI dependency does not apply to lan743x driver, and other drivers in the group already state their dependence on SPI. Signed-off-by: Bryan Whitehead Signed-off-by: David S. Miller commit 55469bc6b5770ffdf0f87c38ce2573f8ddbaa33f Author: Eric Dumazet Date: Thu Oct 25 06:42:12 2018 -0700 drivers: net: remove inclusion when not needed Drivers using generic NAPI interface no longer need to include , since busy polling was moved to core networking stack long ago. See commit 79e7fff47b7b ("net: remove support for per driver ndo_busy_poll()") for reference. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit f802912d42525eddb2e504b0b852539f46c8fd9d Author: Andrew Lunn Date: Thu Oct 25 14:42:38 2018 +0200 net: phy: genphy_10g_driver: Avoid NULL pointer dereference This driver got missed during the recent change of .features from a u32 to a pointer to a Linux bitmap. Change the initialisation from 0 to PHY_10GBIT_FEATURES so removing the danger of a NULL pointer dereference. Fixes: 719655a14971 ("net: phy: Replace phy driver features u32 with link_mode bitmap") Reported-by: Jose Abreu Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller commit 649f0837a8cc2b39329f2de00fa0d04b029291c5 Author: Heiner Kallweit Date: Thu Oct 25 18:40:19 2018 +0200 r8169: fix broken Wake-on-LAN from S5 (poweroff) It was reported that WoL from S5 is broken (WoL from S3 works) and the analysis showed that during system shutdown the network interface was brought down already when the actual kernel shutdown started. Therefore netif_running() returned false and as a consequence the PHY was suspended. Obviously WoL wasn't working then. To fix this the original patch needs to be effectively reverted. A side effect is that when normally bringing down the interface and WoL is enabled the PHY will remain powered on (like it was before the original patch). Fixes: fe87bef01f9b ("r8169: don't check WoL when powering down PHY and interface is down") Reported-by: Neil MacLeod Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 4a6998aff82a20a1aece86a186d8e5263f8b2315 Author: Martin Lau Date: Wed Oct 24 20:42:25 2018 +0000 bpf, btf: fix a missing check bug in btf_parse Wenwen Wang reported: In btf_parse(), the header of the user-space btf data 'btf_data' is firstly parsed and verified through btf_parse_hdr(). In btf_parse_hdr(), the header is copied from user-space 'btf_data' to kernel-space 'btf->hdr' and then verified. If no error happens during the verification process, the whole data of 'btf_data', including the header, is then copied to 'data' in btf_parse(). It is obvious that the header is copied twice here. More importantly, no check is enforced after the second copy to make sure the headers obtained in these two copies are same. Given that 'btf_data' resides in the user space, a malicious user can race to modify the header between these two copies. By doing so, the user can inject inconsistent data, which can cause undefined behavior of the kernel and introduce potential security risk. This issue is similar to the one fixed in commit 8af03d1ae2e1 ("bpf: btf: Fix a missing check bug"). To fix it, this patch copies the user 'btf_data' *before* parsing / verifying the BTF header. Fixes: 69b693f0aefa ("bpf: btf: Introduce BPF Type Format (BTF)") Signed-off-by: Martin KaFai Lau Co-developed-by: Wenwen Wang Acked-by: Song Liu Signed-off-by: Daniel Borkmann commit a3f49d97c22022666fb94101454520a7adacaf08 Author: Naresh Kamboju Date: Thu Oct 25 20:17:28 2018 +0530 selftests/bpf: add config fragments BPF_STREAM_PARSER and XDP_SOCKETS BPF sockmap and hashmap are dependent on CONFIG_BPF_STREAM_PARSER and xskmap is dependent on CONFIG_XDP_SOCKETS Signed-off-by: Naresh Kamboju Signed-off-by: Daniel Borkmann commit f592f804831f1cf9d1f9966f58c80f150e6829b5 Author: Taehee Yoo Date: Wed Oct 24 20:15:17 2018 +0900 bpf: devmap: fix wrong interface selection in notifier_call The dev_map_notification() removes interface in devmap if unregistering interface's ifindex is same. But only checking ifindex is not enough because other netns can have same ifindex. so that wrong interface selection could occurred. Hence netdev pointer comparison code is added. v2: compare netdev pointer instead of using net_eq() (Daniel Borkmann) v1: Initial patch Fixes: 2ddf71e23cc2 ("net: add notifier hooks for devmap bpf map") Signed-off-by: Taehee Yoo Acked-by: Song Liu Signed-off-by: Daniel Borkmann commit 24ed334f33666f2ae929ccc08f72e7e72e353c64 Merge: e80bc229691a 85a585918fb4 Author: Linus Torvalds Date: Thu Oct 25 13:32:00 2018 -0700 Merge branch 'next-loadpin' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull LoadPin updates from James Morris: "From Kees: This is a small reporting improvement and the param change needed for the ordering series (but since the loadpin change is desired and separable, I'm putting it here)" * 'next-loadpin' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: LoadPin: Rename boot param "enabled" to "enforce" LoadPin: Report friendly block device name commit e80bc229691a4f601a2476e07cbdf08a289a2ad6 Merge: 52ff0779d6cf f0f9756b7260 Author: Linus Torvalds Date: Thu Oct 25 13:29:51 2018 -0700 Merge branch 'next-smack' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull smack updates from James Morris: "From Casey: three patches for Smack for 4.20. Two clean up warnings and one is a rarely encountered ptrace capability check" * 'next-smack' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: Smack: Mark expected switch fall-through Smack: ptrace capability use fixes Smack: remove set but not used variable 'root_inode' commit 52ff0779d6cfcce24c0204c22b0b4899dc55449d Merge: 57ce66d39f10 b8d7b7581452 Author: Linus Torvalds Date: Thu Oct 25 13:25:18 2018 -0700 Merge branch 'next-tpm' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull TPM updates from James Morris: "From Jarkko: The only new feature is non-blocking operation for /dev/tpm0" * 'next-tpm' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: tpm: Restore functionality to xen vtpm driver. tpm: add support for nonblocking operation tpm: add ptr to the tpm_space struct to file_priv tpm: Make SECURITYFS a weak dependency tpm: suppress transmit cmd error logs when TPM 1.2 is disabled/deactivated tpm: fix response size validation in tpm_get_random() commit 57ce66d39f10fb01efabd72b14eb033deddb226b Merge: 4ba9628fe5bf 34bccd61b139 Author: Linus Torvalds Date: Thu Oct 25 13:22:23 2018 -0700 Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull integrity updates from James Morris: "From Mimi: This contains a couple of bug fixes, including one for a recent problem with calculating file hashes on overlayfs, and some code cleanup" * 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: MAINTAINERS: add Jarkko as maintainer for trusted keys ima: open a new file instance if no read permissions ima: fix showing large 'violations' or 'runtime_measurements_count' security/integrity: remove unnecessary 'init_keyring' variable security/integrity: constify some read-only data vfs: require i_size <= SIZE_MAX in kernel_read_file() commit 4ba9628fe5bf90e0125dbec847a0cf4f5553de14 Merge: 06999fd59277 1a16dbaf798c Author: Linus Torvalds Date: Thu Oct 25 12:55:31 2018 -0700 Merge branch 'work.lookup' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull more ->lookup() cleanups from Al Viro: "Some ->lookup() instances are still overcomplicating the life for themselves, open-coding the stuff that would be handled by d_splice_alias() just fine. Simplify a couple of such cases caught this cycle and document d_splice_alias() intended use" * 'work.lookup' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: Document d_splice_alias() calling conventions for ->lookup() users. simplify btrfs_lookup() clean erofs_lookup() commit 06999fd59277afef07638453c695a500eb2a93c0 Merge: ba7d4f36a2ec 8a68060cefa6 Author: Linus Torvalds Date: Thu Oct 25 12:52:10 2018 -0700 Merge branch 'work.alpha' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull alpha syscall glue updates from Al Viro: "Two old patches making alpha syscall glue a bit less mysterious" * 'work.alpha' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: alpha: unify the glue for sigreturn-like syscalls alpha: use alpha_ni_syscall only for syscall zero commit ba7d4f36a2ec7d6f8d9e5c6cabbc57469dd4dc22 Merge: 5947a64a7e0c 702ec3072ae6 Author: Linus Torvalds Date: Thu Oct 25 12:48:22 2018 -0700 Merge branch 'work.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull compat_ioctl fixes from Al Viro: "A bunch of compat_ioctl fixes, mostly in bluetooth. Hopefully, most of fs/compat_ioctl.c will get killed off over the next few cycles; between this, tty series already merged and Arnd's work this cycle ought to take a good chunk out of the damn thing..." * 'work.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: hidp: fix compat_ioctl hidp: constify hidp_connection_add() cmtp: fix compat_ioctl bnep: fix compat_ioctl compat_ioctl: trim the pointless includes commit 0af5c656fdb797f74ee57414e0c07cd57406d0c3 Author: Christian König Date: Thu Oct 18 14:29:28 2018 +0200 drm/amdgpu: fix amdgpu_vm_fini We should not remove mappings in rbtree_postorder_for_each_entry_safe because that rebalances the tree. Signed-off-by: Christian König Reviewed-by: Chunming Zhou Signed-off-by: Alex Deucher commit 3732eb0683c17113201cd29fdefd7a58b1acfa7f Author: Evan Quan Date: Wed Oct 24 12:57:56 2018 +0800 drm/amd/powerplay: commonize the API for retrieving current clocks So that it can be shared between all clocks. Signed-off-by: Evan Quan Reviewed-by: Feifei Xu Reviewed-by: Rex Zhu Signed-off-by: Alex Deucher commit 7dc94969e165464896366fcb096f4be18ba56f44 Author: Evan Quan Date: Tue Oct 23 14:31:38 2018 +0800 drm/amd/powerplay: correct the clocks for DAL to be Khz unit Currently the clocks reported are in 10Khz unit. Correct them as Khz unit as DAL wanted. Signed-off-by: Evan Quan Reviewed-by: Feifei Xu Reviewed-by: Rex Zhu Signed-off-by: Alex Deucher commit 1b50bb4d36e89fd54c14722c4ab5266ef17767ff Author: Pavel Machek Date: Wed Oct 24 22:44:39 2018 +0200 Fix pattern handling optimalization Check for zero duration before skipping step. This fixes pattern echo "0 1000 10 2550 0 1000" > pattern which should do [ .-xXx-.] but does [ Xx-.] Signed-off-by: Pavel Machek Suggested-by: Jacek Anaszewski Signed-off-by: Jacek Anaszewski commit 5947a64a7e0c70cc16d5d1e5af3cf3b44535047a Merge: 4dcb9239dad6 746a923b863a Author: Linus Torvalds Date: Thu Oct 25 11:43:47 2018 -0700 Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq updates from Thomas Gleixner: "The interrupt brigade came up with the following updates: - Driver for the Marvell System Error Interrupt machinery - Overhaul of the GIC-V3 ITS driver - Small updates and fixes all over the place" * 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (31 commits) genirq: Fix race on spurious interrupt detection softirq: Fix typo in __do_softirq() comments genirq: Fix grammar s/an /a / irqchip/gic: Unify GIC priority definitions irqchip/gic-v3: Remove acknowledge loop dt-bindings/interrupt-controller: Add documentation for Marvell SEI controller dt-bindings/interrupt-controller: Update Marvell ICU bindings irqchip/irq-mvebu-icu: Add support for System Error Interrupts (SEI) arm64: marvell: Enable SEI driver irqchip/irq-mvebu-sei: Add new driver for Marvell SEI irqchip/irq-mvebu-icu: Support ICU subnodes irqchip/irq-mvebu-icu: Disociate ICU and NSR irqchip/irq-mvebu-icu: Clarify the reset operation of configured interrupts irqchip/irq-mvebu-icu: Fix wrong private data retrieval dt-bindings/interrupt-controller: Fix Marvell ICU length in the example genirq/msi: Allow creation of a tree-based irqdomain for platform-msi dt-bindings: irqchip: renesas-irqc: Document r8a7744 support dt-bindings: irqchip: renesas-irqc: Document R-Car E3 support irqchip/pdc: Setup all edge interrupts as rising edge at GIC irqchip/gic-v3-its: Allow use of LPI tables in reserved memory ... commit 42d0f71c9b5fd48861d61cfc05c9e001f847c9d5 Author: Wei Yongjun Date: Thu Oct 25 01:42:26 2018 +0000 octeontx2-af: Use GFP_ATOMIC under spin lock The function nix_update_mce_list() is called from nix_update_bcast_mce_list(), and a spin lock is held here, so we should use GFP_ATOMIC instead. Fixes: 4b05528ebf0c ("octeontx2-af: Update bcast list upon NIXLF alloc/free") Signed-off-by: Wei Yongjun Signed-off-by: David S. Miller commit 899ecaedd15599c22553d158f53b127cc1632dc2 Author: Tristram Ha Date: Wed Oct 24 14:51:23 2018 -0700 net: ethernet: cadence: fix socket buffer corruption problem Socket buffer is not re-created when headroom is 2 and tailroom is 1. Signed-off-by: Tristram Ha Signed-off-by: David S. Miller commit 4dcb9239dad6cee17c538482619a5b659774ee51 Merge: 3acbd2de6bc3 d59e0ba19481 Author: Linus Torvalds Date: Thu Oct 25 11:14:36 2018 -0700 Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timekeeping updates from Thomas Gleixner: "The timers and timekeeping departement provides: - Another large y2038 update with further preparations for providing the y2038 safe timespecs closer to the syscalls. - An overhaul of the SHCMT clocksource driver - SPDX license identifier updates - Small cleanups and fixes all over the place" * 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (31 commits) tick/sched : Remove redundant cpu_online() check clocksource/drivers/dw_apb: Add reset control clocksource: Remove obsolete CLOCKSOURCE_OF_DECLARE clocksource/drivers: Unify the names to timer-* format clocksource/drivers/sh_cmt: Add R-Car gen3 support dt-bindings: timer: renesas: cmt: document R-Car gen3 support clocksource/drivers/sh_cmt: Properly line-wrap sh_cmt_of_table[] initializer clocksource/drivers/sh_cmt: Fix clocksource width for 32-bit machines clocksource/drivers/sh_cmt: Fixup for 64-bit machines clocksource/drivers/sh_tmu: Convert to SPDX identifiers clocksource/drivers/sh_mtu2: Convert to SPDX identifiers clocksource/drivers/sh_cmt: Convert to SPDX identifiers clocksource/drivers/renesas-ostm: Convert to SPDX identifiers clocksource: Convert to using %pOFn instead of device_node.name tick/broadcast: Remove redundant check RISC-V: Request newstat syscalls y2038: signal: Change rt_sigtimedwait to use __kernel_timespec y2038: socket: Change recvmmsg to use __kernel_timespec y2038: sched: Change sched_rr_get_interval to use __kernel_timespec y2038: utimes: Rework #ifdef guards for compat syscalls ... commit 760eea43f8c6d48684f1f34b8a02fddc1456e849 Author: Geert Uytterhoeven Date: Fri Oct 12 09:20:17 2018 +0200 thermal: da9062/61: Prevent hardware access during system suspend The workqueue used for monitoring the hardware may run while the device is already suspended. Fix this by using the freezable system workqueue instead, cfr. commit 51e20d0e3a60cf46 ("thermal: Prevent polling from happening during system suspend"). Fixes: 608567aac3206ae8 ("thermal: da9062/61: Thermal junction temperature monitoring driver") Signed-off-by: Geert Uytterhoeven Acked-by: Steve Twiss Signed-off-by: Eduardo Valentin commit 697ee786f15d7b65c7f3045d45fe3a05d28e0911 Author: Geert Uytterhoeven Date: Fri Oct 12 09:20:16 2018 +0200 thermal: rcar_thermal: Prevent doing work after unbind When testing bind/unbind on r8a7791/koelsch: WARNING: CPU: 1 PID: 697 at lib/debugobjects.c:329 debug_print_object+0x8c/0xb4 ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x10 This happens if the workqueue runs after the device has been unbound. Fix this by cancelling any queued work during remove. Fixes: e0a5172e9eec7f0d ("thermal: rcar: add interrupt support") Signed-off-by: Geert Uytterhoeven Reviewed-by: Niklas Söderlund Signed-off-by: Eduardo Valentin commit 3a31386217628ffe2491695be2db933c25dde785 Author: Geert Uytterhoeven Date: Fri Oct 12 09:20:15 2018 +0200 thermal: rcar_thermal: Prevent hardware access during system suspend On r8a7791/koelsch, sometimes the following message is printed during system suspend: rcar_thermal e61f0000.thermal: thermal sensor was broken This happens if the workqueue runs while the device is already suspended. Fix this by using the freezable system workqueue instead, cfr. commit 51e20d0e3a60cf46 ("thermal: Prevent polling from happening during system suspend"). Fixes: e0a5172e9eec7f0d ("thermal: rcar: add interrupt support") Signed-off-by: Geert Uytterhoeven Reviewed-by: Niklas Söderlund Signed-off-by: Eduardo Valentin commit 853cbc1f2d3a6ef9d5f6f99fe7c4b7595eae9d3a Author: Sergei Shtylyov Date: Tue Oct 9 22:11:51 2018 +0300 thermal: rcar_gen3_thermal: add R8A77980 support Add the R-Car V3H (R8A77980) SoC support to the R-Car gen3 thermal driver. Signed-off-by: Sergei Shtylyov Reviewed-by: Simon Horman Reviewed-by: Niklas Söderlund Signed-off-by: Eduardo Valentin commit 8583d8d621eb7f38e388dfe53a45fff908ccf07d Author: Sergei Shtylyov Date: Tue Oct 9 22:10:14 2018 +0300 dt-bindings: thermal: rcar-gen3-thermal: document R8A77980 bindings Document the R-Car V3H (R8A77980) SoC in the Renesas R-Car gen3 thermal bindings. Signed-off-by: Sergei Shtylyov Reviewed-by: Simon Horman Reviewed-by: Niklas Söderlund Reviewed-by: Rob Herring Signed-off-by: Eduardo Valentin commit 1d693155607329adff57f5307d35a3a8320d4e7f Author: David HERNANDEZ SANCHEZ Date: Fri Oct 5 10:08:46 2018 +0000 thermal: add stm32 thermal driver Add support for DTS thermal sensor that can be found on some STM32 platforms. This driver is based on OF and works in interrupt mode. It offers two temperature trip points: passive and critical. The first is intended for passive cooling notification while the second is used for over-temperature reset. Signed-off-by: David Hernandez Sanchez Signed-off-by: Eduardo Valentin commit 7f1a22ce597c2d6410843628c7d240e7441a81a3 Author: David HERNANDEZ SANCHEZ Date: Fri Oct 5 10:08:45 2018 +0000 dt-bindings: stm32-thermal: add binding documentation Add thermal binding documentation for STM32 DTS sensor Signed-off-by: David Hernandez Sanchez Reviewed-by: Rob Herring Signed-off-by: Eduardo Valentin commit 92ca366e9b835ada0bfe3c663da91ae44d7e8184 Author: Sergei Shtylyov Date: Fri Oct 5 00:03:13 2018 +0300 thermal: rcar_thermal: add R8A77970 support Add the R-Car V3M (R8A77970) SoC support to the R-Car gen2 thermal driver. The hardware is the same as in the R-Car D3 (R8A77995) plus the CIVM status register (we don't use). Signed-off-by: Sergei Shtylyov Reviewed-by: Geert Uytterhoeven Reviewed-by: Simon Horman Signed-off-by: Eduardo Valentin commit a14404a9f04b904bd0c22f34e2119afbf1425abe Author: Sergei Shtylyov Date: Fri Oct 5 00:01:38 2018 +0300 dt-bindings: thermal: rcar-thermal: document R8A77970 bindings Document the R-Car V3M (R8A77970) SoC in the Renesas R-Car gen2 thermal bindings. The hardware is the same as in the R-Car D3 (R8A77995) plus an extra status register. Signed-off-by: Sergei Shtylyov Reviewed-by: Geert Uytterhoeven Reviewed-by: Simon Horman Reviewed-by: Rob Herring Signed-off-by: Eduardo Valentin commit df016bbba63743bbef9ff5c6c282561211dd72cc Author: Sergei Shtylyov Date: Wed Oct 3 23:47:34 2018 +0300 thermal: rcar_thermal: fix duplicate IRQ request The driver on R8A77995 requests the same IRQ twice since platform_get_resource() is always called for the 1st IRQ resource. Fixes: 1969d9dc2079 ("thermal: rcar_thermal: add r8a77995 support") Signed-off-by: Sergei Shtylyov Reviewed-by: Geert Uytterhoeven Reviewed-by: Simon Horman Reviewed-by: Daniel Lezcano Signed-off-by: Eduardo Valentin commit caf539cd1087f7c36b9c4df271575e9aee49fde5 Author: David S. Miller Date: Thu Oct 25 10:36:19 2018 -0700 sparc: Fix VDSO build with older binutils. Older versions of bintutils do not allow symbol math across different segments on sparc: ==================== Assembler messages: 99: Error: operation combines symbols in different segments ==================== This is controlled by whether or not DIFF_EXPR_OK is defined in gas/config/tc-*.h and for sparc this was not the case until mid-2017. So we have to patch between %stick and %tick another way. Do what powerpc does and emit two versions of the relevant functions, one using %tick and one using %stick, and patch the symbols in the dynamic symbol table. Fixes: 2f6c9bf31a0b ("sparc: Improve VDSO instruction patching.") Reported-by: Meelis Roos Tested-by: Meelis Roos Signed-off-by: David S. Miller commit 98fa7a3e001b21fb47c08af4304f40a3b0535cbd Author: Federico Motta Date: Wed Oct 24 19:13:25 2018 +0200 block, bfq: fix asymmetric scenarios detection Since commit 2d29c9f89fcd ("block, bfq: improve asymmetric scenarios detection"), a scenario is defined asymmetric when one of the following conditions holds: - active bfq_queues have different weights - one or more group of entities (bfq_queue or other groups of entities) are active bfq grants fairness and low latency also in such asymmetric scenarios, by plugging the dispatching of I/O if the bfq_queue in service happens to be temporarily idle. This plugging may lower throughput, so it is important to do it only when strictly needed. By mistake, in commit '2d29c9f89fcd' ("block, bfq: improve asymmetric scenarios detection") the num_active_groups counter was firstly incremented and subsequently decremented at any entity (group or bfq_queue) weight change. This is useless, because only transitions from active to inactive and vice versa matter for that counter. Unfortunately this is also incorrect in the following case: the entity at issue is a bfq_queue and it is under weight raising. In fact in this case there is a spurious increment of the num_active_groups counter. This spurious increment may cause scenarios to be wrongly detected as asymmetric, thus causing useless plugging and loss of throughput. This commit fixes this issue by simply removing the above useless and wrong increments and decrements. Fixes: 2d29c9f89fcd ("block, bfq: improve asymmetric scenarios detection") Tested-by: Oleksandr Natalenko Signed-off-by: Federico Motta Signed-off-by: Paolo Valente Signed-off-by: Jens Axboe commit 0a40a93524736c2ce01d82effe2f2bc34d5cf159 Author: Jens Axboe Date: Thu Oct 25 08:15:30 2018 -0600 gdrom: fix mistake in assignment of error Apparently the kbuild bots missed this one originally, but at least it caught it now. Fix compilation error: All errors (new ones prefixed by >>): drivers/cdrom/gdrom.c: In function 'probe_gdrom': >> drivers/cdrom/gdrom.c:797:3: error: 'rc' undeclared (first use in this function) rc = PTR_ERR(gd.gdrom_rq); ^~ drivers/cdrom/gdrom.c:797:3: note: each undeclared identifier is reported only once for each function it appears in Fixes: ad5fc6bb7221 ("gdrom: convert to blk-mq") Signed-off-by: Jens Axboe commit d6f1dda27251909a27b8d8aacb498628a1047978 Author: Xiaoguang Wang Date: Tue Oct 23 22:30:50 2018 +0800 blk-mq: place trace_block_getrq() in correct place trace_block_getrq() is to indicate a request struct has been allocated for queue, so put it in right place. Reviewed-by: Jianchao Wang Signed-off-by: Xiaoguang Wang Signed-off-by: Jens Axboe commit bf5054569653c491ece544cc7ee333ae53b47121 Author: Damien Le Moal Date: Fri Oct 12 19:08:50 2018 +0900 block: Introduce blk_revalidate_disk_zones() Drivers exposing zoned block devices have to initialize and maintain correctness (i.e. revalidate) of the device zone bitmaps attached to the device request queue (seq_zones_bitmap and seq_zones_wlock). To simplify coding this, introduce a generic helper function blk_revalidate_disk_zones() suitable for most (and likely all) cases. This new function always update the seq_zones_bitmap and seq_zones_wlock bitmaps as well as the queue nr_zones field when called for a disk using a request based queue. For a disk using a BIO based queue, only the number of zones is updated since these queues do not have schedulers and so do not need the zone bitmaps. With this change, the zone bitmap initialization code in sd_zbc.c can be replaced with a call to this function in sd_zbc_read_zones(), which is called from the disk revalidate block operation method. A call to blk_revalidate_disk_zones() is also added to the null_blk driver for devices created with the zoned mode enabled. Finally, to ensure that zoned devices created with dm-linear or dm-flakey expose the correct number of zones through sysfs, a call to blk_revalidate_disk_zones() is added to dm_table_set_restrictions(). The zone bitmaps allocated and initialized with blk_revalidate_disk_zones() are freed automatically from __blk_release_queue() using the block internal function blk_queue_free_zone_bitmaps(). Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Reviewed-by: Mike Snitzer Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit e76239a3748c90a8b0e197f8f4544a8ce52f126e Author: Christoph Hellwig Date: Fri Oct 12 19:08:49 2018 +0900 block: add a report_zones method Dispatching a report zones command through the request queue is a major pain due to the command reply payload rewriting necessary. Given that blkdev_report_zones() is executing everything synchronously, implement report zones as a block device file operation instead, allowing major simplification of the code in many places. sd, null-blk, dm-linear and dm-flakey being the only block device drivers supporting exposing zoned block devices, these drivers are modified to provide the device side implementation of the report_zones() block device file operation. For device mappers, a new report_zones() target type operation is defined so that the upper block layer calls blkdev_report_zones() can be propagated down to the underlying devices of the dm targets. Implementation for this new operation is added to the dm-linear and dm-flakey targets. Reviewed-by: Hannes Reinecke Signed-off-by: Christoph Hellwig [Damien] * Changed method block_device argument to gendisk * Various bug fixes and improvements * Added support for null_blk, dm-linear and dm-flakey. Reviewed-by: Martin K. Petersen Reviewed-by: Mike Snitzer Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit 965b652e901886ea54f93c60027b5be76328d958 Author: Damien Le Moal Date: Fri Oct 12 19:08:48 2018 +0900 block: Expose queue nr_zones in sysfs Expose through sysfs the nr_zones field of struct request_queue. Exposing this value helps in debugging disk issues as well as facilitating scripts based use of the disk (e.g. blktests). For zoned block devices, the nr_zones field indicates the total number of zones of the device calculated using the known disk capacity and zone size. This number of zones is always 0 for regular block devices. Since nr_zones is defined conditionally with CONFIG_BLK_DEV_ZONED, introduce the blk_queue_nr_zones() function to return the correct value for any device, regardless if CONFIG_BLK_DEV_ZONED is set. Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit a2d6b3a2d39005ab4d4a83481a7db092ebf0e9d6 Author: Damien Le Moal Date: Fri Oct 12 19:08:47 2018 +0900 block: Improve zone reset execution There is no need to synchronously execute all REQ_OP_ZONE_RESET BIOs necessary to reset a range of zones. Similarly to what is done for discard BIOs in blk-lib.c, all zone reset BIOs can be chained and executed asynchronously and a synchronous call done only for the last BIO of the chain. Modify blkdev_reset_zones() to operate similarly to blkdev_issue_discard() using the next_bio() helper for chaining BIOs. To avoid code duplication of that function in blk_zoned.c, rename next_bio() into blk_next_bio() and declare it as a block internal function in blk.h. Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit 65e4e3eee83d7a4ad7e8c5175b2a0ddfd3b5685f Author: Damien Le Moal Date: Fri Oct 12 19:08:46 2018 +0900 block: Introduce BLKGETNRZONES ioctl Get a zoned block device total number of zones. The device can be a partition of the whole device. The number of zones is always 0 for regular block devices. Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit 72cd87576d1d885fc2968416ed5aca8f54749653 Author: Damien Le Moal Date: Fri Oct 12 19:08:45 2018 +0900 block: Introduce BLKGETZONESZ ioctl Get a zoned block device zone size in number of 512 B sectors. The zone size is always 0 for regular block devices. Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit 2e85fbaff3a71e46038ec736186c42ffa721c775 Author: Damien Le Moal Date: Fri Oct 12 19:08:44 2018 +0900 block: Limit allocation of zone descriptors for report zones There is no point in allocating more zone descriptors than the number of zones a block device has for doing a zone report. Avoid doing that in blkdev_report_zones_ioctl() by limiting the number of zone decriptors allocated internally to process the user request. Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit a91e138022bc29b5d2bbc56b41de3e0db6261e28 Author: Damien Le Moal Date: Fri Oct 12 19:08:43 2018 +0900 block: Introduce blkdev_nr_zones() helper Introduce the blkdev_nr_zones() helper function to get the total number of zones of a zoned block device. This number is always 0 for a regular block device (q->limits.zoned == BLK_ZONED_NONE case). Replace hard-coded number of zones calculation in dmz_get_zoned_device() with a call to this helper. Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit 5f832a395859de7191e638e3777ae57f37d46d08 Author: Damien Le Moal Date: Fri Oct 12 19:08:42 2018 +0900 scsi: sd_zbc: Fix sd_zbc_check_zones() error checks The unsigned 32 bits overflow check for the zone size value is already done within sd_zbc_check_zones() with the test: } else if (logical_to_sectors(sdkp->device, zone_blocks) > UINT_MAX) { so there is no need to check again for an out of range value in sd_zbc_read_zones(). Simplify the code and fix sd_zbc_check_zones() error return to -EFBIG instead of -ENODEV if the zone size is too large. Change the return type of sd_zbc_check_zones() to an int for the error code and return the zone size (zone_blocks) through a u32 pointer to avoid overflowing the signed 32 return value. Reviewed-by: Hannes Reinecke Acked-by: Martin K. Petersen Reviewed-by: Christoph Hellwig Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit d2e428e49eec9b7ff175d7d5941d50e5a7d15324 Author: Damien Le Moal Date: Fri Oct 12 19:08:41 2018 +0900 scsi: sd_zbc: Reduce boot device scan and revalidate time Handling checks of ZBC device capacity using the max_lba field of the REPORT ZONES command reply for disks with rc_basis == 0 can be done using the same report zones command reply used to check the "same" field. Avoid executing a report zones command solely to check the disk capacity by merging sd_zbc_check_capacity() into sd_zbc_check_zone_size() and renaming that function to sd_zbc_check_zones(). This removes a costly execution of a full report zones command and so reduces device scan duration at boot time as well as the duration of disk revalidate calls. Furthermore, setting the partial report bit in the REPORT ZONES command cdb can significantly reduce this command execution time as the device does not have to count and report the total number of zones that could be reported assuming a large enough reply buffer. A non-partial zone report is necessary only for the first execution of report zones used to check the same field value (to ensure that this value applies to all zones of the disk). All other calls to sd_zbc_report_zones() can use a partial report to reduce execution time. Using a 14 TB ZBC disk, these simple changes reduce device scan time at boot from about 3.5s down to about 900ms. Disk revalidate times are also reduced from about 450ms down to 230ms. Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Acked-by: Martin K. Petersen Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit 7f9d35d24c56576a8c18a8b6f74711c7f3c9c6c0 Author: Damien Le Moal Date: Fri Oct 12 19:08:40 2018 +0900 scsi: sd_zbc: Rearrange code Move the urswrz check out of sd_zbc_read_zones() and into sd_zbc_read_zoned_characteristics() where that value is obtained (read from the disk zoned characteristics VPD page). Since this function now does more than simply reading the VPD page, rename it to sd_zbc_check_zoned_characteristics(). Also fix the error message displayed when reading that VPD page fails. Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Acked-by: Martin K. Petersen Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit cdffab7a86b05b207907c391c093023daed5d4a4 Author: zhong jiang Date: Tue Oct 23 20:06:37 2018 +0800 cdrom: remove set but not used variable 'tocuse' tocuse is not used after setting its value. It is safe to remove the unused variable. Signed-off-by: zhong jiang Signed-off-by: Jens Axboe commit d91dc172e34f6954a94957b012c3b08f4103d5f9 Author: Gustavo A. R. Silva Date: Fri Oct 19 20:44:17 2018 +0200 skd: fix unchecked return values Check return values of dma_set_mask_and_coherent(). Otherwise, if dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)); fails, the following piece of code will be executed even when the call to dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)); returns 0: dev_err(&pdev->dev, "DMA mask error %d\n", rc); goto err_out_regions; Addresses-Coverity-ID: 1474553 ("Unchecked return value") Fixes: 138126214868 ("skd: switch to the generic DMA API") Reviewed-by: Christoph Hellwig Signed-off-by: Gustavo A. R. Silva Signed-off-by: Jens Axboe commit f92898e7f32e3533bfd95be174044bc349d416ca Author: Vasilis Liaskovitis Date: Mon Oct 15 15:25:08 2018 +0200 xen/blkfront: avoid NULL blkfront_info dereference on device removal If a block device is hot-added when we are out of grants, gnttab_grant_foreign_access fails with -ENOSPC (log message "28 granting access to ring page") in this code path: talk_to_blkback -> setup_blkring -> xenbus_grant_ring -> gnttab_grant_foreign_access and the failing path in talk_to_blkback sets the driver_data to NULL: destroy_blkring: blkif_free(info, 0); mutex_lock(&blkfront_mutex); free_info(info); mutex_unlock(&blkfront_mutex); dev_set_drvdata(&dev->dev, NULL); This results in a NULL pointer BUG when blkfront_remove and blkif_free try to access the failing device's NULL struct blkfront_info. Cc: stable@vger.kernel.org # 4.5 and later Signed-off-by: Vasilis Liaskovitis Reviewed-by: Roger Pau Monné Signed-off-by: Konrad Rzeszutek Wilk Signed-off-by: Jens Axboe commit 2347e7e1aea410865e3c3f92014b07ff7d4c5b02 Author: Guo Ren Date: Wed Sep 5 14:25:23 2018 +0800 dt-bindings: interrupt-controller: C-SKY APB intc - Dt-bindings doc about C-SKY apb bus interrupt controller. Signed-off-by: Guo Ren Reviewed-by: Rob Herring commit edff1b4835b71e14538d3a48568fa513ee9f7931 Author: Guo Ren Date: Sun Sep 16 15:57:14 2018 +0800 irqchip: add C-SKY APB bus interrupt controller The driver is for C-SKY APB bus interrupt controller. It's a simple interrupt controller which use pending reg to detect the irq and use enable/disable reg to mask/unmask interrupt sources. A lot of SOCs based on C-SKY CPU use the interrupt controller as root controller. Signed-off-by: Guo Ren Reviewed-by: Mark Rutland commit 3fe5d5bd2dd92124f2a773c19fbc117e023a2ce3 Author: Guo Ren Date: Tue Sep 18 21:07:00 2018 +0800 dt-bindings: interrupt-controller: C-SKY SMP intc Dt-bindings doc about C-SKY Multi-processors interrupt controller. Changelog: - Should be: '#interrupt-cells' not 'interrupt-cells' Signed-off-by: Guo Ren Reviewed-by: Rob Herring commit d8a5f5f79122b42b8afdce29f03683c1b8cdb60e Author: Guo Ren Date: Sun Sep 16 15:57:14 2018 +0800 irqchip: add C-SKY SMP interrupt controller The driver is for C-SKY SMP interrupt controller. It support 16 soft-irqs, 16 private-irqs, and 992 max external-irqs, a total of 1024 interrupts. C-SKY CPU 807/810/860 SMP/non-SMP could use it. Signed-off-by: Guo Ren Reviewed-by: Marc Zyngier commit 243b40a469d1c5d7824df8235ccddbde8c45f03e Author: Guo Ren Date: Thu Sep 20 17:54:54 2018 +0800 MAINTAINERS: Add csky Add a maintainer information for the csky(C-SKY) architecture. Signed-off-by: Guo Ren Reviewed-by: Arnd Bergmann commit f746650f9cdce67419041b8c2cc1f11db2d666d1 Author: Guo Ren Date: Wed Sep 12 21:03:06 2018 +0800 dt-bindings: Add vendor prefix for csky Add csky vendor definition. Signed-off-by: Guo Ren Reviewed-by: Rob Herring commit 19fef6c4893d0321ec07978cb56bda0a753dde8c Author: Guo Ren Date: Wed Sep 5 14:25:22 2018 +0800 dt-bindings: csky CPU Bindings This patch adds the documentation to describe that how to add cpu nodes in dts for SMP. Signed-off-by: Guo Ren Reviewed-by: Rob Herring commit 735ee005c371b2d8d1dbf0542590d17f1e0a0b2f Author: Guo Ren Date: Wed Sep 5 14:25:22 2018 +0800 csky: Misc headers This patch adds csky registers' definition, bitops, byteorder, asm-offsets codes. Signed-off-by: Guo Ren Reviewed-by: Arnd Bergmann commit 991069865796f8ad31ee54aca8a0f1b7a522e94b Author: Guo Ren Date: Wed Sep 5 14:25:20 2018 +0800 csky: SMP support This patch adds boot, ipi, hotplug codes for SMP. Signed-off-by: Guo Ren Cc: Marc Zyngier Cc: Mark Rutland Cc: Peter Zijlstra Reviewed-by: Arnd Bergmann commit 2ce36bfa6a0904524baed699ad78706e50295f84 Author: Guo Ren Date: Wed Sep 5 14:25:19 2018 +0800 csky: Debug and Ptrace GDB This patch adds arch ptrace implementation, stack dump and bug.h. Signed-off-by: Guo Ren Reviewed-by: Arnd Bergmann commit da551281947cb2c0ab6e0045529a706af5d79584 Author: Guo Ren Date: Wed Sep 5 14:25:18 2018 +0800 csky: User access The patch adds "user access from kernel" codes. Signed-off-by: Guo Ren Reviewed-by: Arnd Bergmann commit c5af58b769113c4045209973052db3e3a543ee43 Author: Guo Ren Date: Wed Sep 5 14:25:18 2018 +0800 csky: Library functions This patch adds string optimize codes and some auxiliary codes. Signed-off-by: Chen Linfei Signed-off-by: Mao Han Signed-off-by: Guo Ren Reviewed-by: Arnd Bergmann commit 9d056df0924edbb0a30c85a1c1d3153c1229ec47 Author: Guo Ren Date: Wed Sep 5 14:25:16 2018 +0800 csky: ELF and module probe This patch adds ELF definition and module relocate codes. Signed-off-by: Guo Ren Reviewed-by: Arnd Bergmann commit a0ae62806ff495b60235cc4f2fee3f3ab6a265c9 Author: Guo Ren Date: Wed Sep 5 14:25:16 2018 +0800 csky: Atomic operations This patch adds atomic, cmpxchg, spinlock files. Signed-off-by: Guo Ren Cc: Andrea Parri Cc: Arnd Bergmann Reviewed-by: Peter Zijlstra commit e38a5272baaa81b31680389efdec0c9008e17446 Author: Guo Ren Date: Wed Sep 5 14:25:15 2018 +0800 csky: IRQ handling This patch adds IRQ handling files. Signed-off-by: Guo Ren Cc: Thomas Gleixner Reviewed-by: Arnd Bergmann commit dd3ef10ea295f8f4181e6044fb19444cad7c6aab Author: Guo Ren Date: Wed Sep 5 14:25:14 2018 +0800 csky: VDSO and rt_sigreturn This patch adds files related to VDSO and our VDSO only support rt_sigreturn. Signed-off-by: Guo Ren Reviewed-by: Arnd Bergmann commit e9564df753fd547fcbcd4fd10015c3b1213ef452 Author: Guo Ren Date: Wed Sep 5 14:25:14 2018 +0800 csky: Process management and Signal This patch adds files related to task_switch, sigcontext, signal, fpu context switch. Signed-off-by: Guo Ren Cc: Arnd Bergmann Cc: Eric W. Biederman commit a1c6ca3c6de763459a6e93b644ec6518c890ba1c Author: Vitaly Kuznetsov Date: Wed Oct 17 13:23:55 2018 +0200 kernel: hung_task.c: disable on suspend It is possible to observe hung_task complaints when system goes to suspend-to-idle state: # echo freeze > /sys/power/state PM: Syncing filesystems ... done. Freezing user space processes ... (elapsed 0.001 seconds) done. OOM killer disabled. Freezing remaining freezable tasks ... (elapsed 0.002 seconds) done. sd 0:0:0:0: [sda] Synchronizing SCSI cache INFO: task bash:1569 blocked for more than 120 seconds. Not tainted 4.19.0-rc3_+ #687 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. bash D 0 1569 604 0x00000000 Call Trace: ? __schedule+0x1fe/0x7e0 schedule+0x28/0x80 suspend_devices_and_enter+0x4ac/0x750 pm_suspend+0x2c0/0x310 Register a PM notifier to disable the detector on suspend and re-enable back on wakeup. Signed-off-by: Vitaly Kuznetsov Signed-off-by: Rafael J. Wysocki commit f174e49e4906d945a0e4de98fbf796de31614f47 Author: Sudeep Holla Date: Wed Oct 24 14:44:58 2018 +0100 cpufreq: remove unused arm_big_little_dt driver Most of the ARM platforms used cpufreq-dt driver irrespective of whether it's big-little(HMP) or SMP system. This arm_big_little_dt is not used actively at all. So let's remove the driver, so that it need not be maintained. Signed-off-by: Sudeep Holla Acked-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit a7314405d83c8f95736edb0ea7ade5d459b79afe Author: Sudeep Holla Date: Wed Oct 24 14:44:57 2018 +0100 cpufreq: drop ARM_BIG_LITTLE_CPUFREQ support for ARM64 ARM_BIG_LITTLE_CPUFREQ depends on topology_physical_package_id to get the cluster id which inturn provides the information on related cpus in the same performance domain. ARM64 core doesn't provide the cluster information as it's not architecturally defined. There are no users of this driver in ARM64 after the one and only user(SCPI) moved away. So let's ban the usage of this driver for ARM64. Signed-off-by: Sudeep Holla Acked-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit 5906056e52e9ee5e130d880443e83016f892b5dd Author: Dominik Brodowski Date: Tue Oct 23 21:54:04 2018 +0200 cpufreq: intel_pstate: Fix compilation for !CONFIG_ACPI While at it, add a few comments which config options #ifdef and #else statements refer to. Fixes: 86d333a8cc7f (cpufreq: intel_pstate: Add base_frequency attribute) Signed-off-by: Dominik Brodowski Acked-by: Srinivas Pandruvada Signed-off-by: Rafael J. Wysocki commit 3acbd2de6bc3af215c6ed7732dfc097d1e238503 Merge: d49f8a52b15b de7d83da84bd Author: Linus Torvalds Date: Thu Oct 25 09:00:15 2018 -0700 Merge tag 'sound-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "There have been little changes in ALSA core stuff, but ASoC core still kept rolling for the continued restructuring. The rest are lots of small driver-specific changes and some minor API updates. Here are highlights: General: - Appropriate fall-through annotations everywhere - Some code cleanup in memalloc code, handling non-cacahed pages more commonly in the helper - Deployment of SNDRV_PCM_INFO_SYNC_APPLPTR flag consistently Drivers: - More HD-audio CA0132 codec improvement for supporting other Creative boards - Plumbing legacy HD-audio codecs as ASoC BE on Intel SST; this will give move support of existing HD-audio devices with DSP - A few device-specific HD-audio quirks as usual - New quirk for RME CC devices and correction for B&W PX for USB-audio - FireWire: code refactoring including devres usages ASoC Core: - Continued componentization works; it's almost done! - A bunch of new for_each_foo macros - Cleanups and fixes in DAPM code ASoC Drivers: - MCLK support for several different devices, including CS42L51, STM32 SAI, and MAX98373 - Support for Allwinner A64 CODEC analog, Intel boards with DA7219 and MAX98927, Meson AXG PDM inputs, Nuvoton NAU8822, Renesas R8A7744 and TI PCM3060" * tag 'sound-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (299 commits) ASoC: stm32: sai: fix master clock naming ASoC: stm32: add clock dependency for sai ALSA: hda/ca0132 - Actually fix microphone issue ASoC: sun4i-i2s: move code from startup/shutdown hooks into pm_runtime hooks ASoC: wm2000: Remove wm2000_read helper function ASoC: cs42l51: fix mclk support ASoC: wm_adsp: Log addresses as 8 digits in wm_adsp_buffer_populate ASoC: wm_adsp: Rename memory fields in wm_adsp_buffer ASoC: cs42l51: add mclk support ASoC: stm32: sai: set sai as mclk clock provider ASoC: dt-bindings: add mclk support to cs42l51 ASoC: dt-bindings: add mclk provider support to stm32 sai ASoC: soc-core: fix trivial checkpatch issues ASoC: dapm: Add support for hw_free on CODEC to CODEC links ASoC: Intel: kbl_da7219_max98927: minor white space clean up ALSA: i2c/cs8427: Fix int to char conversion ALSA: doc: Brush up the old writing-an-alsa-driver ASoC: rsnd: tidyup SSICR::SWSP for TDM ASoC: rsnd: enable TDM settings for SSI parent ASoC: pcm3168a: add hw constraint for capture channel ... commit 013de2d6671d89de3397904749c86a69ac0686f7 Author: Guo Ren Date: Wed Sep 5 14:25:12 2018 +0800 csky: MMU and page table management This patch adds files related to memory management and here is our memory-layout: Fixmap : 0xffc02000 – 0xfffff000 (4 MB - 12KB) Pkmap : 0xff800000 – 0xffc00000 (4 MB) Vmalloc : 0xf0200000 – 0xff000000 (238 MB) Lowmem : 0x80000000 – 0xc0000000 (1GB) abiv1 CPU (CK610) is VIPT cache and it doesn't support highmem. abiv2 CPUs are all PIPT cache and they could support highmem. Lowmem is directly mapped by msa0 & msa1 reg, and we needn't setup memory page table for it. Link:https://lore.kernel.org/lkml/20180518215548.GH17671@n2100.armlinux.org.uk/ Signed-off-by: Guo Ren Cc: Christoph Hellwig Reviewed-by: Arnd Bergmann commit 00a9730e1007c6cc87a7c78af2f24a4105d616ee Author: Guo Ren Date: Wed Sep 5 14:25:10 2018 +0800 csky: Cache and TLB routines This patch adds cache and tlb sync codes for abiv1 & abiv2. Signed-off-by: Guo Ren Reviewed-by: Arnd Bergmann commit 4859bfca11c7d63d55175bcd85a75d6cee4b7184 Author: Guo Ren Date: Wed Sep 5 14:25:08 2018 +0800 csky: System Call This patch adds files related to syscall. Signed-off-by: Guo Ren Reviewed-by: Arnd Bergmann commit 081860b970adb69888734df0c8aa849b00ea7254 Author: Guo Ren Date: Wed Sep 5 14:25:08 2018 +0800 csky: Exception handling and mm-fault This patch adds exception handling code, cpuinfo and mm-fault code. Signed-off-by: Guo Ren Reviewed-by: Arnd Bergmann commit 9143a9359d051142081b26c3726c928f965c5eb7 Author: Guo Ren Date: Wed Sep 5 14:25:07 2018 +0800 csky: Kernel booting This patch add boot code. Thx boot params is all in dtb and it's the only way to let kernel get bootloader param information. Signed-off-by: Guo Ren Reviewed-by: Arnd Bergmann commit 7c768f845104b7c96954ad536be29797eff6a434 Author: Guo Ren Date: Wed Sep 5 14:25:06 2018 +0800 csky: defconfig This patch adds csky defconfig. Signed-off-by: Guo Ren Reviewed-by: Arnd Bergmann commit c32e64e852f3f5c0fd709f84bc94736840088375 Author: Guo Ren Date: Wed Sep 5 14:25:06 2018 +0800 csky: Build infrastructure This patch adds Makefile, Kconfig for build infrastructure. Signed-off-by: Guo Ren Acked-by: Arnd Bergmann commit 6a9b593d4b6f5994209456de7a3c2db0974b5dda Author: Hans de Goede Date: Fri Oct 19 10:41:28 2018 +0200 ACPI / PMIC: xpower: Add depends on IOSF_MBI to Kconfig entry This is necessary to avoid compilation issues on non x86 systems (where the asm/iosf_mbi.h header is not available) and on x86 systems in case IOSF_MBI support is not enabled there. Note that the AXP288 PMIC is connected through the LPSS i2c controller, so either we have IOSF_MBI support selected through the X86_INTEL_LPSS option, or we have a kernel where the OpRegion will never work anyways. Signed-off-by: Hans de Goede Acked-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki commit 8afb46804dfa88bb86d65e13f3209372f3d912e3 Author: Hans de Goede Date: Thu Oct 11 16:29:11 2018 +0200 i2c: designware: Cleanup bus lock handling Now that most of the special Bay- / Cherry-Trail bus lock handling has been moved to the iosf_mbi code we can simplify the remaining code a bit. Signed-off-by: Hans de Goede Acked-by: Jarkko Nikula Tested-by: Jarkko Nikula Acked-by: Wolfram Sang Signed-off-by: Rafael J. Wysocki commit 3c670dba864d9ab0a23612a93b7d98700734bd44 Author: Hans de Goede Date: Thu Oct 11 16:29:10 2018 +0200 ACPI / PMIC: xpower: Block P-Unit I2C access during read-modify-write intel_xpower_pmic_update_power() does a read-modify-write of the output control register. The i2c-designware code blocks the P-Unit I2C access during the read and write by taking the P-Unit's PMIC bus semaphore. But between the read and the write that semaphore is released and the P-Unit could make changes to the register which we then end up overwriting. This commit makes intel_xpower_pmic_update_power() take the semaphore itself so that it is held over the entire read-modify-write, avoiding this race. Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit ad6e16059d8e00de0887885db11d87cba0bd1512 Author: Qiuxu Zhuo Date: Sun Oct 21 15:18:56 2018 +0800 EDAC, skx_edac: Add address translation for non-volatile DIMMs Currently, this driver doesn't support address translation for non-volatile DIMMs. The ACPI ADXL DSM method provides address translation for both volatile and non-volatile DIMMs. Enable it to use the ACPI DSM methods if they are supported and there are non-volatile DIMMs populated on the system. Co-developed-by: Tony Luck Signed-off-by: Qiuxu Zhuo Signed-off-by: Borislav Petkov CC: Mauro Carvalho Chehab CC: arozansk@redhat.com CC: linux-edac Link: http://lkml.kernel.org/r/1540106336-5212-1-git-send-email-qiuxu.zhuo@intel.com commit e09db3d241f8d594381b6e5f2ca0f72ffcce478a Author: Hans de Goede Date: Thu Oct 11 16:29:09 2018 +0200 x86: baytrail/cherrytrail: Rework and move P-Unit PMIC bus semaphore code On some BYT/CHT systems the SoC's P-Unit shares the I2C bus with the kernel. The P-Unit has a semaphore for the PMIC bus which we can take to block it from accessing the shared bus while the kernel wants to access it. Currently we have the I2C-controller driver acquiring and releasing the semaphore around each I2C transfer. There are 2 problems with this: 1) PMIC accesses often come in the form of a read-modify-write on one of the PMIC registers, we currently release the P-Unit's PMIC bus semaphore between the read and the write. If the P-Unit modifies the register during this window?, then we end up overwriting the P-Unit's changes. I believe that this is mostly an academic problem, but I'm not sure. 2) To safely access the shared I2C bus, we need to do 3 things: a) Notify the GPU driver that we are starting a window in which it may not access the P-Unit, since the P-Unit seems to ignore the semaphore for explicit power-level requests made by the GPU driver b) Make a pm_qos request to force all CPU cores out of C6/C7 since entering C6/C7 while we hold the semaphore hangs the SoC c) Finally take the P-Unit's PMIC bus semaphore All 3 these steps together are somewhat expensive, so ideally if we have a bunch of i2c transfers grouped together we only do this once for the entire group. Taking the read-modify-write on a PMIC register as example then ideally we would only do all 3 steps once at the beginning and undo all 3 steps once at the end. For this we need to be able to take the semaphore from within e.g. the PMIC opregion driver, yet we do not want to remove the taking of the semaphore from the I2C-controller driver, as that is still necessary to protect many other code-paths leading to accessing the shared I2C bus. This means that we first have the PMIC driver acquire the semaphore and then have the I2C controller driver trying to acquire it again. To make this possible this commit does the following: 1) Move the semaphore code from being private to the I2C controller driver into the generic iosf_mbi code, which already has other code to deal with the shared bus so that it can be accessed outside of the I2C bus driver. 2) Rework the code so that it can be called multiple times nested, while still blocking I2C accesses while e.g. the GPU driver has indicated the P-Unit needs the bus through a iosf_mbi_punit_acquire() call. Signed-off-by: Hans de Goede Acked-by: Jarkko Nikula Tested-by: Jarkko Nikula Acked-by: Wolfram Sang Signed-off-by: Rafael J. Wysocki commit a7fe5190c03f8137ef08db84a58dd4daf2c4785d Author: Daniel Lezcano Date: Thu Oct 4 14:04:03 2018 +0200 cpuidle: menu: Remove get_loadavg() from the performance multiplier The function get_loadavg() returns almost always zero. To be more precise, statistically speaking for a total of 1023379 times passing in the function, the load is equal to zero 1020728 times, greater than 100, 610 times, the remaining is between 0 and 5. In 2011, the get_loadavg() was removed from the Android tree because of the above [1]. At this time, the load was: unsigned long this_cpu_load(void) { struct rq *this = this_rq(); return this->cpu_load[0]; } In 2014, the code was changed by commit 372ba8cb46b2 (cpuidle: menu: Lookup CPU runqueues less) and the load is: void get_iowait_load(unsigned long *nr_waiters, unsigned long *load) { struct rq *rq = this_rq(); *nr_waiters = atomic_read(&rq->nr_iowait); *load = rq->load.weight; } with the same result. Both measurements show using the load in this code path does no matter anymore. Removing it. [1] https://android.googlesource.com/kernel/common/+/4dedd9f124703207895777ac6e91dacde0f7cc17 Signed-off-by: Daniel Lezcano Acked-by: Mel Gorman Acked-by: Peter Zijlstra (Intel) Signed-off-by: Rafael J. Wysocki commit 145d952a29320dea883246bcb24ba1da7ac4bb7f Author: Daniel Lezcano Date: Thu Oct 4 14:04:02 2018 +0200 sched: Factor out nr_iowait and nr_iowait_cpu The function nr_iowait_cpu() can be used directly by nr_iowait() instead of duplicating code. Call nr_iowait_cpu() from nr_iowait() Signed-off-by: Daniel Lezcano Acked-by: Peter Zijlstra (Intel) Signed-off-by: Rafael J. Wysocki commit d49f8a52b15bf35db778035340d8a673149f9f93 Merge: bd6bf7c10484 a0db8a7516d9 Author: Linus Torvalds Date: Thu Oct 25 07:40:30 2018 -0700 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "This is mostly updates of the usual drivers: UFS, esp_scsi, NCR5380, qla2xxx, lpfc, libsas, hisi_sas. In addition there's a set of mostly small updates to the target subsystem a set of conversions to the generic DMA API, which do have some potential for issues in the older drivers but we'll handle those as case by case fixes. A new myrs driver for the DAC960/mylex raid controllers to replace the block based DAC960 which is also being removed by Jens in this merge window. Plus the usual slew of trivial changes" [ "myrs" stands for "MYlex Raid Scsi". Obviously. Silly of me to even wonder. There's also a "myrb" driver, where the 'b' stands for 'block'. Truly, somebody has got mad naming skillz. - Linus ] * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (237 commits) scsi: myrs: Fix the processor absent message in processor_show() scsi: myrs: Fix a logical vs bitwise bug scsi: hisi_sas: Fix NULL pointer dereference scsi: myrs: fix build failure on 32 bit scsi: fnic: replace gross legacy tag hack with blk-mq hack scsi: mesh: switch to generic DMA API scsi: ips: switch to generic DMA API scsi: smartpqi: fully convert to the generic DMA API scsi: vmw_pscsi: switch to generic DMA API scsi: snic: switch to generic DMA API scsi: qla4xxx: fully convert to the generic DMA API scsi: qla2xxx: fully convert to the generic DMA API scsi: qla1280: switch to generic DMA API scsi: qedi: fully convert to the generic DMA API scsi: qedf: fully convert to the generic DMA API scsi: pm8001: switch to generic DMA API scsi: nsp32: switch to generic DMA API scsi: mvsas: fully convert to the generic DMA API scsi: mvumi: switch to generic DMA API scsi: mpt3sas: switch to generic DMA API ... commit bd6bf7c10484f026505814b690104cdef27ed460 Merge: a41efc2a0f68 663569db6476 Author: Linus Torvalds Date: Thu Oct 25 06:50:48 2018 -0700 Merge tag 'pci-v4.20-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI updates from Bjorn Helgaas: - Fix ASPM link_state teardown on removal (Lukas Wunner) - Fix misleading _OSC ASPM message (Sinan Kaya) - Make _OSC optional for PCI (Sinan Kaya) - Don't initialize ASPM link state when ACPI_FADT_NO_ASPM is set (Patrick Talbert) - Remove x86 and arm64 node-local allocation for host bridge structures (Punit Agrawal) - Pay attention to device-specific _PXM node values (Jonathan Cameron) - Support new Immediate Readiness bit (Felipe Balbi) - Differentiate between pciehp surprise and safe removal (Lukas Wunner) - Remove unnecessary pciehp includes (Lukas Wunner) - Drop pciehp hotplug_slot_ops wrappers (Lukas Wunner) - Tolerate PCIe Slot Presence Detect being hardwired to zero to workaround broken hardware, e.g., the Wilocity switch/wireless device (Lukas Wunner) - Unify pciehp controller & slot structs (Lukas Wunner) - Constify hotplug_slot_ops (Lukas Wunner) - Drop hotplug_slot_info (Lukas Wunner) - Embed hotplug_slot struct into users instead of allocating it separately (Lukas Wunner) - Initialize PCIe port service drivers directly instead of relying on initcall ordering (Keith Busch) - Restore PCI config state after a slot reset (Keith Busch) - Save/restore DPC config state along with other PCI config state (Keith Busch) - Reference count devices during AER handling to avoid race issue with concurrent hot removal (Keith Busch) - If an Upstream Port reports ERR_FATAL, don't try to read the Port's config space because it is probably unreachable (Keith Busch) - During error handling, use slot-specific reset instead of secondary bus reset to avoid link up/down issues on hotplug ports (Keith Busch) - Restore previous AER/DPC handling that does not remove and re-enumerate devices on ERR_FATAL (Keith Busch) - Notify all drivers that may be affected by error recovery resets (Keith Busch) - Always generate error recovery uevents, even if a driver doesn't have error callbacks (Keith Busch) - Make PCIe link active reporting detection generic (Keith Busch) - Support D3cold in PCIe hierarchies during system sleep and runtime, including hotplug and Thunderbolt ports (Mika Westerberg) - Handle hpmemsize/hpiosize kernel parameters uniformly, whether slots are empty or occupied (Jon Derrick) - Remove duplicated include from pci/pcie/err.c and unused variable from cpqphp (YueHaibing) - Remove driver pci_cleanup_aer_uncorrect_error_status() calls (Oza Pawandeep) - Uninline PCI bus accessors for better ftracing (Keith Busch) - Remove unused AER Root Port .error_resume method (Keith Busch) - Use kfifo in AER instead of a local version (Keith Busch) - Use threaded IRQ in AER bottom half (Keith Busch) - Use managed resources in AER core (Keith Busch) - Reuse pcie_port_find_device() for AER injection (Keith Busch) - Abstract AER interrupt handling to disconnect error injection (Keith Busch) - Refactor AER injection callbacks to simplify future improvments (Keith Busch) - Remove unused Netronome NFP32xx Device IDs (Jakub Kicinski) - Use bitmap_zalloc() for dma_alias_mask (Andy Shevchenko) - Add switch fall-through annotations (Gustavo A. R. Silva) - Remove unused Switchtec quirk variable (Joshua Abraham) - Fix pci.c kernel-doc warning (Randy Dunlap) - Remove trivial PCI wrappers for DMA APIs (Christoph Hellwig) - Add Intel GPU device IDs to spurious interrupt quirk (Bin Meng) - Run Switchtec DMA aliasing quirk only on NTB endpoints to avoid useless dmesg errors (Logan Gunthorpe) - Update Switchtec NTB documentation (Wesley Yung) - Remove redundant "default n" from Kconfig (Bartlomiej Zolnierkiewicz) - Avoid panic when drivers enable MSI/MSI-X twice (Tonghao Zhang) - Add PCI support for peer-to-peer DMA (Logan Gunthorpe) - Add sysfs group for PCI peer-to-peer memory statistics (Logan Gunthorpe) - Add PCI peer-to-peer DMA scatterlist mapping interface (Logan Gunthorpe) - Add PCI configfs/sysfs helpers for use by peer-to-peer users (Logan Gunthorpe) - Add PCI peer-to-peer DMA driver writer's documentation (Logan Gunthorpe) - Add block layer flag to indicate driver support for PCI peer-to-peer DMA (Logan Gunthorpe) - Map Infiniband scatterlists for peer-to-peer DMA if they contain P2P memory (Logan Gunthorpe) - Register nvme-pci CMB buffer as PCI peer-to-peer memory (Logan Gunthorpe) - Add nvme-pci support for PCI peer-to-peer memory in requests (Logan Gunthorpe) - Use PCI peer-to-peer memory in nvme (Stephen Bates, Steve Wise, Christoph Hellwig, Logan Gunthorpe) - Cache VF config space size to optimize enumeration of many VFs (KarimAllah Ahmed) - Remove unnecessary include (Bjorn Helgaas) - Fix VMD AERSID quirk Device ID matching (Jon Derrick) - Fix Cadence PHY handling during probe (Alan Douglas) - Signal Cadence Endpoint interrupts via AXI region 0 instead of last region (Alan Douglas) - Write Cadence Endpoint MSI interrupts with 32 bits of data (Alan Douglas) - Remove redundant controller tests for "device_type == pci" (Rob Herring) - Document R-Car E3 (R8A77990) bindings (Tho Vu) - Add device tree support for R-Car r8a7744 (Biju Das) - Drop unused mvebu PCIe capability code (Thomas Petazzoni) - Add shared PCI bridge emulation code (Thomas Petazzoni) - Convert mvebu to use shared PCI bridge emulation (Thomas Petazzoni) - Add aardvark Root Port emulation (Thomas Petazzoni) - Support 100MHz/200MHz refclocks for i.MX6 (Lucas Stach) - Add initial power management for i.MX7 (Leonard Crestez) - Add PME_Turn_Off support for i.MX7 (Leonard Crestez) - Fix qcom runtime power management error handling (Bjorn Andersson) - Update TI dra7xx unaligned access errata workaround for host mode as well as endpoint mode (Vignesh R) - Fix kirin section mismatch warning (Nathan Chancellor) - Remove iproc PAXC slot check to allow VF support (Jitendra Bhivare) - Quirk Keystone K2G to limit MRRS to 256 (Kishon Vijay Abraham I) - Update Keystone to use MRRS quirk for host bridge instead of open coding (Kishon Vijay Abraham I) - Refactor Keystone link establishment (Kishon Vijay Abraham I) - Simplify and speed up Keystone link training (Kishon Vijay Abraham I) - Remove unused Keystone host_init argument (Kishon Vijay Abraham I) - Merge Keystone driver files into one (Kishon Vijay Abraham I) - Remove redundant Keystone platform_set_drvdata() (Kishon Vijay Abraham I) - Rename Keystone functions for uniformity (Kishon Vijay Abraham I) - Add Keystone device control module DT binding (Kishon Vijay Abraham I) - Use SYSCON API to get Keystone control module device IDs (Kishon Vijay Abraham I) - Clean up Keystone PHY handling (Kishon Vijay Abraham I) - Use runtime PM APIs to enable Keystone clock (Kishon Vijay Abraham I) - Clean up Keystone config space access checks (Kishon Vijay Abraham I) - Get Keystone outbound window count from DT (Kishon Vijay Abraham I) - Clean up Keystone outbound window configuration (Kishon Vijay Abraham I) - Clean up Keystone DBI setup (Kishon Vijay Abraham I) - Clean up Keystone ks_pcie_link_up() (Kishon Vijay Abraham I) - Fix Keystone IRQ status checking (Kishon Vijay Abraham I) - Add debug messages for all Keystone errors (Kishon Vijay Abraham I) - Clean up Keystone includes and macros (Kishon Vijay Abraham I) - Fix Mediatek unchecked return value from devm_pci_remap_iospace() (Gustavo A. R. Silva) - Fix Mediatek endpoint/port matching logic (Honghui Zhang) - Change Mediatek Root Port Class Code to PCI_CLASS_BRIDGE_PCI (Honghui Zhang) - Remove redundant Mediatek PM domain check (Honghui Zhang) - Convert Mediatek to pci_host_probe() (Honghui Zhang) - Fix Mediatek MSI enablement (Honghui Zhang) - Add Mediatek system PM support for MT2712 and MT7622 (Honghui Zhang) - Add Mediatek loadable module support (Honghui Zhang) - Detach VMD resources after stopping root bus to prevent orphan resources (Jon Derrick) - Convert pcitest build process to that used by other tools (iio, perf, etc) (Gustavo Pimentel) * tag 'pci-v4.20-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: (140 commits) PCI/AER: Refactor error injection fallbacks PCI/AER: Abstract AER interrupt handling PCI/AER: Reuse existing pcie_port_find_device() interface PCI/AER: Use managed resource allocations PCI: pcie: Remove redundant 'default n' from Kconfig PCI: aardvark: Implement emulated root PCI bridge config space PCI: mvebu: Convert to PCI emulated bridge config space PCI: mvebu: Drop unused PCI express capability code PCI: Introduce PCI bridge emulated config space common logic PCI: vmd: Detach resources after stopping root bus nvmet: Optionally use PCI P2P memory nvmet: Introduce helper functions to allocate and free request SGLs nvme-pci: Add support for P2P memory in requests nvme-pci: Use PCI p2pmem subsystem to manage the CMB IB/core: Ensure we map P2P memory correctly in rdma_rw_ctx_[init|destroy]() block: Add PCI P2P flag for request queue PCI/P2PDMA: Add P2P DMA driver writer's documentation docs-rst: Add a new directory for PCI documentation PCI/P2PDMA: Introduce configfs/sysfs enable attribute helpers PCI/P2PDMA: Add PCI p2pmem DMA mappings to adjust the bus offset ... commit 721fb6fbfd2132164c2e8777cc837f9b2c1794dc Author: Jan Kara Date: Wed Oct 17 13:07:05 2018 +0200 fsnotify: Fix busy inodes during unmount Detaching of mark connector from fsnotify_put_mark() can race with unmounting of the filesystem like: CPU1 CPU2 fsnotify_put_mark() spin_lock(&conn->lock); ... inode = fsnotify_detach_connector_from_object(conn) spin_unlock(&conn->lock); generic_shutdown_super() fsnotify_unmount_inodes() sees connector detached for inode -> nothing to do evict_inode() barfs on pending inode reference iput(inode); Resulting in "Busy inodes after unmount" message and possible kernel oops. Make fsnotify_unmount_inodes() properly wait for outstanding inode references from detached connectors. Note that the accounting of outstanding inode references in the superblock can cause some cacheline contention on the counter. OTOH it happens only during deletion of the last notification mark from an inode (or during unlinking of watched inode) and that is not too bad. I have measured time to create & delete inotify watch 100000 times from 64 processes in parallel (each process having its own inotify group and its own file on a shared superblock) on a 64 CPU machine. Average and standard deviation of 15 runs look like: Avg Stddev Vanilla 9.817400 0.276165 Fixed 9.710467 0.228294 So there's no statistically significant difference. Fixes: 6b3f05d24d35 ("fsnotify: Detach mark from object list when last reference is dropped") CC: stable@vger.kernel.org Signed-off-by: Jan Kara commit a41efc2a0f68cea26665ab9e6d991c9bf33b3f59 Merge: 36168d712331 71f021cf6de8 Author: Linus Torvalds Date: Thu Oct 25 06:43:18 2018 -0700 Merge tag 'dmaengine-4.20-rc1' of git://git.infradead.org/users/vkoul/slave-dma Pull dmaengine updates from Vinod Koul: - Support for ColdFire mcf5441x edma controller - Support for link list mode in sprd dma - More users of managed dmaenginem_async_device_register API - Cyclic mode support in owl dma driver - DT updates for renesas drivers, dma-jz4780 updates and support for JZ4770, JZ4740 and JZ4725B controllers - Removal of deprecated dma_slave_config direction in dmaengine drivers, few more users will be removed in next cycle and eventually removed. - Minor updates to idma64, ioat, pxa, ppc drivers * tag 'dmaengine-4.20-rc1' of git://git.infradead.org/users/vkoul/slave-dma: (66 commits) dmaengine: ppc4xx: fix off-by-one build failure dmaengine: owl: Fix warnings generated during build dmaengine: fsl-edma: remove dma_slave_config direction usage dmaengine: rcar-dmac: set scatter/gather max segment size dmaengine: mmp_tdma: remove dma_slave_config direction usage dmaengine: ep93xx_dma: remove dma_slave_config direction usage dmaengine: k3dma: remove dma_slave_config direction usage dmaengine: k3dma: dont use direction for memcpy dmaengine: imx-dma: remove dma_slave_config direction usage dmaengine: idma: remove dma_slave_config direction usage dmaengine: hsu: remove dma_slave_config direction usage dmaengine: dw: remove dma_slave_config direction usage dmaengine: jz4740: remove dma_slave_config direction usage dmaengine: coh901318: remove dma_slave_config direction usage dmaengine: bcm2835: remove dma_slave_config direction usage dmaengine: at_hdmac: remove dma_slave_config direction usage dmaengine: owl: Add Slave and Cyclic mode support for Actions Semi Owl S900 SoC dmaengine: ioat: fix prototype of ioat_enumerate_channels dmaengine: stm32-dma: check whether length is aligned on FIFO threshold dt-bindings: dmaengine: usb-dmac: Add binding for r8a7744 ... commit 36168d7123311d52e085c116f6c66e16f0b84615 Merge: 6078e07dcf53 4cf841e39850 Author: Linus Torvalds Date: Thu Oct 25 06:40:00 2018 -0700 Merge tag 'edac_for_4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp Pull EDAC updates from Borislav Petkov: "The EDAC tree was busier than usual this cycle as the shortlog below shows. Also, this pull request is carrying an ACPI DSM driver which is used to ask the platform to supply the DIMM location of a reported hardware error and thus simplify all the EDAC logic when trying to map the error address to the respective DIMM. Core EDAC updates: - amd64_edac: AMD family 0x17, models 0x10-0x2f support (Michael Jin) Hygon Dhyana support (Pu Wen) - sb_edac: New maintainer + fixes (Tony Luck) Error reporting improvements and fixes (Qiuxu Zhuo) - ghes_edac: SMBIOS handle type 17 for DIMM locating and per-DIMM error accounting (Fan Wu) - altera_edac: Stratix10 support and refactoring (Thor Thayer) Out of tree addition: - acpi_adxl: Address Translation interface using an ACPI DSM (Tony Luck) - the usual amount of other misc fixes and cleanups all over" * tag 'edac_for_4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp: (22 commits) ACPI/ADXL: Add address translation interface using an ACPI DSM EDAC, thunderx: Fix memory leak in thunderx_l2c_threaded_isr() EDAC, skx_edac: Fix logical channel intermediate decoding EDAC, {i7core,sb,skx}_edac: Fix uncorrected error counting EDAC, altera: Work around int-to-pointer-cast warnings EDAC, amd64: Add Hygon Dhyana support EDAC: Raise the maximum number of memory controllers arm64: dts: stratix10: Add peripheral EDAC nodes EDAC, altera: Add Stratix10 peripheral support EDAC, altera: Merge Stratix10 into the Arria10 SDRAM probe routine arm64: dts: stratix10: Add SDRAM node EDAC, altera: Combine Stratix10 and Arria10 probe functions arm64: dts: stratix10: Additions to EDAC System Manager EDAC, i7core: Remove set but not used variable pvt EDAC, ghes: Use CPER module handles to locate DIMMs EDAC: Correct DIMM capacity unit symbol EDAC, sb_edac: Fix signedness bugs in *_get_ha() functions EDAC, sb_edac: Fix reporting for patrol scrubber errors EDAC, sb_edac: Return early on ADDRV bit and address type test MAINTAINERS: Update maintainer for drivers/edac/sb_edac.c ... commit 6078e07dcf5348075713124508d03786dc9ffa8b Merge: df132e4062af 594861215c83 Author: Linus Torvalds Date: Thu Oct 25 06:31:56 2018 -0700 Merge tag 'libnvdimm-for-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm updates from Dan Williams: - Improve the efficiency and performance of reading nvdimm-namespace labels. Reduce the amount of label data read at driver load time by a few orders of magnitude. Reduce heavyweight call-outs to platform-firmware routines. - Handle media errors located in the 'struct page' array stored on a persistent memory namespace. Let the kernel clear these errors rather than an awkward userspace workaround. - Fix Address Range Scrub (ARS) completion tracking. Correct occasions where the kernel indicates completion of ARS before submission. - Fix asynchronous device registration reference counting. - Add support for reporting an nvdimm dirty-shutdown-count via sysfs. - Fix various small libnvdimm core and uapi issues. * tag 'libnvdimm-for-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: (21 commits) acpi, nfit: Further restrict userspace ARS start requests acpi, nfit: Fix Address Range Scrub completion tracking UAPI: ndctl: Remove use of PAGE_SIZE UAPI: ndctl: Fix g++-unsupported initialisation in headers tools/testing/nvdimm: Populate dirty shutdown data acpi, nfit: Collect shutdown status acpi, nfit: Introduce nfit_mem flags libnvdimm, label: Fix sparse warning nvdimm: Use namespace index data to reduce number of label reads needed nvdimm: Split label init out from the logic for getting config data nvdimm: Remove empty if statement nvdimm: Clarify comment in sizeof_namespace_index nvdimm: Sanity check labeloff libnvdimm, dimm: Maximize label transfer size libnvdimm, pmem: Fix badblocks population for 'raw' namespaces libnvdimm, namespace: Drop the repeat assignment for variable dev->parent libnvdimm, region: Fail badblocks listing for inactive regions libnvdimm, pfn: during init, clear errors in the metadata area libnvdimm: Set device node in nd_device_register libnvdimm: Hold reference on parent while scheduling async init ... commit df132e4062afe06ddc9938802243d704906a884a Merge: 96f2f66a9856 cfb347979e71 Author: Linus Torvalds Date: Thu Oct 25 06:28:08 2018 -0700 Merge tag 'for-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: - Add Spreadtrum SC2731 charger driver - bq25890-charger: Add BQ25896 support - bq27xxx-battery: Add support for BQ27411 - qcom-pon: Add pms405 pon support - cros-charger: add support for dedicated port - misc fixes * tag 'for-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (28 commits) power: max8925: mark expected switch fall-through power: supply: fix spelling mistake "Gauage" -> "Gauge" power: reset: qcom-pon: Add pms405 pon support power: supply: bq27xxx: Add support for BQ27411 power: supply: Add Spreadtrum SC2731 charger support dt-bindings: power: Add Spreadtrum SC2731 charger documentation power: supply: twl4030_charger: disable eoc interrupt on linear charge power: supply: twl4030_charger: fix charging current out-of-bounds power: supply: bq25890_charger: fix semicolon.cocci warnings power: supply: max8998-charger: Fix platform data retrieval power: supply: cros: add support for dedicated port mfd: cros: add charger port count command definition power: reset: at91-poweroff: do not procede if at91_shdwc is allocated power: reset: at91-poweroff: rename at91_shdwc_base member of struct shdwc power: reset: at91-poweroff: make sclk part of struct shdwc power: reset: at91-poweroff: make mpddrc_base part of struct shdwc power: reset: at91-poweroff: use only one poweroff function power: reset: at91-poweroff: switch to slow clock before shutdown power: reset: convert to SPDX identifiers power: supply: ab8500_fg: silence uninitialized variable warnings ... commit 96f2f66a985699d201b3a84222b8dd42262a71fe Merge: 3f2dcb6411eb 46011e9755e9 Author: Linus Torvalds Date: Thu Oct 25 06:23:07 2018 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid Pull HID updates from Jiri Kosina: - rumble support for Xbox One S, from Andrey Smirnov - high-resolution support for Logitech mice, from Harry Cutts - support for recent devices requiring the HID parse to be able to cope with tag report sizes > 256 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: (35 commits) HID: usbhid: Add quirk for Redragon/Dragonrise Seymur 2 HID: wacom: Work around HID descriptor bug in DTK-2451 and DTH-2452 HID: google: add dependency on Cros EC for Hammer HID: elan: fix spelling mistake "registred" -> "registered" HID: google: drop superfluous const before SIMPLE_DEV_PM_OPS() HID: google: add support tablet mode switch for Whiskers mfd: cros: add "base attached" MKBP switch definition Input: reserve 2 events code because of HID HID: magicmouse: add support for Apple Magic Trackpad 2 HID: i2c-hid: override HID descriptors for certain devices HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad HID: logitech: fix a used uninitialized GCC warning HID: intel-ish-hid: using list_head for ipc write queue HID: intel-ish-hid: use resource-managed api HID: intel_ish-hid: Enhance API to get ring buffer sizes HID: intel-ish-hid: use helper function to search client id HID: intel-ish-hid: ishtp: add helper function for client search HID: intel-ish-hid: use helper function to access client buffer HID: intel-ish-hid: ishtp: add helper functions for client buffer operation HID: intel-ish-hid: use helper function for private driver data set/get ... commit 3f2dcb6411eb3fd4a8be5d3713be0e2c1c750d6d Merge: 3ea172c84dc5 e1c9f2eaa0fb Author: Linus Torvalds Date: Thu Oct 25 06:21:28 2018 -0700 Merge tag 'backlight-next-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "Old Drivers - Remove driver for S6E63M0 - Remove driver for LD9040 Fix-ups - Trivial (email address update); adp*_bl - Use 'atomic' PWM API; pwm_bl Bug Fixes - Remove pointless boolen '&ptr' check; lm3639_bl" * tag 'backlight-next-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: Remove ld9040 driver backlight: Remove s6e63m0 driver backlight: lm3639: Unconditionally call led_classdev_unregister backlight: pwm_bl: Switch to using "atomic" PWM API backlight: Update MODULE AUTHOR email address commit 3ea172c84dc5a88f4fa7316311857f5878bcf777 Merge: 01aa9d518eae 6eb357844373 Author: Linus Torvalds Date: Thu Oct 25 06:19:15 2018 -0700 Merge tag 'mfd-next-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "New Drivers - Add support for USART SPI to AT91* New Functionality - Add support for Audio CODECs to motorola-cpcap Fix-ups - DT documentation fix-ups; atmel-usart - Staticise functions/structs; spi-at91-usart, arizona-core - Constify; ti-lmu - Fix memory leaks; menelaus - Change device 'wake-up' status; ti_am335x_tscadc, max8997 - Power Management (suspend/resume) semantic changes; ti_am335x_adc, cros_ec, max8997 - SPDX churn; sec-core (+ headers), max* (+ headers), intel* (+ headers), - Trivial (whitespace, email addresses, alphabetisise); Kconfig, adp5520, intel_soc_pmic_* - Build as module; sec-irq - Use new %pOFn printk format for device_node.name; max77620 - Remove unused code; madera - Use generic MACROs; intel_msic, intel_soc_pmic_crc - Move to GPIOD; ti-lmu - Use managed resources; ti-lmu Bug Fixes - Add missing headers; at91-usart - Prevent device from entering low-power mode; arizona-core - Poll for BOOT_DONE to avoid still-booting NACK; madera-core - Prevent ADC read from shutting down device; mc13xxx-core" * tag 'mfd-next-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (45 commits) mfd: cros_ec: Avoid unneeded internal declaration warning mfd: ti-lmu: Use of_device_get_match_data() helper mfd: ti-lmu: Use managed resource for everything mfd: ti-lmu: Switch to GPIOD mfd: ti-lmu: constify mfd_cell tables mfd: max8997: Disable interrupt handling for suspend/resume cycle mfd: max8997: Enale irq-wakeup unconditionally mfd: arizona: Make array mclk_name static, shrinks object size MAINTAINERS: Add myself as designated reviewer of Intel MFD PMIC mfd: Convert Intel PMIC drivers to use SPDX identifier 1;5201;0c Reduce size of duplicated comments by switching to use SPDX identifier. mfd: Sort headers alphabetically for Intel PMIC drivers mfd: intel_soc_pmic_bxtwc: Chain power button IRQs as well mfd: intel_soc_pmic_crc: Use REGMAP_IRQ_REG() macro mfd: intel_soc_pmic_crc: Use DEFINE_RES_IRQ_NAMED() macro mfd: intel_msic: Use DEFINE_RES_IRQ() macro mfd: motorola-cpcap: Add audio-codec support mfd: mc13xxx-core: Fix PMIC shutdown when reading ADC values mfd: madera: Remove unused forward reference mfd: max77620: Convert to using %pOFn instead of device_node.name mfd: madera: Don't use regmap_read_poll_timeout to poll for BOOT_DONE ... commit 5a8de47b3c250521dd632cdedaac6db88367defa Author: Jiri Slaby Date: Wed Oct 24 13:54:03 2018 +0200 netfilter: bridge: define INT_MIN & INT_MAX in userspace With 4.19, programs like ebtables fail to build when they include "linux/netfilter_bridge.h". It is caused by commit 94276fa8a2a4 which added a use of INT_MIN and INT_MAX to the header: : In file included from /usr/include/linux/netfilter_bridge/ebtables.h:18, : from include/ebtables_u.h:28, : from communication.c:23: : /usr/include/linux/netfilter_bridge.h:30:20: error: 'INT_MIN' undeclared here (not in a function) : NF_BR_PRI_FIRST = INT_MIN, : ^~~~~~~ Define these constants by including "limits.h" when !__KERNEL__ (the same way as for other netfilter_* headers). Fixes: 94276fa8a2a4 ("netfilter: bridge: Expose nf_tables bridge hook priorities through uapi") Signed-off-by: Jiri Slaby Acked-by: Máté Eckl Signed-off-by: Pablo Neira Ayuso commit 5e91c9d9cd3fd557226ca75fed58816b9eee7e07 Author: Pablo Neira Ayuso Date: Mon Oct 22 21:49:45 2018 +0200 netfilter: nft_osf: check if attribute is present If the attribute is not sent, eg. old libnftnl binary, then tb[NFTA_OSF_TTL] is NULL and kernel crashes from the _init path. Fixes: a218dc82f0b5 ("netfilter: nft_osf: Add ttl option support") Signed-off-by: Pablo Neira Ayuso commit 61792b677415b77c8db04991c22966bb8de7603e Author: Florian Westphal Date: Tue Oct 23 16:47:16 2018 +0200 netfilter: ipv6: fix oops when defragmenting locally generated fragments Unlike ipv4 and normal ipv6 defrag, netfilter ipv6 defragmentation did not save/restore skb->dst. This causes oops when handling locally generated ipv6 fragments, as output path needs a valid dst. Reported-by: Maciej Żenczykowski Fixes: 84379c9afe01 ("netfilter: ipv6: nf_defrag: drop skb dst before queueing") Signed-off-by: Florian Westphal Reviewed-by: Eric Dumazet Signed-off-by: Pablo Neira Ayuso commit ace6485a03266cc3c198ce8e927a1ce0ce139699 Author: Fenghua Yu Date: Wed Oct 24 14:57:17 2018 -0700 x86/cpufeatures: Enumerate MOVDIR64B instruction MOVDIR64B moves 64-bytes as direct-store with 64-bytes write atomicity. Direct store is implemented by using write combining (WC) for writing data directly into memory without caching the data. In low latency offload (e.g. Non-Volatile Memory, etc), MOVDIR64B writes work descriptors (and data in some cases) to device-hosted work-queues atomically without cache pollution. Availability of the MOVDIR64B instruction is indicated by the presence of the CPUID feature flag MOVDIR64B (CPUID.0x07.0x0:ECX[bit 28]). Please check the latest Intel Architecture Instruction Set Extensions and Future Features Programming Reference for more details on the CPUID feature MOVDIR64B flag. Signed-off-by: Fenghua Yu Cc: Andy Lutomirski Cc: Ashok Raj Cc: Borislav Petkov Cc: Brian Gerst Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Ravi V Shankar Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/1540418237-125817-3-git-send-email-fenghua.yu@intel.com Signed-off-by: Ingo Molnar commit 33823f4d63f7a010653d219800539409a78ef4be Author: Fenghua Yu Date: Wed Oct 24 14:57:16 2018 -0700 x86/cpufeatures: Enumerate MOVDIRI instruction MOVDIRI moves doubleword or quadword from register to memory through direct store which is implemented by using write combining (WC) for writing data directly into memory without caching the data. Programmable agents can handle streaming offload (e.g. high speed packet processing in network). Hardware implements a doorbell (tail pointer) register that is updated by software when adding new work-elements to the streaming offload work-queue. MOVDIRI can be used as the doorbell write which is a 4-byte or 8-byte uncachable write to MMIO. MOVDIRI has lower overhead than other ways to write the doorbell. Availability of the MOVDIRI instruction is indicated by the presence of the CPUID feature flag MOVDIRI(CPUID.0x07.0x0:ECX[bit 27]). Please check the latest Intel Architecture Instruction Set Extensions and Future Features Programming Reference for more details on the CPUID feature MOVDIRI flag. Signed-off-by: Fenghua Yu Cc: Andy Lutomirski Cc: Ashok Raj Cc: Borislav Petkov Cc: Brian Gerst Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Ravi V Shankar Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/1540418237-125817-2-git-send-email-fenghua.yu@intel.com Signed-off-by: Ingo Molnar commit 79f800b2e76923cd8ce0aa659cb5c019d9643bc9 Author: Stefan Hajnoczi Date: Fri Oct 12 16:46:37 2018 +0100 MAINTAINERS: remove reference to bogus vsock file The file drivers/vhost/vsock.h never existed. Remove the bogus MAINTAINERS reference. Fixes: 433fc58e6bf2c8bd97e57153ed28e64fd78207b8 ("VSOCK: Introduce vhost_vsock.ko") Reported-by: Joe Perches Signed-off-by: Stefan Hajnoczi Signed-off-by: Michael S. Tsirkin commit 09d7583294aada625349b6f80f1e1c730b5a5208 Author: Bijan Mottahedeh Date: Mon Sep 17 17:09:49 2018 -0700 vhost/scsi: Use common handling code in request queue handler Change the request queue handler to use common handling routines same as the control queue handler. Signed-off-by: Bijan Mottahedeh Signed-off-by: Michael S. Tsirkin commit 3f8ca2e115e55af4c15d97dda635e948d2e380be Author: Bijan Mottahedeh Date: Mon Sep 17 17:09:48 2018 -0700 vhost/scsi: Extract common handling code from control queue handler Prepare to change the request queue handler to use common handling routines. Signed-off-by: Bijan Mottahedeh Signed-off-by: Michael S. Tsirkin commit 0d02dbd68c47b66367130b696baef7246720791c Author: Bijan Mottahedeh Date: Mon Sep 17 17:09:47 2018 -0700 vhost/scsi: Respond to control queue operations The vhost-scsi driver currently does not handle any control queue operations. In particular, vhost_scsi_ctl_handle_kick, merely prints out a debug message but does nothing else. This can cause guest VMs to hang. As part of SCSI recovery from an error, e.g., an I/O timeout, the SCSI midlayer attempts to abort the failed operation. The SCSI virtio driver translates the abort to a SCSI TMF request that gets put on the control queue (virtscsi_abort -> virtscsi_tmf). The SCSI virtio driver then waits indefinitely for this request to be completed, but it never will because vhost-scsi never responds to that request. To avoid a hang, always respond to control queue operations; explicitly reject TMF requests, and return a no-op response to event requests. Signed-off-by: Bijan Mottahedeh Signed-off-by: Michael S. Tsirkin commit 4542d623c7134bc1738f8a68ccb6dd546f1c264f Author: Greg Edwards Date: Wed Aug 22 13:21:53 2018 -0600 vhost/scsi: truncate T10 PI iov_iter to prot_bytes Commands with protection information included were not truncating the protection iov_iter to the number of protection bytes in the command. This resulted in vhost_scsi mis-calculating the size of the protection SGL in vhost_scsi_calc_sgls(), and including both the protection and data SG entries in the protection SGL. Fixes: 09b13fa8c1a1 ("vhost/scsi: Add ANY_LAYOUT support in vhost_scsi_handle_vq") Signed-off-by: Greg Edwards Signed-off-by: Michael S. Tsirkin Fixes: 09b13fa8c1a1093e9458549ac8bb203a7c65c62a Cc: stable@vger.kernel.org Reviewed-by: Paolo Bonzini commit 1a0e348e5693b7acde02e50319b3237657b7981a Author: David Francis Date: Tue Sep 25 11:23:31 2018 -0400 drm/amd/display: Disable 4k 60 HDMI on DCE11 [Why] Carrizo and Stoney have severe corruption when trying to power 4k 60 monitors over HDMI connectors that support 4k 60. Carrizo and Stoney require retimers and redrivers to support 4k 60 over HDMI. This driver does not currently support these. Thus, 4k 60 HDMI (and all other modes requiring over 300MHz) should be disabled. [How] Reduce the dce11 HDMI pixel clock cap to 300000kHz. Signed-off-by: David Francis Reviewed-by: Roman Li Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit 7179d24040d66de22e4710e943256be9e1045feb Author: Rex Zhu Date: Fri Oct 19 10:46:53 2018 +0800 drm/amdgpu: Fix null point error need to check adev->powerplay.pp_funcs first, becasue from AI, the smu ip can be disabled by user, and the pp_handle is null in this case. Reviewed-by: Alex Deucher Signed-off-by: Rex Zhu Signed-off-by: Alex Deucher commit 6f059c641b31076248ba89d0f7e0e753946a8099 Author: Rex Zhu Date: Fri Oct 19 10:38:10 2018 +0800 drm/amd/display: Fix Null point error if smu ip was disabled from AI, SMU Ip is not indispensable to driver and can be disabled by user via module parameter ip_block_mask. so the pp_handle may be NULL. Reviewed-by: Alex Deucher Signed-off-by: Rex Zhu Signed-off-by: Alex Deucher commit 355c8db13be409695956c666e839f654a99cfc2d Author: Evan Quan Date: Mon Oct 22 14:35:40 2018 +0800 drm/amd/powerplay: commit get_performance_level API as DAL needed This can suppress the error reported on driver loading. Also these are empty APIs as Vega12/Vega20 has no performance levels. Signed-off-by: Evan Quan Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit 2e991629bcf55a43681aec1ee096eeb03cf81709 Author: Wei Wang Date: Mon Aug 27 09:32:19 2018 +0800 virtio-balloon: VIRTIO_BALLOON_F_PAGE_POISON The VIRTIO_BALLOON_F_PAGE_POISON feature bit is used to indicate if the guest is using page poisoning. Guest writes to the poison_val config field to tell host about the page poisoning value that is in use. Suggested-by: Michael S. Tsirkin Signed-off-by: Wei Wang Cc: Michael S. Tsirkin Cc: Michal Hocko Cc: Andrew Morton Signed-off-by: Michael S. Tsirkin commit d95f58f4a6ca002126c36c530fb096519c94baef Author: Wei Wang Date: Mon Aug 27 09:32:18 2018 +0800 mm/page_poison: expose page_poisoning_enabled to kernel modules In some usages, e.g. virtio-balloon, a kernel module needs to know if page poisoning is in use. This patch exposes the page_poisoning_enabled function to kernel modules. Signed-off-by: Wei Wang Cc: Andrew Morton Cc: Michal Hocko Cc: Michael S. Tsirkin Acked-by: Andrew Morton Signed-off-by: Michael S. Tsirkin commit 86a559787e6f5cf662c081363f64a20cad654195 Author: Wei Wang Date: Mon Aug 27 09:32:17 2018 +0800 virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT Negotiation of the VIRTIO_BALLOON_F_FREE_PAGE_HINT feature indicates the support of reporting hints of guest free pages to host via virtio-balloon. Currenlty, only free page blocks of MAX_ORDER - 1 are reported. They are obtained one by one from the mm free list via the regular allocation function. Host requests the guest to report free page hints by sending a new cmd id to the guest via the free_page_report_cmd_id configuration register. When the guest starts to report, it first sends a start cmd to host via the free page vq, which acks to host the cmd id received. When the guest finishes reporting free pages, a stop cmd is sent to host via the vq. Host may also send a stop cmd id to the guest to stop the reporting. VIRTIO_BALLOON_CMD_ID_STOP: Host sends this cmd to stop the guest reporting. VIRTIO_BALLOON_CMD_ID_DONE: Host sends this cmd to tell the guest that the reported pages are ready to be freed. Why does the guest free the reported pages when host tells it is ready to free? This is because freeing pages appears to be expensive for live migration. free_pages() dirties memory very quickly and makes the live migraion not converge in some cases. So it is good to delay the free_page operation when the migration is done, and host sends a command to guest about that. Why do we need the new VIRTIO_BALLOON_CMD_ID_DONE, instead of reusing VIRTIO_BALLOON_CMD_ID_STOP? This is because live migration is usually done in several rounds. At the end of each round, host needs to send a VIRTIO_BALLOON_CMD_ID_STOP cmd to the guest to stop (or say pause) the reporting. The guest resumes the reporting when it receives a new command id at the beginning of the next round. So we need a new cmd id to distinguish between "stop reporting" and "ready to free the reported pages". TODO: - Add a batch page allocation API to amortize the allocation overhead. Signed-off-by: Wei Wang Signed-off-by: Liang Li Cc: Michael S. Tsirkin Cc: Michal Hocko Cc: Andrew Morton Cc: Linus Torvalds Signed-off-by: Michael S. Tsirkin commit d7b31359ecef8d32540266f39d99892f61d17c4b Author: Lénaïc Huard Date: Thu Mar 22 23:53:05 2018 +0100 kvm_config: add CONFIG_VIRTIO_MENU Make sure that make kvmconfig enables all the virtio drivers even if it is preceded by a make allnoconfig. Signed-off-by: Lénaïc Huard Signed-off-by: Michael S. Tsirkin commit 3822d1bb0df18aa28930f19bc46e0704aea1be0f Author: Baolin Wang Date: Thu Oct 18 16:52:30 2018 +0800 rtc: sc27xx: Always read normal alarm when registering RTC device When registering one RTC device, it will check to see if there is an alarm already set in RTC hardware by reading RTC alarm, at this time we should always read the normal alarm put in always-on region by checking the rtc->registered flag. Signed-off-by: Baolin Wang Signed-off-by: Alexandre Belloni commit bf2c532b67fc077051e17de4a1304a83e5ca5b15 Author: Baolin Wang Date: Thu Oct 18 16:52:29 2018 +0800 rtc: sc27xx: Add check to see if need to enable the alarm interrupt The RTC interrupt enable register is not put in always-power-on region supplied by VDDRTC, so we should check if we need enable the alarm interrupt when system booting. Signed-off-by: Baolin Wang Signed-off-by: Alexandre Belloni commit b2ddc48582efa157635f7ef815c9d4a657e2cabd Author: Baolin Wang Date: Thu Oct 18 16:52:28 2018 +0800 rtc: sc27xx: Remove interrupts disable and clear in probe() When registering one rtc device, it will check to see if there is an alarm already set in rtc hardware by issuing __rtc_read_alarm(). So we should not disable the RTC interrupts and clear the interrupts status in probe() function. Signed-off-by: Baolin Wang Signed-off-by: Alexandre Belloni commit 7db5adfa63167dac548022c973e00da7f56ffb72 Author: Baolin Wang Date: Thu Oct 18 16:52:27 2018 +0800 rtc: sc27xx: Clear SPG value update interrupt status We should clear the SPG value update interrupt status once the SPG value is updated successfully, in case incorrect status validation for next time. Signed-off-by: Baolin Wang Signed-off-by: Alexandre Belloni commit a86d6b23ed9729d47b2818857d8fa5d8e3f8284a Author: Baolin Wang Date: Thu Oct 18 16:52:26 2018 +0800 rtc: sc27xx: Set wakeup capability before registering rtc device Set wakeup capability before registering rtc device, in case the alarmtimer can find one available rtc device. Signed-off-by: Baolin Wang Signed-off-by: Alexandre Belloni commit 4f3ebb04d05fe36f74ef17c6ee06559626d47964 Merge: 4ed591c8ab44 4f4be03bdeb3 Author: David S. Miller Date: Wed Oct 24 16:27:33 2018 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue Jeff Kirsher says: ==================== Intel Wired LAN Driver Fixes 2018-10-24 This series contains fixes for the ice driver. Anirudh fixes a namespace issue which was introduced with a previous patch to remove ice_netpoll. Fixed up the device ID define names to align with the branding string names. Use the capability count returned by the firmware, instead of calculating the count. Introduced driver workarounds due to current firmware limitations. Fixed the queue mapping for a VF, which needs to be set in the config and scatter queue modes. Fixed the driver which is setup to handle link status events (LSE), even though the firmware does not have this feature yet, so add the ability to poll for link status changes while we wait for updated firmware. ==================== Signed-off-by: David S. Miller commit 4ed591c8ab44e711e56b8e021ffaf4f407c045f5 Author: David Ahern Date: Wed Oct 24 13:58:39 2018 -0700 net/ipv6: Allow onlink routes to have a device mismatch if it is the default route The intent of ip6_route_check_nh_onlink is to make sure the gateway given for an onlink route is not actually on a connected route for a different interface (e.g., 2001:db8:1::/64 is on dev eth1 and then an onlink route has a via 2001:db8:1::1 dev eth2). If the gateway lookup hits the default route then it most likely will be a different interface than the onlink route which is ok. Update ip6_route_check_nh_onlink to disregard the device mismatch if the gateway lookup hits the default route. Turns out the existing onlink tests are passing because there is no default route or it is an unreachable default, so update the onlink tests to have a default route other than unreachable. Fixes: fc1e64e1092f6 ("net/ipv6: Add support for onlink flag") Signed-off-by: David Ahern Signed-off-by: David S. Miller commit e72bde6b66299602087c8c2350d36a525e75d06e Author: David Ahern Date: Wed Oct 24 08:32:49 2018 -0700 net: sched: Remove TCA_OPTIONS from policy Marco reported an error with hfsc: root@Calimero:~# tc qdisc add dev eth0 root handle 1:0 hfsc default 1 Error: Attribute failed policy validation. Apparently a few implementations pass TCA_OPTIONS as a binary instead of nested attribute, so drop TCA_OPTIONS from the policy. Fixes: 8b4c3cdd9dd8 ("net: sched: Add policy validation for tc attributes") Reported-by: Marco Berizzi Signed-off-by: David Ahern Signed-off-by: David S. Miller commit 4f4be03bdeb32761f89cec3f2bec5e69dd41bc82 Author: Anirudh Venkataramanan Date: Thu Oct 18 08:37:09 2018 -0700 ice: Poll for link status change When the physical link goes up or down, the driver is supposed to receive a link status event (LSE). The driver currently has the code to handle LSEs but there is no firmware support for this feature yet. So this patch adds the ability for the driver to poll for link status changes. The polling itself is done in ice_watchdog_subtask. For namespace cleanliness, this patch also removes code that handles LSE. This code will be reintroduced once the feature is officially supported. Signed-off-by: Anirudh Venkataramanan Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 982b1219182ecd5a18a08caaf9be59a8373ac764 Author: Anirudh Venkataramanan Date: Thu Oct 18 08:37:08 2018 -0700 ice: Allocate VF interrupts and set queue map Allocate VF interrupts using VPINT_ALLOC_PCI. Multiple interrupts are specified as a range from "first" to "last". Also, according to the spec, the queue mapping for a VF needs to be set in both contig and scatter queue modes. So make this change as well. Signed-off-by: Anirudh Venkataramanan Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit f203dca363f837b1e5a4e0c018264680aab90307 Author: Anirudh Venkataramanan Date: Thu Oct 18 08:37:07 2018 -0700 ice: Introduce ice_dev_onetime_setup ice_dev_onetime_setup contains a couple of driver workarounds for current firmware limitations. These workarounds are expected to go away once these limitations are fixed in the firmware. On a firmware release that has these issues addressed, these workarounds (while unnecessary) will not break anything. Signed-off-by: Anirudh Venkataramanan Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit ac0e549678d60097793a6a818ece319e99d1ae9a Author: Shiju Jose Date: Wed Oct 24 15:32:18 2018 +0100 net: hns3: Fix for warning uninitialized symbol hw_err_lst3 This patch fixes the smatch warning, drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c:700 hclge_log_and_clear_ppp_error() error: uninitialized symbol 'hw_err_lst3' Link: https://lkml.org/lkml/2018/10/23/430 Fixes: da2d072a9ea7 ("net: hns3: Add enable and process hw errors from PPP") Reported-by: Dan Carpenter Signed-off-by: Shiju Jose Signed-off-by: Salil Mehta Signed-off-by: David S. Miller commit cdaa18f9bd98df75d4ce9478f72c0a5d11562249 Author: Dan Carpenter Date: Wed Oct 24 11:32:21 2018 +0300 octeontx2-af: Copy the right amount of memory This is a copy and paste bug where we copied the sizeof() from the chunk before. We're copying more data than intended but the destination is a union so it doesn't cause memory corruption. Fixes: ffb0abd7e9cb ("octeontx2-af: NIX AQ instruction enqueue support") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller commit db4f1be3ca9b0ef7330763d07bf4ace83ad6f913 Author: Sean Tranchetti Date: Tue Oct 23 16:04:31 2018 -0600 net: udp: fix handling of CHECKSUM_COMPLETE packets Current handling of CHECKSUM_COMPLETE packets by the UDP stack is incorrect for any packet that has an incorrect checksum value. udp4/6_csum_init() will both make a call to __skb_checksum_validate_complete() to initialize/validate the csum field when receiving a CHECKSUM_COMPLETE packet. When this packet fails validation, skb->csum will be overwritten with the pseudoheader checksum so the packet can be fully validated by software, but the skb->ip_summed value will be left as CHECKSUM_COMPLETE so that way the stack can later warn the user about their hardware spewing bad checksums. Unfortunately, leaving the SKB in this state can cause problems later on in the checksum calculation. Since the the packet is still marked as CHECKSUM_COMPLETE, udp_csum_pull_header() will SUBTRACT the checksum of the UDP header from skb->csum instead of adding it, leaving us with a garbage value in that field. Once we try to copy the packet to userspace in the udp4/6_recvmsg(), we'll make a call to skb_copy_and_csum_datagram_msg() to checksum the packet data and add it in the garbage skb->csum value to perform our final validation check. Since the value we're validating is not the proper checksum, it's possible that the folded value could come out to 0, causing us not to drop the packet. Instead, we believe that the packet was checksummed incorrectly by hardware since skb->ip_summed is still CHECKSUM_COMPLETE, and we attempt to warn the user with netdev_rx_csum_fault(skb->dev); Unfortunately, since this is the UDP path, skb->dev has been overwritten by skb->dev_scratch and is no longer a valid pointer, so we end up reading invalid memory. This patch addresses this problem in two ways: 1) Do not use the dev pointer when calling netdev_rx_csum_fault() from skb_copy_and_csum_datagram_msg(). Since this gets called from the UDP path where skb->dev has been overwritten, we have no way of knowing if the pointer is still valid. Also for the sake of consistency with the other uses of netdev_rx_csum_fault(), don't attempt to call it if the packet was checksummed by software. 2) Add better CHECKSUM_COMPLETE handling to udp4/6_csum_init(). If we receive a packet that's CHECKSUM_COMPLETE that fails verification (i.e. skb->csum_valid == 0), check who performed the calculation. It's possible that the checksum was done in software by the network stack earlier (such as Netfilter's CONNTRACK module), and if that says the checksum is bad, we can drop the packet immediately instead of waiting until we try and copy it to userspace. Otherwise, we need to mark the SKB as CHECKSUM_NONE, since the skb->csum field no longer contains the full packet checksum after the call to __skb_checksum_validate_complete(). Fixes: e6afc8ace6dd ("udp: remove headers from UDP packets before queueing") Fixes: c84d949057ca ("udp: copy skb->truesize in the first cache line") Cc: Sam Kumar Cc: Eric Dumazet Signed-off-by: Sean Tranchetti Signed-off-by: David S. Miller commit 559bf69e3c8f8892c3205417c01cdf8d7823d03c Merge: 01aa9d518eae c63586dc9b3e Author: David S. Miller Date: Wed Oct 24 14:06:26 2018 -0700 Merge branch 'route-dump-filter-fixes' David Ahern says: ==================== net: Fixups for recent dump filtering changes Li RongQing noted that tgt_net is leaked in ipv4 due to the recent change to handle address dumps for a specific device. The report also applies to ipv6 and other error paths. Patches 1 and 2 fix those leaks. Patch 3 stops route dumps from erroring out when dumping across address families and a table id is given. This is needed in preparation for patch 4. Patch 4 updates the rtnl_dump_all to handle a failure in one of the dumpit functions. At the moment, if an address dump returns an error the dump all loop breaks but the error is dropped. The result can be no data is returned and no error either leaving the user wondering about the addresses. Patches were tested with a modified iproute2 to add invalid data to the dump request causing each specific failure path to be hit in addition to positive testing that it works as it should when given valid data. ==================== Signed-off-by: David S. Miller commit c63586dc9b3ed5d45ba82e16bf9e2170a55521e6 Author: David Ahern Date: Wed Oct 24 12:59:02 2018 -0700 net: rtnl_dump_all needs to propagate error from dumpit function If an address, route or netconf dump request is sent for AF_UNSPEC, then rtnl_dump_all is used to do the dump across all address families. If one of the dumpit functions fails (e.g., invalid attributes in the dump request) then rtnl_dump_all needs to propagate that error so the user gets an appropriate response instead of just getting no data. Fixes: effe67926624 ("net: Enable kernel side filtering of route dumps") Fixes: 5fcd266a9f64 ("net/ipv4: Add support for dumping addresses for a specific device") Fixes: 6371a71f3a3b ("net/ipv6: Add support for dumping addresses for a specific device") Signed-off-by: David Ahern Signed-off-by: David S. Miller commit ae677bbb4441309e1827e60413de92363153dccb Author: David Ahern Date: Wed Oct 24 12:59:01 2018 -0700 net: Don't return invalid table id error when dumping all families When doing a route dump across all address families, do not error out if the table does not exist. This allows a route dump for AF_UNSPEC with a table id that may only exist for some of the families. Do return the table does not exist error if dumping routes for a specific family and the table does not exist. Signed-off-by: David Ahern Signed-off-by: David S. Miller commit 242afaa6968cde96824247ab984c24c466ca29f3 Author: David Ahern Date: Wed Oct 24 12:59:00 2018 -0700 net/ipv6: Put target net when address dump fails due to bad attributes If tgt_net is set based on IFA_TARGET_NETNSID attribute in the dump request, make sure all error paths call put_net. Fixes: 6371a71f3a3b ("net/ipv6: Add support for dumping addresses for a specific device") Fixes: ed6eff11790a ("net/ipv6: Update inet6_dump_addr for strict data checking") Signed-off-by: David Ahern Signed-off-by: David S. Miller commit d7e38611b81e6d7e14969c361f2b9fc07403a6c3 Author: David Ahern Date: Wed Oct 24 12:58:59 2018 -0700 net/ipv4: Put target net when address dump fails due to bad attributes If tgt_net is set based on IFA_TARGET_NETNSID attribute in the dump request, make sure all error paths call put_net. Fixes: 5fcd266a9f64 ("net/ipv4: Add support for dumping addresses for a specific device") Fixes: c33078e3dfb1 ("net/ipv4: Update inet_dump_ifaddr for strict data checking") Reported-by: Li RongQing Signed-off-by: David Ahern Signed-off-by: David S. Miller commit 99189e8b6b0ea3e561df8602982b796a146a6747 Author: Anirudh Venkataramanan Date: Thu Oct 18 08:37:06 2018 -0700 ice: Use capability count returned by the firmware The firmware now returns the capability count in the command buffer. Use it. Signed-off-by: Anirudh Venkataramanan Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit ac5a8aef112e194c7d41988c4f32112085ebc22f Author: Anirudh Venkataramanan Date: Thu Oct 18 08:37:05 2018 -0700 ice: Update expected FW version Update to the current firmware major and minor version which are 1 and 3 respectively. Also remove an empty comment line. Signed-off-by: Anirudh Venkataramanan Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit 633d7449a30133e99a5182fb74f40594801497b1 Author: Anirudh Venkataramanan Date: Thu Oct 18 08:37:04 2018 -0700 ice: Change device ID define names to align with branding string Basically remove references to C810 and use E810C (from the branding string) instead. Signed-off-by: Anirudh Venkataramanan Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit f73581f8d9a367459f36e6a4ef0065997ab14c75 Author: Masami Hiramatsu Date: Wed Oct 17 12:33:23 2018 +0900 selftests/ftrace: Strip escape sequences for log file Strip escape sequences from the stream to the ftracetest summary log file. Note that all test-case results are dumped raw in each file. Signed-off-by: Masami Hiramatsu Acked-by: Steven Rostedt (VMware) Signed-off-by: Shuah Khan (Samsung OSG) commit 8096fbcf55c0da535bdca9adab982ec0c5affb67 Author: Daniel Díaz Date: Tue Oct 16 12:02:20 2018 -0500 selftests/ftrace: Use colored output when available If test is being directly executed (with stdout opened on the terminal) and the terminal capabilities indicate enough colors, then use the existing scheme of green, red, and blue to show when tests pass, fail or end in a different way. When running the tests redirecting the stdout, for instance, to a file, then colors are not shown, thus producing a more readable output. Signed-off-by: Daniel Díaz Acked-by: Steven Rostedt (VMware) Signed-off-by: Shuah Khan (Samsung OSG) commit 0387662d1b6c5ad2950d8e94d5e380af3f15c05c Author: Peng Hao Date: Fri Oct 12 03:53:50 2018 +0800 selftests: fix warning: "_GNU_SOURCE" redefined Makefile contains -D_GNU_SOURCE. remove define "_GNU_SOURCE" in c files. Signed-off-by: Peng Hao Signed-off-by: Shuah Khan (Samsung OSG) commit fb363e2d20351e1d16629df19e7bce1a31b3227a Author: Andrea Parri Date: Tue Oct 16 16:13:46 2018 +0200 selftests: kvm: Fix -Wformat warnings Fixes the following warnings: dirty_log_test.c: In function ‘help’: dirty_log_test.c:216:9: warning: format ‘%lu’ expects argument of type ‘long unsigned int’, but argument 2 has type ‘int’ [-Wformat=] printf(" -i: specify iteration counts (default: %"PRIu64")\n", ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/test_util.h:18:0, from dirty_log_test.c:16: /usr/include/inttypes.h:105:34: note: format string is defined here # define PRIu64 __PRI64_PREFIX "u" dirty_log_test.c:218:9: warning: format ‘%lu’ expects argument of type ‘long unsigned int’, but argument 2 has type ‘int’ [-Wformat=] printf(" -I: specify interval in ms (default: %"PRIu64" ms)\n", ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/test_util.h:18:0, from dirty_log_test.c:16: /usr/include/inttypes.h:105:34: note: format string is defined here # define PRIu64 __PRI64_PREFIX "u" Signed-off-by: Andrea Parri Signed-off-by: Shuah Khan (Samsung OSG) commit 8f381ac4d3210025891c5397e744fd4c771481d7 Author: Steven Rostedt (VMware) Date: Fri Oct 12 22:21:06 2018 -0400 selftests/ftrace: Add color to the PASS / FAIL results Now that ftracetest has over 80 tests, it is difficult to simply scroll up the console window to find the failed tests when it reports just two tests have failed. In order to make this stand out better, have the color of the word "PASS" be green, "FAIL" and "XFAIL" be red, and all other results be blue. This helps tremendously in quickly spotting the failed tests by just scrolling up the console window. Signed-off-by: Steven Rostedt (VMware) Signed-off-by: Shuah Khan (Samsung OSG) commit 717da97e94a9ba590632624992a9f79d53d3579b Author: Colin Ian King Date: Sat Oct 13 16:41:05 2018 +0100 kvm: selftests: fix spelling mistake "Insufficent" -> "Insufficient" Trivial fix to spelling mistake in TEST_ASSERT message text Signed-off-by: Colin Ian King Signed-off-by: Shuah Khan (Samsung OSG) commit 8c7f6316fccf38ca45d33ed658cc4813837b6294 Author: Daniel Díaz Date: Fri Sep 7 09:34:55 2018 -0500 selftests: gpio: Fix OUTPUT directory in Makefile When simply running `make' from the selftests top dir, this error shows up: cc -O2 -g -std=gnu99 -Wall -I../../../../usr/include/ -I/usr/include/libmount -I/usr/include/blkid -I/usr/include/uuid gpio-mockup-chardev.c ../../../gpio/gpio-utils.o -lmount -o gpio-mockup-chardev cc: error: ../../../gpio/gpio-utils.o: No such file or directory : recipe for target 'gpio-mockup-chardev' failed make[1]: *** [gpio-mockup-chardev] Error 1 because the output directory is set to "selftests/gpio" and all binaries built from ../../../gpio/ end up there. In fact, they appear as, exempli gratia: * gpiogpio-event-mon * gpiogpio-hammer * gpioinclude/ * gpiolsgpio which is wrong, as it's missing a directory separator somewhere. This patch sets straight the output directory when building ../../../gpio/ so that binaries don't cross paths. Signed-off-by: Daniel Díaz Signed-off-by: Shuah Khan (Samsung OSG) commit a4f222e000b3f75bd1ab763dcc289d004ff6596e Author: Fathi Boudra Date: Fri Sep 7 09:34:54 2018 -0500 selftests: gpio: restructure Makefile This patch cleans up the Makefile by restructuring a couple of things, namely: 1) change explicit paths in targets for variables 2) substitute a variable (BINARIES) for another, part of the selftests build system (TEST_PROGS_EXTENDED) 3) proper cleaning up of the EXTRA objects The resulting Makefile is much more readable and manageable. Signed-off-by: Fathi Boudra Signed-off-by: Daniel Díaz Signed-off-by: Shuah Khan (Samsung OSG) commit d89d08ffd2c5a9043c8df7333d9bee6c09904a8f Author: Shuah Khan (Samsung OSG) Date: Wed Sep 26 16:37:43 2018 -0600 selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path When ioctls for WDIOC_SETOPTIONS (WDIOS_DISABLECARD or WDIOS_ENABLECARD), WDIOC_SETTIMEOUT, and WDIOC_SETPRETIMEOUT fail, the error path continues to handler watchdog timer until user terminates it. When ioctl returns error, it might not be safe to let the watchdog tick. The error could be due an unsupported ioctl command or some other error. Fix it to handle error paths as oneshot to stop the watchdog ticks and exit right away. Signed-off-by: Shuah Khan (Samsung OSG) commit 7514c39cf1d9433203c9b7c6674dbfa429db804b Author: Jerry Hoemann Date: Wed Sep 26 15:23:09 2018 -0600 selftests: watchdog: Add gettimeout and get|set pretimeout Add command line arguments to call ioctl WDIOC_GETTIMEOUT, WDIOC_GETPRETIMEOUT and WDIOC_SETPRETIMEOUT. Signed-off-by: Jerry Hoemann Signed-off-by: Shuah Khan (Samsung OSG) commit 04d5e4bd37516ad60854eb74592c7dbddd75d277 Author: Jerry Hoemann Date: Wed Sep 26 15:23:08 2018 -0600 selftests: watchdog: Fix error message. Printf's say errno but print the string version of error. Make consistent. Signed-off-by: Jerry Hoemann Signed-off-by: Shuah Khan (Samsung OSG) commit 9a244229a4b850b11952a0df79607c69b18fd8df Author: Shuah Khan (Samsung OSG) Date: Wed Sep 26 13:07:11 2018 -0600 selftests: watchdog: fix message when /dev/watchdog open fails When /dev/watchdog open fails, watchdog exits with "watchdog not enabled" message. This is incorrect when open fails due to insufficient privilege. Fix message to clearly state the reason when open fails with EACCESS when a non-root user runs it. Signed-off-by: Shuah Khan (Samsung OSG) commit 8ffade754bdf8350f63792c6125346d77f975b41 Author: Masami Hiramatsu Date: Thu Aug 30 23:25:39 2018 +0900 selftests/ftrace: Add ftrace cpumask testcase Add a testcase for tracing_cpumask with function tracer. Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan (Samsung OSG) commit c575dea2c1a50306d382615fad06767564734e0b Author: Masami Hiramatsu Date: Thu Aug 30 23:25:11 2018 +0900 selftests/ftrace: Add wakeup_rt tracer testcase Add a testcase for wakeup_rt tracer. This requires chrt command to test. Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan (Samsung OSG) commit c1edd060b41383bb6fa76008aacf4b0b3b1c46e7 Author: Masami Hiramatsu Date: Thu Aug 30 23:24:42 2018 +0900 selftests/ftrace: Add wakeup tracer testcase Add a testcase for wakeup tracer. Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan (Samsung OSG) commit 91ae08a265142d9378f7d972e00de29d5c91a2de Author: Masami Hiramatsu Date: Thu Aug 30 23:24:14 2018 +0900 selftests/ftrace: Add stacktrace ftrace filter command testcase Add a test case for stacktrace filter command for ftrace. Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan (Samsung OSG) commit 174fd823397a2f19905a20bbcf47907e30e58444 Author: Masami Hiramatsu Date: Thu Aug 30 23:23:46 2018 +0900 selftests/ftrace: Add trace_pipe testcase Add a simple testcase for trace_pipe which can consume ringbuffer. Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan (Samsung OSG) commit 7bc026d6c0328f49469a56168b50ff7a498a5810 Author: Masami Hiramatsu Date: Thu Aug 30 23:23:18 2018 +0900 selftests/ftrace: Add function filter on module testcase Add a testcase for function filter on module. Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan (Samsung OSG) commit 47c509d30db4cef11a406f87279633cd21380163 Author: Masami Hiramatsu Date: Thu Aug 30 23:22:49 2018 +0900 selftests/ftrace: Add max stack tracer testcase Add a testcase for max stack tracer, which checks basic max stack usage tracing and its filter feature. Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan (Samsung OSG) commit 5b56a07b9c461bb4db26797c82d6ac3be0f83a94 Author: Masami Hiramatsu Date: Thu Aug 30 23:22:21 2018 +0900 selftests/ftrace: Add function profiling stat testcase Add a testcase for function profiling per-cpu statistics interface. There is already func_profile.tc, but that is mainly focusing on the combination of function-profiler and function tracer. This testcase ensures trace_stat per-cpu function statistics is correctly updated. Signed-off-by: Masami Hiramatsu Acked-by: Steven Rostedt (VMware) Signed-off-by: Shuah Khan (Samsung OSG) commit c21ceceae94dc22f5b42c8174efa4597a0c990de Author: Masami Hiramatsu Date: Thu Aug 30 23:21:53 2018 +0900 selftests/ftrace: Add ringbuffer size changing testcase Add a testcase for changing ringbuffer size. This tests not only ringbuffer size but also tests the imbalance per-cpu buffer size change too. Signed-off-by: Masami Hiramatsu Acked-by: Steven Rostedt (VMware) Signed-off-by: Shuah Khan (Samsung OSG) commit 4d23e9b4fd2e44f10d22b9d2ba1dfb3fff8cd9d5 Author: Masami Hiramatsu Date: Thu Aug 30 23:21:25 2018 +0900 selftests/ftrace: Add trace_printk sample module test Add trace_printk sample module test. This requires to enable trace_printk.ko module for test. Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan (Samsung OSG) commit 873b4af2103fbd1bb7895be202a58878254d89bc Author: Masami Hiramatsu Date: Thu Aug 30 23:20:56 2018 +0900 selftests/ftrace: Add kprobe-event with symbol argument test Add a testcase for kprobe-event with @symbol argument. Since @symbol needs to refer the kernel data symbol (linux_proc_banner), it requires CONFIG_KALLSYMS_ALL. Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan (Samsung OSG) commit 32f6e5da83c7f06db7e4efbdacdbc59c16fd6ecb Author: Masami Hiramatsu Date: Thu Aug 30 23:20:28 2018 +0900 selftests/ftrace: Add kprobe profile testcase Add a testcase for testing kprobe_profile interface which provides per-kprobe event hit/misshit counts. Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan (Samsung OSG) commit b0898e84851c96248c376897c96f3fde3ff7e3b5 Author: Masami Hiramatsu Date: Thu Aug 30 23:19:59 2018 +0900 selftests/ftrace: Add kprobe event with $comm argument testcase Add kprobe-event with $comm argument testcase to ftracetest. This not only checks syntax but also checks log file. Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan (Samsung OSG) commit ddbc31e63aef5e7d12f28f3ac4742420bd5b274c Author: Masami Hiramatsu Date: Thu Aug 30 23:19:31 2018 +0900 selftests/ftrace: Check set_event_pid result Ensure the set_event_pid shows set pid list. Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan (Samsung OSG) commit 00b2f2bc3aacb658c44dcb76e004423b6a6380eb Author: Masami Hiramatsu Date: Thu Aug 30 23:19:03 2018 +0900 selftests/ftrace: Test kprobe-event argument with various bitsize Improve the kprobe-event with argument types testcase to test it with various bitsize. kprobe-event argument can be recorded in given types with various bitsize (8, 16, 32, 64), thus the type testcase should test the different bitsize too. Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan (Samsung OSG) commit 1e51263ef4e637199b725df6811f0d2bea70156c Author: Masami Hiramatsu Date: Thu Aug 30 23:18:35 2018 +0900 selftests/ftrace: Improve kretprobe testcase to check log data Improve kretprobe testcase to check the log data correctness and ensure the event definition is corrctly including argument definition. Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan (Samsung OSG) commit e42e5c46b07d09b6b985ceea954eae165103c7ed Author: Masami Hiramatsu Date: Thu Aug 30 23:18:06 2018 +0900 selftests/ftrace: Improve kprobe testcase to check log data Improve kprobe testcase to check the log data correctness and ensure the event definition is corrctly including argument definition. Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan (Samsung OSG) commit af2a0750f374935c07b8beab78d6032b1ca2218d Author: Masami Hiramatsu Date: Thu Aug 30 23:17:38 2018 +0900 selftests/ftrace: Improve kprobe on module testcase to load/unload module Improve kprobe events on module testcase to check module load/unload with disabled/enabled events. This also change the target module to trace_printk.ko, so it depends on CONFIG_SAMPLE_TRACE_PRINTK=m. Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan (Samsung OSG) commit cec3adf5f57160d829a033bcb578c3dd0a90c693 Author: Masami Hiramatsu Date: Thu Aug 30 23:17:10 2018 +0900 selftests/ftrace: Use loopback address instead of localhost Use raw loopback address instead of localhost, because "localhost" can depend on nsswitch and in some case we can not resolve the localhost. Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan (Samsung OSG) commit 72ce3daf92ba4f5bae6e91095d40e67b367c6b2f Author: Masami Hiramatsu Date: Thu Aug 30 23:16:41 2018 +0900 selftests/ftrace: Fix checkbashisms errors Fix a test case to make checkbashisms clean. Signed-off-by: Masami Hiramatsu Acked-by: Steven Rostedt (VMware) Signed-off-by: Shuah Khan (Samsung OSG) commit 2452c96e617a0ff6fb2692e55217a3fa57a7322c Author: Masami Hiramatsu Date: Thu Aug 30 23:16:13 2018 +0900 selftests/ftrace: Fix to test kprobe $comm arg only if available Test $comm in kprobe-event argument syntax testcase only if it is supported on the kernel because $comm has been introduced 4.8 kernel. So on older stable kernel, it should be skipped. Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan (Samsung OSG) commit e527c47081c7e2795ffc3201809de9545cc25830 Author: Masami Hiramatsu Date: Thu Aug 30 23:15:44 2018 +0900 selftests/ftrace: Remove unneeded per-test init/cleanup ftrace Since ftracetest framework calls initialize_ftrace() right before each test and after all tests, we don't need to init/cleanup ftrace for each test case. Just remove such unneeded init/cleanup code because it can increase logfile size. Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan (Samsung OSG) commit 9768cc46d39a029f7da47beea449d023b377103d Author: Masami Hiramatsu Date: Thu Aug 30 23:15:16 2018 +0900 selftests/ftrace: Cleanup ftrace after running test Cleanup ftrace by initialize_ftrace() after running all test cases. This means we also don't need cleanup ftrace on each test case, except for some special options. Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan (Samsung OSG) commit 3a96a9d0a4e985e80280357393d86ff4401eeff7 Author: Masami Hiramatsu Date: Thu Aug 30 23:14:48 2018 +0900 selftests/ftrace: Add SPDX License Identifier to template Add SPDX License Identifier line to template file so that someone who makes new testcase from the template does not forgot it. Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan (Samsung OSG) commit 7590472e78c8fbe1383aba30450655fd6415fa7b Author: Masami Hiramatsu Date: Thu Aug 30 23:14:19 2018 +0900 selftests/ftrace: More initialize features in initialize_ftrace Clear pid filter, synthetic_events, snapshots, ftrace filter, and trace log in initialize_ftrace(), since those are used in test cases. Signed-off-by: Masami Hiramatsu Acked-by: Steven Rostedt (VMware) Signed-off-by: Shuah Khan (Samsung OSG) commit 7d0abba4293e555a5b1a6ea060cddd05f4ee357f Author: Masami Hiramatsu Date: Thu Aug 30 23:13:51 2018 +0900 selftests/ftrace: Add case number prefix to logfile Add a case number prefix to each logfile. This makes it easier to find which logfile is corresponding to which failure. Signed-off-by: Masami Hiramatsu Acked-by: Steven Rostedt (VMware) Signed-off-by: Shuah Khan (Samsung OSG) commit 5d1c6580d616dfc864ffdec587e645e50a21c072 Author: Masami Hiramatsu Date: Thu Aug 30 23:13:23 2018 +0900 selftests/ftrace: Add --console hidden option Add --console hidden option for debug test cases. This option allows to put "sh" or something else when the test case hits a bug. For example, if you find a testcase which doesn't pass, you can insert sh for interactive debug as below ----- #!/bin/sh # description: sample test case good-command suspicious-wrong-command sh # <- add this for interactive debug ----- Signed-off-by: Masami Hiramatsu Signed-off-by: Shuah Khan (Samsung OSG) commit 9d954f9519707bc0af29ead8b1dedc660306da1b Author: Masami Hiramatsu Date: Thu Aug 30 23:12:55 2018 +0900 selftests/ftrace: Add --stop-fail hidden option for debug Add --stop-fail option for debugging the ftracetest. With this option, ftracetest stops right after a testcase fails instead of finish running all testcases. Signed-off-by: Masami Hiramatsu Acked-by: Steven Rostedt (VMware) Signed-off-by: Shuah Khan (Samsung OSG) commit f3aaaaaae2633281ad2a4d9b835d4093f0b0a2c8 Author: Anirudh Venkataramanan Date: Thu Oct 18 08:37:03 2018 -0700 ice: Make ice_msix_clean_rings static commit 158a08a694c4e ("ice: remove ndo_poll_controller") removed ice_netpoll and introduced a namespace warning for ice_msix_clean_rings. Fix the namespace warning by making ice_msix_clean_rings static. Signed-off-by: Anirudh Venkataramanan Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher commit fe57120e18a1f9124ca758c89cc54f91333d1847 Author: Andi Kleen Date: Mon Sep 24 10:07:32 2018 -0700 perf script: Support total cycles count For 'perf script' brstackinsn also print a running cycles count. This makes it easier to calculate cycle deltas for code sections measured with LBRs. % perf record -b -a sleep 1 % perf script -F +brstackinsn ... 00007f73ecc41083 insn: 74 06 # PRED 9 cycles [17] 1.11 IPC 00007f73ecc4108b insn: a8 10 00007f73ecc4108d insn: 74 71 # PRED 1 cycles [18] 1.00 IPC 00007f73ecc41100 insn: 48 8b 46 10 00007f73ecc41104 insn: 4c 8b 38 00007f73ecc41107 insn: 4d 85 ff 00007f73ecc4110a insn: 0f 84 b0 00 00 00 00007f73ecc41110 insn: 83 43 58 01 00007f73ecc41114 insn: 48 89 df 00007f73ecc41117 insn: e8 94 73 04 00 # PRED 6 cycles [24] 1.00 IPC Signed-off-by: Andi Kleen Acked-by: Jiri Olsa Cc: Andi Kleen Link: http://lkml.kernel.org/r/20180924170732.GA28040@tassilo.jf.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 99f753f048b3f02f31a56951781672021af6cd0d Author: Andi Kleen Date: Thu Sep 20 11:05:39 2018 -0700 perf script: Implement --graph-function Add a ftrace style --graph-function argument to 'perf script' that allows to print itrace function calls only below a given function. This makes it easier to find the code of interest in a large trace. % perf record -e intel_pt//k -a sleep 1 % perf script --graph-function group_sched_in --call-trace perf 900 [000] 194167.205652203: ([kernel.kallsyms]) group_sched_in perf 900 [000] 194167.205652203: ([kernel.kallsyms]) __x86_indirect_thunk_rax perf 900 [000] 194167.205652203: ([kernel.kallsyms]) event_sched_in.isra.107 perf 900 [000] 194167.205652203: ([kernel.kallsyms]) perf_event_set_state.part.71 perf 900 [000] 194167.205652203: ([kernel.kallsyms]) perf_event_update_time perf 900 [000] 194167.205652203: ([kernel.kallsyms]) perf_pmu_disable perf 900 [000] 194167.205652203: ([kernel.kallsyms]) perf_log_itrace_start perf 900 [000] 194167.205652203: ([kernel.kallsyms]) __x86_indirect_thunk_rax perf 900 [000] 194167.205652203: ([kernel.kallsyms]) perf_event_update_userpage perf 900 [000] 194167.205652203: ([kernel.kallsyms]) calc_timer_values perf 900 [000] 194167.205652203: ([kernel.kallsyms]) sched_clock_cpu perf 900 [000] 194167.205652203: ([kernel.kallsyms]) __x86_indirect_thunk_rax perf 900 [000] 194167.205652203: ([kernel.kallsyms]) arch_perf_update_userpage perf 900 [000] 194167.205652203: ([kernel.kallsyms]) __fentry__ perf 900 [000] 194167.205652203: ([kernel.kallsyms]) using_native_sched_clock perf 900 [000] 194167.205652203: ([kernel.kallsyms]) sched_clock_stable perf 900 [000] 194167.205652203: ([kernel.kallsyms]) perf_pmu_enable perf 900 [000] 194167.205652203: ([kernel.kallsyms]) __x86_indirect_thunk_rax swapper 0 [001] 194167.205660693: ([kernel.kallsyms]) group_sched_in swapper 0 [001] 194167.205660693: ([kernel.kallsyms]) __x86_indirect_thunk_rax swapper 0 [001] 194167.205660693: ([kernel.kallsyms]) event_sched_in.isra.107 swapper 0 [001] 194167.205660693: ([kernel.kallsyms]) perf_event_set_state.part.71 swapper 0 [001] 194167.205660693: ([kernel.kallsyms]) perf_event_update_time swapper 0 [001] 194167.205660693: ([kernel.kallsyms]) perf_pmu_disable swapper 0 [001] 194167.205660693: ([kernel.kallsyms]) perf_log_itrace_start swapper 0 [001] 194167.205660693: ([kernel.kallsyms]) __x86_indirect_thunk_rax swapper 0 [001] 194167.205660693: ([kernel.kallsyms]) perf_event_update_userpage swapper 0 [001] 194167.205660693: ([kernel.kallsyms]) calc_timer_values swapper 0 [001] 194167.205660693: ([kernel.kallsyms]) sched_clock_cpu swapper 0 [001] 194167.205660693: ([kernel.kallsyms]) __x86_indirect_thunk_rax swapper 0 [001] 194167.205660693: ([kernel.kallsyms]) arch_perf_update_userpage swapper 0 [001] 194167.205660693: ([kernel.kallsyms]) __fentry__ swapper 0 [001] 194167.205660693: ([kernel.kallsyms]) using_native_sched_clock swapper 0 [001] 194167.205660693: ([kernel.kallsyms]) sched_clock_stable Signed-off-by: Andi Kleen Tested-by: Arnaldo Carvalho de Melo Tested-by: Leo Yan Acked-by: Jiri Olsa Cc: Kim Phillips Link: http://lkml.kernel.org/r/20180920180540.14039-5-andi@firstfloor.org Signed-off-by: Arnaldo Carvalho de Melo commit d1b1552e15d41297abcaf3812378e3391d44fa6b Author: Andi Kleen Date: Thu Sep 20 11:05:38 2018 -0700 tools script: Add --call-trace and --call-ret-trace Add short cut options to print PT call trace and call-ret-trace, for calls and call and returns. Roughly corresponds to ftrace function tracer and function graph tracer. Just makes these common use cases nicer to use. % perf record -a -e intel_pt// sleep 1 % perf script --call-trace perf 900 [000] 194167.205652203: ([kernel.kallsyms]) perf_pmu_enable perf 900 [000] 194167.205652203: ([kernel.kallsyms]) __x86_indirect_thunk_rax perf 900 [000] 194167.205652203: ([kernel.kallsyms]) event_filter_match perf 900 [000] 194167.205652203: ([kernel.kallsyms]) group_sched_in perf 900 [000] 194167.205652203: ([kernel.kallsyms]) __x86_indirect_thunk_rax perf 900 [000] 194167.205652203: ([kernel.kallsyms]) event_sched_in.isra.107 perf 900 [000] 194167.205652203: ([kernel.kallsyms]) perf_event_set_state.part.71 perf 900 [000] 194167.205652203: ([kernel.kallsyms]) perf_event_update_time perf 900 [000] 194167.205652203: ([kernel.kallsyms]) perf_pmu_disable perf 900 [000] 194167.205652203: ([kernel.kallsyms]) perf_log_itrace_start perf 900 [000] 194167.205652203: ([kernel.kallsyms]) __x86_indirect_thunk_rax perf 900 [000] 194167.205652203: ([kernel.kallsyms]) perf_event_update_userpage % perf script --call-ret-trace perf 900 [000] 194167.205652203: tr strt ([unknown]) pt_config perf 900 [000] 194167.205652203: return ([kernel.kallsyms]) pt_config perf 900 [000] 194167.205652203: return ([kernel.kallsyms]) pt_event_add perf 900 [000] 194167.205652203: call ([kernel.kallsyms]) perf_pmu_enable perf 900 [000] 194167.205652203: return ([kernel.kallsyms]) perf_pmu_nop_void perf 900 [000] 194167.205652203: return ([kernel.kallsyms]) event_sched_in.isra.107 perf 900 [000] 194167.205652203: call ([kernel.kallsyms]) __x86_indirect_thunk_rax perf 900 [000] 194167.205652203: return ([kernel.kallsyms]) perf_pmu_nop_int perf 900 [000] 194167.205652203: return ([kernel.kallsyms]) group_sched_in perf 900 [000] 194167.205652203: call ([kernel.kallsyms]) event_filter_match perf 900 [000] 194167.205652203: return ([kernel.kallsyms]) event_filter_match perf 900 [000] 194167.205652203: call ([kernel.kallsyms]) group_sched_in perf 900 [000] 194167.205652203: call ([kernel.kallsyms]) __x86_indirect_thunk_rax perf 900 [000] 194167.205652203: return ([kernel.kallsyms]) perf_pmu_nop_txn perf 900 [000] 194167.205652203: call ([kernel.kallsyms]) event_sched_in.isra.107 perf 900 [000] 194167.205652203: call ([kernel.kallsyms]) perf_event_set_state.part.71 Signed-off-by: Andi Kleen Tested-by: Arnaldo Carvalho de Melo Tested-by: Leo Yan Acked-by: Jiri Olsa Cc: Kim Phillips Link: http://lkml.kernel.org/r/20180920180540.14039-4-andi@firstfloor.org Signed-off-by: Arnaldo Carvalho de Melo commit 4eb068157121939f4bc16256a37bcd88f5554123 Author: Andi Kleen Date: Thu Sep 20 11:05:37 2018 -0700 perf script: Make itrace script default to all calls By default 'perf script' for itrace outputs sampled instructions or branches. In my experience this is confusing to users because it's hard to correlate with real program behavior. The sampling makes sense for tools like 'perf report' that actually sample to reduce the run time, but run time is normally not a problem for 'perf script'. It's better to give an accurate representation of the program flow. Default 'perf script' to output all calls for itrace. That's a much saner default. The old behavior can be still requested with 'perf script' --itrace=ibxwpe100000 v2: Fix ETM build failure v3: Really fix ETM build failure (Kim Phillips) Signed-off-by: Andi Kleen Acked-by: Jiri Olsa Cc: Kim Phillips Cc: Leo Yan Link: http://lkml.kernel.org/r/20180920180540.14039-3-andi@firstfloor.org Signed-off-by: Arnaldo Carvalho de Melo commit b585ebdb5912cf1438d4822f79aaebe36a2d123a Author: Andi Kleen Date: Thu Sep 20 11:05:36 2018 -0700 perf script: Add --insn-trace for instruction decoding Add a --insn-trace short hand option for decoding and disassembling instruction streams for intel_pt. This automatically pipes the output into the xed disassembler to generate disassembled instructions. This just makes this use model much nicer to use. Before % perf record -e intel_pt// ... % perf script --itrace=i0ns --ns -F +insn,-event,-period | xed -F insn: -A -64 swapper 0 [000] 17276.429606186: ffffffff81010486 pt_config ([kernel.kallsyms]) nopl %eax, (%rax,%rax,1) swapper 0 [000] 17276.429606186: ffffffff8101048b pt_config ([kernel.kallsyms]) add $0x10, %rsp swapper 0 [000] 17276.429606186: ffffffff8101048f pt_config ([kernel.kallsyms]) popq %rbx swapper 0 [000] 17276.429606186: ffffffff81010490 pt_config ([kernel.kallsyms]) popq %rbp swapper 0 [000] 17276.429606186: ffffffff81010491 pt_config ([kernel.kallsyms]) popq %r12 swapper 0 [000] 17276.429606186: ffffffff81010493 pt_config ([kernel.kallsyms]) popq %r13 swapper 0 [000] 17276.429606186: ffffffff81010495 pt_config ([kernel.kallsyms]) popq %r14 swapper 0 [000] 17276.429606186: ffffffff81010497 pt_config ([kernel.kallsyms]) popq %r15 swapper 0 [000] 17276.429606186: ffffffff81010499 pt_config ([kernel.kallsyms]) retq swapper 0 [000] 17276.429606186: ffffffff8101063e pt_event_add ([kernel.kallsyms]) cmpl $0x1, 0x1b0(%rbx) swapper 0 [000] 17276.429606186: ffffffff81010645 pt_event_add ([kernel.kallsyms]) mov $0xffffffea, %eax swapper 0 [000] 17276.429606186: ffffffff8101064a pt_event_add ([kernel.kallsyms]) mov $0x0, %edx swapper 0 [000] 17276.429606186: ffffffff8101064f pt_event_add ([kernel.kallsyms]) popq %rbx swapper 0 [000] 17276.429606186: ffffffff81010650 pt_event_add ([kernel.kallsyms]) cmovnz %edx, %eax swapper 0 [000] 17276.429606186: ffffffff81010653 pt_event_add ([kernel.kallsyms]) jmp 0xffffffff81010635 swapper 0 [000] 17276.429606186: ffffffff81010635 pt_event_add ([kernel.kallsyms]) retq swapper 0 [000] 17276.429606186: ffffffff8115e687 event_sched_in.isra.107 ([kernel.kallsyms]) test %eax, %eax Now: % perf record -e intel_pt// ... % perf script --insn-trace --xed ... same output ... XED needs to be installed with: $ git clone https://github.com/intelxed/mbuild.git mbuild $ git clone https://github.com/intelxed/xed $ cd xed $ ./mfile.py $ ./mfile.py examples $ sudo ./mfile.py --prefix=/usr/local install $ sudo cp obj/examples/xed /usr/local/bin $ xed | head -3 ERROR: required argument(s) were missing Copyright (C) 2017, Intel Corporation. All rights reserved. XED version: [v10.0-328-g7d62c8c49b7b] $ Signed-off-by: Andi Kleen Tested-by: Arnaldo Carvalho de Melo Acked-by: Jiri Olsa Link: http://lkml.kernel.org/r/20180920180540.14039-2-andi@firstfloor.org [ Fixed up whitespace damage, added the 'mfile.py examples + cp obj/examples/xed ... ] Signed-off-by: Arnaldo Carvalho de Melo commit 01aa9d518eae8a4d75cd3049defc6ed0b6d0a658 Merge: 5993692f0958 aea74de4b216 Author: Linus Torvalds Date: Wed Oct 24 18:01:11 2018 +0100 Merge tag 'docs-4.20' of git://git.lwn.net/linux Pull documentation updates from Jonathan Corbet: "This is a fairly typical cycle for documentation. There's some welcome readability improvements for the formatted output, some LICENSES updates including the addition of the ISC license, the removal of the unloved and unmaintained 00-INDEX files, the deprecated APIs document from Kees, more MM docs from Mike Rapoport, and the usual pile of typo fixes and corrections" * tag 'docs-4.20' of git://git.lwn.net/linux: (41 commits) docs: Fix typos in histogram.rst docs: Introduce deprecated APIs list kernel-doc: fix declaration type determination doc: fix a typo in adding-syscalls.rst docs/admin-guide: memory-hotplug: remove table of contents doc: printk-formats: Remove bogus kobject references for device nodes Documentation: preempt-locking: Use better example dm flakey: Document "error_writes" feature docs/completion.txt: Fix a couple of punctuation nits LICENSES: Add ISC license text LICENSES: Add note to CDDL-1.0 license that it should not be used docs/core-api: memory-hotplug: add some details about locking internals docs/core-api: rename memory-hotplug-notifier to memory-hotplug docs: improve readability for people with poorer eyesight yama: clarify ptrace_scope=2 in Yama documentation docs/vm: split memory hotplug notifier description to Documentation/core-api docs: move memory hotplug description into admin-guide/mm doc: Fix acronym "FEKEK" in ecryptfs docs: fix some broken documentation references iommu: Fix passthrough option documentation ... commit 5993692f09582accb4cb7af11d344598af43c3b8 Merge: d6edff78fe9e 33458eaba4df Author: Linus Torvalds Date: Wed Oct 24 17:42:24 2018 +0100 Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 updates from Ted Ts'o: - further restructure ext4 documentation - fix up ext4's delayed allocation for bigalloc file systems - fix up some syzbot-detected races in EXT4_IOC_MOVE_EXT, EXT4_IOC_SWAP_BOOT, and ext4_remount - ... and a few other miscellaneous bugs and optimizations. * tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (21 commits) ext4: fix use-after-free race in ext4_remount()'s error path ext4: cache NULL when both default_acl and acl are NULL docs: promote the ext4 data structures book to top level docs: move ext4 administrative docs to admin-guide/ jbd2: fix use after free in jbd2_log_do_checkpoint() ext4: propagate error from dquot_initialize() in EXT4_IOC_FSSETXATTR ext4: fix setattr project check in fssetxattr ioctl docs: make ext4 readme tables readable docs: fix ext4 documentation table formatting problems docs: generate a separate ext4 pdf file from the documentation ext4: convert fault handler to use vm_fault_t type ext4: initialize retries variable in ext4_da_write_inline_data_begin() ext4: fix EXT4_IOC_SWAP_BOOT ext4: fix build error when DX_DEBUG is defined ext4: fix argument checking in EXT4_IOC_MOVE_EXT ext4: fix reserved cluster accounting at page invalidation time ext4: adjust reserved cluster count when removing extents ext4: reduce reserved cluster count by number of allocated clusters ext4: fix reserved cluster accounting at delayed write time ext4: add new pending reservation mechanism ... commit d6edff78fe9e34dbea1bec7dc26cfce92c6d96d5 Merge: fe0142df648f 78130819695f Author: Linus Torvalds Date: Wed Oct 24 17:39:36 2018 +0100 Merge tag 'f2fs-for-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs updates from Jaegeuk Kim: "In this round, we've added 1) superblock checksum feature, 2) implemented new mount option which we can disable/enable checkpoint to provide atomic updates of entire filesystem, 3) refactored quota operations to enhance its consistency along with checkpoint, 4) fixed subtle IO hang conditions and roll-forward recovery flow to resurrect any fsync'ed inode metadata. Enhancements: - add checksum to keep superblock contents more safe - add checkpoint=disable/enable to support A/B update of entire filesystem - use plug for readahead IO in readdir - add more IO counts to avoid block layer hacks Bug fixes: - prevent data corruption issue for hardware encryption - fix IO hang issues when GC is heavily triggered - add missing up_read in __write_node_page - recover inode metadata during roll-forward recovery flow - fix null pointer dereference issue in wrongly configured discard map There are some more sanity checks and minor bug fixes as well" * tag 'f2fs-for-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (62 commits) f2fs: fix to keep project quota consistent f2fs: guarantee journalled quota data by checkpoint f2fs: cleanup dirty pages if recover failed f2fs: fix data corruption issue with hardware encryption f2fs: fix to recover inode->i_flags of inode block during POR f2fs: spread f2fs_set_inode_flags() f2fs: fix to spread clear_cold_data() Revert "f2fs: fix to clear PG_checked flag in set_page_dirty()" f2fs: account read IOs and use IO counts for is_idle f2fs: fix to account IO correctly for cgroup writeback f2fs: fix to account IO correctly f2fs: remove request_list check in is_idle() f2fs: allow to mount, if quota is failed f2fs: update REQ_TIME in f2fs_cross_rename() f2fs: do not update REQ_TIME in case of error conditions f2fs: remove unneeded disable_nat_bits() f2fs: remove unused sbi->trigger_ssr_threshold f2fs: shrink sbi->sb_lock coverage in set_file_temperature() f2fs: use rb_*_cached friends f2fs: fix to recover cold bit of inode block during POR ... commit fe0142df648f5478f410c41e01771b90b9793215 Merge: bfd93a87eadb 96987eea537d Author: Linus Torvalds Date: Wed Oct 24 17:36:12 2018 +0100 Merge tag 'xfs-4.20-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pul xfs updates from Dave Chinner: "There's not a huge amount of change in this cycle - Darrick has been out of action for a couple of months (hence me sending the last few pull requests), so we decided a quiet cycle mainly focussed on bug fixes was a good idea. Darrick will take the helm again at the end of this merge window. FYI, I may be sending another update later in the cycle - there's a pending rework of the clone/dedupe_file_range code that fixes numerous bugs that is spread amongst the VFS, XFS and ocfs2 code. It has been reviewed and tested, Al and I just need to work out the details of the merge, so it may come from him rather than me. Summary: - only support filesystems with unwritten extents - add definition for statfs XFS magic number - remove unused parameters around reflink code - more debug for dangling delalloc extents - cancel COW extents on extent swap targets - fix quota stats output and clean up the code - refactor some of the attribute code in preparation for parent pointers - fix several buffer handling bugs" * tag 'xfs-4.20-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (21 commits) xfs: cancel COW blocks before swapext xfs: clear ail delwri queued bufs on unmount of shutdown fs xfs: use offsetof() in place of offset macros for __xfsstats xfs: Fix xqmstats offsets in /proc/fs/xfs/xqmstat xfs: fix use-after-free race in xfs_buf_rele xfs: Add attibute remove and helper functions xfs: Add attibute set and helper functions xfs: Add helper function xfs_attr_try_sf_addname xfs: Move fs/xfs/xfs_attr.h to fs/xfs/libxfs/xfs_attr.h xfs: issue log message on user force shutdown xfs: fix buffer state management in xrep_findroot_block xfs: always assign buffer verifiers when one is provided xfs: xrep_findroot_block should reject root blocks with siblings xfs: add a define for statfs magic to uapi xfs: print dangling delalloc extents xfs: fix fork selection in xfs_find_trim_cow_extent xfs: remove the unused trimmed argument from xfs_reflink_trim_around_shared xfs: remove the unused shared argument to xfs_reflink_reserve_cow xfs: handle zeroing in xfs_file_iomap_begin_delay xfs: remove suport for filesystems without unwritten extent flag ... commit bfd93a87eadb03499a5ff02dfebfaf515310d27c Merge: e1cbbf406782 8e31582a9ab1 Author: Linus Torvalds Date: Wed Oct 24 17:30:39 2018 +0100 Merge tag 'gfs2-4.20.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 updates from Bob Peterson: "We've got 18 patches for this merge window, none of which are very major: - clean up the gfs2 block allocator to prepare for future performance enhancements (Andreas Gruenbacher) - fix a use-after-free problem (Andy Price) - patches that fix gfs2's broken rgrplvb mount option (me) - cleanup patches and error message improvements (me) - enable getlabel support (Steve Whitehouse and Abhi Das) - flush the glock delete workqueue at exit (Tim Smith)" * tag 'gfs2-4.20.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: gfs2: Fix minor typo: couln't versus couldn't. gfs2: write revokes should traverse sd_ail1_list in reverse gfs2: Pass resource group to rgblk_free gfs2: Remove unnecessary gfs2_rlist_alloc parameter gfs2: Fix marking bitmaps non-full gfs2: Fix some minor typos gfs2: Rename bitmap.bi_{len => bytes} gfs2: Remove unused RGRP_RSRV_MINBYTES definition gfs2: Move rs_{sizehint, rgd_gh} fields into the inode gfs2: Clean up out-of-bounds check in gfs2_rbm_from_block gfs2: Always check the result of gfs2_rbm_from_block gfs2: getlabel support GFS2: Flush the GFS2 delete workqueue before stopping the kernel threads gfs2: Don't leave s_fs_info pointing to freed memory in init_sbd gfs2: Use fs_* functions instead of pr_* function where we can gfs2: slow the deluge of io error messages gfs2: Don't set GFS2_RDF_UPTODATE when the lvb is updated gfs2: improve debug information when lvb mismatches are found commit e1cbbf4067820ea4df534dd96f51c8f67854dcad Merge: 6b609e3b0068 22fc9db296fc Author: Linus Torvalds Date: Wed Oct 24 17:28:03 2018 +0100 Merge tag 'for-linus-4.20-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux Pull orangefs updates from Mike Marshall: "Fixes and a cleanup. Fixes: - fix superfluous service_operation return code check in orangefs_lookup - fix some error code paths that missed kmem_cache_free - don't let orangefs_iget return NULL - don't let orangefs_new_inode return NULL - cache NULL when both default_acl and acl are NULL Cleanup: - rate limit the client not running info message" * tag 'for-linus-4.20-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux: orangefs: no need to check for service_operation returns > 0 orangefs: some error code paths missed kmem_cache_free orangefs: don't let orangefs_iget return NULL. orangefs: don't let orangefs_new_inode return NULL orangefs: rate limit the client not running info message orangefs: cache NULL when both default_acl and acl are NULL commit 6b609e3b0068d29c676e8f1c6d2c0d503d18fea1 Merge: deba28b12bcb 3df629d873f8 Author: Linus Torvalds Date: Wed Oct 24 17:24:04 2018 +0100 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs fixes from Al Viro. * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: gfs2_meta: ->mount() can get NULL dev_name ecryptfs_rename(): verify that lower dentries are still OK after lock_rename() cachefiles: fix the race between cachefiles_bury_object() and rmdir(2) commit deba28b12bcb5e11c6f6689f4edd96eea4929162 Merge: 318b067a5dd6 1390643d1d5c Author: Linus Torvalds Date: Wed Oct 24 17:22:16 2018 +0100 Merge tag 'jfs-for-4.20' of git://github.com/kleikamp/linux-shaggy Pull jfs updates from David Kleikamp: "Just a few small fixes" * tag 'jfs-for-4.20' of git://github.com/kleikamp/linux-shaggy: jfs: remove redundant dquot_initialize() in jfs_evict_inode() jfs: remove quota option from ignore list jfs: cache NULL when both default_acl and acl are NULL commit 318b067a5dd649d198c2ba00cf7408d778fc00b4 Merge: 44adbac8f721 d9352794dad9 Author: Linus Torvalds Date: Wed Oct 24 17:15:26 2018 +0100 Merge tag 'for-4.20-part1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs updates from David Sterba: "This is the first batch with fixes and some nice performance improvements. Preliminary results show eg. more files/sec in fsmark, better perf on multi-threaded workloads (filebench, dbench), fewer context switches and overall better memory allocation characteristics (multiple benchmarks). Apart from general performance, there's an improvement for qgroups + balance workload that's been troubling our users. Note for stable: there are 20+ patches tagged for stable, out of 90. Not all of them apply cleanly on all stable versions but the conflicts are mostly due to simple cleanups and resolving should be obvious. The fixes are otherwise independent. Performance improvements: - transition between blocking and spinning modes of path is gone, which originally resulted to more unnecessary wakeups and updates to the path locks, the effects are measurable and improve latency and scalability - qgroups: first batch of changes that should speedup balancing with qgroups on, skip quota accounting on unchanged subtrees, overall gain is about 30+% in runtime - use rb-tree with cached first node for several structures, small improvement to avoid pointer chasing Fixes: - trim - fix: some blockgroups could have been missed if their logical address was past the total filesystem size (ie. after a lot of balancing) - better error reporting, after processing blockgroups and whole device - fix: continue trimming block groups after an error is encountered - check for trim support of the device earlier and avoid some unnecessary work - less interaction with transaction commit that improves latency on slower storage (eg. image files over NFS) - fsync - fix warning when replaying log after fsync of a O_TMPFILE - fix wrong dentries after fsync of file that got its parent replaced - qgroups: fix rescan that might misc some dirty groups - don't clean dirty pages during buffered writes, this could lead to lost updates in some corner cases - some block groups could have been delayed in creation, if the allocation triggered another one - error handling improvements Cleanups: - removed unused struct members and variables - function return type cleanups - delayed refs code refactoring - protect against deadlock that could be caused by crafted image that tries to allocate from a tree that's locked already" * tag 'for-4.20-part1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (93 commits) btrfs: switch return_bigger to bool in find_ref_head btrfs: remove fs_info from btrfs_should_throttle_delayed_refs btrfs: remove fs_info from btrfs_check_space_for_delayed_refs btrfs: delayed-ref: pass delayed_refs directly to btrfs_delayed_ref_lock btrfs: delayed-ref: pass delayed_refs directly to btrfs_select_ref_head btrfs: qgroup: move the qgroup->members check out from (!qgroup)'s else branch btrfs: relocation: Remove redundant tree level check btrfs: relocation: Cleanup while loop using rbtree_postorder_for_each_entry_safe btrfs: qgroup: Avoid calling qgroup functions if qgroup is not enabled Btrfs: fix wrong dentries after fsync of file that got its parent replaced Btrfs: fix warning when replaying log after fsync of a tmpfile btrfs: drop min_size from evict_refill_and_join btrfs: assert on non-empty delayed iputs btrfs: make sure we create all new block groups btrfs: reset max_extent_size on clear in a bitmap btrfs: protect space cache inode alloc with GFP_NOFS btrfs: release metadata before running delayed refs Btrfs: kill btrfs_clear_path_blocking btrfs: dev-replace: remove pointless assert in write unlock btrfs: dev-replace: move replace members out of fs_info ... commit 44adbac8f7217040be97928cd19998259d9d4418 Merge: 08ffb584d9eb ce5a983191ce Author: Linus Torvalds Date: Wed Oct 24 14:43:41 2018 +0100 Merge branch 'work.tty-ioctl' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull tty ioctl updates from Al Viro: "This is the compat_ioctl work related to tty ioctls. Quite a bit of dead code taken out, all tty-related stuff gone from fs/compat_ioctl.c. A bunch of compat bugs fixed - some still remain, but all more or less generic tty-related ioctls should be covered (remaining issues are in things like driver-private ioctls in a pcmcia serial card driver not getting properly handled in 32bit processes on 64bit host, etc)" * 'work.tty-ioctl' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (53 commits) kill TIOCSERGSTRUCT change semantics of ldisc ->compat_ioctl() kill TIOCSER[SG]WILD synclink_gt(): fix compat_ioctl() pty: fix compat ioctls compat_ioctl - kill keyboard ioctl handling gigaset: add ->compat_ioctl() vt_compat_ioctl(): clean up, use compat_ptr() properly gigaset: don't try to printk userland buffer contents dgnc: don't bother with (empty) stub for TCXONC dgnc: leave TIOC[GS]SOFTCAR to ldisc remove fallback to drivers for TIOCGICOUNT dgnc: break-related ioctls won't reach ->ioctl() kill the rest of tty COMPAT_IOCTL() entries dgnc: TIOCM... won't reach ->ioctl() isdn_tty: TCSBRK{,P} won't reach ->ioctl() kill capinc_tty_ioctl() take compat TIOC[SG]SERIAL treatment into tty_compat_ioctl() synclink: reduce pointless checks in ->ioctl() complete ->[sg]et_serial() switchover ... commit 08ffb584d9eb17940321317ef6c9c7383ad4f149 Merge: 638820d8da8e 1227daa43bce Author: Linus Torvalds Date: Wed Oct 24 14:42:02 2018 +0100 Merge tag 'pstore-v4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore updates from Kees Cook: "pstore improvements: - refactor init to happen as early as possible again (Joel Fernandes) - improve resource reservation names" * tag 'pstore-v4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: pstore/ram: Clarify resource reservation labels pstore: Refactor compression initialization pstore: Allocate compression during late_initcall() pstore: Centralize init/exit routines commit 38f876bb2d621bfbcc6636c0317121137e9f2afc Author: Steve French Date: Sun Sep 23 19:06:33 2018 -0500 cifs: update internal module version number for cifs.ko to 2.14 Update version reported in "modinfo cifs" Signed-off-by: Steve French commit 43de1db36424fd21bbcfbe11a018f25c1566f246 Author: Steve French Date: Tue Oct 23 21:04:57 2018 -0500 smb3: add debug for unexpected mid cancellation We have hit this intermittently, increase the verbosity of warning message on unexpected mid cancellation. Signed-off-by: Steve French commit 32a1fb36f6e50183871c2c1fcf5493c633e84732 Author: Ronnie Sahlberg Date: Wed Oct 24 11:50:33 2018 +1000 cifs: allow calling SMB2_xxx_free(NULL) Change these free functions to allow passing NULL as the argument and treat it as a no-op just like free(NULL) would. Or, if rqst->rq_iov is NULL. The second scenario could happen for smb2_queryfs() if the call to SMB2_query_info_init() fails and we go to qfs_exit to clean up and free all resources. In that case we have not yet assigned rqst[2].rq_iov and thus the rq_iov dereference in SMB2_close_free() will cause a NULL pointer dereference. Fixes: 1eb9fb52040f ("cifs: create SMB2_open_init()/SMB2_open_free() helpers") Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French Reviewed-by: Aurelien Aptel CC: Stable commit 54edeb0327d7320e2a9a3e517e8bc8f318d41a77 Merge: d2130e82e945 431bca24308c Author: Petr Mladek Date: Wed Oct 24 13:59:05 2018 +0200 Merge branch 'for-4.20-vsprintf-hash-fixes' into for-linus commit 638820d8da8ededd6dc609beaef02d5396599c03 Merge: d5e4d81da4d4 3f6caaf5ff33 Author: Linus Torvalds Date: Wed Oct 24 11:49:35 2018 +0100 Merge branch 'next-general' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull security subsystem updates from James Morris: "In this patchset, there are a couple of minor updates, as well as some reworking of the LSM initialization code from Kees Cook (these prepare the way for ordered stackable LSMs, but are a valuable cleanup on their own)" * 'next-general' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: LSM: Don't ignore initialization failures LSM: Provide init debugging infrastructure LSM: Record LSM name in struct lsm_info LSM: Convert security_initcall() into DEFINE_LSM() vmlinux.lds.h: Move LSM_TABLE into INIT_DATA LSM: Convert from initcall to struct lsm_info LSM: Remove initcall tracing LSM: Rename .security_initcall section to .lsm_info vmlinux.lds.h: Avoid copy/paste of security_init section LSM: Correctly announce start of LSM initialization security: fix LSM description location keys: Fix the use of the C++ keyword "private" in uapi/linux/keyctl.h seccomp: remove unnecessary unlikely() security: tomoyo: Fix obsolete function security/capabilities: remove check for -EINVAL commit f9776280c29e77a18cbc7ebb6d48f7885e494990 Author: Dhinakaran Pandiyan Date: Thu Sep 27 13:57:31 2018 -0700 drm/i915/dp: Restrict link retrain workaround to external monitors Commit '3cf71bc9904d ("drm/i915: Re-apply "Perform link quality check, unconditionally during long pulse"")' applies a work around for sinks that don't signal link loss. The work around does not need to have to be that broad as the issue was seen with only one particular monitor; limit this only for external displays as eDP features like PSR turn off the link and the driver ends up retraining the link seeeing that link is not synchronized. Cc: Lyude Paul Cc: Jan-Marek Glogowski Cc: Ville Syrjälä Cc: Rodrigo Vivi References: 3cf71bc9904d ("drm/i915: Re-apply "Perform link quality check, unconditionally during long pulse"") Signed-off-by: Dhinakaran Pandiyan Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20180927205735.16651-2-dhinakaran.pandiyan@intel.com (cherry picked from commit f24f6eb95807bca0dbd8dc5b2f3a4099000f4472) Fixes: 399334708b4f ("drm/i915: Re-apply "Perform link quality check, unconditionally during long pulse"") Cc: stable@vger.kernel.org Signed-off-by: Joonas Lahtinen commit d5e4d81da4d443d54b0b5c28ba6d26be297c509b Merge: ba9f6f8954af 4458bba09788 Author: Linus Torvalds Date: Wed Oct 24 11:47:32 2018 +0100 Merge tag 'selinux-pr-20181022' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull SELinux updates from Paul Moore: "Three SELinux patches for v4.20, all fall under the bug-fix or behave-better category, which is good. All three have pretty good descriptions too, which is even better" * tag 'selinux-pr-20181022' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: Add __GFP_NOWARN to allocation at str_read() selinux: refactor mls_context_to_sid() and make it stricter selinux: fix mounting of cgroup2 under older policies commit 22a7cdcae6a4a3c8974899e62851d270956f58ce Author: KarimAllah Ahmed Date: Sat Oct 20 23:42:59 2018 +0200 KVM/nVMX: Do not validate that posted_intr_desc_addr is page aligned The spec only requires the posted interrupt descriptor address to be 64-bytes aligned (i.e. bits[0:5] == 0). Using page_address_valid also forces the address to be page aligned. Only validate that the address does not cross the maximum physical address without enforcing a page alignment. Cc: Paolo Bonzini Cc: Radim Krčmář Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: H. Peter Anvin Cc: x86@kernel.org Cc: kvm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Fixes: 6de84e581c0 ("nVMX x86: check posted-interrupt descriptor addresss on vmentry of L2") Signed-off-by: KarimAllah Ahmed Reviewed-by: Jim Mattson Reviewed-by: Krish Sadhuhan Signed-off-by: Radim Krčmář commit 49af5d95b9b3c21a84ad115a9db9acbc036d849a Author: Dhinakaran Pandiyan Date: Thu Sep 27 13:57:30 2018 -0700 drm/i915/dp: Fix link retraining comment in intel_dp_long_pulse() Comment claims link needs to be retrained because the connected sink raised a long pulse to indicate link loss. If the sink did so, intel_dp_hotplug() would have handled link retraining. Looking at the logs in Bugzilla referenced in commit '3cf71bc9904d ("drm/i915: Re-apply Perform link quality check, unconditionally during long pulse"")', the issue is that the sink does not trigger an interrupt. What we want is ->detect() from user space to check link status and retrain. Ville's review for the original patch also indicates the same root cause. So, rewrite the comment. v2: Patch split and rewrote comment. Cc: Lyude Paul Cc: Ville Syrjälä Cc: Jani Nikula Cc: Rodrigo Vivi Cc: Jan-Marek Glogowski References: 3cf71bc9904d ("drm/i915: Re-apply "Perform link quality check, unconditionally during long pulse"") Signed-off-by: Dhinakaran Pandiyan Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20180927205735.16651-1-dhinakaran.pandiyan@intel.com (cherry picked from commit 9ebd8202393dde9d3678c9ec162c1aa63ba17eac) Fixes: 399334708b4f ("drm/i915: Re-apply "Perform link quality check, unconditionally during long pulse"") Cc: stable@vger.kernel.org Signed-off-by: Joonas Lahtinen commit 3511ba7d4ca6f39e2d060bb94e42a41ad1fee7bf Author: Keiji Hayashibara Date: Wed Oct 24 18:34:29 2018 +0900 spi: uniphier: fix incorrect property items This commit fixes incorrect property because it was different from the actual. The parameters of '#address-cells' and '#size-cells' were removed, and 'interrupts', 'pinctrl-names' and 'pinctrl-0' were added. Fixes: 4dcd5c2781f3 ("spi: add DT bindings for UniPhier SPI controller") Signed-off-by: Keiji Hayashibara Signed-off-by: Mark Brown commit 409fa67a7f4a68f6990955849c22eaca589f18c0 Author: kbuild test robot Date: Tue Oct 23 20:20:22 2018 +0800 ASoC: stm32: sai: fix noderef.cocci warnings sound/soc/stm/stm32_sai_sub.c:393:26-32: ERROR: application of sizeof to pointer sizeof when applied to a pointer typed expression gives the size of the pointer Generated by: scripts/coccinelle/misc/noderef.cocci Fixes: 8307b2afd386 ("ASoC: stm32: sai: set sai as mclk clock provider") CC: Olivier Moysan Signed-off-by: kbuild test robot Signed-off-by: Mark Brown commit ba9f6f8954afa5224e3ed60332f7b92242b7ed0f Merge: a978a5b8d83f a36700589b85 Author: Linus Torvalds Date: Wed Oct 24 11:22:39 2018 +0100 Merge branch 'siginfo-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace Pull siginfo updates from Eric Biederman: "I have been slowly sorting out siginfo and this is the culmination of that work. The primary result is in several ways the signal infrastructure has been made less error prone. The code has been updated so that manually specifying SEND_SIG_FORCED is never necessary. The conversion to the new siginfo sending functions is now complete, which makes it difficult to send a signal without filling in the proper siginfo fields. At the tail end of the patchset comes the optimization of decreasing the size of struct siginfo in the kernel from 128 bytes to about 48 bytes on 64bit. The fundamental observation that enables this is by definition none of the known ways to use struct siginfo uses the extra bytes. This comes at the cost of a small user space observable difference. For the rare case of siginfo being injected into the kernel only what can be copied into kernel_siginfo is delivered to the destination, the rest of the bytes are set to 0. For cases where the signal and the si_code are known this is safe, because we know those bytes are not used. For cases where the signal and si_code combination is unknown the bits that won't fit into struct kernel_siginfo are tested to verify they are zero, and the send fails if they are not. I made an extensive search through userspace code and I could not find anything that would break because of the above change. If it turns out I did break something it will take just the revert of a single change to restore kernel_siginfo to the same size as userspace siginfo. Testing did reveal dependencies on preferring the signo passed to sigqueueinfo over si->signo, so bit the bullet and added the complexity necessary to handle that case. Testing also revealed bad things can happen if a negative signal number is passed into the system calls. Something no sane application will do but something a malicious program or a fuzzer might do. So I have fixed the code that performs the bounds checks to ensure negative signal numbers are handled" * 'siginfo-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: (80 commits) signal: Guard against negative signal numbers in copy_siginfo_from_user32 signal: Guard against negative signal numbers in copy_siginfo_from_user signal: In sigqueueinfo prefer sig not si_signo signal: Use a smaller struct siginfo in the kernel signal: Distinguish between kernel_siginfo and siginfo signal: Introduce copy_siginfo_from_user and use it's return value signal: Remove the need for __ARCH_SI_PREABLE_SIZE and SI_PAD_SIZE signal: Fail sigqueueinfo if si_signo != sig signal/sparc: Move EMT_TAGOVF into the generic siginfo.h signal/unicore32: Use force_sig_fault where appropriate signal/unicore32: Generate siginfo in ucs32_notify_die signal/unicore32: Use send_sig_fault where appropriate signal/arc: Use force_sig_fault where appropriate signal/arc: Push siginfo generation into unhandled_exception signal/ia64: Use force_sig_fault where appropriate signal/ia64: Use the force_sig(SIGSEGV,...) in ia64_rt_sigreturn signal/ia64: Use the generic force_sigsegv in setup_frame signal/arm/kvm: Use send_sig_mceerr signal/arm: Use send_sig_fault where appropriate signal/arm: Use force_sig_fault where appropriate ... commit 769d6bfc74c1f02333dd5f9a438df3346aded56f Author: Stefano Stabellini Date: Wed Oct 17 21:44:45 2018 +0800 add myself as reviewer for Xen support in Linux It would be good for me to keep an eye on the patches that touch Xen support in Linux to try to spot changes that break Xen on ARM early on. Signed-off-by: Stefano Stabellini Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit f1db0050483cd3d63bb7b2e8c8a772501d52031b Author: Bartlomiej Zolnierkiewicz Date: Tue Oct 16 16:33:58 2018 +0200 xen: remove redundant 'default n' from Kconfig 'default n' is the default value for any bool or tristate Kconfig setting so there is no need to write it explicitly. Also since commit f467c5640c29 ("kconfig: only write '# CONFIG_FOO is not set' for visible symbols") the Kconfig behavior is the same regardless of 'default n' being present or not: ... One side effect of (and the main motivation for) this change is making the following two definitions behave exactly the same: config FOO bool config FOO bool default n With this change, neither of these will generate a '# CONFIG_FOO is not set' line (assuming FOO isn't selected/implied). That might make it clearer to people that a bare 'default n' is redundant. ... Signed-off-by: Bartlomiej Zolnierkiewicz Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross commit 217188d9f985bd3ce8c9a0cd50ca35be62d0f8c6 Author: Bartlomiej Zolnierkiewicz Date: Wed Oct 24 11:26:32 2018 +0200 video: fbdev: remove redundant 'default n' from Kconfig-s 'default n' is the default value for any bool or tristate Kconfig setting so there is no need to write it explicitly. Also since commit f467c5640c29 ("kconfig: only write '# CONFIG_FOO is not set' for visible symbols") the Kconfig behavior is the same regardless of 'default n' being present or not: ... One side effect of (and the main motivation for) this change is making the following two definitions behave exactly the same: config FOO bool config FOO bool default n With this change, neither of these will generate a '# CONFIG_FOO is not set' line (assuming FOO isn't selected/implied). That might make it clearer to people that a bare 'default n' is redundant. ... Acked-by: Randy Dunlap Signed-off-by: Bartlomiej Zolnierkiewicz commit ca6d73f97f92167dedfc31740606c99045df85c9 Author: Bartlomiej Zolnierkiewicz Date: Wed Oct 24 11:26:32 2018 +0200 video: fbdev: remove dead old CLPS711x LCD support driver Since commit c86f51737f8d ("ARM: clps711x: Switch to MULTIPLATFORM") ARCH_CLPS711X depends on ARCH_MULTIPLATFORM to be enabled so the old CLPS711x LCD support driver (enabled by the FB_CLPS711X_OLD config option) can't be selected any longer. Remove all FB_CLPS711XX_OLD code as it has been dead for over 2 years now. Please note that the new CLPS711x LCD support driver (enabled by the FB_CLPS711X config option) is still available in the kernel tree. Reviewed-by: Alexander Shiyan Signed-off-by: Bartlomiej Zolnierkiewicz commit 3aa6c19d2f38be9c6e9a8ad5fa8e3c9d29ee3c35 Author: Boris Ostrovsky Date: Sun Oct 7 16:05:38 2018 -0400 xen/balloon: Support xend-based toolstack Xend-based toolstacks don't have static-max entry in xenstore. The equivalent node for those toolstacks is memory_static_max. Fixes: 5266b8e4445c (xen: fix booting ballooned down hvm guest) Signed-off-by: Boris Ostrovsky Cc: # 4.13 Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross commit 7deecbda3026f5e2a8cc095d7ef7261a920efcf2 Author: Roger Pau Monne Date: Tue Oct 9 12:32:37 2018 +0200 xen/pvh: increase early stack size While booting on an AMD EPYC box the stack canary would detect stack overflows when using the current PVH early stack size (256). Switch to using the value defined by BOOT_STACK_SIZE, which prevents the stack overflow. Cc: # 4.11 Signed-off-by: Roger Pau Monné Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross commit a856531951dc8094359dfdac21d59cee5969c18e Author: Juergen Gross Date: Mon Oct 1 07:57:42 2018 +0200 xen: make xen_qlock_wait() nestable xen_qlock_wait() isn't safe for nested calls due to interrupts. A call of xen_qlock_kick() might be ignored in case a deeper nesting level was active right before the call of xen_poll_irq(): CPU 1: CPU 2: spin_lock(lock1) spin_lock(lock1) -> xen_qlock_wait() -> xen_clear_irq_pending() Interrupt happens spin_unlock(lock1) -> xen_qlock_kick(CPU 2) spin_lock_irqsave(lock2) spin_lock_irqsave(lock2) -> xen_qlock_wait() -> xen_clear_irq_pending() clears kick for lock1 -> xen_poll_irq() spin_unlock_irq_restore(lock2) -> xen_qlock_kick(CPU 2) wakes up spin_unlock_irq_restore(lock2) IRET resumes in xen_qlock_wait() -> xen_poll_irq() never wakes up The solution is to disable interrupts in xen_qlock_wait() and not to poll for the irq in case xen_qlock_wait() is called in nmi context. Cc: stable@vger.kernel.org Cc: Waiman.Long@hp.com Cc: peterz@infradead.org Signed-off-by: Juergen Gross Reviewed-by: Jan Beulich Signed-off-by: Juergen Gross commit 2ac2a7d4d9ff4e01e36f9c3d116582f6f655ab47 Author: Juergen Gross Date: Mon Oct 1 07:57:42 2018 +0200 xen: fix race in xen_qlock_wait() In the following situation a vcpu waiting for a lock might not be woken up from xen_poll_irq(): CPU 1: CPU 2: CPU 3: takes a spinlock tries to get lock -> xen_qlock_wait() frees the lock -> xen_qlock_kick(cpu2) -> xen_clear_irq_pending() takes lock again tries to get lock -> *lock = _Q_SLOW_VAL -> *lock == _Q_SLOW_VAL ? -> xen_poll_irq() frees the lock -> xen_qlock_kick(cpu3) And cpu 2 will sleep forever. This can be avoided easily by modifying xen_qlock_wait() to call xen_poll_irq() only if the related irq was not pending and to call xen_clear_irq_pending() only if it was pending. Cc: stable@vger.kernel.org Cc: Waiman.Long@hp.com Cc: peterz@infradead.org Signed-off-by: Juergen Gross Reviewed-by: Jan Beulich Signed-off-by: Juergen Gross commit af320de90ec864bb78fdbc9c0c3e99f28d1aab0f Author: Geert Uytterhoeven Date: Wed Sep 26 10:43:13 2018 +0200 xen/balloon: Grammar s/Is it/It is/ Signed-off-by: Geert Uytterhoeven Signed-off-by: Juergen Gross commit ea9e57d06e48239e19f67769703aa48554f6648b Author: Jason Andryuk Date: Tue Sep 25 07:36:55 2018 -0400 xen: Make XEN_BACKEND selectable by DomU XEN_BACKEND doesn't actually depend on XEN_DOM0. DomUs can serve backends to other DomUs. One example is a service VM providing network backends. The original Kconfig defaulted Dom0 to y and it could be disabled. DomU could not select the option. With the new Kconfig, we default y for Dom0 and n for DomU. Either can then toggle the selection. Signed-off-by: Jason Andryuk Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross commit 71f021cf6de822ac49a790509683fbb4a06ce4bf Merge: 4b4447bfadd0 cc832dc8e327 Author: Vinod Koul Date: Wed Oct 24 09:16:33 2018 +0100 Merge branch 'topic/stm' into for-linus commit 4b4447bfadd0e12aa975c45d953ef6c34eb2e5cd Merge: 8e75ab9bd835 4ac695464763 Author: Vinod Koul Date: Wed Oct 24 09:16:27 2018 +0100 Merge branch 'topic/sprd' into for-linus commit 8e75ab9bd835bd29bc9f3a587d8e2799009d301a Merge: bfda90208708 97d49c59e219 Author: Vinod Koul Date: Wed Oct 24 09:16:22 2018 +0100 Merge branch 'topic/renesas' into for-linus commit bfda9020870824c497c674901142f836c199dde9 Merge: 4fa7393bda7b a3e403161fe1 Author: Vinod Koul Date: Wed Oct 24 09:16:18 2018 +0100 Merge branch 'topic/owl' into for-linus commit 4fa7393bda7b558f8ff546ebad51a445da86cd58 Merge: ca36ed0c4547 5ab64902b5f9 Author: Vinod Koul Date: Wed Oct 24 09:16:14 2018 +0100 Merge branch 'topic/of' into for-linus commit ca36ed0c4547e954f8cac9dfc5a647fb4dbd243c Merge: 81c3ee027e5d cbc229a47c82 Author: Vinod Koul Date: Wed Oct 24 09:16:08 2018 +0100 Merge branch 'topic/mv' into for-linus commit 81c3ee027e5d79eb184d2b225a67b06e9e5b9271 Merge: b29cf44398a9 d426c517a742 Author: Vinod Koul Date: Wed Oct 24 09:16:04 2018 +0100 Merge branch 'topic/jz' into for-linus commit b29cf44398a93ae6ea9122f9b722faad0d280981 Merge: 9b01029dc093 f4d34aa8c887 Author: Vinod Koul Date: Wed Oct 24 09:15:59 2018 +0100 Merge branch 'topic/intel' into for-linus commit 9b01029dc093262c6ad7fde6940916f154168496 Merge: 11b73fcf3a3a 0e819e3564c0 Author: Vinod Koul Date: Wed Oct 24 09:15:52 2018 +0100 Merge branch 'topic/fsl' into for-linus commit 11b73fcf3a3aee7f70dc48eb4fb471a938dbf55e Merge: b8bb45cbb387 5658f4f94cca Author: Vinod Koul Date: Wed Oct 24 09:15:48 2018 +0100 Merge branch 'topic/dw' into for-linus commit b8bb45cbb3873f38715471726530eedf39a13ac7 Merge: edc329fbb8de a436ff1e96b9 Author: Vinod Koul Date: Wed Oct 24 09:15:43 2018 +0100 Merge branch 'topic/dmam' into for-linus commit edc329fbb8de57afd144632cdb0749c7da27810a Merge: e1b5c26e254a 314448f0386f Author: Vinod Koul Date: Wed Oct 24 09:15:37 2018 +0100 Merge branch 'topic/dirn_remove' into for-linus commit e1b5c26e254af3f4f59cdddb91c21b48c2c34b2c Merge: 27d8d2d7a9b7 d8570d018f69 Author: Vinod Koul Date: Wed Oct 24 09:15:32 2018 +0100 Merge branch 'topic/at' into for-linus commit a978a5b8d83f795e107a2ff759b28643739be70e Author: Linus Torvalds Date: Wed Oct 24 08:11:35 2018 +0100 net/kconfig: Make QCOM_QMI_HELPERS available when COMPILE_TEST The networking merge brought in the experimental support for the Qualcomm ath10k system NOC, which selects QCOM_QMI_HELPERS as a dependency. But the ATH10K_SNOC option (which selects QCOM_QMI_HELPERS) depends on ARCH_QCOM || COMPILE_TEST in order to get wider build testing than just the unusual QCOM architecture build, while the QCOM_QMI_HELPERS option doesn't have that COMPILE_TEST option and is limited to only ARCH_QCOM. As a result, a "make allmodconfig" complains WARNING: unmet direct dependencies detected for QCOM_QMI_HELPERS Depends on [n]: ARCH_QCOM && NET [=y] Selected by [m]: - ATH10K_SNOC [=m] && NETDEVICES [=y] && WLAN [=y] && WLAN_VENDOR_ATH [=y] && ATH10K [=m] && (ARCH_QCOM || COMPILE_TEST [=y]) Fix the config-time warning by making QCOM_QMI_HELPERS available when COMPILE_TEST, since the result seems to build fine. Cc: Bjorn Andersson Cc: Govind Singh Cc: Kalle Valo Cc: David Miller Signed-off-by: Linus Torvalds commit 50b825d7e87f4cff7070df6eb26390152bb29537 Merge: a97a2d4d56ea 3f80e08f40cd Author: Linus Torvalds Date: Wed Oct 24 06:47:44 2018 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next Pull networking updates from David Miller: 1) Add VF IPSEC offload support in ixgbe, from Shannon Nelson. 2) Add zero-copy AF_XDP support to i40e, from Björn Töpel. 3) All in-tree drivers are converted to {g,s}et_link_ksettings() so we can get rid of the {g,s}et_settings ethtool callbacks, from Michal Kubecek. 4) Add software timestamping to veth driver, from Michael Walle. 5) More work to make packet classifiers and actions lockless, from Vlad Buslov. 6) Support sticky FDB entries in bridge, from Nikolay Aleksandrov. 7) Add ipv6 version of IP_MULTICAST_ALL sockopt, from Andre Naujoks. 8) Support batching of XDP buffers in vhost_net, from Jason Wang. 9) Add flow dissector BPF hook, from Petar Penkov. 10) i40e vf --> generic iavf conversion, from Jesse Brandeburg. 11) Add NLA_REJECT netlink attribute policy type, to signal when users provide attributes in situations which don't make sense. From Johannes Berg. 12) Switch TCP and fair-queue scheduler over to earliest departure time model. From Eric Dumazet. 13) Improve guest receive performance by doing rx busy polling in tx path of vhost networking driver, from Tonghao Zhang. 14) Add per-cgroup local storage to bpf 15) Add reference tracking to BPF, from Joe Stringer. The verifier can now make sure that references taken to objects are properly released by the program. 16) Support in-place encryption in TLS, from Vakul Garg. 17) Add new taprio packet scheduler, from Vinicius Costa Gomes. 18) Lots of selftests additions, too numerous to mention one by one here but all of which are very much appreciated. 19) Support offloading of eBPF programs containing BPF to BPF calls in nfp driver, frm Quentin Monnet. 20) Move dpaa2_ptp driver out of staging, from Yangbo Lu. 21) Lots of u32 classifier cleanups and simplifications, from Al Viro. 22) Add new strict versions of netlink message parsers, and enable them for some situations. From David Ahern. 23) Evict neighbour entries on carrier down, also from David Ahern. 24) Support BPF sk_msg verdict programs with kTLS, from Daniel Borkmann and John Fastabend. 25) Add support for filtering route dumps, from David Ahern. 26) New igc Intel driver for 2.5G parts, from Sasha Neftin et al. 27) Allow vxlan enslavement to bridges in mlxsw driver, from Ido Schimmel. 28) Add queue and stack map types to eBPF, from Mauricio Vasquez B. 29) Add back byte-queue-limit support to r8169, with all the bug fixes in other areas of the driver it works now! From Florian Westphal and Heiner Kallweit. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (2147 commits) tcp: add tcp_reset_xmit_timer() helper qed: Fix static checker warning Revert "be2net: remove desc field from be_eq_obj" Revert "net: simplify sock_poll_wait" net: socionext: Reset tx queue in ndo_stop net: socionext: Add dummy PHY register read in phy_write() net: socionext: Stop PHY before resetting netsec net: stmmac: Set OWN bit for jumbo frames arm64: dts: stratix10: Support Ethernet Jumbo frame tls: Add maintainers net: ethernet: ti: cpsw: unsync mcast entries while switch promisc mode octeontx2-af: Support for NIXLF's UCAST/PROMISC/ALLMULTI modes octeontx2-af: Support for setting MAC address octeontx2-af: Support for changing RSS algorithm octeontx2-af: NIX Rx flowkey configuration for RSS octeontx2-af: Install ucast and bcast pkt forwarding rules octeontx2-af: Add LMAC channel info to NIXLF_ALLOC response octeontx2-af: NPC MCAM and LDATA extract minimal configuration octeontx2-af: Enable packet length and csum validation octeontx2-af: Support for VTAG strip and capture ... commit a97a2d4d56ea596871b739d63d41b084733bd9fb Merge: 44786880df19 8dbc450f76dc Author: Linus Torvalds Date: Wed Oct 24 06:42:00 2018 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc Pull sparc updates from David Miller: "Mostly VDSO cleanups and optimizations" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: sparc: Several small VDSO vclock_gettime.c improvements. sparc: Validate VDSO for undefined symbols. sparc: Really use linker with LDFLAGS. sparc: Improve VDSO CFLAGS. sparc: Set DISABLE_BRANCH_PROFILING in VDSO CFLAGS. sparc: Don't bother masking out TICK_PRIV_BIT in VDSO code. sparc: Inline VDSO gettime code aggressively. sparc: Improve VDSO instruction patching. sparc: Fix parport build warnings. commit 3f80e08f40cdb308589a49077c87632fa4508b21 Author: Eric Dumazet Date: Tue Oct 23 11:54:16 2018 -0700 tcp: add tcp_reset_xmit_timer() helper With EDT model, SRTT no longer is inflated by pacing delays. This means that RTO and some other xmit timers might be setup incorrectly. This is particularly visible with either : - Very small enforced pacing rates (SO_MAX_PACING_RATE) - Reduced rto (from the default 200 ms) This can lead to TCP flows aborts in the worst case, or spurious retransmits in other cases. For example, this session gets far more throughput than the requested 80kbit : $ netperf -H 127.0.0.2 -l 100 -- -q 10000 MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 127.0.0.2 () port 0 AF_INET Recv Send Send Socket Socket Message Elapsed Size Size Size Time Throughput bytes bytes bytes secs. 10^6bits/sec 540000 262144 262144 104.00 2.66 With the fix : $ netperf -H 127.0.0.2 -l 100 -- -q 10000 MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 127.0.0.2 () port 0 AF_INET Recv Send Send Socket Socket Message Elapsed Size Size Size Time Throughput bytes bytes bytes secs. 10^6bits/sec 540000 262144 262144 104.00 0.12 EDT allows for better control of rtx timers, since TCP has a better idea of the earliest departure time of each skb in the rtx queue. We only have to eventually add to the timer the difference of the EDT time with current time. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 35a908072311b8efce8467161ea870cd410a1d68 Author: Steve French Date: Fri Oct 19 21:21:37 2018 -0500 smb3 - clean up debug output displaying network interfaces Make the output of /proc/fs/cifs/DebugData a little easier to read by cleaning up the listing of network interfaces removing a wasted line break. Here is a comparison of the network interface information that from be viewed at the end of output from "cat /proc/fs/cifs/DebugData" Before: Server interfaces: 8 0) Speed: 10000000000 bps Capabilities: rss IPv6: fe80:0000:0000:0000:2cf5:407e:84b0:21dd 1) Speed: 1000000000 bps Capabilities: IPv6: fe80:0000:0000:0000:61cd:6147:3d0c:f484 vs. after: Server interfaces: 11 0) Speed: 10000000000 bps Capabilities: rss IPv6: fe80:0000:0000:0000:2cf5:407e:84b0:21dd 1) Speed: 2000000000 bps Capabilities: IPv6: fe80:0000:0000:0000:3d76:2d05:dcf8:ed10 Signed-off-by: Steve French commit fae8044c03c3c03e06b384a6122b78a6c3a0b6a7 Author: Steve French Date: Fri Oct 19 17:14:32 2018 -0500 smb3: show number of current open files in /proc/fs/cifs/Stats To allow better debugging (for example applications with handle leaks, or complex reconnect scenarios) display the number of open files (on the client) and number of open server file handles for each tcon in /proc/fs/cifs/Stats. Note that open files on server is one larger than local due to handle caching (in this case of the root of the share). In this example there are two local open files, and three (two file and one directory handle) open on the server. Sample output: $ cat /proc/fs/cifs/Stats Resources in use CIFS Session: 1 Share (unique mount targets): 2 SMB Request/Response Buffer: 1 Pool size: 5 SMB Small Req/Resp Buffer: 1 Pool size: 30 Operations (MIDs): 0 0 session 0 share reconnects Total vfs operations: 36 maximum at one time: 2 1) \\localhost\test SMBs: 69 Bytes read: 27 Bytes written: 0 Open files: 2 total (local), 3 open on server TreeConnects: 1 total 0 failed TreeDisconnects: 0 total 0 failed Creates: 19 total 0 failed Closes: 16 total 0 failed ... Signed-off-by: Steve French commit 8d8b26e58432cb2840048b9f8aea286be6f75de5 Author: Ronnie Sahlberg Date: Wed Oct 17 05:47:58 2018 +1000 cifs: add support for ioctl on directories We do not call cifs_open_file() for directories and thus we do not have a pSMBFile we can extract the FIDs from. Solve this by instead always using a compounded open/query/close for the passthrough ioctl. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit 3b7960caceafdfc2cdfe2850487f8d091eb41144 Author: Steve French Date: Fri Oct 19 01:58:22 2018 -0500 cifs: fallback to older infolevels on findfirst queryinfo retry In cases where queryinfo fails, we have cases in cifs (vers=1.0) where with backupuid mounts we retry the query info with findfirst. This doesn't work to some NetApp servers which don't support WindowsXP (and later) infolevel 261 (SMB_FIND_FILE_ID_FULL_DIR_INFO) so in this case use other info levels (in this case it will usually be level 257, SMB_FIND_FILE_DIRECTORY_INFO). (Also fixes some indentation) See kernel bugzilla 201435 Signed-off-by: Steve French commit 1e77a8c204c9d1b655c61751b8ad0fde22421dbb Author: Steve French Date: Fri Oct 19 00:45:21 2018 -0500 smb3: do not attempt cifs operation in smb3 query info error path If backupuid mount option is sent, we can incorrectly retry (on access denied on query info) with a cifs (FindFirst) operation on an smb3 mount which causes the server to force the session close. We set backup intent on open so no need for this fallback. See kernel bugzilla 201435 Signed-off-by: Steve French CC: Stable Reviewed-by: Ronnie Sahlberg commit 61351d6d54e651ec4098445afa5ddc2092c4741a Author: Steve French Date: Fri Oct 19 00:32:41 2018 -0500 smb3: send backup intent on compounded query info When mounting with backupuid set, we should be setting CREATE_OPEN_BACKUP_INTENT flag on compounded opens as well, especially the case of compounded smb2_query_path_info. Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg commit 0cb012d1a0a9ead759112da141698a2078fbf2ce Author: Steve French Date: Thu Oct 11 01:01:02 2018 -0500 cifs: track writepages in vfs operation counters writepages and readpages operations did not call get/free_xid so the statistics for file copy could get confusing with "vfs operations" not increasing. Add get_xid and free_xid to cifs readpages and writepages functions. Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg commit f70556c8cae976e50ba9c27dd4c1a86b57efc17d Author: Gustavo A. R. Silva Date: Wed Oct 10 00:02:20 2018 +0200 smb2: fix uninitialized variable bug in smb2_ioctl_query_info There is a potential execution path in which variable *resp_buftype* is passed as an argument to function free_rsp_buf(), in which it is used in a comparison without being properly initialized previously. Fix this by initializing variable *resp_buftype* to CIFS_NO_BUFFER in order to avoid unpredictable or unintended results. Addresses-Coverity-ID: 1473971 ("Uninitialized scalar variable") Fixes: c5d25bdb2967 ("cifs: add IOCTL for QUERY_INFO passthrough to userspace") Signed-off-by: Gustavo A. R. Silva Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg commit f5b05d622a3e99e6a97a189fe500414be802a05c Author: Ronnie Sahlberg Date: Sun Oct 7 19:19:58 2018 -0500 cifs: add IOCTL for QUERY_INFO passthrough to userspace This allows userspace tools to query the raw info levels for cifs files and process the response in userspace. In particular this is useful for many of those data where there is no corresponding native data structure in linux. For example querying the security descriptor for a file and extract the SIDs. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit 8c1beb9801293b175cfa0341e5df89581a87dc02 Author: Steve French Date: Sun Oct 7 13:52:18 2018 -0500 cifs: minor clarification in comments Clarify meaning (in comments) meaning of various options for debug messages in cifs.ko. Also fixed trivial formatting/style issue with previous patch. Signed-off-by: Steve French commit f80eaedd6c5978fdd31549446cfa4a7212522b8d Author: Rodrigo Freire Date: Sun Oct 7 12:21:26 2018 -0300 CIFS: Print message when attempting a mount Currently, no messages are printed when mounting a CIFS filesystem and no debug configuration is enabled. However, a CIFS mount information is valuable when troubleshooting and/or forensic analyzing a system and finding out if was a CIFS endpoint mount attempted. Other filesystems such as XFS, EXT* does issue a printk() when mounting their filesystems. A terse log message is printed only if cifsFYI is not enabled. Otherwise, the default full debug message is printed. In order to not clutter and classify correctly the event messages, these are logged as KERN_INFO level. Sample mount operations: [root@corinthians ~]# mount -o user=administrator //172.25.250.18/c$ /mnt (non-existent system) [root@corinthians ~]# mount -o user=administrator //172.25.250.19/c$ /mnt (Valid system) Kernel message log for the mount operations: [ 450.464543] CIFS: Attempting to mount //172.25.250.18/c$ [ 456.478186] CIFS VFS: Error connecting to socket. Aborting operation. [ 456.478381] CIFS VFS: cifs_mount failed w/return code = -113 [ 467.688866] CIFS: Attempting to mount //172.25.250.19/c$ Signed-off-by: Rodrigo Freire Signed-off-by: Steve French commit 9a0efeccfa7ea6a82585bb2def161de006396b7d Author: Rodrigo Freire Date: Sun Oct 7 12:21:25 2018 -0300 CIFS: Adds information-level logging function Currently, CIFS lacks a internal logging function that prints out data when CIFS_DEBUG=n. When CIFS_DEBUG=y, the only message level for CIFS events are KERN_ERR or KERN_DEBUG. This patch creates cifs_info(), which is useful for printing non-critical event messges, at either CIFS_DEBUG state. Signed-off-by: Rodrigo Freire Signed-off-by: Steve French commit 9645759ce6b39013231f4fa312834935c93fe5bc Author: Ronnie Sahlberg Date: Thu Oct 4 09:24:38 2018 +1000 cifs: OFD locks do not conflict with eachothers RHBZ 1484130 Update cifs_find_fid_lock_conflict() to recognize that ODF locks do not conflict with eachother. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit ff526d86051f3689fe41e235ab962389d43999a9 Author: Long Li Date: Thu Sep 20 21:18:39 2018 +0000 CIFS: SMBD: Do not call ib_dereg_mr on invalidated memory registration It is not necessary to deregister a memory registration after it has been successfully invalidated. Signed-off-by: Long Li Signed-off-by: Steve French commit 6d3adb23becb7b14995f6171c1d9f7f3baab1c79 Author: Long Li Date: Thu Sep 20 21:18:38 2018 +0000 CIFS: pass page offsets on SMB1 read/write When issuing SMB1 read/write, pass the page offset to transport. Signed-off-by: Long Li Signed-off-by: Steve French commit ef2298a06d012973bbc592b86fe5ff730d4d0c63 Author: Garry McNulty Date: Wed Oct 3 20:51:21 2018 +0100 fs/cifs: fix uninitialised variable warnings In some error conditions, resp_buftype can be passed uninitialised to free_rsp_buf(), potentially resulting in a spurious debug message. If resp_buftype randomly had the value 1 (CIFS_SMALL_BUFFER) then this would log a debug message. The rsp pointer is initialised to NULL so there is no other side-effect. Detected by CoverityScan, CID 1438585 ("Uninitialized scalar variable") Detected by CoverityScan, CID 1438667 ("Uninitialized scalar variable") Detected by CoverityScan, CID 1438764 ("Uninitialized scalar variable") Signed-off-by: Garry McNulty Signed-off-by: Steve French Reviewed-by: Aurelien Aptel commit 179e44d49c2f6f4e90479f0a98d896e415742c96 Author: Steve French Date: Fri Sep 28 19:44:23 2018 -0500 smb3: add tracepoint for sending lease break responses to server Be able to log a ftrace message on success and/or failure of sending a lease break response to the server. Example output: TASK-PID CPU# |||| TIMESTAMP FUNCTION | | | |||| | | kworker/1:1-5681 [001] .... 11123.530457: smb3_lease_done: sid=0x291e3e0f tid=0x8ba43071 lease_key=0x1852ca0d3ecd9b55847750a86716fde lease_state=0x0 Signed-off-by: Steve French Reviewed-by: Aurelien Aptel commit 9b9c5bea0b960616d638711d0ecc270c3a074e7f Author: Steve French Date: Sat Sep 22 12:07:06 2018 -0500 cifs: do not return atime less than mtime In network file system it is fairly easy for server and client atime vs. mtime to get confused (and atime updated less frequently) which we noticed broke some apps which expect atime >= mtime Also ignore relatime mount option (rather than error on it) since relatime is basically what some network server fs are doing (relatime). Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg commit 3d621230b8a0c6616f32b86ec3f0bc3ead9eb5b8 Author: Steve French Date: Tue Sep 25 15:33:47 2018 -0500 smb3: update default requested iosize to 4MB from 1MB for recent dialects Modern servers often support 8MB as maximum i/o size, and we see some performance benefits (my testing showed 1 to 13% on write paths, and 1 to 3% on read paths for increasing the default to 4MB). If server doesn't support larger i/o size, during negotiate protocol it is already set correctly to the server's maximum if lower than 4MB. Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg commit 6e4d3bbe92120f8482d31e4138e5fc2983caec3e Author: Steve French Date: Sat Sep 22 11:25:04 2018 -0500 smb3: Add debug message later in smb2/smb3 reconnect path As we reset credits later in the reconnect path, useful to have optional (cifsFYI) debug message. Signed-off-by: Steve French Reviewed-by: Pavel Shilovsky commit 8393072bab060f0a05888ee31543175d44b5dde0 Author: Aurelien Aptel Date: Thu Sep 20 18:10:25 2018 -0700 CIFS: make 'nodfs' mount opt a superblock flag tcon->Flags is only used by SMB1 code and changing it is not permanent (you lose the setting on tcon reconnect). * Move the setting to superblock flags (per mount-points). * Make automount callback exit early when flag present * Make dfs resolving happening in mount syscall exit early if flag present Signed-off-by: Aurelien Aptel Signed-off-by: Steve French Acked-by: Pavel Shilovsky commit 9e1a37dad4f3b9f1d36d9fd27021bbd67fb8c85f Author: Steve French Date: Wed Sep 19 02:38:17 2018 -0500 smb3: track the instance of each session for debugging Each time we reconnect to the same server, bump an instance counter (and display in /proc/fs/cifs/DebugData) to make it easier to debug. Signed-off-by: Steve French Reviewed-by: Aurelien Aptel Reviewed-by: Pavel Shilovsky commit 37e6a7057607121485099e405eb528d416a5ced4 Author: Steve French Date: Wed Sep 19 02:02:58 2018 -0500 smb3: minor missing defines relating to reparse points Previously reserved dpen response field changed in smb3 Signed-off-by: Steve French Reviewed-by: Aurelien Aptel commit 00778e2294d560361e2ed4e94cc003351a2d82d9 Author: Steve French Date: Tue Sep 18 14:05:18 2018 -0500 smb3: add way to control slow response threshold for logging and stats /proc/fs/cifs/Stats when CONFIG_CIFS_STATS2 is enabled logs 'slow' responses, but depending on the server you are debugging a one second timeout may be too fast, so allow setting it to a larger number of seconds via new module parameter /sys/module/cifs/parameters/slow_rsp_threshold or via modprobe: slow_rsp_threshold:Amount of time (in seconds) to wait before logging that a response is delayed. Default: 1 (if set to 0 disables msg). (uint) Recommended values are 0 (disabled) to 32767 (9 hours) with the default remaining as 1 second. Signed-off-by: Steve French Reviewed-by: Aurelien Aptel commit 1c3a13a38a28c6ed84ff9220c1b8dadf5fbcf8a5 Author: Steve French Date: Tue Sep 18 04:07:45 2018 -0500 cifs: minor updates to module description for cifs.ko note smb3 (and common more modern servers) in the module description Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg commit 5a519bead49938aa0e3086bc753930d610fbd705 Author: Steve French Date: Sat Sep 15 14:07:09 2018 -0500 cifs: protect against server returning invalid file system block size For a network file system we generally prefer large i/o, but if the server returns invalid file system block/sector sizes in cifs (vers=1.0) QFSInfo then set block size to a default of a reasonable minimum (4K). Reported-by: Dan Carpenter Signed-off-by: Steve French Reviewed-by: Aurelien Aptel commit 2c887635cd6ab3af619dc2be94e5bf8f2e172b78 Author: Steve French Date: Sat Sep 15 23:04:41 2018 -0500 smb3: allow stats which track session and share reconnects to be reset Currently, "echo 0 > /proc/fs/cifs/Stats" resets all of the stats except the session and share reconnect counts. Fix it to reset those as well. CC: Stable Signed-off-by: Steve French Reviewed-by: Aurelien Aptel commit 4d5bdf28690a304e089ce750efc8b7dd718945c7 Author: Steve French Date: Tue Aug 28 16:14:21 2018 -0500 SMB3: Backup intent flag missing from compounded ops When "backup intent" is requested on the mount (e.g. backupuid or backupgid mount options), the corresponding flag was missing from some of the new compounding operations as well (now that open_query_close is gone). Related to kernel bugzilla #200953 Reported-and-tested-by: Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg commit 14e562ada2b152cdeb49a1aec40fac402d19f3ce Author: Ronnie Sahlberg Date: Mon Sep 3 13:33:50 2018 +1000 cifs: create a define for the max number of iov we need for a SMB2 set_info So we don't overflow the io vector arrays accidentally Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit bb435512cec806a8e4e1af2700a7a7848baed0b5 Author: Ronnie Sahlberg Date: Mon Sep 3 13:33:49 2018 +1000 cifs: change SMB2_OP_RENAME and SMB2_OP_HARDLINK to use compounding Get rid of smb2_open_op_close() as all operations are now migrated to smb2_compound_op(). Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit 3764cbd179f061ddb308cd58c1e9bbf987505a18 Author: Ronnie Sahlberg Date: Mon Sep 3 13:33:47 2018 +1000 cifs: remove the is_falloc argument to SMB2_set_eof We never pass is_falloc==true here anyway and if we ever need to support is_falloc in the future, SMB2_set_eof is such a trivial wrapper around send_set_info() that we can/should just create a differently named wrapper for that new functionality. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit dcbf91035709e9b8490bba96995998f48ce85947 Author: Ronnie Sahlberg Date: Mon Sep 3 13:33:48 2018 +1000 cifs: change SMB2_OP_SET_INFO to use compounding Cuts number of network roundtrips significantly for some common syscalls Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit f7bfe04bf0dbc422cbb3d5cffe1601518116dad6 Author: Ronnie Sahlberg Date: Mon Sep 3 13:33:46 2018 +1000 cifs: change SMB2_OP_SET_EOF to use compounding This changes SMB2_OP_SET_EOF to use compounding in some situations. This is part of the path based API to truncate a file. Most of the time this will however not be invoked for SMB2 since cifs_set_file_size() will as far as I can tell almost always just open the file synchronously and switch to the handle based truncate code path, thus bypassing the compounding we add here. Rewriting cifs_set_file_size() and make that whole pile of code more compounding friendly, and also easier to read and understand, is a different project though and not for this patch. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit c2e0fe3f5aae1f70a1ab402778819d2cacbaefa6 Author: Ronnie Sahlberg Date: Mon Sep 3 13:33:45 2018 +1000 cifs: make rmdir() use compounding This and previous patches drop the number of roundtrips we need for rmdir() from 6 to 2. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit ba8ca116854abe19893b8287d15c781e73e72405 Author: Ronnie Sahlberg Date: Mon Sep 3 13:33:44 2018 +1000 cifs: create helpers for SMB2_set_info_init/free() so that we can use these later for compounded set-info calls. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit 47dd9597df41f0f5cc6d86cffbbccce2d9e3a788 Author: Ronnie Sahlberg Date: Mon Sep 3 13:33:43 2018 +1000 cifs: change unlink to use a compound This,and previous patches, drops the number of roundtrips from five to two for unlink() Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit f733e3936da462265a155f4dd44a333e56d197ed Author: Ronnie Sahlberg Date: Mon Sep 3 13:33:42 2018 +1000 cifs: change mkdir to use a compound This with the previous patch changes mkdir() from needing 6 roundtrips to just 3. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit c5a5f38f075cf7656a1d7ad2b40cbc19e48e9805 Author: Ronnie Sahlberg Date: Mon Sep 3 13:33:41 2018 +1000 cifs: add a smb2_compound_op and change QUERY_INFO to use it This turns most open/query-info/close patterns in cifs.ko to become compounds. This changes stat from using 3 roundtrips to just a single one. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit cb5c2e63948451d38c977685fffc06e23beb4517 Author: Ronnie Sahlberg Date: Wed Oct 10 15:29:06 2018 +1000 cifs: fix a credits leak for compund commands When processing the mids for compounds we would only add credits based on the last successful mid in the compound which would leak credits and eventually triggering a re-connect. Fix this by splitting the mid processing part into two loops instead of one where the first loop just waits for all mids and then counts how many credits we were granted for the whole compound. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit b340a4d4aa18691a6d8b0e747840b0cf30dc01cb Author: Steve French Date: Sat Sep 1 01:10:17 2018 -0500 smb3: add tracepoint to catch cases where credit refund of failed op overlaps reconnect Add tracepoint to catch potential cases where a pending operation overlapping a reconnect could fail and incorrectly refund its credits causing the client to think it has more credits available than the server thinks it does. Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg commit ce7fb50f92d78cf9cd35a520d293a4b791c8d7a1 Author: YueHaibing Date: Thu Sep 6 01:50:43 2018 +0000 cifs: remove set but not used variable 'cifs_sb' Fixes gcc '-Wunused-but-set-variable' warning: fs/cifs/ioctl.c: In function 'cifs_ioctl': fs/cifs/ioctl.c:164:23: warning: variable 'cifs_sb' set but not used [-Wunused-but-set-variable] Signed-off-by: YueHaibing Signed-off-by: Steve French commit d034feeb44b8a8fb473f1ba805db97787f54bf3a Author: YueHaibing Date: Mon Sep 10 01:33:06 2018 +0000 cifs: Use kmemdup rather than duplicating its implementation in smb311_posix_mkdir() Use kmemdup rather than duplicating its implementation Signed-off-by: YueHaibing Signed-off-by: Steve French commit d42c8a87d18b7f08325a695d00afa83cad876631 Author: Steve French Date: Thu Sep 13 15:12:34 2018 -0500 smb3: do not display confusing message on mount to Azure servers Some servers (e.g. Azure) return "STATUS_NOT_IMPLEMENTED" rather than "STATUS_INVALID_DEVICE_REQUEST" on query network interface info at mount. This shouldn't cause us to log a warning message automatically. Don't log this unless noisier cifsFYI is enabled. Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg commit 33279c305d071090e529febf043a8a02d2ab451a Author: YueHaibing Date: Sun Oct 21 09:50:54 2018 +0000 scsi: mvsas: Remove set but not used variable 'id' Fixes gcc '-Wunused-but-set-variable' warning: drivers/scsi/mvsas/mv_sas.c: In function 'mvs_work_queue': drivers/scsi/mvsas/mv_sas.c:1909:31: warning: variable 'id' set but not used [-Wunused-but-set-variable] It never used since introduction in commit 20b09c2992fe ("[SCSI] mvsas: add support for 94xx; layout change; bug fixes") Signed-off-by: YueHaibing Reviewed-by: John Garry Signed-off-by: Martin K. Petersen commit 2c309aeed62c25661eb2c7d4e4510613a1c7ffc2 Author: Bart Van Assche Date: Thu Oct 18 15:45:46 2018 -0700 scsi: qla2xxx: Remove two arguments from qlafx00_error_entry() Move a debug statement from qlafx00_error_entry() into its caller. Remove one unused argument from that function. This patch does not change the behavior of the qla2xxx driver. Cc: Himanshu Madhani Signed-off-by: Bart Van Assche Acked-by: Himanshu Madhani Signed-off-by: Martin K. Petersen commit 5b0af4777b1bf397787f03336f0db34f185ca565 Author: Bart Van Assche Date: Thu Oct 18 15:45:45 2018 -0700 scsi: qla2xxx: Make sure that qlafx00_ioctl_iosb_entry() initializes 'res' Only one of the two code paths in qlafx00_ioctl_iosb_entry() initializes the variable 'res'. Make sure that 'res' is initialized before sp->done(sp, res) is called. Cc: Himanshu Madhani Signed-off-by: Bart Van Assche Acked-by: Himanshu Madhani Signed-off-by: Martin K. Petersen commit eb023220f4eac1703e22e48ed62310a6565b3a1f Author: Bart Van Assche Date: Thu Oct 18 15:45:44 2018 -0700 scsi: qla2xxx: Remove a set-but-not-used variable This patch does not change any functionality. Cc: Himanshu Madhani Signed-off-by: Bart Van Assche Acked-by: Himanshu Madhani Signed-off-by: Martin K. Petersen commit 109a5987d9ead316523647d6310d609dc95bdaa2 Author: Bart Van Assche Date: Thu Oct 18 15:45:43 2018 -0700 scsi: qla2xxx: Make qla2x00_sysfs_write_nvram() easier to analyze Modify the unlock statement such that it becomes easier for static analyzers to analyze it. This patch does not change any functionality. Cc: Himanshu Madhani Signed-off-by: Bart Van Assche Acked-by: Himanshu Madhani Signed-off-by: Martin K. Petersen commit 8f9a214823c9806386760b9f8624a376bbcd5232 Author: Bart Van Assche Date: Thu Oct 18 15:45:42 2018 -0700 scsi: qla2xxx: Declare local functions 'static' This patch avoids that the compiler complains about missing declarations when building with W=1. Cc: Himanshu Madhani Signed-off-by: Bart Van Assche Acked-by: Himanshu Madhani Signed-off-by: Martin K. Petersen commit 807eb90703e78c0fb853d8e5b90c9947d7a95cba Author: Bart Van Assche Date: Thu Oct 18 15:45:41 2018 -0700 scsi: qla2xxx: Improve several kernel-doc headers This patch avoids that complaints about kernel-doc headers are reported when building with W=1. Cc: Himanshu Madhani Signed-off-by: Bart Van Assche Acked-by: Himanshu Madhani Signed-off-by: Martin K. Petersen commit 50435d4211a784e1577b4af72b07276c3851d324 Author: Bart Van Assche Date: Thu Oct 18 15:45:40 2018 -0700 scsi: qla2xxx: Modify fall-through annotations This patch avoids that the compiler complains about missing fall-through annotations when building with W=1. Cc: Himanshu Madhani Signed-off-by: Bart Van Assche Acked-by: Himanshu Madhani Signed-off-by: Martin K. Petersen commit 09968e5049b4b9a47413327c56f254aa2812bbc2 Author: Nathan Chancellor Date: Thu Oct 18 14:55:41 2018 -0700 scsi: 3w-sas: 3w-9xxx: Use unsigned char for cdb Clang warns a few times: drivers/scsi/3w-sas.c:386:11: warning: implicit conversion from 'int' to 'char' changes value from 128 to -128 [-Wconstant-conversion] cdb[4] = TW_ALLOCATION_LENGTH; /* allocation length */ ~ ^~~~~~~~~~~~~~~~~~~~ Update cdb's type to unsigned char, which matches the type of the cdb member in struct TW_Command_Apache. Link: https://github.com/ClangBuiltLinux/linux/issues/158 Signed-off-by: Nathan Chancellor Acked-by: Adam Radford Signed-off-by: Martin K. Petersen commit 1b171b1a29d68bcad1e44b0135a5155570efa3ea Author: Sabyasachi Gupta Date: Thu Oct 18 21:36:26 2018 +0530 scsi: mvsas: Use dma_pool_zalloc Replace dma_pool_alloc + memset with dma_pool_zalloc. Signed-off-by: Sabyasachi Gupta Reviewed-by: Jack Wang Signed-off-by: Martin K. Petersen commit 6110f37fb33d54781e1fa841922c466c8b9005cd Author: Roland Dreier Date: Sat Oct 20 09:45:16 2018 -0700 scsi: target: Don't request modules that aren't even built If, for example, I don't enable CONFIG_TCM_PSCSI, then every time I load the target subsystem, I get an annoying Unable to load target_core_pscsi kernel log message. Instead let's only request_module() on things if that code is enabled. Signed-off-by: Roland Dreier Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen commit 7081fb629e434c13f126f191c67ff0c9939d9ef5 Author: Roland Dreier Date: Sat Oct 20 09:45:04 2018 -0700 scsi: target: Set response length for REPORT TARGET PORT GROUPS One more place where we can return the length we actually fill in. Signed-off-by: Roland Dreier Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen commit 3bf0fb6f33dd545693da5e65f5b1b9b9f0bfc35e Author: David Howells Date: Sat Oct 20 00:57:59 2018 +0100 afs: Probe multiple fileservers simultaneously Send probes to all the unprobed fileservers in a fileserver list on all addresses simultaneously in an attempt to find out the fastest route whilst not getting stuck for 20s on any server or address that we don't get a reply from. This alleviates the problem whereby attempting to access a new server can take a long time because the rotation algorithm ends up rotating through all servers and addresses until it finds one that responds. Signed-off-by: David Howells commit 18ac61853cc4e44eb30e125fc8344a3b25c7b6fe Author: David Howells Date: Sat Oct 20 00:57:59 2018 +0100 afs: Fix callback handling In some circumstances, the callback interest pointer is NULL, so in such a case we can't dereference it when checking to see if the callback is broken. This causes an oops in some circumstances. Fix this by replacing the function that worked out the aggregate break counter with one that actually does the comparison, and then make that return true (ie. broken) if there is no callback interest as yet (ie. the pointer is NULL). Fixes: 68251f0a6818 ("afs: Fix whole-volume callback handling") Signed-off-by: David Howells commit 2feeaf8433c8e68de3d0a06a0ffe7742bcd13c1a Author: David Howells Date: Sat Oct 20 00:57:59 2018 +0100 afs: Eliminate the address pointer from the address list cursor Eliminate the address pointer from the address list cursor as it's redundant (ac->addrs[ac->index] can be used to find the same address) and address lists must be replaced rather than being rearranged, so is of limited value. Signed-off-by: David Howells commit 744bcd713a4eabb248246f7deccfad30c579b7f5 Author: David Howells Date: Sat Oct 20 00:57:58 2018 +0100 afs: Allow dumping of server cursor on operation failure Provide an option to allow the file or volume location server cursor to be dumped if the rotation routine falls off the end without managing to contact a server. Signed-off-by: David Howells commit 30062bd13e3659a309d249a06d5f4ebb4a5c5251 Author: David Howells Date: Sat Oct 20 00:57:58 2018 +0100 afs: Implement YFS support in the fs client Implement support for talking to YFS-variant fileservers in the cache manager and the filesystem client. These implement upgraded services on the same port as their AFS services. YFS fileservers provide expanded capabilities over AFS. Signed-off-by: David Howells commit d4936803a92b7d088086b1d7b8ecb5739d52c03b Author: David Howells Date: Sat Oct 20 00:57:58 2018 +0100 afs: Expand data structure fields to support YFS Expand fields in various data structures to support the expanded information that YFS is capable of returning. Signed-off-by: David Howells commit f58db83fd3325a305cf615f4ffb0e6f60745ed8a Author: David Howells Date: Sat Oct 20 00:57:58 2018 +0100 afs: Get the target vnode in afs_rmdir() and get a callback on it Get the target vnode in afs_rmdir() and validate it before we attempt the deletion, The vnode pointer will be passed through to the delivery function in a later patch so that the delivery function can mark it deleted. Signed-off-by: David Howells commit 12d8e95a911eb3921a1fecf1e4d913654f6f4fb5 Author: David Howells Date: Sat Oct 20 00:57:58 2018 +0100 afs: Calc callback expiry in op reply delivery Calculate the callback expiration time at the point of operation reply delivery, using the reply time queried from AF_RXRPC on that call as a base. Signed-off-by: David Howells commit 36bb5f490a542f230beb982475b56d79d72033de Author: David Howells Date: Sat Oct 20 00:57:58 2018 +0100 afs: Fix FS.FetchStatus delivery from updating wrong vnode The FS.FetchStatus reply delivery function was updating inode of the directory in which a lookup had been done with the status of the looked up file. This corrupts some of the directory state. Fixes: 5cf9dd55a0ec ("afs: Prospectively look up extra files when doing a single lookup") Signed-off-by: David Howells commit 35dbfba3111a5ef0663bb89185ce8dfdbef63f8d Author: David Howells Date: Sat Oct 20 00:57:58 2018 +0100 afs: Implement the YFS cache manager service Implement the YFS cache manager service which gives extra capabilities on top of AFS. This is done by listening for an additional service on the same port and indicating that anyone requesting an upgrade should be upgraded to the YFS port. Signed-off-by: David Howells commit 06aeb2971457b33c1123af9f307a55f3dc4052c9 Author: David Howells Date: Sat Oct 20 00:57:58 2018 +0100 afs: Remove callback details from afs_callback_break struct Remove unnecessary details of a broken callback, such as version, expiry and type, from the afs_callback_break struct as they're not actually used and make the list take more memory. Signed-off-by: David Howells commit 0067191201de0d1870ff692368900da5207daf2c Author: David Howells Date: Sat Oct 20 00:57:57 2018 +0100 afs: Commit the status on a new file/dir/symlink Call the function to commit the status on a new file, dir or symlink so that the access rights for the caller's key are cached for that object. Without this, the next access to the file will cause a FetchStatus operation to be emitted to retrieve the access rights. Signed-off-by: David Howells commit 3b6492df4153b8550d347dfc581856138678a231 Author: David Howells Date: Sat Oct 20 00:57:57 2018 +0100 afs: Increase to 64-bit volume ID and 96-bit vnode ID for YFS Increase the sizes of the volume ID to 64 bits and the vnode ID (inode number equivalent) to 96 bits to allow the support of YFS. This requires the iget comparator to check the vnode->fid rather than i_ino and i_generation as i_ino is not sufficiently capacious. It also requires this data to be placed into the vnode cache key for fscache. For the moment, just discard the top 32 bits of the vnode ID when returning it though stat. Signed-off-by: David Howells commit 2a0b4f64c9edcdcb67306f26d9d08ef982cb0ccd Author: David Howells Date: Sat Oct 20 00:57:57 2018 +0100 afs: Don't invoke the server to read data beyond EOF When writing a new page, clear space in the page rather than attempting to load it from the server if the space is beyond the EOF. Signed-off-by: David Howells commit f51375cd9e1ad75e9e38186aa0d3749ade7d52a5 Author: David Howells Date: Sat Oct 20 00:57:57 2018 +0100 afs: Add a couple of tracepoints to log I/O errors Add a couple of tracepoints to log the production of I/O errors within the AFS filesystem. Signed-off-by: David Howells commit 4ac15ea53622272c01954461b4814892b7481b40 Author: David Howells Date: Sat Oct 20 00:57:57 2018 +0100 afs: Handle EIO from delivery function Fix afs_deliver_to_call() to handle -EIO being returned by the operation delivery function, indicating that the call found itself in the wrong state, by printing an error and aborting the call. Currently, an assertion failure will occur. This can happen, say, if the delivery function falls off the end without calling afs_extract_data() with the want_more parameter set to false to collect the end of the Rx phase of a call. The assertion failure looks like: AFS: Assertion failed 4 == 7 is false 0x4 == 0x7 is false ------------[ cut here ]------------ kernel BUG at fs/afs/rxrpc.c:462! and is matched in the trace buffer by a line like: kworker/7:3-3226 [007] ...1 85158.030203: afs_io_error: c=0003be0c r=-5 CM_REPLY Fixes: 98bf40cd99fc ("afs: Protect call->state changes against signals") Reported-by: Marc Dionne Signed-off-by: David Howells commit ded2f4c58ac24083c536aa7d2ff2b73752a88612 Author: David Howells Date: Sat Oct 20 00:57:57 2018 +0100 afs: Fix TTL on VL server and address lists Currently the TTL on VL server and address lists isn't set in all circumstances and may be set to poor choices in others, since the TTL is derived from the SRV/AFSDB DNS record if and when available. Fix the TTL by limiting the range to a minimum and maximum from the current time. At some point these can be made into sysctl knobs. Further, use the TTL we obtained from the upcall to set the expiry on negative results too; in future a mechanism can be added to force reloading of such data. Signed-off-by: David Howells commit 0a5143f2f89cc88d8a3eada8e8ccd86c1e988257 Author: David Howells Date: Sat Oct 20 00:57:57 2018 +0100 afs: Implement VL server rotation Track VL servers as independent entities rather than lumping all their addresses together into one set and implement server-level rotation by: (1) Add the concept of a VL server list, where each server has its own separate address list. This code is similar to the FS server list. (2) Use the DNS resolver to retrieve a set of servers and their associated addresses, ports, preference and weight ratings. (3) In the case of a legacy DNS resolver or an address list given directly through /proc/net/afs/cells, create a list containing just a dummy server record and attach all the addresses to that. (4) Implement a simple rotation policy, for the moment ignoring the priorities and weights assigned to the servers. (5) Show the address list through /proc/net/afs//vlservers. This also displays the source and status of the data as indicated by the upcall. Signed-off-by: David Howells commit e7f680f45bd1deb4ca479c2348b395e1a4d44b17 Author: David Howells Date: Sat Oct 20 00:57:57 2018 +0100 afs: Improve FS server rotation error handling Improve the error handling in FS server rotation by: (1) Cache the latest useful error value for the fs operation as a whole in struct afs_fs_cursor separately from the error cached in the afs_addr_cursor struct. The one in the address cursor gets clobbered occasionally. Copy over the error to the fs operation only when it's something we'd be interested in passing to userspace. (2) Make it so that EDESTADDRREQ is the default that is seen only if no addresses are available to be accessed. (3) When calling utility functions, such as checking a volume status or probing a fileserver, don't let a successful result clobber the cached error in the cursor; instead, stash the result in a temporary variable until it has been assessed. (4) Don't return ETIMEDOUT or ETIME if a better error, such as ENETUNREACH, is already cached. (5) On leaving the rotation loop, turn any remote abort code into a more useful error than ECONNABORTED. Fixes: d2ddc776a458 ("afs: Overhaul volume and server record caching and fileserver rotation") Signed-off-by: David Howells commit 12bdcf333fe13ece2a487a699b1a0f4c5dbb594b Author: David Howells Date: Sat Oct 20 00:57:56 2018 +0100 afs: Set up the iov_iter before calling afs_extract_data() afs_extract_data sets up a temporary iov_iter and passes it to AF_RXRPC each time it is called to describe the remaining buffer to be filled. Instead: (1) Put an iterator in the afs_call struct. (2) Set the iterator for each marshalling stage to load data into the appropriate places. A number of convenience functions are provided to this end (eg. afs_extract_to_buf()). This iterator is then passed to afs_extract_data(). (3) Use the new ITER_DISCARD iterator to discard any excess data provided by FetchData. Signed-off-by: David Howells commit 160cb9574b550426122422444b8f19d614505f81 Author: David Howells Date: Sat Oct 20 00:57:56 2018 +0100 afs: Better tracing of protocol errors Include the site of detection of AFS protocol errors in trace lines to better be able to determine what went wrong. Signed-off-by: David Howells commit 9ea9ce0427aab02a2fd88fc608267cf6952119f1 Author: David Howells Date: Sat Oct 20 00:57:56 2018 +0100 iov_iter: Add I/O discard iterator Add a new iterator, ITER_DISCARD, that can only be used in READ mode and just discards any data copied to it. This is useful in a network filesystem for discarding any unwanted data sent by a server. Signed-off-by: David Howells commit aa563d7bca6e882ec2bdae24603c8f016401a144 Author: David Howells Date: Sat Oct 20 00:57:56 2018 +0100 iov_iter: Separate type from direction and use accessor functions In the iov_iter struct, separate the iterator type from the iterator direction and use accessor functions to access them in most places. Convert a bunch of places to use switch-statements to access them rather then chains of bitwise-AND statements. This makes it easier to add further iterator types. Also, this can be more efficient as to implement a switch of small contiguous integers, the compiler can use ~50% fewer compare instructions than it has to use bitwise-and instructions. Further, cease passing the iterator type into the iterator setup function. The iterator function can set that itself. Only the direction is required. Signed-off-by: David Howells commit 00e23707442a75b404392cef1405ab4fd498de6b Author: David Howells Date: Mon Oct 22 13:07:28 2018 +0100 iov_iter: Use accessor function Use accessor functions to access an iterator's type and direction. This allows for the possibility of using some other method of determining the type of iterator than if-chains with bitwise-AND conditions. Signed-off-by: David Howells commit 1fcb748d187d0c7732a75a509e924ead6d070e04 Author: David Howells Date: Wed Oct 24 00:36:12 2018 +0100 amd-gpu: Don't undefine READ and WRITE Remove the undefinition of READ and WRITE because these constants may be used elsewhere in subsequently included header files, thus breaking them. These constants don't actually appear to be used in the driver, so the undefinition seems pointless. Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)") Signed-off-by: David Howells commit a90e90b7d55e789c71d85b946ffb5c1ab2f137ca Author: Michal Hocko Date: Thu Oct 18 10:56:17 2018 +0200 cgroup, netclassid: add a preemption point to write_classid We have seen a customer complaining about soft lockups on !PREEMPT kernel config with 4.4 based kernel [1072141.435366] NMI watchdog: BUG: soft lockup - CPU#21 stuck for 22s! [systemd:1] [1072141.444090] Modules linked in: mpt3sas raid_class binfmt_misc af_packet 8021q garp mrp stp llc xfs libcrc32c bonding iscsi_ibft iscsi_boot_sysfs msr ext4 crc16 jbd2 mbcache cdc_ether usbnet mii joydev hid_generic usbhid intel_rapl x86_pkg_temp_thermal intel_powerclamp coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel ipmi_ssif mgag200 i2c_algo_bit ttm ipmi_devintf drbg ixgbe drm_kms_helper vxlan ansi_cprng ip6_udp_tunnel drm aesni_intel udp_tunnel aes_x86_64 iTCO_wdt syscopyarea ptp xhci_pci lrw iTCO_vendor_support pps_core gf128mul ehci_pci glue_helper sysfillrect mdio pcspkr sb_edac ablk_helper cryptd ehci_hcd sysimgblt xhci_hcd fb_sys_fops edac_core mei_me lpc_ich ses usbcore enclosure dca mfd_core ipmi_si mei i2c_i801 scsi_transport_sas usb_common ipmi_msghandler shpchp fjes wmi processor button acpi_pad btrfs xor raid6_pq sd_mod crc32c_intel megaraid_sas sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua scsi_mod md_mod autofs4 [1072141.444146] Supported: Yes [1072141.444149] CPU: 21 PID: 1 Comm: systemd Not tainted 4.4.121-92.80-default #1 [1072141.444150] Hardware name: LENOVO Lenovo System x3650 M5 -[5462P4U]- -[5462P4U]-/01GR451, BIOS -[TCE136H-2.70]- 06/13/2018 [1072141.444151] task: ffff880191bd0040 ti: ffff880191bd4000 task.ti: ffff880191bd4000 [1072141.444153] RIP: 0010:[] [] update_classid_sock+0x29/0x40 [1072141.444157] RSP: 0018:ffff880191bd7d58 EFLAGS: 00000286 [1072141.444158] RAX: ffff883b177cb7c0 RBX: 0000000000000000 RCX: 0000000000000000 [1072141.444159] RDX: 00000000000009c7 RSI: ffff880191bd7d5c RDI: ffff8822e29bb200 [1072141.444160] RBP: ffff883a72230980 R08: 0000000000000101 R09: 0000000000000000 [1072141.444161] R10: 0000000000000008 R11: f000000000000000 R12: ffffffff815229d0 [1072141.444162] R13: 0000000000000000 R14: ffff881fd0a47ac0 R15: ffff880191bd7f28 [1072141.444163] FS: 00007f3e2f1eb8c0(0000) GS:ffff882000340000(0000) knlGS:0000000000000000 [1072141.444164] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [1072141.444165] CR2: 00007f3e2f200000 CR3: 0000001ffea4e000 CR4: 00000000001606f0 [1072141.444166] Stack: [1072141.444166] ffffffa800000246 00000000000009c7 ffffffff8121d583 ffff8818312a05c0 [1072141.444168] ffff8818312a1100 ffff880197c3b280 ffff881861422858 ffffffffffffffea [1072141.444170] ffffffff81522b1c ffffffff81d0ca20 ffff8817fa17b950 ffff883fdd8121e0 [1072141.444171] Call Trace: [1072141.444179] [] iterate_fd+0x53/0x80 [1072141.444182] [] write_classid+0x4c/0x80 [1072141.444187] [] cgroup_file_write+0x9b/0x100 [1072141.444193] [] kernfs_fop_write+0x11b/0x150 [1072141.444198] [] __vfs_write+0x26/0x100 [1072141.444201] [] vfs_write+0x9d/0x190 [1072141.444203] [] SyS_write+0x42/0xa0 [1072141.444207] [] entry_SYSCALL_64_fastpath+0x1e/0xca [1072141.445490] DWARF2 unwinder stuck at entry_SYSCALL_64_fastpath+0x1e/0xca If a cgroup has many tasks with many open file descriptors then we would end up in a large loop without any rescheduling point throught the operation. Add cond_resched once per task. Signed-off-by: Michal Hocko Signed-off-by: Tejun Heo commit 8bc7146a5b8bb4c9bfa32697f7208c70611845f9 Author: Rami Rosen Date: Tue Oct 23 18:01:06 2018 +0300 rdmacg: fix a typo in rdmacg documentation This patch fixes a typo in RDMA cgroup documentation. Signed-off-by: Rami Rosen Reviewed-by: Parav Pandit Signed-off-by: Tejun Heo commit 44786880df196a4200c178945c4d41675faf9fb7 Merge: 07171da26424 e543b3a62029 Author: Linus Torvalds Date: Tue Oct 23 20:02:03 2018 +0100 Merge branch 'parisc-4.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc updates from Helge Deller: "Lots of small fixes and enhancements, most noteably: - Many TLB and cache flush optimizations (Dave) - Fixed HPMC/crash handler on 64-bit kernel (Dave and myself) - Added alternative infrastructre. The kernel now live-patches itself for various situations, e.g. replace SMP code when running on one CPU only or drop cache flushes when system has no cache installed. - vmlinuz now contains a full copy of the compressed vmlinux file. This simplifies debugging the currently booted kernel. - Unused driver removal (Christoph) - Reduced warnings of Dino PCI bridge when running in qemu - Removed gcc version check (Masahiro)" * 'parisc-4.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: (23 commits) parisc: Retrieve and display the PDC PAT capabilities parisc: Optimze cache flush algorithms parisc: Remove pte_inserted define parisc: Add PDC PAT cell_info() and pd_get_pdc_revisions() functions parisc: Drop two instructions from pte lookup code parisc: Use zdep for shlw macro on PA1.1 and PA2.0 parisc: Add alternative coding infrastructure parisc: Include compressed vmlinux file in vmlinuz boot kernel extract-vmlinux: Check for uncompressed image as fallback parisc: Fix address in HPMC IVA parisc: Fix exported address of os_hpmc handler parisc: Fix map_pages() to not overwrite existing pte entries parisc: Purge TLB entries after updating page table entry and set page accessed flag in TLB handler parisc: Release spinlocks using ordered store parisc: Ratelimit dino stuck interrupt warnings parisc: dino: Utilize DINO_MASK_IRQ() macro parisc: Clean up crash header output parisc: Add SYSTEM_INFO and REGISTER TOC PAT functions parisc: Remove PTE load and fault check from L2_ptep macro parisc: Reorder TLB flush timing calculation ... commit 07171da26424bcdb5d8c4571544c8c7b11137d34 Merge: 034bda1cd5ab 3e98d240981a Author: Linus Torvalds Date: Tue Oct 23 19:32:10 2018 +0100 Merge branch 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM updates from Russell King: "The main item in this pull request are the Spectre variant 1.1 fixes from Julien Thierry. A few other patches to improve various areas, and removal of some obsolete mcount bits and a redundant kbuild conditional" * 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 8802/1: Call syscall_trace_exit even when system call skipped ARM: 8797/1: spectre-v1.1: harden __copy_to_user ARM: 8796/1: spectre-v1,v1.1: provide helpers for address sanitization ARM: 8795/1: spectre-v1.1: use put_user() for __put_user() ARM: 8794/1: uaccess: Prevent speculative use of the current addr_limit ARM: 8793/1: signal: replace __put_user_error with __put_user ARM: 8792/1: oabi-compat: copy oabi events using __copy_to_user() ARM: 8791/1: vfp: use __copy_to_user() when saving VFP state ARM: 8790/1: signal: always use __copy_to_user to save iwmmxt context ARM: 8789/1: signal: copy registers using __copy_to_user() ARM: 8801/1: makefile: use ARMv3M mode for RiscPC ARM: 8800/1: use choice for kernel unwinders ARM: 8798/1: remove unnecessary KBUILD_SRC ifeq conditional ARM: 8788/1: ftrace: remove old mcount support ARM: 8786/1: Debug kernel copy by printing commit 9844fb2e351311210e6660a9a1c62d17424a6145 Author: Johan Hovold Date: Mon Aug 27 10:21:53 2018 +0200 power: supply: twl4030-charger: fix OF sibling-node lookup Use the new of_get_compatible_child() helper to lookup the usb sibling node instead of using of_find_compatible_node(), which searches the entire tree from a given start node and thus can return an unrelated (non-sibling) node. This also addresses a potential use-after-free (e.g. after probe deferral) as the tree-wide helper drops a reference to its first argument (i.e. the parent device node). While at it, also fix the related phy-node reference leak. Fixes: f5e4edb8c888 ("power: twl4030_charger: find associated phy by more reliable means.") Cc: stable # 4.2 Cc: NeilBrown Cc: Felipe Balbi Cc: Sebastian Reichel Reviewed-by: Sebastian Reichel Signed-off-by: Johan Hovold Signed-off-by: Rob Herring commit 5bf59773aaf36dd62117dc83d50e1bbf9ef432da Author: Johan Hovold Date: Mon Aug 27 10:21:52 2018 +0200 NFC: nfcmrvl_uart: fix OF child-node lookup Use the new of_get_compatible_child() helper to lookup the nfc child node instead of using of_find_compatible_node(), which searches the entire tree from a given start node and thus can return an unrelated (i.e. non-child) node. This also addresses a potential use-after-free (e.g. after probe deferral) as the tree-wide helper drops a reference to its first argument (i.e. the parent node). Fixes: e097dc624f78 ("NFC: nfcmrvl: add UART driver") Fixes: d8e018c0b321 ("NFC: nfcmrvl: update device tree bindings for Marvell NFC") Cc: stable # 4.2 Cc: Vincent Cuissard Cc: Samuel Ortiz Signed-off-by: Johan Hovold Signed-off-by: Rob Herring commit ac63043d8cb5503c7e0fe110f947eacf2663804e Author: Johan Hovold Date: Mon Aug 27 10:21:51 2018 +0200 net: stmmac: dwmac-sun8i: fix OF child-node lookup Use the new of_get_compatible_child() helper to lookup the mdio-internal child node instead of using of_find_compatible_node(), which searches the entire tree from a given start node and thus can return an unrelated (i.e. non-child) node. This also addresses a potential use-after-free (e.g. after probe deferral) as the tree-wide helper drops a reference to its first argument (i.e. the mdio-mux node). Fortunately, this was inadvertently balanced by a failure to drop the mdio-mux reference after lookup. While at it, also fix the related mdio-internal- and phy-node reference leaks. Fixes: 634db83b8265 ("net: stmmac: dwmac-sun8i: Handle integrated/external MDIOs") Tested-by: Corentin Labbe Cc: Andrew Lunn Cc: Giuseppe Cavallaro Cc: Alexandre Torgue Cc: Jose Abreu Cc: David S. Miller Signed-off-by: Johan Hovold Signed-off-by: Rob Herring commit d397dbe606120a1ea1b11b0020c3f7a3852da5ac Author: Johan Hovold Date: Mon Aug 27 10:21:50 2018 +0200 net: bcmgenet: fix OF child-node lookup Use the new of_get_compatible_child() helper to lookup the mdio child node instead of using of_find_compatible_node(), which searches the entire tree from a given start node and thus can return an unrelated (i.e. non-child) node. This also addresses a potential use-after-free (e.g. after probe deferral) as the tree-wide helper drops a reference to its first argument (i.e. the node of the device being probed). Fixes: aa09677cba42 ("net: bcmgenet: add MDIO routines") Cc: stable # 3.15 Cc: David S. Miller Reviewed-by: Florian Fainelli Signed-off-by: Johan Hovold Signed-off-by: Rob Herring commit f9a7082327e26f54067a49cac2316d31e0cc8ba7 Author: Johan Hovold Date: Mon Aug 27 10:21:47 2018 +0200 drm/msm: fix OF child-node lookup Use the new of_get_compatible_child() helper to lookup the legacy pwrlevels child node instead of using of_find_compatible_node(), which searches the entire tree from a given start node and thus can return an unrelated (i.e. non-child) node. This also addresses a potential use-after-free (e.g. after probe deferral) as the tree-wide helper drops a reference to its first argument (i.e. the probed device's node). While at it, also fix the related child-node reference leak. Fixes: e2af8b6b0ca1 ("drm/msm: gpu: Use OPP tables if we can") Cc: stable # 4.12 Cc: Jordan Crouse Cc: Rob Clark Cc: David Airlie Signed-off-by: Johan Hovold Signed-off-by: Rob Herring commit ceff2f4dcd44abf35864d9a99f85ac619e89a01d Author: Johan Hovold Date: Mon Aug 27 10:21:46 2018 +0200 drm/mediatek: fix OF sibling-node lookup Use the new of_get_compatible_child() helper to lookup the sibling instead of using of_find_compatible_node(), which searches the entire tree from a given start node and thus can return an unrelated (i.e. non-sibling) node. This also addresses a potential use-after-free (e.g. after probe deferral) as the tree-wide helper drops a reference to its first argument (i.e. the parent device node). While at it, also fix the related cec-node reference leak. Fixes: 8f83f26891e1 ("drm/mediatek: Add HDMI support") Cc: stable # 4.8 Cc: Junzhi Zhao Cc: Philipp Zabel Cc: CK Hu Cc: David Airlie Signed-off-by: Johan Hovold Signed-off-by: Rob Herring commit 034bda1cd5abbe7b170ce76b618768d164030bbd Merge: d82924c3b8d0 99c19e6a8fe4 Author: Linus Torvalds Date: Tue Oct 23 19:07:25 2018 +0100 Merge branch 'x86-vdso-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 vdso updates from Ingo Molnar: "Two main changes: - Cleanups, simplifications and CLOCK_TAI support (Thomas Gleixner) - Improve code generation (Andy Lutomirski)" * 'x86-vdso-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/vdso: Rearrange do_hres() to improve code generation x86/vdso: Document vgtod_ts better x86/vdso: Remove "memory" clobbers in the vDSO syscall fallbacks x66/vdso: Add CLOCK_TAI support x86/vdso: Move cycle_last handling into the caller x86/vdso: Simplify the invalid vclock case x86/vdso: Replace the clockid switch case x86/vdso: Collapse coarse functions x86/vdso: Collapse high resolution functions x86/vdso: Introduce and use vgtod_ts x86/vdso: Use unsigned int consistently for vsyscall_gtod_data:: Seq x86/vdso: Enforce 64bit clocksource x86/time: Implement clocksource_arch_init() clocksource: Provide clocksource_arch_init() commit de7d83da84bdf0b5ec50b3b09249e608c0e4b81d Merge: 5e3cdecf7834 6be0f96d799f Author: Takashi Iwai Date: Tue Oct 23 20:07:07 2018 +0200 Merge tag 'asoc-v5.0-2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Additional fixes for the next release A couple of fixes for build bot issues in the STM32 SAI driver. commit 68203a67a7024c5d0b8e545d3d370b1fec971551 Author: Rahul Verma Date: Tue Oct 23 08:04:24 2018 -0700 qed: Fix static checker warning Static Checker Warnings: drivers/net/ethernet/qlogic/qed/qed_main.c:1510 qed_fill_link_capability() error: uninitialized symbol 'tcvr_state'. drivers/net/ethernet/qlogic/qed/qed_mcp.c:1951 qed_mcp_trans_speed_mask() error: uninitialized symbol 'transceiver_state'. drivers/net/ethernet/qlogic/qed/qed_mcp.c:1951 qed_mcp_trans_speed_mask() error: uninitialized symbol 'transceiver_type'. Symbols tcvr_state, transceiver_state and transceiver_type are initialized with respective default state. Fixes: c56a8be7e7aa ("qed: Add supported link and advertise link to display in ethtool.") Reported-by: Dan Carpenter Signed-off-by: Rahul Verma Signed-off-by: David S. Miller commit 5ef79151c2fbc401cf38325e9a32e77b9fc593ae Author: Ivan Vecera Date: Tue Oct 23 16:40:26 2018 +0200 Revert "be2net: remove desc field from be_eq_obj" The mentioned commit needs to be reverted because we cannot pass string allocated on stack to request_irq(). This function stores uses this pointer for later use (e.g. /proc/interrupts) so we need to keep this string persistently. Fixes: d6d9704af8f4 ("be2net: remove desc field from be_eq_obj") Signed-off-by: Ivan Vecera Signed-off-by: David S. Miller commit 89ab066d4229acd32e323f1569833302544a4186 Author: Karsten Graul Date: Tue Oct 23 13:40:39 2018 +0200 Revert "net: simplify sock_poll_wait" This reverts commit dd979b4df817e9976f18fb6f9d134d6bc4a3c317. This broke tcp_poll for SMC fallback: An AF_SMC socket establishes an internal TCP socket for the initial handshake with the remote peer. Whenever the SMC connection can not be established this TCP socket is used as a fallback. All socket operations on the SMC socket are then forwarded to the TCP socket. In case of poll, the file->private_data pointer references the SMC socket because the TCP socket has no file assigned. This causes tcp_poll to wait on the wrong socket. Signed-off-by: Karsten Graul Signed-off-by: David S. Miller commit 6b7a02f7089b223317bf264b8fdfdaf74be35b5f Merge: 487e2e22ab79 8d5b0bf611ec Author: David S. Miller Date: Tue Oct 23 10:55:35 2018 -0700 Merge branch 'netsec-fixes' Masahisa Kojima says: ==================== Bugfix for the netsec driver This patch series include bugfix for the netsec ethernet controller driver, fix the problem in interface down/up. changes in v2: - change the place to perform the PHY power down - use the MACROs defiend in include/uapi/linux/mii.h - update commit comment ==================== Signed-off-by: David S. Miller commit 8d5b0bf611ec5b7618d5b772dddc93b8afa78cb8 Author: Masahisa Kojima Date: Tue Oct 23 20:24:28 2018 +0900 net: socionext: Reset tx queue in ndo_stop We observed that packets and bytes count are not reset when user performs interface down. Eventually, tx queue is exhausted and packets will not be sent out. To avoid this problem, resets tx queue in ndo_stop. Fixes: 533dd11a12f6 ("net: socionext: Add Synquacer NetSec driver") Signed-off-by: Masahisa Kojima Signed-off-by: Yoshitoyo Osaki Signed-off-by: David S. Miller commit a3241a91de6429051a211b5ce04d6946157caec7 Author: Masahisa Kojima Date: Tue Oct 23 20:24:27 2018 +0900 net: socionext: Add dummy PHY register read in phy_write() There is a compatibility issue between RTL8211E implemented in Developerbox and netsec ethernet controller IP. Our MDIO controller stops MDC clock right after the write access, but RTL8211E expects MDC clock must be kept toggling for several clock cycle with MDIO high before entering the IDLE state. Without keeping clock after write access, write access is not correctly handled and register is not updated. To meet this requirement, netsec driver needs to issue dummy read(e.g. read PHYID1(offset 0x2) register) right after write access, to keep MDC clock. We think this compatibility issue is a problem specific to our MDIO controller and RTL8211E. Fixes: 533dd11a12f6 ("net: socionext: Add Synquacer NetSec driver") Signed-off-by: Masahisa Kojima Signed-off-by: Yoshitoyo Osaki Signed-off-by: David S. Miller commit 8e850f25b5812aefedec6732732eb10e7b47cb5c Author: Masahisa Kojima Date: Tue Oct 23 20:24:26 2018 +0900 net: socionext: Stop PHY before resetting netsec In ndo_stop, driver resets the netsec ethernet controller IP. When the netsec IP is reset, HW running mode turns to NRM mode and driver has to wait until this mode transition completes. But mode transition to NRM will not complete if the PHY is in normal operation state. Netsec IP requires PHY is in power down state when it is reset. This modification stops the PHY before resetting netsec. Together with this modification, phy_addr is stored in netsec_priv structure because ndev->phydev is not yet ready in ndo_init. Fixes: 533dd11a12f6 ("net: socionext: Add Synquacer NetSec driver") Signed-off-by: Masahisa Kojima Signed-off-by: Yoshitoyo Osaki Signed-off-by: David S. Miller commit 76099f98aea4606f7c96b8d2366b46840529d08f Author: Adrian Hunter Date: Tue Oct 23 10:59:49 2018 +0300 perf scripts python: exported-sql-viewer.py: Add All branches report Add a report to display branches in a similar fashion to perf script. The main purpose of this report is to display disassembly, however, presently, the only supported disassembler is Intel XED, and additionally the object code must be present in perf build ID cache. To use Intel XED, libxed.so must be present. To build and install libxed.so: git clone https://github.com/intelxed/mbuild.git mbuild git clone https://github.com/intelxed/xed cd xed ./mfile.py --share sudo ./mfile.py --prefix=/usr/local install sudo ldconfig Signed-off-by: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20181023075949.18920-1-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit d82924c3b8d0607094b94fab290a33c5ad7d586c Merge: d7197a5ad852 bb4b3b776273 Author: Linus Torvalds Date: Tue Oct 23 18:43:04 2018 +0100 Merge branch 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 pti updates from Ingo Molnar: "The main changes: - Make the IBPB barrier more strict and add STIBP support (Jiri Kosina) - Micro-optimize and clean up the entry code (Andy Lutomirski) - ... plus misc other fixes" * 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/speculation: Propagate information about RSB filling mitigation to sysfs x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation x86/speculation: Apply IBPB more strictly to avoid cross-process data leak x86/speculation: Add RETPOLINE_AMD support to the inline asm CALL_NOSPEC variant x86/CPU: Fix unused variable warning when !CONFIG_IA32_EMULATION x86/pti/64: Remove the SYSCALL64 entry trampoline x86/entry/64: Use the TSS sp2 slot for SYSCALL/SYSRET scratch space x86/entry/64: Document idtentry commit 8392b74b575c38fa5d50d1fe07fa9a4bcea93862 Author: Adrian Hunter Date: Mon Oct 1 09:28:50 2018 +0300 perf scripts python: exported-sql-viewer.py: Add ability to display all the database tables Displaying all the database tables can help make the database easier to understand. Committer testing: Opened all the tables, even the sqlite master table, which I selected everything and used control+C, lets see if it works... CREATE VIEW threads_view AS SELECT id,machine_id,(SELECT host_or_guest FROM machines_view WHERE id = machine_id) AS host_or_guest,process_id,pid,tid FROM threads Humm, nope, just one of the cells got copied, even with everything selected :-) Anyway, works as advertised, useful for perusing the data. Signed-off-by: Adrian Hunter Tested-by: Arnaldo Carvalho de Melo Cc: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20181001062853.28285-17-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 82f68e2898e634b8b0efc7ddd57e037ef75ea114 Author: Adrian Hunter Date: Mon Oct 1 09:28:49 2018 +0300 perf scripts python: exported-sql-viewer.py: Add ability to shrink / enlarge font Shrinking the font allows more information to display. Committer testing: Works, tested with the convenient Control+Shift+'+' and Control+'-' as well with the more cumbersome top menu "Edit" + "Enlarge/Shrink font" options. Signed-off-by: Adrian Hunter Tested-by: Arnaldo Carvalho de Melo Cc: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20181001062853.28285-16-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit ebd70c7dc2f5f57315e19d959ddc9cb05e9d48e1 Author: Adrian Hunter Date: Mon Oct 1 09:28:48 2018 +0300 perf scripts python: exported-sql-viewer.py: Add ability to find symbols in the call-graph Add a Find bar that appears at the bottom of the call-graph window. Committer testing: Using: python tools/perf/scripts/python/exported-sql-viewer.py pt_example branches calls Using the database built in the first "Committer Testing" section in this patch series I was able to: "Reports" "Context-Sensitive Call Graphs" Control+F or select "Edit" in the top menu then "Find" __poll and find the first place where the "__poll" function appears, then press the down arrow in the lower right corner and go to the next, etc. Signed-off-by: Adrian Hunter Tested-by: Arnaldo Carvalho de Melo Cc: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20181001062853.28285-15-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 1beb5c7b07040b70975a2ae0e90b87d412fabf06 Author: Adrian Hunter Date: Mon Oct 1 09:28:47 2018 +0300 perf scripts python: exported-sql-viewer.py: Add support for multiple sub-windows Use Qt MDI (multiple document interface) to support multiple sub-windows. Put the data model in a cache so that each sub-window can share the same data. This allows mutiple views of the call-graph at the same time and paves the way to add more reports. Committer testing: Starts with a "File Reports Windows" main menu, from the "Reports" I can get what was available up to now, the "Context-Sensitivi Call Graph" option. Signed-off-by: Adrian Hunter Tested-by: Arnaldo Carvalho de Melo Cc: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20181001062853.28285-14-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 031c2a004ba75a4f8f2a6d0a7ca6f2fe5912de22 Author: Adrian Hunter Date: Mon Oct 1 09:28:46 2018 +0300 perf scripts python: call-graph-from-sql.py: Rename to exported-sql-viewer.py Additional reports will be added to the script so rename to reflect the more general purpose. Signed-off-by: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20181001062853.28285-13-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 341e73cbd3019d350d1271803b45d84af88f2408 Author: Adrian Hunter Date: Mon Oct 1 09:28:45 2018 +0300 perf scripts python: call-graph-from-sql.py: Refactor TreeItem class class TreeItem represents items at all levels of the call-graph tree. However, not all the levels represent the same data i.e. the top-level is comms, the next level is threads, and subsequent levels are functions. Consequently it is simpler to have separate classes for different levels with commonality in a base class. Refactor TreeItem class accordingly. Signed-off-by: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20181001062853.28285-12-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 4be9ace7e1cdcb44c1fba1fb41ec2b92dda06732 Author: Adrian Hunter Date: Mon Oct 1 09:28:44 2018 +0300 perf scripts python: call-graph-from-sql.py: Add data helper functions Add helper functions for a few common cases. Signed-off-by: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20181001062853.28285-11-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 70d831e85c1bdd87d193e85666bf3aa39aab7f21 Author: Adrian Hunter Date: Mon Oct 1 09:28:43 2018 +0300 perf scripts python: call-graph-from-sql.py: Factor out CallGraphModel from TreeModel Factor out CallGraphModel from TreeModel, which paves the way to reuse TreeModel in future reports. Signed-off-by: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20181001062853.28285-10-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit e99ef8141a6d97abaf47647cfd0034769144d080 Author: Adrian Hunter Date: Mon Oct 1 09:28:42 2018 +0300 perf scripts python: call-graph-from-sql.py: Remove use of setObjectName() The object name is never used, so don't bother setting it. Signed-off-by: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20181001062853.28285-9-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 5f9dfef1bb7fadfb2d001244ef23359982fedd06 Author: Adrian Hunter Date: Mon Oct 1 09:28:41 2018 +0300 perf scripts python: call-graph-from-sql.py: Add a class for global data Keep global data in a single object that is easy to pass around as needed, without polluting the global namespace. Signed-off-by: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20181001062853.28285-8-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit b2556c46a69b4c0e6bbf690ac4ca2913cbe90e1e Author: Adrian Hunter Date: Mon Oct 1 09:28:40 2018 +0300 perf scripts python: call-graph-from-sql.py: Separate the database details into a class Separate the database details into a class that can provide different connections using the same connection information. That paves the way for sub-processes that require their own connection. Signed-off-by: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20181001062853.28285-7-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 7e4fc93e2ade2b0c453a97e307203ffe3f930c98 Author: Adrian Hunter Date: Mon Oct 1 09:28:39 2018 +0300 perf scripts python: call-graph-from-sql.py: Make a "Main" function Make a "Main" function so that the variables used do not pollute the global namespace. Signed-off-by: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20181001062853.28285-6-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 99a097c987c26c8c82293fcb92908d07009c925e Author: Adrian Hunter Date: Mon Oct 1 09:28:38 2018 +0300 perf scripts python: call-graph-from-sql.py: Change icon There are not many standard icons, but the computer icon looks slightly better than the information icon. Committer testing: Noticed the change on the icon on the gnome menu right next to the "Activities" menu, looks nicer indeed. Signed-off-by: Adrian Hunter Tested-by: Arnaldo Carvalho de Melo Cc: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20181001062853.28285-5-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 3c4ef451506897a15aff76ff141c995c6cd32f4d Author: Adrian Hunter Date: Mon Oct 1 09:28:37 2018 +0300 perf scripts python: call-graph-from-sql.py: Set a minimum window size Prevent weirdly small window size. Committer testing: Seems to work, but even before this patch, on my system, it always started with: xwininfo: Window id: 0x1e00002 "Call Graph: pt_example" Width: 800 Height: 600 Signed-off-by: Adrian Hunter Tested-by: Arnaldo Carvalho de Melo Cc: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20181001062853.28285-4-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit d7197a5ad8528642cb70f1d27d4d5c7332a2b395 Merge: f682a7920baf fa112cf1e8bc Author: Linus Torvalds Date: Tue Oct 23 18:17:11 2018 +0100 Merge branch 'x86-platform-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 platform updates from Ingo Molnar: "Two minor OLPC changes: a build fix and a new quirk" * 'x86-platform-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/olpc: Fix build error with CONFIG_MFD_CS5535=m x86/olpc: Indicate that legacy PC XO-1 platform should not register RTC commit 1d865c06f5715df94528f76d6bb7f6f98975e04e Author: Adrian Hunter Date: Mon Oct 1 09:28:36 2018 +0300 perf scripts python: call-graph-from-sql.py: Provide better default column sizes Set initial column sizes to improve initial display. Committer testing: Extended instructions on testing this, using the sqlite variant: Make sure you have the SQLite glue for python+Qt installed, on fedora 27 I used: # dnf install python-pyside Collect some PT samples, say 5-secs worth, system wide: # perf record -r 10 -e intel_pt//u -a sleep 5 [ perf record: Woken up 49 times to write data ] [ perf record: Captured and wrote 96.131 MB perf.data ] This results in this perf.data file: # ls -larth perf.data -rw-------. 1 root root 97M Oct 23 10:11 perf.data With the following attributes: # perf evlist -v intel_pt//u: type: 8, size: 112, config: 0x300e601, { sample_period, sample_freq }: 1, sample_type: IP|TID|TIME|CPU|IDENTIFIER, read_format: ID, disabled: 1, inherit: 1, exclude_kernel: 1, exclude_hv: 1, sample_id_all: 1 dummy:u: type: 1, size: 112, config: 0x9, { sample_period, sample_freq }: 1, sample_type: IP|TID|TIME|CPU|IDENTIFIER, read_format: ID, inherit: 1, exclude_kernel: 1, exclude_hv: 1, mmap: 1, comm: 1, task: 1, sample_id_all: 1, mmap2: 1, comm_exec: 1, context_switch: 1 # Then generate the "pt_example" tables using: # perf script -s ~/libexec/perf-core/scripts/python/export-to-sqlite.py pt_example branches calls 2018-10-23 10:56:59.177711 Creating database... 2018-10-23 10:56:59.195842 Writing records... instruction trace error type 1 cpu 2 pid 1644 tid 1644 ip 0x263984516750 code 5: Failed to get instruction instruction trace error type 1 cpu 2 pid 1644 tid 1644 ip 0x7f26e116fd20 code 6: Trace doesn't match instruction instruction trace error type 1 cpu 2 pid 1644 tid 1644 ip 0x7f26e162c9ee code 6: Trace doesn't match instruction instruction trace error type 1 cpu 2 pid 1644 tid 1644 ip 0x7f26e9ce831a code 6: Trace doesn't match instruction instruction trace error type 1 cpu 0 pid 1644 tid 1644 ip 0x7f26e13d07b4 code 6: Trace doesn't match instruction Warning: 132 instruction trace errors 2018-10-23 11:25:25.015717 Adding indexes 2018-10-23 11:25:28.788061 Done # In my example, that perf.data file generated this db: # file pt_example pt_example: SQLite 3.x database, last written using SQLite version 3020001 [root@seventh perf]# ls -lah pt_example -rw-r--r--. 1 root root 6.6G Oct 23 11:25 pt_example # Then use this python script to use that db and provide a GUI: $ python tools/perf/scripts/python/call-graph-from-sql.py pt_example branches calls I compared the column widths before this patch and after applying it, the visual results match the patch intent. The following patches will refer to this set of instructions in the "Committer Testing" section. Signed-off-by: Adrian Hunter Tested-by: Arnaldo Carvalho de Melo Cc: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20181001062853.28285-3-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit f682a7920baf7b721d01dd317f3b532265357cbb Merge: 99792e0cea1e 3a025de64bf8 Author: Linus Torvalds Date: Tue Oct 23 17:54:58 2018 +0100 Merge branch 'x86-paravirt-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 paravirt updates from Ingo Molnar: "Two main changes: - Remove no longer used parts of the paravirt infrastructure and put large quantities of paravirt ops under a new config option PARAVIRT_XXL=y, which is selected by XEN_PV only. (Joergen Gross) - Enable PV spinlocks on Hyperv (Yi Sun)" * 'x86-paravirt-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/hyperv: Enable PV qspinlock for Hyper-V x86/hyperv: Add GUEST_IDLE_MSR support x86/paravirt: Clean up native_patch() x86/paravirt: Prevent redefinition of SAVE_FLAGS macro x86/xen: Make xen_reservation_lock static x86/paravirt: Remove unneeded mmu related paravirt ops bits x86/paravirt: Move the Xen-only pv_mmu_ops under the PARAVIRT_XXL umbrella x86/paravirt: Move the pv_irq_ops under the PARAVIRT_XXL umbrella x86/paravirt: Move the Xen-only pv_cpu_ops under the PARAVIRT_XXL umbrella x86/paravirt: Move items in pv_info under PARAVIRT_XXL umbrella x86/paravirt: Introduce new config option PARAVIRT_XXL x86/paravirt: Remove unused paravirt bits x86/paravirt: Use a single ops structure x86/paravirt: Remove clobbers from struct paravirt_patch_site x86/paravirt: Remove clobbers parameter from paravirt patch functions x86/paravirt: Make paravirt_patch_call() and paravirt_patch_jmp() static x86/xen: Add SPDX identifier in arch/x86/xen files x86/xen: Link platform-pci-unplug.o only if CONFIG_XEN_PVHVM x86/xen: Move pv specific parts of arch/x86/xen/mmu.c to mmu_pv.c x86/xen: Move pv irq related functions under CONFIG_XEN_PV umbrella commit 331bc71cb1751d78f6807ad8e6162b07c67cdd1b Author: Trond Myklebust Date: Sun Oct 14 10:40:29 2018 -0400 SUNRPC: Convert the auth cred cache to use refcount_t Signed-off-by: Trond Myklebust commit 79b181810285a6b9b7a1aed25c365c9e1782e22a Author: Trond Myklebust Date: Sun Oct 14 10:34:31 2018 -0400 SUNRPC: Convert auth creds to use refcount_t Signed-off-by: Trond Myklebust commit 07d02a67b7faae56e184f6c35f78de47f06da37f Author: Trond Myklebust Date: Fri Oct 12 13:28:26 2018 -0400 SUNRPC: Simplify lookup code We no longer need to worry about whether or not the entry is hashed in order to figure out if the contents are valid. We only care whether or not the refcount is non-zero. Signed-off-by: Trond Myklebust commit 95cd623250adce2269e71cfeaf1d487cf4b0d088 Author: Trond Myklebust Date: Thu Oct 11 16:11:09 2018 -0400 SUNRPC: Clean up the AUTH cache code Signed-off-by: Trond Myklebust commit 86bbd7422ae6a33735df6846fd685e46686da714 Author: Frank Sorenson Date: Tue Oct 23 10:34:57 2018 -0500 NFS: change sign of nfs_fh length The filehandle has a length which is defined as a 32-bit "unsigned integer". Change sign of the length appropriately. Signed-off-by: Frank Sorenson Signed-off-by: Trond Myklebust commit 99792e0cea1ed733cdc8d0758677981e0cbebfed Merge: 382d72a9aa52 977e4be5eb71 Author: Linus Torvalds Date: Tue Oct 23 17:05:28 2018 +0100 Merge branch 'x86-mm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 mm updates from Ingo Molnar: "Lots of changes in this cycle: - Lots of CPA (change page attribute) optimizations and related cleanups (Thomas Gleixner, Peter Zijstra) - Make lazy TLB mode even lazier (Rik van Riel) - Fault handler cleanups and improvements (Dave Hansen) - kdump, vmcore: Enable kdumping encrypted memory with AMD SME enabled (Lianbo Jiang) - Clean up VM layout documentation (Baoquan He, Ingo Molnar) - ... plus misc other fixes and enhancements" * 'x86-mm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (51 commits) x86/stackprotector: Remove the call to boot_init_stack_canary() from cpu_startup_entry() x86/mm: Kill stray kernel fault handling comment x86/mm: Do not warn about PCI BIOS W+X mappings resource: Clean it up a bit resource: Fix find_next_iomem_res() iteration issue resource: Include resource end in walk_*() interfaces x86/kexec: Correct KEXEC_BACKUP_SRC_END off-by-one error x86/mm: Remove spurious fault pkey check x86/mm/vsyscall: Consider vsyscall page part of user address space x86/mm: Add vsyscall address helper x86/mm: Fix exception table comments x86/mm: Add clarifying comments for user addr space x86/mm: Break out user address space handling x86/mm: Break out kernel address space handling x86/mm: Clarify hardware vs. software "error_code" x86/mm/tlb: Make lazy TLB mode lazier x86/mm/tlb: Add freed_tables element to flush_tlb_info x86/mm/tlb: Add freed_tables argument to flush_tlb_mm_range smp,cpumask: introduce on_each_cpu_cond_mask smp: use __cpumask_set_cpu in on_each_cpu_cond ... commit 382d72a9aa525b56ab8453ce61751fa712414d3d Merge: ac73e08eda88 5140a6f47113 Author: Linus Torvalds Date: Tue Oct 23 16:47:41 2018 +0100 Merge branch 'x86-hyperv-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 hyperv updates from Ingo Molnar: "Two small changes: a boot warning removal and a minor cleanup" * 'x86-hyperv-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/hyperv: Remove unused include x86/hyperv: Suppress "PCI: Fatal: No config space access function found" commit ac73e08eda885a6723593c45d634b59c63365986 Merge: fec98069fb72 e7b66d16fe41 Author: Linus Torvalds Date: Tue Oct 23 16:31:33 2018 +0100 Merge branch 'x86-grub2-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 grub2 updates from Ingo Molnar: "This extends the x86 boot protocol to include an address for the RSDP table - utilized by Xen currently. Matching Grub2 patches are pending as well. (Juergen Gross)" * 'x86-grub2-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/acpi, x86/boot: Take RSDP address for boot params if available x86/boot: Add ACPI RSDP address to setup_header x86/xen: Fix boot loader version reported for PVH guests commit fec98069fb72fb656304a3e52265e0c2fc9adf87 Merge: 04ce7fae3d4e 995d5f64b62f Author: Linus Torvalds Date: Tue Oct 23 16:16:40 2018 +0100 Merge branch 'x86-cpu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cpu updates from Ingo Molnar: "The main changes in this cycle were: - Add support for the "Dhyana" x86 CPUs by Hygon: these are licensed based on the AMD Zen architecture, and are built and sold in China, for domestic datacenter use. The code is pretty close to AMD support, mostly with a few quirks and enumeration differences. (Pu Wen) - Enable CPUID support on Cyrix 6x86/6x86L processors" * 'x86-cpu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: tools/cpupower: Add Hygon Dhyana support cpufreq: Add Hygon Dhyana support ACPI: Add Hygon Dhyana support x86/xen: Add Hygon Dhyana support to Xen x86/kvm: Add Hygon Dhyana support to KVM x86/mce: Add Hygon Dhyana support to the MCA infrastructure x86/bugs: Add Hygon Dhyana to the respective mitigation machinery x86/apic: Add Hygon Dhyana support x86/pci, x86/amd_nb: Add Hygon Dhyana support to PCI and northbridge x86/amd_nb: Check vendor in AMD-only functions x86/alternative: Init ideal_nops for Hygon Dhyana x86/events: Add Hygon Dhyana support to PMU infrastructure x86/smpboot: Do not use BSP INIT delay and MWAIT to idle on Dhyana x86/cpu/mtrr: Support TOP_MEM2 and get MTRR number x86/cpu: Get cache info and setup cache cpumap for Hygon Dhyana x86/cpu: Create Hygon Dhyana architecture support file x86/CPU: Change query logic so CPUID is enabled before testing x86/CPU: Use correct macros for Cyrix calls commit 04ce7fae3d4ed1b045d20da071b96f7dcb93bda8 Merge: 642116d4ac58 b3569d3a4b4f Author: Linus Torvalds Date: Tue Oct 23 16:04:22 2018 +0100 Merge branch 'x86-build-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 build update from Ingo Molnar: "A small cleanup to x86 Kconfigs" * 'x86-build-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/kconfig: Remove redundant 'default n' lines from all x86 Kconfig's commit 642116d4ac58745b8058d32a20ca733020feb290 Merge: e1d20beae70e 44060e8a5189 Author: Linus Torvalds Date: Tue Oct 23 15:54:42 2018 +0100 Merge branch 'x86-boot-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 boot updates from Ingo Molnar: "Two cleanups and a bugfix for a rare boot option combination" * 'x86-boot-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/boot/KASLR: Remove return value from handle_mem_options() x86/corruption-check: Use pr_*() instead of printk() x86/corruption-check: Fix panic in memory_corruption_check() when boot option without value is provided commit f9dcf08e2017cad12d771cdd862c8c314b885615 Author: Radim Krčmář Date: Tue Oct 23 16:31:38 2018 +0200 Revert "kvm: x86: optimize dr6 restore" This reverts commit 0e0a53c551317654e2d7885fdfd23299fee99b6b. As Christian Ehrhardt noted: The most common case is that vcpu->arch.dr6 and the host's %dr6 value are not related at all because ->switch_db_regs is zero. To do this all correctly, we must handle the case where the guest leaves an arbitrary unused value in vcpu->arch.dr6 before disabling breakpoints again. However, this means that vcpu->arch.dr6 is not suitable to detect the need for a %dr6 clear. Signed-off-by: Radim Krčmář commit e1d20beae70eb918cca7f07a77ce199fd148fdd2 Merge: cbbfb0ae2ca9 ec3a94188df7 Author: Linus Torvalds Date: Tue Oct 23 15:24:22 2018 +0100 Merge branch 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 asm updates from Ingo Molnar: "The main changes in this cycle were the fsgsbase related preparatory patches from Chang S. Bae - but there's also an optimized memcpy_flushcache() and a cleanup for the __cmpxchg_double() assembly glue" * 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/fsgsbase/64: Clean up various details x86/segments: Introduce the 'CPUNODE' naming to better document the segment limit CPU/node NR trick x86/vdso: Initialize the CPU/node NR segment descriptor earlier x86/vdso: Introduce helper functions for CPU and node number x86/segments/64: Rename the GDT PER_CPU entry to CPU_NUMBER x86/fsgsbase/64: Factor out FS/GS segment loading from __switch_to() x86/fsgsbase/64: Convert the ELF core dump code to the new FSGSBASE helpers x86/fsgsbase/64: Make ptrace use the new FS/GS base helpers x86/fsgsbase/64: Introduce FS/GS base helper functions x86/fsgsbase/64: Fix ptrace() to read the FS/GS base accurately x86/asm: Use CC_SET()/CC_OUT() in __cmpxchg_double() x86/asm: Optimize memcpy_flushcache() commit cbbfb0ae2ca979222297062647ced653682a6cc7 Merge: 42f52e1c59bd 76f99ae5b54d Author: Linus Torvalds Date: Tue Oct 23 15:15:20 2018 +0100 Merge branch 'x86-apic-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 apic updates from Ingo Molnar: "Improve the spreading of managed IRQs at allocation time" * 'x86-apic-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irq/matrix: Spread managed interrupts on allocation irq/matrix: Split out the CPU selection code into a helper commit 42f52e1c59bdb78cad945b2dd34fa1f892239a39 Merge: 0d1b82cd8ac2 11e13696a08e Author: Linus Torvalds Date: Tue Oct 23 15:00:03 2018 +0100 Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler updates from Ingo Molnar: "The main changes are: - Migrate CPU-intense 'misfit' tasks on asymmetric capacity systems, to better utilize (much) faster 'big core' CPUs. (Morten Rasmussen, Valentin Schneider) - Topology handling improvements, in particular when CPU capacity changes and related load-balancing fixes/improvements (Morten Rasmussen) - ... plus misc other improvements, fixes and updates" * 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (28 commits) sched/completions/Documentation: Add recommendation for dynamic and ONSTACK completions sched/completions/Documentation: Clean up the document some more sched/completions/Documentation: Fix a couple of punctuation nits cpu/SMT: State SMT is disabled even with nosmt and without "=force" sched/core: Fix comment regarding nr_iowait_cpu() and get_iowait_load() sched/fair: Remove setting task's se->runnable_weight during PELT update sched/fair: Disable LB_BIAS by default sched/pelt: Fix warning and clean up IRQ PELT config sched/topology: Make local variables static sched/debug: Use symbolic names for task state constants sched/numa: Remove unused numa_stats::nr_running field sched/numa: Remove unused code from update_numa_stats() sched/debug: Explicitly cast sched_feat() to bool sched/core: Disable SD_PREFER_SIBLING on asymmetric CPU capacity domains sched/fair: Don't move tasks to lower capacity CPUs unless necessary sched/fair: Set rq->rd->overload when misfit sched/fair: Wrap rq->rd->overload accesses with READ/WRITE_ONCE() sched/core: Change root_domain->overload type to int sched/fair: Change 'prefer_sibling' type to bool sched/fair: Kick nohz balance if rq->misfit_task_load ... commit 14fdc2c5318ae420e68496975f48dc1dbef52649 Author: Will Deacon Date: Mon Oct 22 16:39:01 2018 +0100 Documentation/security-bugs: Clarify treatment of embargoed information The Linux kernel security team has been accused of rejecting the idea of security embargoes. This is incorrect, and could dissuade people from reporting security issues to us under the false assumption that the issue would leak prematurely. Clarify the handling of embargoed information in our process documentation. Co-developed-by: Ingo Molnar Acked-by: Kees Cook Acked-by: Peter Zijlstra Acked-by: Laura Abbott Signed-off-by: Will Deacon Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 0d1b82cd8ac2e8856ae9045c97782ac1c359929c Merge: c05f3642f430 711f76a328cb Author: Linus Torvalds Date: Tue Oct 23 13:46:36 2018 +0100 Merge branch 'ras-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RAS updates from Ingo Molnar: "Misc smaller fixes and cleanups" * 'ras-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mcelog: Remove one mce_helper definition x86/mce: Add macros for the corrected error count bit field x86/mce: Use BIT_ULL(x) for bit mask definitions x86/mce-inject: Reset injection struct after injection commit c05f3642f4304dd081876e77a68555b6aba4483f Merge: 0200fbdd4315 dda93b45389f Author: Linus Torvalds Date: Tue Oct 23 13:32:18 2018 +0100 Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf updates from Ingo Molnar: "The main updates in this cycle were: - Lots of perf tooling changes too voluminous to list (big perf trace and perf stat improvements, lots of libtraceevent reorganization, etc.), so I'll list the authors and refer to the changelog for details: Benjamin Peterson, Jérémie Galarneau, Kim Phillips, Peter Zijlstra, Ravi Bangoria, Sangwon Hong, Sean V Kelley, Steven Rostedt, Thomas Gleixner, Ding Xiang, Eduardo Habkost, Thomas Richter, Andi Kleen, Sanskriti Sharma, Adrian Hunter, Tzvetomir Stoyanov, Arnaldo Carvalho de Melo, Jiri Olsa. ... with the bulk of the changes written by Jiri Olsa, Tzvetomir Stoyanov and Arnaldo Carvalho de Melo. - Continued intel_rdt work with a focus on playing well with perf events. This also imported some non-perf RDT work due to dependencies. (Reinette Chatre) - Implement counter freezing for Arch Perfmon v4 (Skylake and newer). This allows to speed up the PMI handler by avoiding unnecessary MSR writes and make it more accurate. (Andi Kleen) - kprobes cleanups and simplification (Masami Hiramatsu) - Intel Goldmont PMU updates (Kan Liang) - ... plus misc other fixes and updates" * 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (155 commits) kprobes/x86: Use preempt_enable() in optimized_callback() x86/intel_rdt: Prevent pseudo-locking from using stale pointers kprobes, x86/ptrace.h: Make regs_get_kernel_stack_nth() not fault on bad stack perf/x86/intel: Export mem events only if there's PEBS support x86/cpu: Drop pointless static qualifier in punit_dev_state_show() x86/intel_rdt: Fix initial allocation to consider CDP x86/intel_rdt: CBM overlap should also check for overlap with CDP peer x86/intel_rdt: Introduce utility to obtain CDP peer tools lib traceevent, perf tools: Move struct tep_handler definition in a local header file tools lib traceevent: Separate out tep_strerror() for strerror_r() issues perf python: More portable way to make CFLAGS work with clang perf python: Make clang_has_option() work on Python 3 perf tools: Free temporary 'sys' string in read_event_files() perf tools: Avoid double free in read_event_file() perf tools: Free 'printk' string in parse_ftrace_printk() perf tools: Cleanup trace-event-info 'tdata' leak perf strbuf: Match va_{add,copy} with va_end perf test: S390 does not support watchpoints in test 22 perf auxtrace: Include missing asm/bitsperlong.h to get BITS_PER_LONG tools include: Adopt linux/bits.h ... commit 0200fbdd431519d730b5d399a12840ec832b27cc Merge: de3fbb2aa802 01a14bda11ad Author: Linus Torvalds Date: Tue Oct 23 13:08:53 2018 +0100 Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking and misc x86 updates from Ingo Molnar: "Lots of changes in this cycle - in part because locking/core attracted a number of related x86 low level work which was easier to handle in a single tree: - Linux Kernel Memory Consistency Model updates (Alan Stern, Paul E. McKenney, Andrea Parri) - lockdep scalability improvements and micro-optimizations (Waiman Long) - rwsem improvements (Waiman Long) - spinlock micro-optimization (Matthew Wilcox) - qspinlocks: Provide a liveness guarantee (more fairness) on x86. (Peter Zijlstra) - Add support for relative references in jump tables on arm64, x86 and s390 to optimize jump labels (Ard Biesheuvel, Heiko Carstens) - Be a lot less permissive on weird (kernel address) uaccess faults on x86: BUG() when uaccess helpers fault on kernel addresses (Jann Horn) - macrofy x86 asm statements to un-confuse the GCC inliner. (Nadav Amit) - ... and a handful of other smaller changes as well" * 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (57 commits) locking/lockdep: Make global debug_locks* variables read-mostly locking/lockdep: Fix debug_locks off performance problem locking/pvqspinlock: Extend node size when pvqspinlock is configured locking/qspinlock_stat: Count instances of nested lock slowpaths locking/qspinlock, x86: Provide liveness guarantee x86/asm: 'Simplify' GEN_*_RMWcc() macros locking/qspinlock: Rework some comments locking/qspinlock: Re-order code locking/lockdep: Remove duplicated 'lock_class_ops' percpu array x86/defconfig: Enable CONFIG_USB_XHCI_HCD=y futex: Replace spin_is_locked() with lockdep locking/lockdep: Make class->ops a percpu counter and move it under CONFIG_DEBUG_LOCKDEP=y x86/jump-labels: Macrofy inline assembly code to work around GCC inlining bugs x86/cpufeature: Macrofy inline assembly code to work around GCC inlining bugs x86/extable: Macrofy inline assembly code to work around GCC inlining bugs x86/paravirt: Work around GCC inlining bugs when compiling paravirt ops x86/bug: Macrofy the BUG table section handling, to work around GCC inlining bugs x86/alternatives: Macrofy lock prefixes to work around GCC inlining bugs x86/refcount: Work around GCC inlining bug x86/objtool: Use asm macros to work around GCC inlining bugs ... commit de3fbb2aa802a267dee2213ae7d5a1e19eb4294a Merge: cee1352f7926 fa70f0d2ce96 Author: Linus Torvalds Date: Tue Oct 23 13:04:03 2018 +0100 Merge branch 'efi-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI updates from Ingo Molnar: "The main changes are: - Add support for enlisting the help of the EFI firmware to create memory reservations that persist across kexec. - Add page fault handling to the runtime services support code on x86 so we can more gracefully recover from buggy EFI firmware. - Fix command line handling on x86 for the boot path that omits the stub's PE/COFF entry point. - Other assorted fixes and updates" * 'efi-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86: boot: Fix EFI stub alignment efi/x86: Call efi_parse_options() from efi_main() efi/x86: earlyprintk - Add 64bit efi fb address support efi/x86: drop task_lock() from efi_switch_mm() efi/x86: Handle page faults occurring while running EFI runtime services efi: Make efi_rts_work accessible to efi page fault handler efi/efi_test: add exporting ResetSystem runtime service efi/libstub: arm: support building with clang efi: add API to reserve memory persistently across kexec reboot efi/arm: libstub: add a root memreserve config table efi: honour memory reservations passed via a linux specific config table commit 84db119f5a83e1bf9cffbc6d9cf16487eda1c056 Author: Ding Xiang Date: Fri Aug 24 01:15:05 2018 -0400 ubifs: Remove unneeded semicolon delete redundant semicolon Signed-off-by: Ding Xiang Signed-off-by: Richard Weinberger commit e453fa60e086786fe89ba15ee8fef80bc2e6ecc3 Author: Sascha Hauer Date: Fri Sep 7 14:36:46 2018 +0200 Documentation: ubifs: Add authentication whitepaper Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit d8a22773a12c6d78ee758c9e530f3a488bb7cb29 Author: Sascha Hauer Date: Fri Sep 7 14:36:45 2018 +0200 ubifs: Enable authentication support With the preparations all being done this patch now enables authentication support for UBIFS. Authentication is enabled when the newly introduced auth_key and auth_hash_name mount options are passed. auth_key provides the key which is used for authentication whereas auth_hash_name provides the hashing algorithm used for this FS. Passing these options make authentication mandatory and only UBIFS images that can be authenticated with the given key are allowed. Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit 1e76592f2c3208ac635c2758aa8326d82fa64a72 Author: Sascha Hauer Date: Fri Sep 7 14:36:44 2018 +0200 ubifs: Do not update inode size in-place in authenticated mode In authenticated mode we cannot fixup the inode sizes in-place during recovery as this would invalidate the hashes and HMACs we stored for this inode. Instead, we just write the updated inodes to the journal. We can only do this after ubifs_rcvry_gc_commit() is done though, so for authenticated mode call ubifs_recover_size() after ubifs_rcvry_gc_commit() and not vice versa as normally done. Calling ubifs_recover_size() after ubifs_rcvry_gc_commit() has the drawback that after a commit the size fixup information is gone, so when a powercut happens while recovering from another powercut we may lose some data written right before the first powercut. This is why we only do this in authenticated mode and leave the behaviour for unauthenticated mode untouched. Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit 104115a3eb54e7e804cd4ef1d6426c0b8aaaeb60 Author: Sascha Hauer Date: Fri Sep 7 14:36:43 2018 +0200 ubifs: Add hashes and HMACs to default filesystem This patch calculates the necessary hashes and HMACs for the default filesystem so that the dynamically created default fs can be authenticated. Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit e158e02ff70038936d374928a5484f16daa4c7d4 Author: Sascha Hauer Date: Fri Sep 7 14:36:42 2018 +0200 ubifs: authentication: Authenticate super block node This adds a HMAC covering the super block node and adds the logic that decides if a filesystem shall be mounted unauthenticated or authenticated. Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit b5b1f08369222394540fb4b3b947fe26a2557d1d Author: Sascha Hauer Date: Fri Sep 7 14:36:41 2018 +0200 ubifs: Create hash for default LPT During creation of the default filesystem on an empty flash the default LPT is created. With this patch a hash over the default LPT is calculated which can be added to the default filesystems master node. Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit 625700ccb5069ec81d15aae3b47282ecc59d63b5 Author: Sascha Hauer Date: Fri Sep 7 14:36:40 2018 +0200 ubfis: authentication: Authenticate master node The master node contains hashes over the root index node and the LPT. This patch adds a HMAC to authenticate the master node itself. Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit a1dc58140f7e63e3b23050eb43b4e5581cb28c88 Author: Sascha Hauer Date: Fri Sep 7 14:36:39 2018 +0200 ubifs: authentication: Authenticate LPT The LPT needs to be authenticated aswell. Since the LPT is only written during commit it is enough to authenticate the whole LPT with a single hash which is stored in the master node. Only the leaf nodes (pnodes) are hashed which makes the implementation much simpler than it would be to hash the complete LPT. Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit da8ef65f9573952c717d86f8f501773daf29bd10 Author: Sascha Hauer Date: Fri Sep 7 14:36:38 2018 +0200 ubifs: Authenticate replayed journal Make sure that during replay all buds can be authenticated. To do this we calculate the hash chain until we find an authentication node and check the HMAC in that node against the current status of the hash chain. After a power cut it can happen that some nodes have been written, but not yet the authentication node for them. These nodes have to be discarded during replay. Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit 6f06d96fdf624be3e1d65c6100704a1fd79a30b7 Author: Sascha Hauer Date: Fri Sep 7 14:36:37 2018 +0200 ubifs: Add auth nodes to garbage collector journal head To be able to authenticate the garbage collector journal head add authentication nodes to the buds the garbage collector creates. Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit 6a98bc4614de8fac8c6d520a6b20b194e23c9936 Author: Sascha Hauer Date: Fri Sep 7 14:36:36 2018 +0200 ubifs: Add authentication nodes to journal Nodes that are written to flash can only be authenticated through the index after the next commit. When a journal replay is necessary the nodes are not yet referenced by the index and thus can't be authenticated. This patch overcomes this situation by creating a hash over all nodes beginning from the commit start node over the reference node(s) and the buds themselves. From time to time we insert authentication nodes. Authentication nodes contain a HMAC from the current hash state, so that they can be used to authenticate a journal replay up to the point where the authentication node is. The hash is continued afterwards so that theoretically we would only have to check the HMAC of the last authentication node we find. Overall we get this picture: ,,,,,,,, ,......,........................................... ,. CS , hash1.----. hash2.----. ,. | , . |hmac . |hmac ,. v , . v . v ,.REF#0,-> bud -> bud -> bud.-> auth -> bud -> bud.-> auth ... ,..|...,........................................... , | , , | ,,,,,,,,,,,,,,, . | hash3,----. , | , |hmac , v , v , REF#1 -> bud -> bud,-> auth ... ,,,|,,,,,,,,,,,,,,,,,, v REF#2 -> ... | V ... Note how hash3 covers CS, REF#0 and REF#1 so that it is not possible to exchange or skip any reference nodes. Unlike the picture suggests the auth nodes themselves are not hashed. With this it is possible for an offline attacker to cut each journal head or to drop the last reference node(s), but not to skip any journal heads or to reorder any operations. Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit 16a26b20d2afd0cf063816725b45b12e78d5bb31 Author: Sascha Hauer Date: Fri Sep 7 14:36:35 2018 +0200 ubifs: authentication: Add hashes to index nodes With this patch the hashes over the index nodes stored in the tree node cache are written to flash and are checked when read back from flash. The hash of the root index node is stored in the master node. During journal replay the hashes are regenerated from the read nodes and stored in the tree node cache. This means the nodes must previously be authenticated by other means. This is done in a later patch. Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit 823838a486888cf484e739ab37df14cb04dfddb5 Author: Sascha Hauer Date: Fri Sep 7 14:36:34 2018 +0200 ubifs: Add hashes to the tree node cache As part of the UBIFS authentication support every branch in the index gets a hash covering the referenced node. To make that happen the tree node cache needs hashes over the nodes. This patch adds a hash argument to ubifs_tnc_add() and ubifs_tnc_add_nm(). The hashes are calculated from the callers of these functions which actually prepare the nodes. With this patch all the leaf nodes of the index tree get hashes, but currently nothing is done with these hashes, this is left for a later patch. Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit a384b47e4954a0f834749fcbe1c096c40ff5eb35 Author: Sascha Hauer Date: Fri Sep 7 14:36:33 2018 +0200 ubifs: Create functions to embed a HMAC in a node With authentication support some nodes (master node, super block node) get a HMAC embedded into them. This patch adds functions to prepare and write such a node. The difficulty is that besides the HMAC the nodes also have a CRC which must stay valid. This means we first have to initialize all fields in the node, then calculate the HMAC (not covering the CRC) and finally calculate the CRC. Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit 49525e5eecca5e1b4a83ac217868e8d8b843539f Author: Sascha Hauer Date: Fri Sep 7 14:36:32 2018 +0200 ubifs: Add helper functions for authentication support This patch adds the various helper functions needed for authentication support. We need functions to hash nodes, to embed HMACs into a node and to compare hashes and HMACs. Most functions first check if this filesystem is authenticated and bail out early if not, which makes the functions safe to be called with disabled authentication. Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit dead97266f1034d1cabd9a50641163d909559816 Author: Sascha Hauer Date: Fri Sep 7 14:36:31 2018 +0200 ubifs: Add separate functions to init/crc a node When adding authentication support we will embed a HMAC into some nodes. To prepare these nodes we have to first initialize the nodes, then add a HMAC and finally add a CRC. To accomplish this add separate ubifs_init_node/ubifs_crc_node functions. Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit 5125cfdff13a4da4c34a053cd67e99083aece028 Author: Sascha Hauer Date: Fri Sep 7 14:36:30 2018 +0200 ubifs: Format changes for authentication support This patch adds the changes to the on disk format needed for authentication support. We'll add: * a HMAC covering super block node * a HMAC covering the master node * a hash over the root index node to the master node * a hash over the LPT to the master node * a flag to the filesystem flag indicating the filesystem is authenticated * an authentication node necessary to authenticate the nodes written to the journal heads while they are written. * a HMAC of a well known message to the super block node to be able to check if the correct key is provided And finally, not visible in this patch, nevertheless explained here: * hashes over the referenced child nodes in each branch of a index node Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit fd6150051becd3a9f8039046e3af91fd9ef01e57 Author: Sascha Hauer Date: Fri Sep 7 14:36:29 2018 +0200 ubifs: Store read superblock node The superblock node is read/modified/written several times throughout the UBIFS code. Instead of reading it from the device each time just keep a copy in memory and write back the modified copy when necessary. This patch helps for authentication support, here we not only have to read the superblock node, but also have to authenticate it, which is easier if we do it once during initialization. Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit 83407437bbeae39551195861e51608c9638ffda4 Author: Sascha Hauer Date: Fri Sep 7 14:36:28 2018 +0200 ubifs: Drop write_node write_node() is used only once and can easily be replaced with calls to ubifs_prepare_node()/write_head() which makes the code a bit shorter. Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit e635cf8c3bbd7b9bd3e282156c6cc4f818b72ee9 Author: Sascha Hauer Date: Fri Sep 7 14:36:27 2018 +0200 ubifs: Implement ubifs_lpt_lookup using ubifs_pnode_lookup ubifs_lpt_lookup() starts by looking up the nth pnode in the LPT. We already have this functionality in ubifs_pnode_lookup(). Use this function rather than open coding its functionality. Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit 0e26b6e2551e21df72c140e46819523e1b686009 Author: Sascha Hauer Date: Fri Sep 7 14:36:26 2018 +0200 ubifs: Export pnode_lookup as ubifs_pnode_lookup ubifs_lpt_lookup could be implemented using pnode_lookup. To make that possible move pnode_lookup from lpt.c to lpt_commit.c. Rename it to ubifs_pnode_lookup since it's now exported. Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit 22ceaa8c688d0c8a6fc6eb7ebf32c01914220d0a Author: Sascha Hauer Date: Fri Sep 7 14:36:25 2018 +0200 ubifs: Pass ubifs_zbranch to read_znode() read_znode() takes len, lnum and offs arguments which the caller all extracts from the same struct ubifs_zbranch *. When adding authentication support we would have to add a pointer to a hash to the arguments which is also part of struct ubifs_zbranch. Pass the ubifs_zbranch * instead so that we do not have to add another argument. Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit 545bc8f6b0c60eee789a91ac1f8c9a16467b2fc5 Author: Sascha Hauer Date: Fri Sep 7 14:36:24 2018 +0200 ubifs: Pass ubifs_zbranch to try_read_node() try_read_node() takes len, lnum and offs arguments which the caller all extracts from the same struct ubifs_zbranch *. When adding authentication support we would have to add a pointer to a hash to the arguments which is also part of struct ubifs_zbranch. Pass the ubifs_zbranch * instead so that we do not have to add another argument. Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit c4de6d7e4319ffb52d6db3138057712749540191 Author: Sascha Hauer Date: Fri Sep 7 14:36:23 2018 +0200 ubifs: Refactor create_default_filesystem() create_default_filesystem() allocates memory for a node, writes that node and frees the memory directly afterwards. With this patch we allocate memory for all nodes at the beginning of the function and free the memory at the end. This makes it easier to implement authentication support since with authentication support we'll need the contents of some nodes when creating other nodes. Signed-off-by: Sascha Hauer Signed-off-by: Richard Weinberger commit 7e5583fd77194b45eef04835576a4fe7f3f235c8 Author: Gustavo A. R. Silva Date: Fri Oct 5 10:29:31 2018 +0200 ubi: Mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Addresses-Coverity-ID: 1373884 ("Missing break in switch") Addresses-Coverity-ID: 114869 ("Missing break in switch") Addresses-Coverity-ID: 114870 ("Missing break in switch") Signed-off-by: Gustavo A. R. Silva Signed-off-by: Richard Weinberger commit 46011e9755e9af6ef90bb59522d315d781d2307b Merge: 5099bc83ba11 7ffa13be4945 Author: Jiri Kosina Date: Tue Oct 23 13:36:28 2018 +0200 Merge branch 'for-4.20/multitouch' into for-linus hid-multitouch driver cleanup commit 5099bc83ba11ff38a530ebebed678f23877a2b2d Merge: 276e722761a1 830e82aa48f3 Author: Jiri Kosina Date: Tue Oct 23 13:36:05 2018 +0200 Merge branch 'for-4.20/microsoft' into for-linus Rumble support for Xbox One S commit 276e722761a1c7903fbfb065420fd1850b00f1dd Merge: 4e7be68e8d0f d9ca1c990a7f Author: Jiri Kosina Date: Tue Oct 23 13:35:22 2018 +0200 Merge branch 'for-4.20/logitech-highres' into for-linus High-resolution support for hid-logitech commit 4e7be68e8d0f7bb3c030cdfa442d298457197751 Merge: a600ffe6ec60 9ee3e06610fd Author: Jiri Kosina Date: Tue Oct 23 13:34:28 2018 +0200 Merge branch 'for-4.20/i2c-hid' into for-linus - general cleanups of hid-i2c driver - SPIODEV device descriptor fixes commit cee1352f792646ae87e65f8bfb0ae91ff3d2cb95 Merge: e2b623fbe6a3 d0346559a7c3 Author: Linus Torvalds Date: Tue Oct 23 12:31:17 2018 +0100 Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RCU updates from Ingo Molnar: "The biggest change in this cycle is the conclusion of the big 'simplify RCU to two primary flavors' consolidation work - i.e. there's a single RCU flavor for any kernel variant (PREEMPT and !PREEMPT): - Consolidate the RCU-bh, RCU-preempt, and RCU-sched flavors into a single flavor similar to RCU-sched in !PREEMPT kernels and into a single flavor similar to RCU-preempt (but also waiting on preempt-disabled sequences of code) in PREEMPT kernels. This branch also includes a refactoring of rcu_{nmi,irq}_{enter,exit}() from Byungchul Park. - Now that there is only one RCU flavor in any given running kernel, the many "rsp" pointers are no longer required, and this cleanup series removes them. - This branch carries out additional cleanups made possible by the RCU flavor consolidation, including inlining now-trivial functions, updating comments and definitions, and removing now-unneeded rcutorture scenarios. - Now that there is only one flavor of RCU in any running kernel, there is also only on rcu_data structure per CPU. This means that the rcu_dynticks structure can be merged into the rcu_data structure, a task taken on by this branch. This branch also contains a -rt-related fix from Mike Galbraith. There were also other updates: - Documentation updates, including some good-eye catches from Joel Fernandes. - SRCU updates, most notably changes enabling call_srcu() to be invoked very early in the boot sequence. - Torture-test updates, including some preliminary work towards making rcutorture better able to find problems that result in insufficient grace-period forward progress. - Initial changes to RCU to better promote forward progress of grace periods, including fixing a bug found by Marius Hillenbrand and David Woodhouse, with the fix suggested by Peter Zijlstra" * 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (140 commits) srcu: Make early-boot call_srcu() reuse workqueue lists rcutorture: Test early boot call_srcu() srcu: Make call_srcu() available during very early boot rcu: Convert rcu_state.ofl_lock to raw_spinlock_t rcu: Remove obsolete ->dynticks_fqs and ->cond_resched_completed rcu: Switch ->dynticks to rcu_data structure, remove rcu_dynticks rcu: Switch dyntick nesting counters to rcu_data structure rcu: Switch urgent quiescent-state requests to rcu_data structure rcu: Switch lazy counts to rcu_data structure rcu: Switch last accelerate/advance to rcu_data structure rcu: Switch ->tick_nohz_enabled_snap to rcu_data structure rcu: Merge rcu_dynticks structure into rcu_data structure rcu: Remove unused rcu_dynticks_snap() from Tiny RCU rcu: Convert "1UL << x" to "BIT(x)" rcu: Avoid resched_cpu() when rescheduling the current CPU rcu: More aggressively enlist scheduler aid for nohz_full CPUs rcu: Compute jiffies_till_sched_qs from other kernel parameters rcu: Provide functions for determining if call_rcu() has been invoked rcu: Eliminate ->rcu_qs_ctr from the rcu_dynticks structure rcu: Motivate Tiny RCU forward progress ... commit a600ffe6ec609b0600ec590236f97f8d430e0984 Merge: d19031d32cd7 23e542e5ba5e Author: Jiri Kosina Date: Tue Oct 23 13:19:54 2018 +0200 Merge branch 'for-4.20/google' into for-linus Whisker device specific fixes to hid-google driver commit d19031d32cd77b2878a006040e0f8e4183ca59ef Merge: d93af50ed68c 75f1f19bdd60 Author: Jiri Kosina Date: Tue Oct 23 13:19:03 2018 +0200 Merge branch 'for-4.20/cougar' into for-linus Functional fixes for hid-cougar driver commit d93af50ed68c0f079fa10491c6bd56daf74d601b Merge: 037ad063f797 8473a93d1ba5 Author: Jiri Kosina Date: Tue Oct 23 13:17:27 2018 +0200 Merge branch 'for-4.20/core' into for-linus Fixes and new features for driver core. Highlights: - maximum global item tag report size gets increased to 256 - improved INPUT_PROP reporting for Digitizer devices commit 037ad063f7977176323da9299102e706674486e5 Merge: 472475000979 256a90ed9e46 Author: Jiri Kosina Date: Tue Oct 23 13:17:00 2018 +0200 Merge branch 'for-4.20/bigbenff' into for-linus Driver for BigBen Interactive PS3OFMINIPAD commit 472475000979a156bc32cd75caa59737f5a1caa5 Merge: 712fca63f50a 9d7b18668956 Author: Jiri Kosina Date: Tue Oct 23 13:16:33 2018 +0200 Merge branch 'for-4.20/apple' into for-linus Support for Apple Magic Trackpad 2 commit 712fca63f50a87780ca6dc105370557a945a7ee8 Merge: 9ff3541e3ddf ce9d58d3eafc Author: Jiri Kosina Date: Tue Oct 23 13:15:57 2018 +0200 Merge branch 'for-4.19/fixes' into for-linus A few device ID-specific quirks commit dda93b45389f025fd3422d22cc31cc1ea6040305 Merge: 2e62024c265a b61b8bba18fe Author: Ingo Molnar Date: Tue Oct 23 12:30:19 2018 +0200 Merge branch 'x86/cache' into perf/core, to pick up fixes Signed-off-by: Ingo Molnar commit e2b623fbe6a34bce1332584212ae101ebc2508f5 Merge: 70408a9987d1 f822ad2c2c03 Author: Linus Torvalds Date: Tue Oct 23 11:14:47 2018 +0100 Merge tag 's390-4.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Martin Schwidefsky: - Improved access control for the zcrypt driver, multiple device nodes can now be created with different access control lists - Extend the pkey API to provide random protected keys, this is useful for encrypted swap device with ephemeral protected keys - Add support for virtually mapped kernel stacks - Rework the early boot code, this moves the memory detection into the boot code that runs prior to decompression. - Add KASAN support - Bug fixes and cleanups * tag 's390-4.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (83 commits) s390/pkey: move pckmo subfunction available checks away from module init s390/kasan: support preemptible kernel build s390/pkey: Load pkey kernel module automatically s390/perf: Return error when debug_register fails s390/sthyi: Fix machine name validity indication s390/zcrypt: fix broken zcrypt_send_cprb in-kernel api function s390/vmalloc: fix VMALLOC_START calculation s390/mem_detect: add missing include s390/dumpstack: print psw mask and address again s390/crypto: Enhance paes cipher to accept variable length key material s390/pkey: Introduce new API for transforming key blobs s390/pkey: Introduce new API for random protected key verification s390/pkey: Add sysfs attributes to emit secure key blobs s390/pkey: Add sysfs attributes to emit protected key blobs s390/pkey: Define protected key blob format s390/pkey: Introduce new API for random protected key generation s390/zcrypt: add ap_adapter_mask sysfs attribute s390/zcrypt: provide apfs failure code on type 86 error reply s390/zcrypt: zcrypt device driver cleanup s390/kasan: add support for mem= kernel parameter ... commit 70408a9987d1ffac006e21b965f0c30dd22b0af2 Merge: a4648c75b95d 02b4da5f84d1 Author: Linus Torvalds Date: Tue Oct 23 11:06:43 2018 +0100 Merge tag 'please-pull-next' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux Pull ia64 updates from Tony Luck: "Miscellaneous ia64 fixes from Christoph" * tag 'please-pull-next' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux: intel-iommu: mark intel_dma_ops static ia64: remove machvec_dma_sync_{single,sg} ia64/sn2: remove no-ops dma sync methods ia64: remove the unused iommu_dma_init function ia64: remove the unused pci_iommu_shutdown function ia64: remove the unused bad_dma_address symbol ia64: remove iommu_dma_supported ia64: remove the dead iommu_sac_force variable ia64: remove the kern_mem_attribute export commit a4648c75b95d972e08f84529c4e8ee4f81cf09e4 Merge: 58a022870787 7250f422da04 Author: Linus Torvalds Date: Tue Oct 23 11:02:05 2018 +0100 Merge branch 'stable/for-linus-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/swiotlb Pull xen swiotlb fix from Konrad Rzeszutek Wilk: "One tiny fix for the Xen SWIOTLB mechanism that occasionally happened with devices that didn't allocate size in power of two but rather some odd sizes. We neglected to make the memory coherent leading to all kinds of fun crashes" * 'stable/for-linus-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/swiotlb: xen-swiotlb: use actually allocated size on check physical continuous commit 6be0f96d799f487f05eb412d362d5a1747d665c2 Author: Olivier Moysan Date: Mon Oct 22 17:10:46 2018 +0200 ASoC: stm32: sai: fix master clock naming Fixes: 8307b2afd386 ("ASoC: stm32: sai: set sai as mclk clock provider") Fix warning issued by strncat when bound equals to source length. Signed-off-by: Olivier Moysan Signed-off-by: Mark Brown commit e6d7942ce602e99d506a7c08f1935a274645dfda Author: Olivier Moysan Date: Mon Oct 22 17:10:45 2018 +0200 ASoC: stm32: add clock dependency for sai Fixes: 8307b2afd386 ("ASoC: stm32: sai: set sai as mclk clock provider") Add COMMON_CLK dependency for STM32 SAI, as it is required by clock provider. Signed-off-by: Olivier Moysan Signed-off-by: Mark Brown commit 58a0228707870c8330917f919804986855443a19 Merge: 12dd08fa954f 0a1875ad29ef Author: Linus Torvalds Date: Tue Oct 23 10:33:16 2018 +0100 Merge tag 'acpi-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI updates from Rafael Wysocki: "These fix ACPICA issues related to the handling of module-level AML, fix an ordering issue during ACPI initialization, update ACPICA to upstream revision 20181003 (including fixes mostly), fix issues with system-wide suspend/resume related to the ACPI driver for Intel SoCs (LPSS), fix device enumeration issues on boards with Dollar Cove or Whiskey Cove Intel PMICs, prevent ACPICA from calling ktime_get() in unsuitable conditions, update a few drivers and clean up some code in several places. Specifics: - Fix ACPICA issues related to the handling of module-level AML and make the ACPI initialization code parse ECDT before loading the definition block tables (Erik Schmauss). - Update ACPICA to upstream revision 20181003 including fixes related to the ill-defined "generic serial bus" and the handling of the _REG object (Bob Moore). - Fix some issues with system-wide suspend/resume on Intel BYT/CHT related to the handling of I2C controllers in the ACPI LPSS driver for Intel SoCs (Hans de Goede). - Modify the ACPI namespace scanning code to enumerate INT33FE HID devices as platform devices with I2C resources to avoid device enumeration problems on boards with Dollar Cove or Whiskey Cove Intel PMICs (Hans de Goede). - Prevent ACPICA from using ktime_get() during early resume from system-wide suspend before resuming the timekeeping which generally is unsafe and triggers a warning from the timekeeping code (Bart Van Assche). - Add low-level real time clock support to the ACPI Time and Aalarm Device (TAD) driver (Rafael Wysocki). - Fix the ACPI SBS driver to avoid GPE storms on MacBook Pro and Oopses when removing modules (Ronald Tschalär). - Fix the ACPI PPTT parsing code to handle architecturally unknown cache types properly (Jeffrey Hugo). - Fix initialization issue in the ACPI processor driver (Dou Liyang). - Clean up the code in several places (Andy Shevchenko, Bartlomiej Zolnierkiewicz, David Arcari, zhong jiang)" * tag 'acpi-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (33 commits) ACPI / scan: Create platform device for INT33FE ACPI nodes ACPI / OSL: Use 'jiffies' as the time bassis for acpi_os_get_timer() ACPI: probe ECDT before loading AML tables regardless of module-level code flag ACPICA: Remove acpi_gbl_group_module_level_code and only use acpi_gbl_execute_tables_as_methods instead ACPICA: AML Parser: fix parse loop to correctly skip erroneous extended opcodes ACPICA: AML interpreter: add region addresses in global list during initialization ACPI: TAD: Add low-level support for real time capability ACPI: remove redundant 'default n' from Kconfig ACPI / SBS: Fix rare oops when removing modules ACPI / SBS: Fix GPE storm on recent MacBookPro's ACPI/PPTT: Handle architecturally unknown cache types drivers: base: cacheinfo: Do not populate sysfs for unknown cache types ACPICA: Update version to 20181003 ACPICA: Never run _REG on system_memory and system_IO ACPICA: Split large interpreter file ACPICA: Update for field unit access ACPICA: Rename some of the Field Attribute defines ACPICA: Update for generic_serial_bus and attrib_raw_process_bytes protocol ACPI / processor: Fix the return value of acpi_processor_ids_walk() ACPI / LPSS: Resume BYT/CHT I2C controllers from resume_noirq ... commit 12dd08fa954fb7c327382ead3bb9ac861f9b9b69 Merge: 72f86d080560 cc19b05e3883 Author: Linus Torvalds Date: Tue Oct 23 10:28:21 2018 +0100 Merge tag 'pm-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "These make hibernation on 32-bit x86 systems work in all of the cases in which it works on 64-bit x86 ones, update the menu cpuidle governor and the "polling" state to make them more efficient, add more hardware support to cpufreq drivers and fix issues with some of them, fix a bug in the conservative cpufreq governor, fix the operating performance points (OPP) framework and make it more stable, update the devfreq subsystem to take changes in the APIs used by into account and clean up some things all over. Specifics: - Backport hibernation bug fixes from x86-64 to x86-32 and consolidate hibernation handling on x86 to allow 32-bit systems to work in all of the cases in which 64-bit ones work (Zhimin Gu, Chen Yu). - Fix hibernation documentation (Vladimir D. Seleznev). - Update the menu cpuidle governor to fix a couple of issues with it, make it more efficient in some cases and clean it up (Rafael Wysocki). - Rework the cpuidle polling state implementation to make it more efficient (Rafael Wysocki). - Clean up the cpuidle core somewhat (Fieah Lim). - Fix the cpufreq conservative governor to take policy limits into account properly in some cases (Rafael Wysocki). - Add support for retrieving guaranteed performance information to the ACPI CPPC library and make the intel_pstate driver use it to expose the CPU base frequency via sysfs on systems with the hardware-managed P-states (HWP) feature enabled (Srinivas Pandruvada). - Fix clang warning in the CPPC cpufreq driver (Nathan Chancellor). - Get rid of device_node.name printing from cpufreq (Rob Herring). - Remove unnecessary unlikely() from the cpufreq core (Igor Stoppa). - Add support for the r8a7744 SoC to the cpufreq-dt driver (Biju Das). - Update the dt-platdev cpufreq driver to allow RK3399 to have separate tunables per cluster (Dmitry Torokhov). - Fix the dma_alloc_coherent() usage in the tegra186 cpufreq driver (Christoph Hellwig). - Make the imx6q cpufreq driver read OCOTP through nvmem for imx6ul/imx6ull (Anson Huang). - Fix several bugs in the operating performance points (OPP) framework and make it more stable (Viresh Kumar, Dave Gerlach). - Update the devfreq subsystem to take changes in the APIs used by into account, fix some issues with it and make it stop print device_node.name directly (Bjorn Andersson, Enric Balletbo i Serra, Matthias Kaehlcke, Rob Herring, Vincent Donnefort, zhong jiang). - Prepare the generic power domains (genpd) framework for dealing with domains containing CPUs (Ulf Hansson). - Prevent sysfs attributes representing low-power S0 residency counters from being exposed if low-power S0 support is not indicated in ACPI FADT (Rajneesh Bhardwaj). - Get rid of custom CPU features macros for Intel CPUs from the intel_idle and RAPL drivers (Andy Shevchenko). - Update the tasks freezer to list tasks that refused to freeze and caused a system transition to a sleep state to be aborted (Todd Brandt). - Update the pm-graph set of tools to v5.2 (Todd Brandt). - Fix some issues in the cpupower utility (Anders Roxell, Prarit Bhargava)" * tag 'pm-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (73 commits) PM / Domains: Document flags for genpd PM / Domains: Deal with multiple states but no governor in genpd PM / Domains: Don't treat zero found compatible idle states as an error cpuidle: menu: Avoid computations when result will be discarded cpuidle: menu: Drop redundant comparison cpufreq: tegra186: don't pass GFP_DMA32 to dma_alloc_coherent() cpufreq: conservative: Take limits changes into account properly Documentation: intel_pstate: Add base_frequency information cpufreq: intel_pstate: Add base_frequency attribute ACPI / CPPC: Add support for guaranteed performance cpuidle: menu: Simplify checks related to the polling state PM / tools: sleepgraph and bootgraph: upgrade to v5.2 PM / tools: sleepgraph: first batch of v5.2 changes cpupower: Fix coredump on VMWare cpupower: Fix AMD Family 0x17 msr_pstate size cpufreq: imx6q: read OCOTP through nvmem for imx6ul/imx6ull cpufreq: dt-platdev: allow RK3399 to have separate tunables per cluster cpuidle: poll_state: Revise loop termination condition cpuidle: menu: Move the latency_req == 0 special case check cpuidle: menu: Avoid computations for very close timers ... commit 72f86d080560d77069dd67b067a69578731320e4 Merge: c403993a41d5 95691e3eddc4 Author: Linus Torvalds Date: Tue Oct 23 10:22:33 2018 +0100 Merge branch 'pcmcia-next' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux Pull pcmcia fixes from Dominik Brodowski: "These are just a few odd fixes and improvements to the PCMCIA core and to a few PCMCIA device drivers" * 'pcmcia-next' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux: pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges pcmcia: pcmcia_resource: Replace mdelay() with msleep() pcmcia: add error handling for pcmcia_enable_device in qlogic_stub char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in set_protocol pcmcia: Use module_pcmcia_driver for scsi drivers pcmcia: remove KERN_INFO level from debug message commit c403993a41d50db1e7d9bc2d43c3c8498162312f Merge: 6fd577cd4b25 0711e8c1b457 Author: Linus Torvalds Date: Tue Oct 23 09:42:05 2018 +0100 Merge tag 'for-linus-4.20' of https://github.com/cminyard/linux-ipmi Pull IPMI updates from Corey Minyard: "Lots of small changes to the IPMI driver. Most of the changes are logging cleanup and style fixes. There are a few smaller bug fixes" * tag 'for-linus-4.20' of https://github.com/cminyard/linux-ipmi: (21 commits) ipmi: Fix timer race with module unload ipmi:ssif: Add support for multi-part transmit messages > 2 parts MAINTAINERS: Add file patterns for ipmi device tree bindings ipmi: Remove platform driver overrides and use the id_table ipmi: Free the address list on module cleanup ipmi: Don't leave holes in the I2C address list in the ssif driver ipmi: fix return value of ipmi_set_my_LUN ipmi: Convert pr_xxx() to dev_xxx() in the BT code ipmi:dmi: Ignore IPMI SMBIOS entries with a zero base address ipmi:dmi: Use pr_fmt in the IPMI DMI code ipmi: Change to ktime_get_ts64() ipmi_si: fix potential integer overflow on large shift ipmi_si_pci: fix NULL device in ipmi_si error message ipmi: Convert printk(KERN_ to pr_( ipmi: Use more common logging styles ipmi: msghandler: Add and use pr_fmt and dev_fmt, remove PFX pci:ipmi: Move IPMI PCI class id defines to pci_ids.h ipmi: Finally get rid of ipmi_user_t and ipmi_smi_t ipmi:powernv: Convert ipmi_smi_t to struct ipmi_smi hwmon:ibm: Change ipmi_user_t to struct ipmi_user * ... commit 6eb357844373f833f085e63e6c8c026a61568c57 Author: Nathan Chancellor Date: Wed Sep 26 20:33:17 2018 -0700 mfd: cros_ec: Avoid unneeded internal declaration warning Clang warns: drivers/mfd/cros_ec_dev.c:509:40: warning: variable 'cros_ec_id' is not needed and will not be emitted [-Wunneeded-internal-declaration] static const struct platform_device_id cros_ec_id[] = { ^ 1 warning generated. Avoid this warning by adding it to the cros_ec_dev_driver definition under the id_table member like all other platform drivers. Signed-off-by: Nathan Chancellor Signed-off-by: Lee Jones commit 697894b9b8478764d59e1e1ae6caa4e9dd11eb51 Author: Pavel Machek Date: Tue Sep 11 23:06:50 2018 +0200 mfd: ti-lmu: Use of_device_get_match_data() helper Replace of_match_device() with of_device_get_match_data(), which slightly decreases lines of code and allows to move the DT table next to the I2C table. Signed-off-by: Sebastian Reichel Signed-off-by: Pavel Machek Signed-off-by: Lee Jones commit 7891d37509cca01f383e8349831ee0adc0724e77 Author: Pavel Machek Date: Tue Sep 11 23:03:44 2018 +0200 mfd: ti-lmu: Use managed resource for everything This replaces all remaining unmanaged resources with device managed ones, so that the remove function is no longer needed. This makes the code slightly shorter and fixes two problems: 1. The hardware is disabled after the child devices have been removed. Previously there was a potential race condition. 2. The hardware is disabled when mfd_add_devices fails during probe. Signed-off-by: Sebastian Reichel Signed-off-by: Pavel Machek Signed-off-by: Lee Jones commit 7a6a395b16c3fdcd2ede2b0ce4bf63f6dafc1fea Author: Pavel Machek Date: Tue Sep 11 23:01:33 2018 +0200 mfd: ti-lmu: Switch to GPIOD Use new descriptor based API instead of the legacy one. Signed-off-by: Sebastian Reichel Signed-off-by: Pavel Machek Signed-off-by: Lee Jones commit 5b6850fa90c581f3743bb369861074d23d0e9f3c Author: Sebastian Reichel Date: Wed Aug 29 11:31:09 2018 +0200 mfd: ti-lmu: constify mfd_cell tables Add const attribute to all mfd_cell structures. Signed-off-by: Sebastian Reichel Signed-off-by: Pavel Machek Signed-off-by: Lee Jones commit c1aaaa1cb7c82fe53463fba4928405fddcc4ea27 Author: Marek Szyprowski Date: Wed Sep 5 16:36:06 2018 +0200 mfd: max8997: Disable interrupt handling for suspend/resume cycle Disable IRQs during suspend/resume cycle to ensure handling of wakeup interrupts (i.e. RTC wake alarm) after max8997_resume(). This way it can be properly handled when I2C bus is finally available. This pattern is also used in other MAX PMIC MFD drivers. Signed-off-by: Marek Szyprowski Reviewed-by: Krzysztof Kozlowski Signed-off-by: Lee Jones commit efddff27c886e729a7f84a7205bd84d7d4af7336 Author: Marek Szyprowski Date: Wed Sep 5 13:54:07 2018 +0200 mfd: max8997: Enale irq-wakeup unconditionally IRQ wake up support for MAX8997 driver was initially configured by respective property in pdata. However, after the driver conversion to device-tree, setting it was left as 'todo'. Nowadays most of other PMIC MFD drivers initialized from device-tree assume that they can be an irq wakeup source, so enable it also for MAX8997. This fixes support for wakeup from MAX8997 RTC alarm. Signed-off-by: Marek Szyprowski Reviewed-by: Krzysztof Kozlowski Signed-off-by: Lee Jones commit 8e27a5638ab5c1b5434a0c22bc43ec6c3f7f5b6b Author: Colin Ian King Date: Tue Sep 4 15:15:53 2018 +0100 mfd: arizona: Make array mclk_name static, shrinks object size Don't populate the array mclk_name on the stack but instead make it static. Makes the object code smaller by 23 bytes: Before: text data bss dec hex filename 38050 11604 64 49718 c236 linux/drivers/mfd/arizona-core.o After: text data bss dec hex filename 38027 11604 64 49695 c21f linux/drivers/mfd/arizona-core.o (gcc version 8.2.0 x86_64) Signed-off-by: Colin Ian King Acked-by: Charles Keepax Signed-off-by: Lee Jones commit 1e984d6d3b3f150a7344fb16b8d52cad7298713c Author: Andy Shevchenko Date: Thu Aug 30 19:52:55 2018 +0300 MAINTAINERS: Add myself as designated reviewer of Intel MFD PMIC There are few Intel MFD PMIC device drivers which I would like to review. Note, Intel MSIC is old system controller that based mostly on PMIC integrated in it. Thus, I included it as well. Signed-off-by: Andy Shevchenko Reviewed-by: Mika Westerberg Signed-off-by: Lee Jones commit 26c7e05a69d3843abb0e5389e7f538cd175c0f09 Author: Andy Shevchenko Date: Thu Aug 30 19:52:54 2018 +0300 mfd: Convert Intel PMIC drivers to use SPDX identifier 1;5201;0c Reduce size of duplicated comments by switching to use SPDX identifier. No functional change. Signed-off-by: Andy Shevchenko Reviewed-by: Mika Westerberg Signed-off-by: Lee Jones commit 51eeee8e4e41b110b1afa374a9e7a532f4fb3e24 Author: Andy Shevchenko Date: Thu Aug 30 19:52:53 2018 +0300 mfd: Sort headers alphabetically for Intel PMIC drivers Sort headers alphabetically for better maintenance. No functional change. Signed-off-by: Andy Shevchenko Reviewed-by: Mika Westerberg Signed-off-by: Lee Jones commit 9f8ddee1dab836ca758ca8fc555ab5a3aaa5d3fd Author: Andy Shevchenko Date: Thu Aug 30 19:52:52 2018 +0300 mfd: intel_soc_pmic_bxtwc: Chain power button IRQs as well Power button IRQ actually has a second level of interrupts to distinguish between UI and POWER buttons. Moreover, current implementation looks awkward in approach to handle second level IRQs by first level related IRQ chip. To address above issues, split power button IRQ to be chained as well. Signed-off-by: Andy Shevchenko Reviewed-by: Mika Westerberg Signed-off-by: Lee Jones commit 8bd2d03e54bbe2c75802c81f5635ebb4c36f7a2c Author: Andy Shevchenko Date: Thu Aug 30 19:52:51 2018 +0300 mfd: intel_soc_pmic_crc: Use REGMAP_IRQ_REG() macro Instead of open coding each data structure with regmap IRQresources, use dedicated macro. No functional change intended. Signed-off-by: Andy Shevchenko Reviewed-by: Mika Westerberg Signed-off-by: Lee Jones commit 0ce8ea71fae006fce5ddd7fc6f22d1a6c72375a6 Author: Andy Shevchenko Date: Thu Aug 30 19:52:50 2018 +0300 mfd: intel_soc_pmic_crc: Use DEFINE_RES_IRQ_NAMED() macro Instead of open coding each data structure with IRQ resources, use dedicated macro. No functional change intended. Signed-off-by: Andy Shevchenko Reviewed-by: Mika Westerberg Signed-off-by: Lee Jones commit 95d617b4d66cd783f643cb763c096c2ce5f6b490 Author: Andy Shevchenko Date: Thu Aug 30 19:52:49 2018 +0300 mfd: intel_msic: Use DEFINE_RES_IRQ() macro Instead of open coding each data structure with IRQ resources, use dedicated macro. In one case use DEFINE_RES_IRQ_NAMED() and DEFINE_RES_MEM_NAMED(). No functional change intended. Signed-off-by: Andy Shevchenko Reviewed-by: Mika Westerberg Signed-off-by: Lee Jones commit 86f955d29ff83e15da62ad5de53a5480309da078 Author: Sebastian Reichel Date: Wed Aug 29 11:31:04 2018 +0200 mfd: motorola-cpcap: Add audio-codec support Add support for the audio-codec node by converting from devm_of_platform_populate() to devm_mfd_add_devices(). Tested-by: Pavel Machek Acked-by: Tony Lindgren Signed-off-by: Sebastian Reichel Signed-off-by: Pavel Machek Signed-off-by: Lee Jones commit 55143439b7b501882bea9d95a54adfe00ffc79a3 Author: Fabio Estevam Date: Tue Aug 28 17:02:40 2018 -0300 mfd: mc13xxx-core: Fix PMIC shutdown when reading ADC values When trying to read any MC13892 ADC channel on a imx51-babbage board: The MC13892 PMIC shutdowns completely. After debugging this issue and comparing the MC13892 and MC13783 initializations done in the vendor kernel, it was noticed that the CHRGRAWDIV bit of the ADC0 register was not being set. This bit is set by default after power on, but the driver was clearing it. After setting this bit it is possible to read the ADC values correctly. Signed-off-by: Fabio Estevam Tested-by: Chris Healy Signed-off-by: Lee Jones commit 6360e40f421fba0a11bbabaa211c9c22c5cf5e61 Author: Richard Fitzgerald Date: Tue Aug 28 09:41:58 2018 +0100 mfd: madera: Remove unused forward reference The madera_irqchip_pdata struct was replaced by the irq_flags member of struct madera_pdata so the forward reference is obsolete. Signed-off-by: Richard Fitzgerald Signed-off-by: Lee Jones commit 75a11072c462e69b7b2392b181ec1752a05f620d Author: Rob Herring Date: Mon Aug 27 20:52:31 2018 -0500 mfd: max77620: Convert to using %pOFn instead of device_node.name In preparation to remove the node name pointer from struct device_node, convert printf users to use the %pOFn format specifier. Signed-off-by: Rob Herring Signed-off-by: Lee Jones commit b04e68d16605dcde1c21b5df5f86a5372e53ae97 Author: Richard Fitzgerald Date: Mon Aug 27 14:51:15 2018 +0100 mfd: madera: Don't use regmap_read_poll_timeout to poll for BOOT_DONE While polling for BOOT_DONE the chip could NAK a read because it is still booting, which would terminate the regmap_read_poll_timeout() with an error. Instead implement a polling loop that ignores read errors so we always poll until the chip signals boot or the loop times out. Signed-off-by: Richard Fitzgerald Signed-off-by: Lee Jones commit 6b269a41a4520f7eb639e61a45ebbb9c9267d5e0 Author: Sapthagiri Baratam Date: Tue Aug 21 19:52:44 2018 +0530 mfd: arizona: Correct calling of runtime_put_sync Don't call runtime_put_sync when clk32k_ref is ARIZONA_32KZ_MCLK2 as there is no corresponding runtime_get_sync call. MCLK1 is not in the AoD power domain so if it is used as 32kHz clock source we need to hold a runtime PM reference to keep the device from going into low power mode. Fixes: cdd8da8cc66b ("mfd: arizona: Add gating of external MCLKn clocks") Signed-off-by: Sapthagiri Baratam Acked-by: Charles Keepax Signed-off-by: Lee Jones commit 3d51ec93a564a0f87d1276f067732be904816a53 Author: Paul Cercueil Date: Tue Aug 21 19:16:12 2018 +0200 mfd: Add ingenic-tcu.h header This header contains macros for the registers that are present in the regmap shared by all the drivers related to the TCU (Timer Counter Unit) of the Ingenic JZ47xx SoCs. Signed-off-by: Paul Cercueil Signed-off-by: Lee Jones commit 61cc15dac01ae84281222452e338ca060179d8b1 Author: RaviChandra Sadineni Date: Mon Aug 20 08:34:19 2018 -0700 mfd: cros_ec: Check for mkbp events on resume only if supported. Currently on every resume we check for mkbp events and notify the clients. This helps in identifying the wakeup sources. But on devices that do not support mkbp protocol, we might end up querying key state of the keyboard in a loop which blocks the resume. Instead check for events only if mkbp is supported. Signed-off-by: RaviChandra Sadineni Reported-by: Marek Szyprowski Tested-by: Marek Szyprowski Signed-off-by: Lee Jones commit 4ded11d1cf128db8b5d5b57db3a50dd124358520 Author: Michael Hennerich Date: Tue Aug 14 13:31:59 2018 +0200 mfd: adp5520: Update MODULE AUTHOR email address No functional changes Signed-off-by: Michael Hennerich Signed-off-by: Lee Jones commit eef0594aee29f289b0ddda02be7ccdbc5dd5956a Author: Krzysztof Kozlowski Date: Tue Aug 7 18:11:25 2018 +0200 mfd: sec-core: Allow building as module The main MFD driver for Samsung PMICs (S2MPSXX, S5M876X) used with Exynos SoCs can be compiled and used as a module. The dependent clock, regulator and RTC drivers already can be built as a module. Building entire set of drivers as modules might require using initial ramdisk and can make booting process longer (due to probe deferrals). However adding such option is useful for testing and for multi-platform configurations. This also add required module authors to sec-irq.c file based on recent main contributors. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Lee Jones commit 838a724072d37c45d717ca38252496253d4c09bc Author: Krzysztof Kozlowski Date: Tue Aug 7 18:11:24 2018 +0200 mfd: sec-core: Fix indentation of Kconfig description The indentation should be a tab followed by two spaces. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Lee Jones commit d7d8d7a2405f8b6296660648e893fc3442269d81 Author: Krzysztof Kozlowski Date: Tue Aug 7 18:11:23 2018 +0200 mfd: maxim: Add SPDX license identifiers Replace GPL v2.0+ license statements with SPDX license identifiers. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Lee Jones commit 39b27ad9c71cb72b07c9cd85191a8fe723e5b21a Author: Krzysztof Kozlowski Date: Tue Aug 7 18:11:22 2018 +0200 mfd: sec-core: Add SPDX license identifiers Replace GPL v2.0+ license statements with SPDX license identifiers. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Lee Jones commit 92af5c130c207b2b0d07e2a223a4901f16be1536 Merge: 7a39915b723a d31ca7e5d0fa 9612f8f50380 65b80dfffeab Author: Lee Jones Date: Tue Oct 23 08:58:01 2018 +0100 Merge branches 'ib-mfd-iio-input-4.20', 'ib-mfd-irqchip-4.20', 'ib-mfd-rtc-4.20' and 'ib-mfd-spi-tty-4.20-1' into ibs-for-mfd-merged commit 6fd577cd4b257ce5cb761adcdedeea55501d84d9 Merge: 114b5f8f7efc 8dbac65f5c18 Author: Linus Torvalds Date: Tue Oct 23 08:55:03 2018 +0100 Merge tag 'leds-for-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds Pull LED updates from Jacek Anaszewski: "We introduce LED pattern trigger - the idea that was proposed three years ago now received enough attention and determination to drive it to the successful end. There is also one new LED class driver and couple of improvements to the existing ones. New LED class driver: - add support for Panasonic AN30259A with related DT bindings New LED trigger: - introduce LED pattern trigger leds-sc27xx-bltc: - implement pattern_set/clear ops to enable support for pattern trigger's hw_pattern sysfs file Improvements to existing LED class drivers: - leds-pwm: don't print error message on -EPROBE_DEFER - leds-gpio: try to lookup gpiod from device - leds-as3645a: convert to using %pOFn instead of device_node.name" * tag 'leds-for-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds: leds: sc27xx: Add pattern_set/clear interfaces for LED controller leds: core: Introduce LED pattern trigger leds: add Panasonic AN30259A support dt-bindings: leds: document Panasonic AN30259A bindings leds: gpio: Try to lookup gpiod from device leds: pwm: silently error out on EPROBE_DEFER leds: Convert to using %pOFn instead of device_node.name commit 114b5f8f7efc036dd7dd16efb0f218a88e6c6c02 Merge: b0b6a28bc4b2 40f5ff4f9f23 Author: Linus Torvalds Date: Tue Oct 23 08:45:05 2018 +0100 Merge tag 'gpio-v4.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO updates from Linus Walleij: "This is the bulk of GPIO changes for the v4.20 series: Core changes: - A patch series from Hans Verkuil to make it possible to enable/disable IRQs on a GPIO line at runtime and drive GPIO lines as output without having to put/get them from scratch. The irqchip callbacks have been improved so that they can use only the fastpatch callbacks to enable/disable irqs like any normal irqchip, especially the gpiod_lock_as_irq() has been improved to be callable in fastpath context. A bunch of rework had to be done to achieve this but it is a big win since I never liked to restrict this to slowpath. The only call requireing slowpath was try_module_get() and this is kept at the .request_resources() slowpath callback. In the GPIO CEC driver this is a big win sine a single line is used for both outgoing and incoming traffic, and this needs to use IRQs for incoming traffic while actively driving the line for outgoing traffic. - Janusz Krzysztofik improved the GPIO array API to pass a "cookie" (struct gpio_array) and a bitmap for setting or getting multiple GPIO lines at once. This improvement orginated in a specific need to speed up an OMAP1 driver and has led to a much better API and real performance gains when the state of the array can be used to bypass a lot of checks and code when we want things to go really fast. The previous code would minimize the number of calls down to the driver callbacks assuming the CPU speed was orders of magnitude faster than the I/O latency, but this assumption was wrong on several platforms: what we needed to do was to profile and improve the speed on the hot path of the array functions and this change is now completed. - Clean out the painful and hard to grasp BNF experiments from the device tree bindings. Future approaches are looking into using JSON schema for this purpose. (Rob Herring is floating a patch series.) New drivers: - The RCAR driver now supports r8a774a1 (RZ/G2M). - Synopsys GPIO via CREGs driver. Major improvements: - Modernization of the EP93xx driver to use irqdomain and other contemporary concepts. - The ingenic driver has been merged into the Ingenic pin control driver and removed from the GPIO subsystem. - Debounce support in the ftgpio010 driver" * tag 'gpio-v4.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: (116 commits) gpio: Clarify kerneldoc on gpiochip_set_chained_irqchip() gpio: Remove unused 'irqchip' argument to gpiochip_set_cascaded_irqchip() gpio: Drop parent irq assignment during cascade setup mmc: pwrseq_simple: Fix incorrect handling of GPIO bitmap gpio: fix SNPS_CREG kconfig dependency warning gpiolib: Initialize gdev field before is used gpio: fix kernel-doc after devres.c file rename gpio: fix doc string for devm_gpiochip_add_data() to not talk about irq_chip gpio: syscon: Fix possible NULL ptr usage gpiolib: Show correct direction from the beginning pinctrl: msm: Use init_valid_mask exported function gpiolib: Add init_valid_mask exported function GPIO: add single-register GPIO via CREG driver dt-bindings: Document the Synopsys GPIO via CREG bindings gpio: mockup: use device properties instead of platform_data gpio: Slightly more helpful debugfs gpio: omap: Remove set but not used variable 'dev' gpio: omap: drop omap_gpio_list Accept partial 'gpio-line-names' property. gpio: omap: get rid of the conditional PM runtime calls ... commit b0b6a28bc4b265aa56cbf4fa8fd27c0a4fa3a49c Merge: 1650ac530665 a93a676b0791 Author: Linus Torvalds Date: Tue Oct 23 08:40:16 2018 +0100 Merge tag 'pinctrl-v4.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "This is the bulk of pin control changes for the v4.20 series: There were no significant changes to the core this time! Bur the new Qualcomm, Mediatek and Broadcom drivers are quite interesting as they will be used in a few million embedded devices the coming years as it seems. New drivers: - Broadcom Northstar pin control driver. - Mediatek MT8183 subdriver. - Mediatek MT7623 subdriver. - Mediatek MT6765 subdriver. - Meson g12a subdriver. - Nuvoton NPCM7xx pin control and GPIO driver. - Qualcomm QCS404 pin control and GPIO subdriver. - Qualcomm SDM660 pin control and GPIO subdriver. - Renesas R8A7744 PFC subdriver. - Renesas R8A774C0 PFC subdriver. - Renesas RZ/N1 pinctrl driver Major improvements: - Pulled the GPIO support for Ingenic over from the GPIO subsystem and consolidated it all in the Ingenic pin control driver. - Major cleanups and consolidation work in all Intel drivers. - Major cleanups and consolidation work in all Mediatek drivers. - Lots of incremental improvements to the Renesas PFC pin controller family. - All drivers doing GPIO now include and nothing else" * tag 'pinctrl-v4.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (153 commits) pinctrl: sunxi: Fix a memory leak in 'sunxi_pinctrl_build_state()' gpio: uniphier: include instead of pinctrl: uniphier: include instead of dt-bindings: pinctrl: bcm4708-pinmux: improve example binding pinctrl: geminilake: Sort register offsets by value pinctrl: geminilake: Get rid of unneeded ->probe() stub pinctrl: geminilake: Update pin list for B0 stepping pinctrl: renesas: Fix platform_no_drv_owner.cocci warnings pinctrl: mediatek: Make eint_m u16 pinctrl: bcm: ns: Use uintptr_t for casting data pinctrl: madera: Fix uninitialized variable bug in madera_mux_set_mux pinctrl: gemini: Fix up TVC clock group pinctrl: gemini: Drop noisy debug prints pinctrl: gemini: Mask and set properly pinctrl: mediatek: select GPIOLIB pinctrl: rza1: don't manually release devm managed resources MAINTAINERS: update entry for Mediatek pin controller pinctrl: bcm: add Northstar driver dt-bindings: pinctrl: document Broadcom Northstar pin mux controller pinctrl: qcom: fix 'const' pointer handling ... commit 1650ac53066577a5e83fe3e9d992c9311597ff8c Merge: ca9eb48fe01f fd82cc3020a0 Author: Linus Torvalds Date: Tue Oct 23 08:36:15 2018 +0100 Merge tag 'mmc-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC updates from Ulf Hansson: "MMC core: - Introduce a host helper function to share re-tuning progress MMC host: - sdhci: Add support for v4 host mode - sdhci-of-arasan: Add Support for AM654 MMC and PHY - sdhci-sprd: Add support for Spreadtrum's host controller - sdhci-tegra: Add support for HS400 enhanced strobe - sdhci-tegra: Enable UHS/HS200 modes for Tegra186/210 - sdhci-tegra: Add support for HS400 delay line calibration - sdhci-tegra: Add support for pad calibration - sdhci-of-dwcmshc: Address 128MB DMA boundary limitation - sdhci-of-esdhc: Add support for tuning erratum A008171 - sdhci-iproc: Add ACPI support - mediatek: Add support for MT8183 - mediatek: Improve the support for tuning - mediatek: Add bus clock control for MT2712 - jz4740: Add support for the JZ4725B - mmci: Add support for the stm32 sdmmc variant - mmci: Add support for an optional reset control - mmci: Add some new variant specific properties/callbacks - mmci: Re-structure DMA code to prepare for new variants - renesas_sdhi: Add support for r8a77470, r8a7744 and r8a774a1 - renesas_sdhi_internal_dmac: Whitelist r8a77970 and r8a774a1 - tmio/uniphier-sd: Add new UniPhier SD/eMMC controller driver - tmio/renesas_sdhi: Deal properly with SCC detection during re-tune - tmio/renesas_sdhi: Refactor/consolidate clock management - omap_hsmmc: Drop cover detection and some unused platform data - dw_mmc-exynos: Enable tuning for more speed modes - sunxi: Clarify the new timing mode and enable it for the A64 controller - various: Convert to slot GPIO descriptors" * tag 'mmc-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (129 commits) mmc: mediatek: drop too much code of tuning method mmc: mediatek: add MT8183 MMC driver support mmc: mediatek: tune CMD/DATA together mmc: mediatek: fix cannot receive new request when msdc_cmd_is_ready fail mmc: mediatek: fill the actual clock for mmc debugfs mmc: dt-bindings: add support for MT8183 SoC mmc: uniphier-sd: avoid using broken DMA RX channel mmc: uniphier-sd: fix DMA disabling mmc: tmio: simplify the DMA mode test mmc: tmio: remove TMIO_MMC_HAVE_HIGH_REG flag mmc: tmio: move MFD variant reset to a platform hook mmc: renesas_sdhi: Add r8a77470 SDHI1 support dt-bindings: mmc: renesas_sdhi: Add r8a77470 support mmc: mmci: add stm32 sdmmc variant dt-bindings: mmci: add stm32 sdmmc variant mmc: mmci: add stm32 sdmmc registers mmc: mmci: add clock divider for stm32 sdmmc mmc: mmci: add optional reset property dt-bindings: mmci: add optional reset property mmc: mmci: add variant property to not read datacnt ... commit 487e2e22ab7968f2c0c82f37b5ca5883efd1a354 Author: Thor Thayer Date: Mon Oct 22 17:22:26 2018 -0500 net: stmmac: Set OWN bit for jumbo frames Ping with Jumbo packet does not reply and get a watchdog timeout [ 46.059616] ------------[ cut here ]------------ [ 46.064268] NETDEV WATCHDOG: eth0 (socfpga-dwmac): transmit queue 0 timed out [ 46.071471] WARNING: CPU: 1 PID: 0 at net/sched/sch_generic.c:461 dev_watchdog+0x2cc/0x2d8 [ 46.079708] Modules linked in: [ 46.082761] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.18.0-00115-gc262be665854-dirty #264 [ 46.091082] Hardware name: SoCFPGA Stratix 10 SoCDK (DT) [ 46.096377] pstate: 20000005 (nzCv daif -PAN -UAO) [ 46.101152] pc : dev_watchdog+0x2cc/0x2d8 [ 46.105149] lr : dev_watchdog+0x2cc/0x2d8 [ 46.109144] sp : ffff00000800bd80 [ 46.112447] x29: ffff00000800bd80 x28: ffff80007a9b4940 [ 46.117744] x27: 00000000ffffffff x26: ffff80007aa183b0 [ 46.123040] x25: 0000000000000001 x24: 0000000000000140 [ 46.128336] x23: ffff80007aa1839c x22: ffff80007aa17fb0 [ 46.133632] x21: ffff80007aa18000 x20: ffff0000091a7000 [ 46.138927] x19: 0000000000000000 x18: ffffffffffffffff [ 46.144223] x17: 0000000000000000 x16: 0000000000000000 [ 46.149519] x15: ffff0000091a96c8 x14: 07740775076f0720 [ 46.154814] x13: 07640765076d0769 x12: 0774072007300720 [ 46.160110] x11: 0765077507650775 x10: 0771072007740769 [ 46.165406] x9 : 076d0773076e0761 x8 : 077207740720073a [ 46.170702] x7 : 072907630761076d x6 : ffff80007ff9a0c0 [ 46.175997] x5 : ffff80007ff9a0c0 x4 : 0000000000000002 [ 46.181293] x3 : 0000000000000000 x2 : ffff0000091ac180 [ 46.186589] x1 : e6a742ebe628e800 x0 : 0000000000000000 [ 46.191885] Call trace: [ 46.194326] dev_watchdog+0x2cc/0x2d8 [ 46.197980] call_timer_fn+0x20/0x78 [ 46.201544] expire_timers+0xa4/0xb0 [ 46.205108] run_timer_softirq+0xe4/0x198 [ 46.209107] __do_softirq+0x114/0x210 [ 46.212760] irq_exit+0xd0/0xd8 [ 46.215895] __handle_domain_irq+0x60/0xb0 [ 46.219977] gic_handle_irq+0x58/0xa8 [ 46.223628] el1_irq+0xb0/0x128 [ 46.226761] arch_cpu_idle+0x10/0x18 [ 46.230326] do_idle+0x1d4/0x288 [ 46.233544] cpu_startup_entry+0x24/0x28 [ 46.237457] secondary_start_kernel+0x17c/0x1c0 [ 46.241971] ---[ end trace 57048cd1372cd828 ]--- Inspection of queue showed Jumbo packets were not sent out. The ring Jumbo packet function needs to set the OWN bit so the packet is sent. Signed-off-by: Thor Thayer Signed-off-by: David S. Miller commit a27460c9768ee19949c5b91f3d959ccd88c2a64a Author: Thor Thayer Date: Mon Oct 22 17:22:25 2018 -0500 arm64: dts: stratix10: Support Ethernet Jumbo frame Properly specify the RX and TX FIFO size which is important for Jumbo frames. Update the max-frame-size to support Jumbo frames. Signed-off-by: Thor Thayer Signed-off-by: David S. Miller commit 807192deb876d7550b5de7bf7a40ea3a4421ae0b Merge: e929ceb66ac0 a3fb3698cadf Author: David S. Miller Date: Mon Oct 22 20:21:30 2018 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for your net tree: 1) rbtree lookup from control plane returns the left-hand side element of the range when the interval end flag is set on. 2) osf extension is not supported from the input path, reject this from the control plane, from Fernando Fernandez Mancera. 3) xt_TEE is leaving output interface unset due to a recent incorrect netns rework, from Taehee Yoo. 4) xt_TEE allows to select an interface which does not belong to this netnamespace, from Taehee Yoo. 5) Zero private extension area in nft_compat, just like we do in x_tables, otherwise we leak kernel memory to userspace. 6) Missing .checkentry and .destroy entries in new DNAT extensions breaks it since we never load nf_conntrack dependencies, from Paolo Abeni. 7) Do not remove flowtable hook from netns exit path, the netdevice handler already deals with this, also from Taehee Yoo. 8) Only cleanup flowtable entries that reside in this netnamespace, also from Taehee Yoo. ==================== Signed-off-by: David S. Miller commit e929ceb66ac0faa3508702efbc5ea028387c6bb1 Author: Dave Watson Date: Mon Oct 22 19:36:37 2018 +0000 tls: Add maintainers Add John and Daniel as additional tls co-maintainers to help review patches and fix syzbot reports. Acked-by: John Fastabend Acked-by: Daniel Borkmann Signed-off-by: Dave Watson Signed-off-by: David S. Miller commit 9737cc99dd14b5b8b9d267618a6061feade8ea68 Author: Ivan Khoronzhuk Date: Mon Oct 22 21:51:36 2018 +0300 net: ethernet: ti: cpsw: unsync mcast entries while switch promisc mode After flushing all mcast entries from the table, the ones contained in mc list of ndev are not restored when promisc mode is toggled off, because they are considered as synched with ALE, thus, in order to restore them after promisc mode - reset syncing info. This fix touches only switch mode devices, including single port boards like Beagle Bone. Fixes: commit 5da1948969bc ("net: ethernet: ti: cpsw: fix lost of mcast packets while rx_mode update") Signed-off-by: Ivan Khoronzhuk Reviewed-by: Grygorii Strashko Signed-off-by: David S. Miller commit 1fad1fe40e1636f2acd87468b6ee3a3748b4a588 Merge: 604d415e2bd6 d6f092ca928f Author: David S. Miller Date: Mon Oct 22 20:15:39 2018 -0700 Merge branch 'octeontx2-af-NPC-parser-and-NIX-blocks-initialization' Sunil Goutham says: ==================== octeontx2-af: NPC parser and NIX blocks initialization This patchset is a continuation to earlier submitted two patch series to add a new driver for Marvell's OcteonTX2 SOC's Resource virtualization unit (RVU) admin function driver. 1. octeontx2-af: Add RVU Admin Function driver https://www.spinics.net/lists/netdev/msg528272.html 2. octeontx2-af: NPA and NIX blocks initialization https://www.spinics.net/lists/netdev/msg529163.html This patch series adds more NIX block configuration logic and additionally adds NPC block parser profile configuration. In brief below is what this series adds. NIX block: - Support for PF/VF to allocate/free transmit scheduler queues, maintenance and their configuration. - Adds support for packet replication lists, only broadcast packets is covered for now. - Defines few RSS flow algorithms for HW to distribute packets. This is not the hash algorithsm (i.e toeplitz or crc32), here SW defines what fields in packet should HW take and calculate the hash. - Support for PF/VF to configure VTAG strip and capture capabilities. - Reset NIXLF statastics. NPC block: This block has multiple parser engines which support packet parsing at multiple layers and generates a parse result which is further used to generate a key. Based on packet field offsets in the key, SW can install packet forwarding rules. This patch series adds - Initial parser profile to be programmed into parser engines. - Default forwarding rules to forward packets to different logical interfaces having a NIXLF attached. - Support for promiscuous and multicast modes. Changes from v1: 1 Fixed kernel build failure when compiled with BIG_ENDIAN enabled. - Reported by Kbuild test robot 2 Fixed a warning observed when kernel is built with -Wunused-but-set-variable ==================== Signed-off-by: David S. Miller commit d6f092ca928f4ed615c11b40f5856ebe1f3d4dd2 Author: Sunil Goutham Date: Mon Oct 22 23:26:04 2018 +0530 octeontx2-af: Support for NIXLF's UCAST/PROMISC/ALLMULTI modes By default NIXLF is set in UCAST mode. This patch adds a new mailbox message which when sent by a RVU PF changes this default mode. When promiscuous mode is needed, the reserved promisc entry for each of RVU PF is setup to match against ingress channel number only, so that all pkts on that channel are accepted and forwarded to the mode change requesting PF_FUNC's NIXLF. PROMISC and ALLMULTI modes are supported only for PFs, for VFs only UCAST mode is supported. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 6f03cf10fcdf56fd72777c60e9dbd75bd4228dae Author: Sunil Goutham Date: Mon Oct 22 23:26:03 2018 +0530 octeontx2-af: Support for setting MAC address Added a new mailbox message for a PF/VF to set/update it's NIXLF's MAC address. Also updates unicast NPC MCAM entry with this address as matching DMAC. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit cc96b0e9b4c66e9dee02456e918541da91bdd4e3 Author: Sunil Goutham Date: Mon Oct 22 23:26:02 2018 +0530 octeontx2-af: Support for changing RSS algorithm This patch adds support for a RVU PF/VF to change NIX Rx flowkey algorithm index in NPC RX RSS_ACTION. eg: a ethtool command changing RSS algorithm for a netdev interface would trigger this change in NPC. If PF/VF doesn't specify any MCAM entry index then default UCAST entry of the NIXLF attached to PF/VF will be updated with RSS_ACTION and flowkey index. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 41a7aa7b800dd0a12d3bedc1947451e503dfee74 Author: Sunil Goutham Date: Mon Oct 22 23:26:01 2018 +0530 octeontx2-af: NIX Rx flowkey configuration for RSS Configure NIX RX flowkey algorithm configuration to support RSS (receive side scaling). Currently support for only L3/L4 2-tuple and 4-tuple hash of IPv4/v6/TCP/UDP/SCTP is added. HW supports upto 32 different flowkey algorithms which SW can define, this patch defines 9. NPC RX ACTION has to point to one of these flowkey indices for RSS to work. The configuration is dependent on NPC parse result's layer info. So if NPC KPU profile changes suchthat LID/LTYPE values of above said protocols change then this configuration will most likely be effected. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 759001406654f4ec8738a1149ed2729306bd335d Author: Sunil Goutham Date: Mon Oct 22 23:26:00 2018 +0530 octeontx2-af: Install ucast and bcast pkt forwarding rules Upon NIXLF_ALLOC install a unicast forwarding rule in NPC MCAM like below - Match pkt DMAC with NIXLF attached PF/VF's MAC address. - Ingress channel - Action is UCAST - Forward to PF_FUNC of this NIXLF And broadcast pkt forwarding rule as - Match L2B bit in MCAM search key - Ingress channel - Action is UCAST, for now, later it will be changed to MCAST. Only PFs can install this rule Upon NIXLF_FREE disable all MCAM entries in use by that NIXLF. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit f5721f76a4376eacbbcc260d318872d2008fffbb Author: Stanislaw Kardach Date: Mon Oct 22 23:25:59 2018 +0530 octeontx2-af: Add LMAC channel info to NIXLF_ALLOC response Add LMAC channel info like Rx/Tx channel base and count to NIXLF_ALLOC mailbox message response. This info is used by NIXLF attached RVU PF/VF to configure SQ's default channel, TL3_TL2_LINKX_CFG and to install MCAM rules in NPC based on matching ingress channel number. Signed-off-by: Stanislaw Kardach Signed-off-by: Tomasz Duszynski Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit fefefd99ae8a8723ad6e324bd084968379f63607 Author: Sunil Goutham Date: Mon Oct 22 23:25:58 2018 +0530 octeontx2-af: NPC MCAM and LDATA extract minimal configuration This patch adds some minimal configuration for NPC MCAM and LDATA extraction which is sufficient enough to install ucast/bcast/promiscuous forwarding rules. Below is the config done - LDATA extraction config to extract DMAC from pkt to offset 64bit in MCAM search key. - Set MCAM lookup keysize to 224bits - Set MCAM TX miss action to UCAST_DEFAULT - Set MCAM RX miss action to DROP Also inorder to have guaranteed space in MCAM to install ucast forwarding rule for each of RVU PF/VF, reserved one MCAM entry for each of NIXLF for ucast rule. And two entries for each of RVU PF. One for bcast pkt replication and other for promiscuous mode which allows all pkts received on a HW CGX/LBK channel. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 6b3321bacc5a1342e6f3f843234a902f65786b4b Author: Sunil Goutham Date: Mon Oct 22 23:25:57 2018 +0530 octeontx2-af: Enable packet length and csum validation Config NPC layer info from KPU profile into protocol checker to identify outer L2/IPv4/TCP/UDP headers in a packet. And enable IPv4 checksum validation. L3/L4 and L4 CSUM validation will be enabled by PF/VF drivers by configuring NIX_AF_LF(0..127)_RX_CFG via mbox i.e 'nix_lf_alloc_req->rx_cfg' Also enable setting of NPC_RESULT_S[L2B] when an outer L2 broadcast address is detected. This will help in installing NPC MCAM rules for broadcast packets. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit d02913d91657941a86208691258837a0fe9a4cd7 Author: Vamsi Attunuru Date: Mon Oct 22 23:25:56 2018 +0530 octeontx2-af: Support for VTAG strip and capture Added support for PF/VF drivers to configure NIX to capture and/or strip VLAN tag from ingress packets. Signed-off-by: Vamsi Attunuru Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 4b05528ebf0c3ffd61543cfcca78844f05d8eb9d Author: Sunil Goutham Date: Mon Oct 22 23:25:55 2018 +0530 octeontx2-af: Update bcast list upon NIXLF alloc/free Upon NIXLF ALLOC/FREE, add or remove corresponding PF_FUNC from the broadcast packet replication list of the CGX LMAC mapped RVU PF. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 52d3d327a2595be7b69c956b45ad44de4ea6f692 Author: Sunil Goutham Date: Mon Oct 22 23:25:54 2018 +0530 octeontx2-af: Broadcast packet replication support Allocate memory for mcast/bcast/mirror replication entry contexts, replication buffers (used by HW) and config HW with corresponding memory bases. Added support for installing MCEs via NIX AQ mbox. For now support is restricted to broadcast pkt replication, hence MCE table size and number of replication buffers allocated are less. Each CGX LMAC mapped RVU PF is assigned a MCE table of size 'num VFs of that PF + PF'. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 94d942c5fb970ac2166216838b278613decfa9a0 Author: Geetha sowjanya Date: Mon Oct 22 23:25:53 2018 +0530 octeontx2-af: Config pkind for CGX mapped PFs For each CGX LMAC that is mapped to a RVU PF, allocate a pkind and config the same in CGX. For a received packet at CGX LMAC interface this pkind is used by NPC block to start parsing of packet. Signed-off-by: Geetha sowjanya Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 23923ea4b144ed43ad8f6e5110b06221d0ff1656 Author: Sunil Goutham Date: Mon Oct 22 23:25:52 2018 +0530 octeontx2-af: Config NPC KPU engines with parser profile This patch configures all 16 KPUs and iKPU (pkinds) with the KPU parser profile defined in npc_profile.h. Each KPU engine has a 128 entry CAM, only CAM entries which are listed in the profile are enabled and rest are left disabled. Also - Memory is allocated for pkind's bitmap and PFFUNC, interface channel mapping. - Added all CSR offsets of NPC HW block. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 21e6699e5cd60f634002ecc6b60a690ab9c21947 Author: Hao Zheng Date: Mon Oct 22 23:25:51 2018 +0530 octeontx2-af: Add NPC KPU profile NPC block is responsible for parsing and forwarding packets to different NIXLFs. NPC has 16 KPU engines (Kangaroo parse engine) and one iKPU which represents pkinds. Each physical port either CGX/LBK is assigned a pkind and upon receiving a packet HW takes that port's pkind and starts parsing as per the KPU engines config. This patch adds header files which contain configuration profile/array for each of the iKPU and 16 KPU engines. Signed-off-by: Hao Zheng Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 42349661780e893537205f9c4c27b1bae060d96a Author: Vamsi Attunuru Date: Mon Oct 22 23:25:50 2018 +0530 octeontx2-af: Reset NIXLF's Rx/Tx stats This patch adds a new mailbox message to reset a NIXLF's receive and transmit HW stats. Signed-off-by: Vamsi Attunuru Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit b279bbb3314e114609983b02c4253aff6b4be976 Author: Sunil Goutham Date: Mon Oct 22 23:25:49 2018 +0530 octeontx2-af: NIX Tx scheduler queue config support This patch adds support for a PF/VF driver to configure NIX transmit scheduler queues via mbox. Since PF/VF doesn't know the absolute HW index of the NIXLF attached to it, AF traps the register config and overwrites with the correct NIXLF index. HW supports shaping, colouring and policing of packets with these multilevel traffic scheduler queues. Instead of introducing different mbox message formats for different configurations and making both AF & PF/VF driver implementation cumbersome, access to the scheduler queue's CSRs is provided via mbox. AF checks whether the sender PF/VF has the corresponding queue allocated or not and dumps the config to HW. With a single mbox msg 20 registers can be configured. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit a3e7121c704470e2c33a4b91bb218205947cd531 Author: Sunil Goutham Date: Mon Oct 22 23:25:48 2018 +0530 octeontx2-af: NIX Tx scheduler queues alloc/free Added support for a PF/VF to allocate or free NIX transmit scheduler queues via mbox. For setting up pkt transmission priorities between queues, the scheduler queues have to be contiguous w.r.t their HW indices. So both contiguous and non-contiguous allocations are supported. Upon receiving NIX_TXSCH_FREE mbox msg all scheduler queues allocated to sending PFFUNC (PF/VF) will be freed. Selective free is not supported. Signed-off-by: Sunil Goutham Signed-off-by: Nithin Dabilpuram Signed-off-by: David S. Miller commit 604d415e2bd642b7e02c80e719e0396b9d4a77a6 Author: Eric Dumazet Date: Mon Oct 22 09:24:27 2018 -0700 llc: do not use sk_eat_skb() syzkaller triggered a use-after-free [1], caused by a combination of skb_get() in llc_conn_state_process() and usage of sk_eat_skb() sk_eat_skb() is assuming the skb about to be freed is only used by the current thread. TCP/DCCP stacks enforce this because current thread holds the socket lock. llc_conn_state_process() wants to make sure skb does not disappear, and holds a reference on the skb it manipulates. But as soon as this skb is added to socket receive queue, another thread can consume it. This means that llc must use regular skb_unlink() and kfree_skb() so that both producer and consumer can safely work on the same skb. [1] BUG: KASAN: use-after-free in atomic_read include/asm-generic/atomic-instrumented.h:21 [inline] BUG: KASAN: use-after-free in refcount_read include/linux/refcount.h:43 [inline] BUG: KASAN: use-after-free in skb_unref include/linux/skbuff.h:967 [inline] BUG: KASAN: use-after-free in kfree_skb+0xb7/0x580 net/core/skbuff.c:655 Read of size 4 at addr ffff8801d1f6fba4 by task ksoftirqd/1/18 CPU: 1 PID: 18 Comm: ksoftirqd/1 Not tainted 4.19.0-rc8+ #295 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c4/0x2b6 lib/dump_stack.c:113 print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412 check_memory_region_inline mm/kasan/kasan.c:260 [inline] check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267 kasan_check_read+0x11/0x20 mm/kasan/kasan.c:272 atomic_read include/asm-generic/atomic-instrumented.h:21 [inline] refcount_read include/linux/refcount.h:43 [inline] skb_unref include/linux/skbuff.h:967 [inline] kfree_skb+0xb7/0x580 net/core/skbuff.c:655 llc_sap_state_process+0x9b/0x550 net/llc/llc_sap.c:224 llc_sap_rcv+0x156/0x1f0 net/llc/llc_sap.c:297 llc_sap_handler+0x65e/0xf80 net/llc/llc_sap.c:438 llc_rcv+0x79e/0xe20 net/llc/llc_input.c:208 __netif_receive_skb_one_core+0x14d/0x200 net/core/dev.c:4913 __netif_receive_skb+0x2c/0x1e0 net/core/dev.c:5023 process_backlog+0x218/0x6f0 net/core/dev.c:5829 napi_poll net/core/dev.c:6249 [inline] net_rx_action+0x7c5/0x1950 net/core/dev.c:6315 __do_softirq+0x30c/0xb03 kernel/softirq.c:292 run_ksoftirqd+0x94/0x100 kernel/softirq.c:653 smpboot_thread_fn+0x68b/0xa00 kernel/smpboot.c:164 kthread+0x35a/0x420 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:413 Allocated by task 18: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490 kmem_cache_alloc_node+0x144/0x730 mm/slab.c:3644 __alloc_skb+0x119/0x770 net/core/skbuff.c:193 alloc_skb include/linux/skbuff.h:995 [inline] llc_alloc_frame+0xbc/0x370 net/llc/llc_sap.c:54 llc_station_ac_send_xid_r net/llc/llc_station.c:52 [inline] llc_station_rcv+0x1dc/0x1420 net/llc/llc_station.c:111 llc_rcv+0xc32/0xe20 net/llc/llc_input.c:220 __netif_receive_skb_one_core+0x14d/0x200 net/core/dev.c:4913 __netif_receive_skb+0x2c/0x1e0 net/core/dev.c:5023 process_backlog+0x218/0x6f0 net/core/dev.c:5829 napi_poll net/core/dev.c:6249 [inline] net_rx_action+0x7c5/0x1950 net/core/dev.c:6315 __do_softirq+0x30c/0xb03 kernel/softirq.c:292 Freed by task 16383: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 __cache_free mm/slab.c:3498 [inline] kmem_cache_free+0x83/0x290 mm/slab.c:3756 kfree_skbmem+0x154/0x230 net/core/skbuff.c:582 __kfree_skb+0x1d/0x20 net/core/skbuff.c:642 sk_eat_skb include/net/sock.h:2366 [inline] llc_ui_recvmsg+0xec2/0x1610 net/llc/af_llc.c:882 sock_recvmsg_nosec net/socket.c:794 [inline] sock_recvmsg+0xd0/0x110 net/socket.c:801 ___sys_recvmsg+0x2b6/0x680 net/socket.c:2278 __sys_recvmmsg+0x303/0xb90 net/socket.c:2390 do_sys_recvmmsg+0x181/0x1a0 net/socket.c:2466 __do_sys_recvmmsg net/socket.c:2484 [inline] __se_sys_recvmmsg net/socket.c:2480 [inline] __x64_sys_recvmmsg+0xbe/0x150 net/socket.c:2480 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8801d1f6fac0 which belongs to the cache skbuff_head_cache of size 232 The buggy address is located 228 bytes inside of 232-byte region [ffff8801d1f6fac0, ffff8801d1f6fba8) The buggy address belongs to the page: page:ffffea000747dbc0 count:1 mapcount:0 mapping:ffff8801d9be7680 index:0xffff8801d1f6fe80 flags: 0x2fffc0000000100(slab) raw: 02fffc0000000100 ffffea0007346e88 ffffea000705b108 ffff8801d9be7680 raw: ffff8801d1f6fe80 ffff8801d1f6f0c0 000000010000000b 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801d1f6fa80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ffff8801d1f6fb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8801d1f6fb80: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc ^ ffff8801d1f6fc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8801d1f6fc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller commit ba59d5705825fb9cab3ff092552802f4fefc3635 Author: Mathias Thore Date: Mon Oct 22 14:55:50 2018 +0200 net/wan/fsl_ucc_hdlc: error counters Extract error information from rx and tx buffer descriptors, and update error counters. Signed-off-by: Mathias Thore Signed-off-by: David S. Miller commit 2af1ccd58107d65f87b747c90a965b2ba97b4feb Author: Wolfram Sang Date: Sun Oct 21 22:01:05 2018 +0200 net: dsa: legacy: simplify getting .driver_data We should get 'driver_data' from 'struct device' directly. Going via platform_device is an unneeded step back and forth. Signed-off-by: Wolfram Sang Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit c0bfdae013e809b209ac325a9895b9ba22599c93 Author: Wolfram Sang Date: Sun Oct 21 22:00:39 2018 +0200 ptp: ptp_dte: simplify getting .driver_data We should get 'driver_data' from 'struct device' directly. Going via platform_device is an unneeded step back and forth. Signed-off-by: Wolfram Sang Acked-by: Richard Cochran Signed-off-by: David S. Miller commit 00f17a8219f02139119d8b4547e032bf4888fa0d Author: Arthur Kiyanovski Date: Sun Oct 21 18:07:14 2018 +0300 net: ena: fix compilation error in xtensa architecture linux/prefetch.h is never explicitly included in ena_com, although functions from it, such as prefetchw(), are used throughout ena_com. This is an inclusion bug, and we fix it here by explicitly including linux/prefetch.h. The bug was exposed when the driver was compiled for the xtensa architecture. Fixes: 689b2bdaaa14 ("net: ena: add functions for handling Low Latency Queues in ena_com") Fixes: 8c590f977638 ("ena: Fix Kconfig dependency on X86") Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller commit 424c22fb62427362f1f660cd83fbdc41aec488b6 Author: Vito Caputo Date: Sun Oct 21 04:33:03 2018 -0700 af_unix.h: trivial whitespace cleanup Replace spurious spaces with a tab and remove superfluous tab from unix_sock struct. Signed-off-by: Vito Caputo Signed-off-by: David S. Miller commit cc3a4cd3f016a081a29b938f1ad17669bfacc9b2 Author: Dan Carpenter Date: Sun Oct 21 14:05:49 2018 +0300 net/mlx5: Allocate enough space for the FDB sub-namespaces FDB_MAX_CHAIN is three. We wanted to allocate enough memory to hold four structs but there are missing parentheses so we only allocate enough memory for three structs and the first byte of the fourth one. Fixes: 328edb499f99 ("net/mlx5: Split FDB fast path prio to multiple namespaces") Signed-off-by: Dan Carpenter Reviewed-by: Or Gerlitz Signed-off-by: David S. Miller commit ec7f0ee2c10539c6ae1e87be8711562ffbea1563 Merge: 92c9d5627a79 246e886d22e2 Author: David S. Miller Date: Mon Oct 22 19:42:58 2018 -0700 Merge branch 'forbid-goto_chain-fallback' Davide Caratti says: ==================== net/sched: forbid 'goto_chain' on fallback actions the following command: # tc actions add action police rate 1mbit burst 1k conform-exceed \ > pass / goto chain 42 generates a NULL pointer dereference when packets exceed the configured rate. Similarly, the following command: # tc actions add action pass random determ goto chain 42 2 makes the kernel crash with NULL dereference when the first packet does not match the 'pass' action. gact and police allow users to specify a fallback control action, that is stored in the action private data. 'goto chain x' never worked for these cases, since a->goto_chain handle was never initialized. There is only one goto_chain handle per TC action, and it is designed to be non-NULL only if tcf_action contains a 'goto chain' command. So, let's forbid 'goto chain' on fallback actions. Patch 1/4 and 2/4 change the .init() functions of police and gact, to let them return an error when users try to set 'goto chain x' in the fallback action. Patch 3/4 and 4/4 add TDC selftest coverage to this new behavior. ==================== Acked-by: Jamal Hadi Salim Signed-off-by: David S. Miller commit 246e886d22e2a8ceceec1f4f66138f93eafddbaa Author: Davide Caratti Date: Sat Oct 20 23:33:10 2018 +0200 tc-tests: test denial of 'goto chain' for exceed traffic in police.json add test to verify if act_police forbids 'goto chain' control actions for 'exceed' traffic. Signed-off-by: Davide Caratti Signed-off-by: David S. Miller commit 88c2e3b4a97277399ceb80d630e9838330b2146a Author: Davide Caratti Date: Sat Oct 20 23:33:09 2018 +0200 tc-tests: test denial of 'goto chain' on 'random' traffic in gact.json add test to verify if act_gact forbids 'goto chain' control actions on 'random' traffic in gact.json. Signed-off-by: Davide Caratti Signed-off-by: David S. Miller commit c08f5ed5d625926f38552b734b587a28e947b55c Author: Davide Caratti Date: Sat Oct 20 23:33:08 2018 +0200 net/sched: act_police: disallow 'goto chain' on fallback control action in the following command: # tc action add action police rate burst conform-exceed / 'goto chain x' is allowed only for c1: setting it for c2 makes the kernel crash with NULL pointer dereference, since TC core doesn't initialize the chain handle. Signed-off-by: Davide Caratti Acked-by: Cong Wang Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 9469f375ab0900075bd3f1f58083c19b0224d978 Author: Davide Caratti Date: Sat Oct 20 23:33:07 2018 +0200 net/sched: act_gact: disallow 'goto chain' on fallback control action in the following command: # tc action add action random 'goto chain x' is allowed only for c1: setting it for c2 makes the kernel crash with NULL pointer dereference, since TC core doesn't initialize the chain handle. Signed-off-by: Davide Caratti Acked-by: Cong Wang Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit 92c9d5627a79b02299dd13e3e0ec695475726cf8 Author: Andrew Lunn Date: Sat Oct 20 22:41:28 2018 +0200 net: phy: phy_support_sym_pause: Clear Asym Pause When indicating the MAC supports Symmetric Pause, clear the Asymmetric Pause bit, which could of been already set is the PHY supports it. Reported-by: Labbe Corentin Fixes: c306ad36184f ("net: ethernet: Add helper for MACs which support pause") Signed-off-by: Andrew Lunn Tested-by: Corentin Labbe Signed-off-by: David S. Miller commit 4b78030b8f2ca29c267b4ca38e900d92428c412e Author: Olivier Brunel Date: Sat Oct 20 19:39:57 2018 +0200 net: bpfilter: Set user mode helper's command line Signed-off-by: Olivier Brunel Signed-off-by: David S. Miller commit 876dcf2f3aaa0f68d437b368b93a4c4b81521191 Author: Olivier Brunel Date: Sat Oct 20 19:39:56 2018 +0200 umh: Add command line to user mode helpers User mode helpers were spawned without a command line, and because an empty command line is used by many tools to identify processes as kernel threads, this could cause some issues. Notably during killing spree on shutdown, since such helper would then be skipped (i.e. not killed) which would result in the process remaining alive, and thus preventing unmouting of the rootfs (as experienced with the bpfilter umh). Fixes: 449325b52b7a ("umh: introduce fork_usermode_blob() helper") Signed-off-by: Olivier Brunel Signed-off-by: David S. Miller commit c94f026fb742b2d3199422751dbc4f6fc0e753d8 Author: Dan Carpenter Date: Fri Oct 19 23:11:11 2018 +0300 qlcnic: fix a return in qlcnic_dcb_get_capability() These functions are supposed to return one on failure and zero on success. Returning a zero here could cause uninitialized variable bugs in several of the callers. For example: drivers/scsi/cxgbi/cxgb4i/cxgb4i.c:1660 get_iscsi_dcb_priority() error: uninitialized symbol 'caps'. Fixes: 48365e485275 ("qlcnic: dcb: Add support for CEE Netlink interface.") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller commit de46e92af4461decff2288a1e97e47cd9e82f783 Merge: 8df591f35e96 6371a71f3a3b Author: David S. Miller Date: Mon Oct 22 19:33:29 2018 -0700 Merge branch 'net-Add-support-for-dumping-addresses-for-a-specific-device' David Ahern says: ==================== net: Add support for dumping addresses for a specific device Use the recently added kernel side filter infrastructure to add support for dumping addresses only for a specific device. Patch 1 creates an IPv4 version similar to IPv6's in6_dump_addrs function. Patch 2 simplifies in6_dump_addrs by moving index tracking of IP addresses from inet6_dump_addr to in6_dump_addrs. Patches 3 and 4 use the device-based address dump helpers to limit a dump to just the addresses on a specific device. ==================== Signed-off-by: David S. Miller commit 6371a71f3a3b2bc47880dd76c2f176495802d0df Author: David Ahern Date: Fri Oct 19 12:45:30 2018 -0700 net/ipv6: Add support for dumping addresses for a specific device If an RTM_GETADDR dump request has ifa_index set in the ifaddrmsg header, then return only the addresses for that device. Since inet6_dump_addr is reused for multicast and anycast addresses, this adds support for device specfic dumps of RTM_GETMULTICAST and RTM_GETANYCAST as well. Signed-off-by: David Ahern Signed-off-by: David S. Miller commit 5fcd266a9f64bc75707f7ddc96427f2e8caaacd5 Author: David Ahern Date: Fri Oct 19 12:45:29 2018 -0700 net/ipv4: Add support for dumping addresses for a specific device If an RTM_GETADDR dump request has ifa_index set in the ifaddrmsg header, then return only the addresses for that device. Signed-off-by: David Ahern Signed-off-by: David S. Miller commit fe884c2be0b329042eaf0371ebdbb636ba3ccc39 Author: David Ahern Date: Fri Oct 19 12:45:28 2018 -0700 net/ipv6: Remove ip_idx arg to in6_dump_addrs ip_idx is always 0 going into in6_dump_addrs; it is passed as a pointer to save the last good index into cb. Since cb is already argument to in6_dump_addrs, just save the value there. Signed-off-by: David Ahern Signed-off-by: David S. Miller commit 1c98eca412e1f183070e76d103a296d7afccfd64 Author: David Ahern Date: Fri Oct 19 12:45:27 2018 -0700 net/ipv4: Move loop over addresses on a device into in_dev_dump_addr Similar to IPv6 move the logic that walks over the ipv4 address list for a device into a helper. Signed-off-by: David Ahern Signed-off-by: David S. Miller commit 8df591f35e9651b955d21f43828f54c106cf4807 Merge: aeb5e02aca91 01865a50d78f Author: David S. Miller Date: Mon Oct 22 19:31:14 2018 -0700 Merge branch 'hns3-next' Salil Mehta says: ==================== Adds support of RAS Error Handling in HNS3 Driver This patch-set adds support related to RAS Error handling to the HNS3 Ethernet PF Driver. Set of errors occurred in the HNS3 hardware are reported to the driver through the PCIe AER interface. The received error information is then used to classify the received errors and then decide the appropriate receovery action depending on the type of error. ==================== Signed-off-by: David S. Miller commit 01865a50d78f515423422b8c55e8b6f6bf4c2cd4 Author: Shiju Jose Date: Fri Oct 19 20:15:32 2018 +0100 net: hns3: Add enable and process hw errors of TM scheduler This patch enables and process hw errors of TM scheduler and QCN(Quantized Congestion Control). Signed-off-by: Shiju Jose Signed-off-by: Salil Mehta Signed-off-by: David S. Miller commit da2d072a9ea75dd5babebcfd71144fb5b3aa9913 Author: Shiju Jose Date: Fri Oct 19 20:15:31 2018 +0100 net: hns3: Add enable and process hw errors from PPP This patch enables and process hw errors from the PPP(Programmable Packet Process) block. Signed-off-by: Shiju Jose Signed-off-by: Salil Mehta Signed-off-by: David S. Miller commit bf1faf9415ddbfaa6d6a56a4bc594c92ca0f7309 Author: Shiju Jose Date: Fri Oct 19 20:15:30 2018 +0100 net: hns3: Add enable and process hw errors from IGU, EGU and NCSI This patch adds enable and processing of hw errors from IGU(Ingress Unit), EGU(Egress Unit) and NCSI(Network Controller Sideband Interface). Signed-off-by: Shiju Jose Signed-off-by: Salil Mehta Signed-off-by: David S. Miller commit 6d67ee9a273bbb5d3f7d66eedb924aee21c2b2cd Author: Shiju Jose Date: Fri Oct 19 20:15:29 2018 +0100 net: hns3: Add enable and process common ecc errors This patch adds enable and processing of ecc errors from common HNS blocks, CMDQ(Command Queue), IMP(Integrated Management Processor) and TQP(Task Queue Pair). Signed-off-by: Shiju Jose Signed-off-by: Salil Mehta Signed-off-by: David S. Miller commit 997141950380931073e13f7db8daf0c27b79af16 Author: Shiju Jose Date: Fri Oct 19 20:15:28 2018 +0100 net: hns3: Add support to enable and disable hw errors This patch adds functions to enable and disable hw errors. Signed-off-by: Shiju Jose Signed-off-by: Salil Mehta Signed-off-by: David S. Miller commit 6ae4e733cdd4e0e6e7069abe40197fc456e2eeea Author: Shiju Jose Date: Fri Oct 19 20:15:27 2018 +0100 net: hns3: Add PCIe AER error recovery This patch adds the error recovery for the HNS hw errors. Signed-off-by: Shiju Jose Signed-off-by: Salil Mehta Signed-off-by: David S. Miller commit 5a9f0eac935b3edbcb3155301cc8aa1e22c04ccd Author: Shiju Jose Date: Fri Oct 19 20:15:26 2018 +0100 net: hns3: Add PCIe AER callback error_detected Set of hw errors occurred in the HNS3 are reported to the hns3 driver through PCIe AER and RAS.The error info will be processed and appropriately recovered. This patch adds error_detected callback and error processing. Signed-off-by: Shiju Jose Signed-off-by: Salil Mehta Signed-off-by: David S. Miller commit aeb5e02aca91522733eb1db595ac607d30c87767 Author: Nathan Chancellor Date: Fri Oct 19 11:00:30 2018 -0700 mISDN: Fix type of switch control variable in ctrl_teimanager Clang warns (trimmed for brevity): drivers/isdn/mISDN/tei.c:1193:7: warning: overflow converting case value to switch condition type (2147764552 to 18446744071562348872) [-Wswitch] case IMHOLD_L1: ^ drivers/isdn/mISDN/tei.c:1187:7: warning: overflow converting case value to switch condition type (2147764550 to 18446744071562348870) [-Wswitch] case IMCLEAR_L2: ^ 2 warnings generated. The root cause is that the _IOC macro can generate really large numbers, which don't find into type int. My research into how GCC and Clang are handling this at a low level didn't prove fruitful and surveying the kernel tree shows that aside from here and a few places in the scsi subsystem, everything that uses _IOC is at least of type 'unsigned int'. Make that change here because as nothing in this function cares about the signedness of the variable and it removes ambiguity, which is never good when dealing with compilers. While we're here, remove the unnecessary local variable ret (just return -EINVAL and 0 directly). Link: https://github.com/ClangBuiltLinux/linux/issues/67 Signed-off-by: Nathan Chancellor Signed-off-by: David S. Miller commit 988f3f1603d4650409db5334355cbf7b13ef50c3 Author: Jon Maloy Date: Fri Oct 19 19:55:40 2018 +0200 tipc: eliminate message disordering during binding table update We have seen the following race scenario: 1) named_distribute() builds a "bulk" message, containing a PUBLISH item for a certain publication. This is based on the contents of the binding tables's 'cluster_scope' list. 2) tipc_named_withdraw() removes the same publication from the list, bulds a WITHDRAW message and distributes it to all cluster nodes. 3) tipc_named_node_up(), which was calling named_distribute(), sends out the bulk message built under 1) 4) The WITHDRAW message arrives at the just detected node, finds no corresponding publication, and is dropped. 5) The PUBLISH item arrives at the same node, is added to its binding table, and remains there forever. This arrival disordering was earlier taken care of by the backlog queue, originally added for a different purpose, which was removed in the commit referred to below, but we now need a different solution. In this commit, we replace the rcu lock protecting the 'cluster_scope' list with a regular RW lock which comprises even the sending of the bulk message. This both guarantees both the list integrity and the message sending order. We will later add a commit which cleans up this code further. Note that this commit needs recently added commit d3092b2efca1 ("tipc: fix unsafe rcu locking when accessing publication list") to apply cleanly. Fixes: 37922ea4a310 ("tipc: permit overlapping service ranges in name table") Reported-by: Tuong Lien Tong Acked-by: Ying Xue Signed-off-by: Jon Maloy Signed-off-by: David S. Miller commit eec6f752f7241cc914cef0b832e1c99f81ba166a Author: YueHaibing Date: Fri Oct 19 13:03:06 2018 +0000 octeontx2-af: Remove set but not used variables 'devnum, is_pf' Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/ethernet/marvell/octeontx2/af/rvu.c: In function 'rvu_detach_rsrcs': drivers/net/ethernet/marvell/octeontx2/af/rvu.c:855:6: warning: variable 'devnum' set but not used [-Wunused-but-set-variable] drivers/net/ethernet/marvell/octeontx2/af/rvu.c:853:7: warning: variable 'is_pf' set but not used [-Wunused-but-set-variable] drivers/net/ethernet/marvell/octeontx2/af/rvu.c: In function 'rvu_mbox_handler_ATTACH_RESOURCES': drivers/net/ethernet/marvell/octeontx2/af/rvu.c:1054:7: warning: variable 'is_pf' set but not used [-Wunused-but-set-variable] drivers/net/ethernet/marvell/octeontx2/af/rvu.c:1053:6: warning: variable 'devnum' set but not used [-Wunused-but-set-variable] It never used since introduction in commit 746ea74241fa ("octeontx2-af: Add RVU block LF provisioning support") Signed-off-by: YueHaibing Signed-off-by: David S. Miller commit 665fc901b59ba336bb084ec0a0606ad8fc7d673f Author: YueHaibing Date: Fri Oct 19 12:51:28 2018 +0000 octeontx2-af: Remove set but not used variable 'block' Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/ethernet/marvell/octeontx2/af/rvu_npa.c: In function 'rvu_npa_init': drivers/net/ethernet/marvell/octeontx2/af/rvu_npa.c:446:20: warning: variable 'block' set but not used [-Wunused-but-set-variable] It never used since introduction in commit 7a37245ef23f ("octeontx2-af: NPA block admin queue init") Signed-off-by: YueHaibing Signed-off-by: David S. Miller commit 627d39c397999668557f6268b48ec8a74b6d2b0b Merge: 29e270fc3219 6acb47d1a318 Author: David S. Miller Date: Mon Oct 22 19:27:15 2018 -0700 Merge branch 'phy-ocelot-serdes-fix-out-of-bounds-read' Gustavo A. R. Silva says: ==================== phy: ocelot-serdes: fix out-of-bounds read This patchset aims to fix an out-of-bounds bug in the phy-ocelot-serdes driver. Currently, there is an out-of-bounds read on array ctrl->phys, once variable i reaches the maximum array size of SERDES_MAX in the for loop. Quentin Schulz pointed out that SERDES_MAX is a valid value to index ctrl->phys. So, I updated SERDES_MAX to be SERDES6G_MAX + 1 in include/dt-bindings/phy/phy-ocelot-serdes.h. Then I changed the condition in the for loop from i <= SERDES_MAX to i < SERDES_MAX in order to complete the fix. The reason I'm sending this fix as series is because checkpatch reported an error when I first tried to integrate the whole solution into a singe patch. So, changes to dt-bindings should be sent as a separate patch. Changes in v3: - Post the series to netdev, so Dave can take it. Changes in v2: - Send the whole series to Kishon Vijay Abraham I, so it can be taken into the PHY tree. - Add Quentin's Reviewed-by to commit log in both patches. ==================== Signed-off-by: David S. Miller commit 6acb47d1a318e5b3b7115354ebc4ea060c59d3a1 Author: Gustavo A. R. Silva Date: Fri Oct 19 11:21:38 2018 +0200 phy: ocelot-serdes: fix out-of-bounds read Currently, there is an out-of-bounds read on array ctrl->phys, once variable i reaches the maximum array size of SERDES_MAX in the for loop. Fix this by changing the condition in the for loop from i <= SERDES_MAX to i < SERDES_MAX. Addresses-Coverity-ID: 1473966 ("Out-of-bounds read") Addresses-Coverity-ID: 1473959 ("Out-of-bounds read") Fixes: 51f6b410fc22 ("phy: add driver for Microsemi Ocelot SerDes muxing") Reviewed-by: Quentin Schulz Signed-off-by: Gustavo A. R. Silva Signed-off-by: David S. Miller commit 81fa7a69c2174ed8de314b9c231ef30a8718e5e1 Author: Gustavo A. R. Silva Date: Fri Oct 19 11:19:13 2018 +0200 dt-bindings: phy: Update SERDES_MAX to be SERDES_MAX + 1 SERDES_MAX is a valid value to index ctrl->phys in drivers/phy/mscc/phy-ocelot-serdes.c. But, currently, there is an out-of-bounds bug in the mentioned driver when reading from ctrl->phys, because the size of array ctrl->phys is SERDES_MAX. Partially fix this by updating SERDES_MAX to be SERDES6G_MAX + 1. Notice that this is the first part of the solution to the out-of-bounds bug mentioned above. Although this change is not dependent on any other one. Suggested-by: Quentin Schulz Reviewed-by: Quentin Schulz Acked-by: Rob Herring Signed-off-by: Gustavo A. R. Silva Signed-off-by: David S. Miller commit 29e270fc32192e7729057963ae7120663856c93e Author: Guoqing Jiang Date: Fri Oct 19 12:08:22 2018 +0800 tipc: use destination length for copy string Got below warning with gcc 8.2 compiler. net/tipc/topsrv.c: In function ‘tipc_topsrv_start’: net/tipc/topsrv.c:660:2: warning: ‘strncpy’ specified bound depends on the length of the source argument [-Wstringop-overflow=] strncpy(srv->name, name, strlen(name) + 1); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ net/tipc/topsrv.c:660:27: note: length computed here strncpy(srv->name, name, strlen(name) + 1); ^~~~~~~~~~~~ So change it to correct length and use strscpy. Signed-off-by: Guoqing Jiang Acked-by: Ying Xue Signed-off-by: David S. Miller commit a1930a9877d66e9333fc1b1ceeec1ab54591a91f Author: Nathan Chancellor Date: Thu Oct 18 18:11:04 2018 -0700 isdn: hfc_{pci,sx}: Avoid empty body if statements Clang warns: drivers/isdn/hisax/hfc_pci.c:131:34: error: if statement has empty body [-Werror,-Wempty-body] if (Read_hfc(cs, HFCPCI_INT_S1)); ^ drivers/isdn/hisax/hfc_pci.c:131:34: note: put the semicolon on a separate line to silence this warning In my attempt to hide the warnings because I thought they didn't serve any purpose[1], Masahiro Yamada pointed out that {Read,Write}_hfc in hci_pci.c should be using a standard register access method; otherwise, the compiler will just remove the if statements. For hfc_pci, use the versions of {Read,Write}_hfc found in drivers/isdn/hardware/mISDN/hfc_pCI.h while converting pci_io to be 'void __iomem *' (and clean up ioremap) then remove the empty if statements. For hfc_sx, {Read,Write}_hfc are already use a proper register accessor (inb, outb) so just remove the unnecessary if statements. [1]: https://lore.kernel.org/lkml/20181016021454.11953-1-natechancellor@gmail.com/ Link: https://github.com/ClangBuiltLinux/linux/issues/66 Suggested-by: Masahiro Yamada Signed-off-by: Nathan Chancellor Signed-off-by: David S. Miller commit 8dbc450f76dc8f3b47fe117cd0cde166e1f21b64 Merge: 46b8306480fb 19832d244954 Author: David S. Miller Date: Mon Oct 22 19:14:24 2018 -0700 Merge branch 'sparc-vdso' sparc: VDSO improvements I started out on these changes with the goal of improving perf annotations when the VDSO is in use. Due to lack of inlining the helper functions are typically hit when profiling instead of __vdso_gettimeoday() or __vdso_vclock_gettime(). The only symbols available by default are the dyanmic symbols, which therefore doesn't cover the helper functions. So the perf output looks terrible, because the symbols cannot be resolved and all show up as "Unknown". The sparc VDSO code forces no inlining because of the way the simplistic %tick register read code patching works. So fixing that was the first order of business. Tricks were taken from how x86 implements alternates. The crucial factor is that if you want to refer to locations (for the original and patch instruction(s)) you have to do so in a way that is resolvable at link time even for a shared object. So you have to do this by storing PC-relative values, and not in executable sections. Next, we sanitize the Makefile so that the cflags et al. make more sense. And LDFLAGS are applied actually to invocations of LD instead of CC. We also add some sanity checking, specifically in a post-link check that makes sure we don't have any unexpected unresolved symbols in the VDSO. This is essential because the dynamic linker cannot resolve symbols in the VDSO because it cannot write to it. Finally some very minor optimizations are preformed to the vclock_gettime.c code. One thing which is tricky with this code on sparc is that struct timeval and struct timespec are layed out differently on 64-bit. This is because, unlike other architectures, sparc defined suseconds_t as 'int' even on 64-bit. This is why we have all of the "union" tstv_t" business and the weird assignments in __vdso_gettimeofday(). Performance wise we do gain some cycle shere, specifically here are cycle counts for a user application calling gettimeofday(): no-VDSO VDSO-orig VDSO-new ================================================ 64-bit 853 cycles 112 cycles 125 cycles 32-bit 849 cycles 134 cycles 141 cycles These results are with current glibc sources. To get better we'd need to implement this in assembler, and I might just do that at some point. Signed-off-by: David S. Miller commit 304d9b486b3c6994c193b6693c601b463987e6ac Author: Biju Das Date: Tue Sep 25 18:01:04 2018 +0100 dt-bindings: thermal: rcar: Add device tree support for r8a7744 Add thermal sensor support for r8a7744 SoC. The Renesas RZ/G1N (r8a7744) thermal sensor module is identical to the R-Car Gen2 family. No driver change is needed due to the fallback compatible value "renesas,rcar-gen2-thermal". Signed-off-by: Biju Das Reviewed-by: Chris Paterson Reviewed-by: Daniel Lezcano Reviewed-by: Simon Horman Reviewed-by: Geert Uytterhoeven Signed-off-by: Eduardo Valentin commit 78130819695f17f5c042d8ba097802639478faf5 Author: Chao Yu Date: Tue Sep 25 15:36:02 2018 +0800 f2fs: fix to keep project quota consistent This patch does below changes to keep consistence of project quota data in sudden power-cut case: - update inode.i_projid and project quota atomically under lock_op() in f2fs_ioc_setproject() - recover inode.i_projid and project quota in recover_inode() Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit af033b2aa8a874fd5737fafe90d159136527b5b4 Author: Chao Yu Date: Thu Sep 20 20:05:00 2018 +0800 f2fs: guarantee journalled quota data by checkpoint For journalled quota mode, let checkpoint to flush dquot dirty data and quota file data to guarntee persistence of all quota sysfile in last checkpoint, by this way, we can avoid corrupting quota sysfile when encountering SPO. The implementation is as below: 1. add a global state SBI_QUOTA_NEED_FLUSH to indicate that there is cached dquot metadata changes in quota subsystem, and later checkpoint should: a) flush dquot metadata into quota file. b) flush quota file to storage to keep file usage be consistent. 2. add a global state SBI_QUOTA_NEED_REPAIR to indicate that quota operation failed due to -EIO or -ENOSPC, so later, a) checkpoint will skip syncing dquot metadata. b) CP_QUOTA_NEED_FSCK_FLAG will be set in last cp pack to give a hint for fsck repairing. 3. add a global state SBI_QUOTA_SKIP_FLUSH, in checkpoint, if quota data updating is very heavy, it may cause hungtask in block_operation(). To avoid this, if our retry time exceed threshold, let's just skip flushing and retry in next checkpoint(). Signed-off-by: Weichao Guo Signed-off-by: Chao Yu [Jaegeuk Kim: avoid warnings and set fsck flag] Signed-off-by: Jaegeuk Kim commit 26b5a079197c8cb6725565968b7fd3299bd1877b Author: Sheng Yong Date: Fri Oct 12 18:49:26 2018 +0800 f2fs: cleanup dirty pages if recover failed During recover, we will try to create new dentries for inodes with dentry_mark. But if the parent is missing (e.g. killed by fsck), recover will break. But those recovered dirty pages are not cleanup. This will hit f2fs_bug_on: [ 53.519566] F2FS-fs (loop0): Found nat_bits in checkpoint [ 53.539354] F2FS-fs (loop0): recover_inode: ino = 5, name = file, inline = 3 [ 53.539402] F2FS-fs (loop0): recover_dentry: ino = 5, name = file, dir = 0, err = -2 [ 53.545760] F2FS-fs (loop0): Cannot recover all fsync data errno=-2 [ 53.546105] F2FS-fs (loop0): access invalid blkaddr:4294967295 [ 53.546171] WARNING: CPU: 1 PID: 1798 at fs/f2fs/checkpoint.c:163 f2fs_is_valid_blkaddr+0x26c/0x320 [ 53.546174] Modules linked in: [ 53.546183] CPU: 1 PID: 1798 Comm: mount Not tainted 4.19.0-rc2+ #1 [ 53.546186] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 53.546191] RIP: 0010:f2fs_is_valid_blkaddr+0x26c/0x320 [ 53.546195] Code: 85 bb 00 00 00 48 89 df 88 44 24 07 e8 ad a8 db ff 48 8b 3b 44 89 e1 48 c7 c2 40 03 72 a9 48 c7 c6 e0 01 72 a9 e8 84 3c ff ff <0f> 0b 0f b6 44 24 07 e9 8a 00 00 00 48 8d bf 38 01 00 00 e8 7c a8 [ 53.546201] RSP: 0018:ffff88006c067768 EFLAGS: 00010282 [ 53.546208] RAX: 0000000000000000 RBX: ffff880068844200 RCX: ffffffffa83e1a33 [ 53.546211] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88006d51e590 [ 53.546215] RBP: 0000000000000005 R08: ffffed000daa3cb3 R09: ffffed000daa3cb3 [ 53.546218] R10: 0000000000000001 R11: ffffed000daa3cb2 R12: 00000000ffffffff [ 53.546221] R13: ffff88006a1f8000 R14: 0000000000000200 R15: 0000000000000009 [ 53.546226] FS: 00007fb2f3646840(0000) GS:ffff88006d500000(0000) knlGS:0000000000000000 [ 53.546229] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 53.546234] CR2: 00007f0fd77f0008 CR3: 00000000687e6002 CR4: 00000000000206e0 [ 53.546237] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 53.546240] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 53.546242] Call Trace: [ 53.546248] f2fs_submit_page_bio+0x95/0x740 [ 53.546253] read_node_page+0x161/0x1e0 [ 53.546271] ? truncate_node+0x650/0x650 [ 53.546283] ? add_to_page_cache_lru+0x12c/0x170 [ 53.546288] ? pagecache_get_page+0x262/0x2d0 [ 53.546292] __get_node_page+0x200/0x660 [ 53.546302] f2fs_update_inode_page+0x4a/0x160 [ 53.546306] f2fs_write_inode+0x86/0xb0 [ 53.546317] __writeback_single_inode+0x49c/0x620 [ 53.546322] writeback_single_inode+0xe4/0x1e0 [ 53.546326] sync_inode_metadata+0x93/0xd0 [ 53.546330] ? sync_inode+0x10/0x10 [ 53.546342] ? do_raw_spin_unlock+0xed/0x100 [ 53.546347] f2fs_sync_inode_meta+0xe0/0x130 [ 53.546351] f2fs_fill_super+0x287d/0x2d10 [ 53.546367] ? vsnprintf+0x742/0x7a0 [ 53.546372] ? f2fs_commit_super+0x180/0x180 [ 53.546379] ? up_write+0x20/0x40 [ 53.546385] ? set_blocksize+0x5f/0x140 [ 53.546391] ? f2fs_commit_super+0x180/0x180 [ 53.546402] mount_bdev+0x181/0x200 [ 53.546406] mount_fs+0x94/0x180 [ 53.546411] vfs_kern_mount+0x6c/0x1e0 [ 53.546415] do_mount+0xe5e/0x1510 [ 53.546420] ? fs_reclaim_release+0x9/0x30 [ 53.546424] ? copy_mount_string+0x20/0x20 [ 53.546428] ? fs_reclaim_acquire+0xd/0x30 [ 53.546435] ? __might_sleep+0x2c/0xc0 [ 53.546440] ? ___might_sleep+0x53/0x170 [ 53.546453] ? __might_fault+0x4c/0x60 [ 53.546468] ? _copy_from_user+0x95/0xa0 [ 53.546474] ? memdup_user+0x39/0x60 [ 53.546478] ksys_mount+0x88/0xb0 [ 53.546482] __x64_sys_mount+0x5d/0x70 [ 53.546495] do_syscall_64+0x65/0x130 [ 53.546503] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 53.547639] ---[ end trace b804d1ea2fec893e ]--- So if recover fails, we need to drop all recovered data. Signed-off-by: Sheng Yong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1e78e8bd9d107c351930cdb1e11202caec01b311 Author: Sahitya Tummala Date: Wed Oct 10 10:56:22 2018 +0530 f2fs: fix data corruption issue with hardware encryption Direct IO can be used in case of hardware encryption. The following scenario results into data corruption issue in this path - Thread A - Thread B- -> write file#1 in direct IO -> GC gets kicked in -> GC submitted bio on meta mapping for file#1, but pending completion -> write file#1 again with new data in direct IO -> GC bio gets completed now -> GC writes old data to the new location and thus file#1 is corrupted. Fix this by submitting and waiting for pending io on meta mapping for direct IO case in f2fs_map_blocks(). Signed-off-by: Sahitya Tummala Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 0c093b590efb5c1ccdc835868dc2ae94bd2e14dc Author: Chao Yu Date: Sun Oct 7 03:03:38 2018 +0800 f2fs: fix to recover inode->i_flags of inode block during POR Testcase to reproduce this bug: 1. mkfs.f2fs /dev/sdd 2. mount -t f2fs /dev/sdd /mnt/f2fs 3. touch /mnt/f2fs/file 4. sync 5. chattr +a /mnt/f2fs/file 6. xfs_io -a /mnt/f2fs/file -c "fsync" 7. godown /mnt/f2fs 8. umount /mnt/f2fs 9. mount -t f2fs /dev/sdd /mnt/f2fs 10. xfs_io /mnt/f2fs/file There is no error when opening this file w/o O_APPEND, but actually, we expect the correct result should be: /mnt/f2fs/file: Operation not permitted The root cause is, in recover_inode(), we recover inode->i_flags more than F2FS_I(inode)->i_flags, so fix it. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 9149a5eb606152df158eb7d7da5a34e84b574189 Author: Chao Yu Date: Sun Oct 7 19:06:15 2018 +0800 f2fs: spread f2fs_set_inode_flags() This patch changes codes as below: - use f2fs_set_inode_flags() to update i_flags atomically to avoid potential race. - synchronize F2FS_I(inode)->i_flags to inode->i_flags in f2fs_new_inode(). - use f2fs_set_inode_flags() to simply codes in f2fs_quota_{on,off}. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 2baf07818549c8bb8d7b3437e889b86eab56d38e Author: Chao Yu Date: Fri Jul 27 18:15:16 2018 +0800 f2fs: fix to spread clear_cold_data() We need to drop PG_checked flag on page as well when we clear PG_uptodate flag, in order to avoid treating the page as GCing one later. Signed-off-by: Weichao Guo Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 164a63fa6b384e30ceb96ed80bc7dc3379bc0960 Author: Jaegeuk Kim Date: Tue Oct 16 19:30:13 2018 -0700 Revert "f2fs: fix to clear PG_checked flag in set_page_dirty()" This reverts commit 66110abc4c931f879d70e83e1281f891699364bf. If we clear the cold data flag out of the writeback flow, we can miscount -1 by end_io, which incurs a deadlock caused by all I/Os being blocked during heavy GC. Balancing F2FS Async: - IO (CP: 1, Data: -1, Flush: ( 0 0 1), Discard: ( ... GC thread: IRQ - move_data_page() - set_page_dirty() - clear_cold_data() - f2fs_write_end_io() - type = WB_DATA_TYPE(page); here, we get wrong type - dec_page_count(sbi, type); - f2fs_wait_on_page_writeback() Cc: Reported-and-Tested-by: Park Ju Hyung Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 5f9abab42b60e67846cd13dafc6a61d70d7a2682 Author: Jaegeuk Kim Date: Tue Oct 16 10:20:53 2018 -0700 f2fs: account read IOs and use IO counts for is_idle This patch adds issued read IO counts which is under block layer. Chao modified a bit, since: Below race can cause reversed reference on F2FS_RD_DATA, there is the same issue in f2fs_submit_page_bio(), fix them by relocate __submit_bio() and inc_page_count. Thread A Thread B - f2fs_write_begin - f2fs_submit_page_read - __submit_bio - f2fs_read_end_io - __read_end_io - dec_page_count(, F2FS_RD_DATA) - inc_page_count(, F2FS_RD_DATA) Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit ca9eb48fe01fa7fa60ff9f2196b1bd0d84dc81af Merge: b537149a2fb4 f35b1e53a66a Author: Linus Torvalds Date: Tue Oct 23 01:54:44 2018 +0100 Merge tag 'regulator-v5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "The biggest chunk of the regulator changes for this release outside of the new drivers is the conversion of the fixed regulator to use the GPIO descriptor API, there's a small addition to the GPIO API plus a bunch of updates to board files to implement it. This is some really welcome work from Linus Walleij that's had a bunch of review and has been sitting in -next for a while so I'm fairly happy there's no major issues. - Helpers for overlapping linear ranges. - Display opmode and consumer requested load in the regualtor_summary file in debugfs, plus a fix there. - Support for the fun and entertaining power off mechanism that the pfuze100 hardware implements. - Conversion of the fixed regulator API to use GPIO descriptors, including pulling in a bunch of patches to a bunch of board files. - New drivers for Cirrus Logic Lochnagar, Qualcomm PMS405, Rohm BD71847, ST PMIC1, and TI LM363x devices" * tag 'regulator-v5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (36 commits) regulator: lochnagar: Use a consisent comment style for SPDX header regulator: bd718x7: Remove struct bd718xx_pmic regulator: Fetch enable gpiods nonexclusive regulator/gpio: Allow nonexclusive GPIO access regulator: lochnagar: Add support for the Cirrus Logic Lochnagar regulator: stpmic1: Return REGULATOR_MODE_INVALID for invalid mode regulator: stpmic1: add stpmic1 regulator driver dt-bindings: regulator: document stpmic1 pmic regulators regulator: axp20x: Mark expected switch fall-throughs regulator: bd718xx: fix build warning on x86_64 regulator: fixed: Default enable high on DT regulators regulator: bd718xx: rename bd71837 to 718xx regulator: bd718XX use pickable ranges regulator/mfd: bd718xx: rename bd71837/bd71847 common instances regulator: Support regulators where voltage ranges are selectable mfd: dt bindings: add BD71847 device-tree binding documentation regulator: dt bindings: add BD71847 device-tree binding documentation regulator/mfd: Support ROHM BD71847 power management IC regulator: da905{2,5}: Remove unnecessary array check regulator: qcom: Add PMS405 regulators ... commit 78efac537de33faab9a4302cc05a70bb4a8b3b63 Author: Chao Yu Date: Mon Oct 22 23:24:28 2018 +0800 f2fs: fix to account IO correctly for cgroup writeback Now, we have supported cgroup writeback, it depends on correctly IO account of specified filesystem. But in commit d1b3e72d5490 ("f2fs: submit bio of in-place-update pages"), we split write paths from f2fs_submit_page_mbio() to two: - f2fs_submit_page_bio() for IPU path - f2fs_submit_page_bio() for OPU path But still we account write IO only in f2fs_submit_page_mbio(), result in incorrect IO account, fix it by adding missing IO account in IPU path. Fixes: d1b3e72d5490 ("f2fs: submit bio of in-place-update pages") Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 4c58ed076875f36dae0f240da1e25e99e5d4afb8 Author: Chao Yu Date: Mon Oct 22 09:12:51 2018 +0800 f2fs: fix to account IO correctly Below race can cause reversed reference on dirty count, fix it by relocating __submit_bio() and inc_page_count(). Thread A Thread B - f2fs_inplace_write_data - f2fs_submit_page_bio - __submit_bio - f2fs_write_end_io - dec_page_count - inc_page_count Cc: Fixes: d1b3e72d5490 ("f2fs: submit bio of in-place-update pages") Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 8c6c36846f1174784bcf90627341ede7ce9a0b36 Author: Daniel Lezcano Date: Tue Sep 25 11:03:12 2018 +0200 thermal/drivers/hisi: Add the dual clusters sensors for hi3660 The code is ready to support multiple sensors on the hi3660. The DT defines a thermal zone per cluster. Add the little cluster sensor and let it bind with the thermal zone. Signed-off-by: Daniel Lezcano Signed-off-by: Eduardo Valentin commit ce8c0700dcf905333733f83a06cd956496e0a661 Author: Daniel Lezcano Date: Tue Sep 25 11:03:10 2018 +0200 thermal/drivers/hisi: Add more sensors channel Add the sensor channels id for the little, g3d and modem. Signed-off-by: Daniel Lezcano Signed-off-by: Eduardo Valentin commit a18e83e77217b63e4138470aa49d8269a201f76d Author: Daniel Lezcano Date: Tue Sep 25 11:03:09 2018 +0200 thermal/drivers/hisi: Remove pointless irq field The irq field in the data structure is pointless as the scope of its usage is just to request the interrupt. It can be replaced by a local variable. Use the 'ret' variable to get the interrupt number. Signed-off-by: Daniel Lezcano Signed-off-by: Eduardo Valentin commit 2cffaeff083fafeefb1daee7b443f7381eca5b2f Author: Daniel Lezcano Date: Tue Sep 25 11:03:07 2018 +0200 thermal/drivers/hisi: Use platform_get_irq_byname As we have the interrupt names defines, replace platform_get_irq() by platform_get_irq_byname(), so no confusion can be made when getting the interrupt with the sensor id. Signed-off-by: Daniel Lezcano Signed-off-by: Eduardo Valentin commit a849eecee7ee70db47c4f7e2976432ef16c081e1 Author: Daniel Lezcano Date: Tue Sep 25 11:03:05 2018 +0200 thermal/drivers/hisi: Replace macro name with relevant sensor location Change the macro name in order to give a better indication of the sensor location. Signed-off-by: Daniel Lezcano Signed-off-by: Eduardo Valentin commit 7edc5e406f2637ba1f9c93b1e72e0e37f446304b Author: Daniel Lezcano Date: Tue Sep 25 11:03:04 2018 +0200 thermal/drivers/hisi: Add multiple sensors support Change the code as it is dealing with several sensors. For git-bisect compatibility (compilation and booting), assume the DT is not yet changed and we have a single interrupt. Next changes will support multiple interrupt sorted by their name. Signed-off-by: Daniel Lezcano Signed-off-by: Eduardo Valentin commit 8c0ffc8f9a76b2007258f146a4ff22ef14e68590 Author: Daniel Lezcano Date: Tue Sep 25 11:03:03 2018 +0200 thermal/drivers/hisi: Prepare to support multiple sensors Convert the 'sensor' field to a pointer and propagate the change in the file. Havintg a pointer, gives us the opportunity to define multiple sensors. Signed-off-by: Daniel Lezcano Signed-off-by: Eduardo Valentin commit 9bb4ec8d9e93f0d1a94e8aa9100c5f42fd364078 Author: Daniel Lezcano Date: Tue Sep 25 11:03:02 2018 +0200 thermal/drivers/hisi: Factor out the probe functions The hi6220 and the hi3660 probe functions are doing almost the same operations, they can share 90% of their code. Factor out the probe functions by moving the common code in the common probe function. Signed-off-by: Daniel Lezcano Signed-off-by: Eduardo Valentin commit 49e778d1c750d5b1f773edeb93dfef963bef3f21 Author: Daniel Lezcano Date: Tue Sep 25 11:03:01 2018 +0200 thermal/drivers/hisi: Set the thermal zone private data to the sensor pointer Store the sensor pointer in the thermal zone private data and use it in the callback functions. That allows to continue the conversion to sensor oriented code where the pointers are the sensors. Signed-off-by: Daniel Lezcano Signed-off-by: Eduardo Valentin commit 9c9ae8da710639790f1d45b1a55d28ee70734c11 Author: Daniel Lezcano Date: Tue Sep 25 11:03:00 2018 +0200 thermal/drivers/hisi: Change the driver to be sensor oriented In order to support multiple sensors, we have to change the code to deal with sensors and not the hisi thermal structure. Add a back pointer to the hisi thermal structure (containerof is not a good option because later we convert the sensor field to a pointer). Change the functions parameters to take a sensor instead of this hisi thermal 'data' structure. Signed-off-by: Daniel Lezcano Signed-off-by: Eduardo Valentin commit 19832d244954189c851d8492718607a14734679c Author: David S. Miller Date: Sun Oct 21 22:38:56 2018 -0700 sparc: Several small VDSO vclock_gettime.c improvements. Almost entirely borrowed from the x86 code. Main improvement is to avoid having to initialize ts->tv_nsec to zero before the sequence loops, by expanding timespec_add_ns(). Signed-off-by: David S. Miller commit c90aaeccc7c6a8967f3efd43048eeae51072251c Author: Daniel Lezcano Date: Tue Sep 25 11:02:59 2018 +0200 thermal/drivers/hisi: Change the platform data pointer to sensor ops Group the temperature sensor specific ops into a single structure and assign it to hisi thermal data structure. Change the platform data pointer to reference the specific sensor ops instead of the probe functions. Moving out those allow to split the code to self-encapsulate the sensor object. Signed-off-by: Daniel Lezcano Signed-off-by: Eduardo Valentin commit d26c4bbf992463c043fdee4b3e5efa3f08990862 Merge: a6de21baf637 8b20d2db0a6d Author: Palmer Dabbelt Date: Mon Oct 22 17:39:29 2018 -0700 RISC-V: SMP cleanup and new features This patch series now has evolved to contain several related changes. 1. Updated the assorted cleanup series by Palmer. The original cleanup patch series can be found here. http://lists.infradead.org/pipermail/linux-riscv/2018-August/001232.html 2. Implemented decoupling linux logical CPU ids from hart id. Some of the work has been inspired from ARM64. Tested on QEMU & HighFive Unleashed board with/without SMP enabled. 3. Included Anup's cleanup and IPI stat patch. All the patch series have been combined to avoid conflicts as a lot of common code is changed different patch sets. Atish has mostly addressed review comments and fixed checkpatch errors from Palmer's and Anup's series. Signed-off-by: Palmer Dabbelt commit a6de21baf6373ac1ddd5c52e8fbd959f164ef9cf Merge: 4e4101cfefd3 827a438156e4 Author: Palmer Dabbelt Date: Mon Oct 22 17:39:08 2018 -0700 RISC-V: Fix some RV32 bugs and build failures This patch set fixes up various failures in the RV32I port. The fixes are all nominally independent, but are really only testable together because the RV32I port fails to build without all of them. The patch set includes: * The removal of tishift on RV32I targets, as 128-bit integers are not supported by the toolchain. * The removal of swiotlb from RV32I targets, since all physical addresses can be mapped by all hardware on all existing RV32I targets. * The addition of ummodi3 and udivmoddi4 from an old version of GCC that was licensed under GPLv2 as generic code, along with their use on RV32I targets. * A fix to our page alignment logic within ioremap for RV32I targets. Signed-off-by: Palmer Dabbelt commit 4e4101cfefd382176b05356c5ef112561ae10384 Merge: aef53f97b505 9411ec60c23d Author: Palmer Dabbelt Date: Mon Oct 22 17:38:26 2018 -0700 riscv: Add support to no-FPU systems This patchset adds an option, CONFIG_FPU, to enable/disable floating- point support within the kernel. The kernel's new behavior will be as follows: * with CONFIG_FPU=y All FPU codes are reserved. If no FPU is found during booting, a global flag will be set, and those functions will be bypassed with condition check to that flag. * with CONFIG_FPU=n No floating-point instructions in kernel and all related settings are excluded. Signed-off-by: Palmer Dabbelt commit d1d2c290b3c04b65fa6132eeebe50a070746d8f6 Author: Dan Carpenter Date: Wed Sep 19 13:35:00 2018 +0300 thermal: armada: fix a test in probe() The platform_get_resource() function doesn't return error pointers, it returns NULL on error. Fixes: 3d4e51844a4e ("thermal: armada: convert driver to syscon register accesses") Signed-off-by: Dan Carpenter Reviewed-by: Miquel Raynal Signed-off-by: Eduardo Valentin commit aef53f97b505ff94190ce3a06dcd0ded6cf5c0ca Author: Nick Kossifidis Date: Thu Sep 20 01:48:15 2018 +0300 RISC-V: Cosmetic menuconfig changes * Move the built-in cmdline configuration on a new menu entry "Boot options", it doesn't make much sense to be part of the debuging menu. * Rename "Kernel Type" menu to "Kernel features" to be more consistent with what other architectures are using, plus "type" is a bit misleading here. Signed-off-by: Nick Kossifidis Signed-off-by: Palmer Dabbelt commit ee5928843a93c7d246bbe17c5eed95918ed0ddb1 Author: Masahiro Yamada Date: Fri Aug 24 17:33:53 2018 +0900 riscv: move GCC version check for ARCH_SUPPORTS_INT128 to Kconfig This becomes much neater in Kconfig. Signed-off-by: Masahiro Yamada Signed-off-by: Palmer Dabbelt commit f31b8de98853091e86a6391f9cd7948a2397287e Author: Christoph Hellwig Date: Fri Sep 21 08:43:21 2018 +0200 RISC-V: remove the unused return_to_handler export This export is not only not needed, but also breaks symbol versioning due to being an undeclared assembly export. Signed-off-by: Christoph Hellwig Signed-off-by: Palmer Dabbelt commit b90edb33010bcfb9a0d74681be2cdd52300f1e69 Author: Jim Wilson Date: Tue Oct 16 14:42:59 2018 -0700 RISC-V: Add futex support. Here is an attempt to add the missing futex support. I started with the MIPS version of futex.h and modified it until I got it working. I tested it on a HiFive Unleashed running Fedora Core 29 using the fc29 4.15 version of the kernel. This was tested against the glibc testsuite, where it fixes 14 nptl related testsuite failures. That unfortunately only tests the cmpxchg support, so I also used the testcase at the end of https://lwn.net/Articles/148830/ which tests the atomic_op functionality, except that it doesn't verify that the operations are atomic, which they obviously are. This testcase runs successfully with the patch and fails without it. I'm not a kernel expert, so there could be details I got wrong here. I wasn't sure about the memory model support, so I used aqrl which seemed safest, and didn't add fences which seemed unnecessary. I'm not sure about the copyright statements, I left in Ralf Baechle's line because I started with his code. Checkpatch reports some style problems, but it is the same style as the MIPS futex.h, and the uses of ENOSYS appear correct even though it complains about them. I don't know if any of that matters. This patch was tested on qemu with the glibc nptl/tst-cond-except testcase, and the wake_op testcase from above. Signed-off-by: Jim Wilson Reviewed-by: Christoph Hellwig Signed-off-by: Palmer Dabbelt commit b8c8a9590e4fde82f8c3ee06a521763e6f21e9c8 Author: Jim Wilson Date: Wed Oct 17 17:59:05 2018 -0700 RISC-V: Add FP register ptrace support for gdb. Add a variable and a macro to describe FP registers, assuming only D is supported. FP code is conditional on CONFIG_FPU. The FP regs and FCSR are copied separately to avoid copying struct padding. Tested by hand and with the gdb testsuite. Signed-off-by: Jim Wilson Signed-off-by: Palmer Dabbelt commit 86e581e310785782e2025a076dc9a3f5138e5bf3 Author: Palmer Dabbelt Date: Mon Aug 27 14:42:53 2018 -0700 RISC-V: Mask out the F extension on systems without D The RISC-V Linux port doesn't support systems that have the F extension but don't have the D extension -- we actually don't support systems without D either, but Alan's patch set is rectifying that soon. For now I think we can leave this in a semi-broken state and just wait for Alan's patch set to get merged for proper non-FPU support -- the patch set is starting to look good, so doing something in-between doesn't seem like it's worth the work. I don't think it's worth fretting about support for systems with F but not D for now: our glibc ABIs are IMAC and IMAFDC so they probably won't end up being popular. We can always extend this in the future. CC: Alan Kao Signed-off-by: Palmer Dabbelt commit 1760debb51f73ed3e089c8d4e847554901dee4bb Author: Palmer Dabbelt Date: Tue Jul 24 17:17:14 2018 -0700 RISC-V: Don't set cacheinfo.{physical_line_partition,attributes} These are just hard coded in the RISC-V port, which doesn't make any sense. We should probably be setting these from device tree entries when they exist, but for now I think it's saner to just leave them all as their default values. Reviewed-by: Jeremy Linton Signed-off-by: Palmer Dabbelt commit b6ad3981ff94b415d48399e949db0bdfbe360736 Author: Anson Huang Date: Thu Sep 13 17:13:06 2018 +0800 thermal: imx: handle error path in one place to save duplicated code During probe phase, the error path can be handled in one place and use goto method to save many duplicated code. Signed-off-by: Anson Huang Reviewed-by: Daniel Lezcano Signed-off-by: Eduardo Valentin commit 337a4aecdaf8fa53b16fbf48a73d328fb44ffb75 Author: Anson Huang Date: Thu Sep 13 17:13:05 2018 +0800 thermal: imx: improve error message Remove the duplicated "from" to improve the error message. Signed-off-by: Anson Huang Reviewed-by: Daniel Lezcano Signed-off-by: Eduardo Valentin commit 36d83c6662450e13a2fa5792b34afff6f8bdba50 Author: Amit Kucheria Date: Wed Sep 12 15:22:58 2018 +0530 dt-bindings: thermal: Fix a typo in documentation c(1) + x(1) was actually meant to be c(1) * x(1). Signed-off-by: Amit Kucheria Reviewed-by: Matthias Kaehlcke Acked-by: Rob Herring Reviewed-by: Bjorn Andersson Signed-off-by: Eduardo Valentin commit c8c3b091b65c55ed950cb1601b21eea59c3117c0 Author: Amit Kucheria Date: Wed Sep 12 15:22:53 2018 +0530 thermal: tsens: Check if the IP is correctly enabled by firmware The SROT registers are initialised by the secure firmware at boot. We don't have write access to the registers. Check if the block is enabled before continuing. Signed-off-by: Amit Kucheria Reviewed-by: Bjorn Andersson Signed-off-by: Eduardo Valentin commit c130a7602e3bc2c6fd896c1d56478fca47a38c02 Author: Amit Kucheria Date: Wed Sep 12 15:22:52 2018 +0530 thermal: tsens: Pass register offsets as private data Registers have moved around across TSENS generations. For example, the CTRL register was at offset 0x0 in the SROT region on msm8916 but is at offset 0x4 in newer v2 based TSENS HW blocks. Allow passing offsets of important registers so that we can continue to use common functions. Signed-off-by: Amit Kucheria Reviewed-by: Bjorn Andersson Signed-off-by: Eduardo Valentin commit a15525b5d9ac37fec559d140b2e24c4ce4defa54 Author: Amit Kucheria Date: Wed Sep 12 15:22:50 2018 +0530 thermal: tsens: Add the SROT address map On platforms whose device trees specify two address spaces for TSENS, the second one points to the SROT registers. Initialise the SROT map on those platforms. Signed-off-by: Amit Kucheria Reviewed-by: Matthias Kaehlcke Reviewed-by: Bjorn Andersson Signed-off-by: Eduardo Valentin commit 67b0f5e064cd7fb3ac79c49dcbf7720fa5dc4acd Author: Amit Kucheria Date: Wed Sep 12 15:22:49 2018 +0530 thermal: tsens: Rename map field in order to add a second address map The TSENS driver currently only uses a limited set of registers from the TM address space. So it was ok to map just that set of registers and call it "map". We'd now like to map a second set: SROT registers to introduce new functionality. Rename the "map" field to a more appropriate "tm_map". The 8960 doesn't have a clear split between TM and SROT registers. To avoid complicating the data structure, it will switchover to using tm_map for its maps. There is no functional change with this patch. Signed-off-by: Amit Kucheria Reviewed-by: Matthias Kaehlcke Reviewed-by: Bjorn Andersson Signed-off-by: Eduardo Valentin commit caac52bce61116c4d645d80e38ed07e47a81a2e9 Author: Amit Kucheria Date: Wed Sep 12 15:22:48 2018 +0530 thermal: tsens: Get rid of dead code hw_id is dynamically allocated but not used anywhere. Get rid of dead code. Signed-off-by: Amit Kucheria Reviewed-by: Matthias Kaehlcke Reviewed-by: Bjorn Andersson Signed-off-by: Eduardo Valentin commit 2d71d8ded5f48b23ae46fec44811fe33da639fc9 Author: Amit Kucheria Date: Wed Sep 12 15:22:47 2018 +0530 thermal: tsens: Add SPDX license identifiers The TSENS drivers use a GPL-2.0 license. Replace with equivalent SPDX tags and delete the full license text. Signed-off-by: Amit Kucheria Reviewed-by: Matthias Kaehlcke Reviewed-by: Bjorn Andersson Signed-off-by: Eduardo Valentin commit bd7557f55a4514bf277dcc80ed66985eadab5719 Author: Amit Kucheria Date: Wed Sep 12 15:22:46 2018 +0530 thermal: tsens: Prepare 8916 and 8974 tsens to use SROT and TM address space We've already converted over the devicetree of platforms using v2 version of the TSENS IP to use two address spaces. Now prepare to convert over the 8916 and 8974 platforms to use separate SROT and TM address spaces. This patch will work with device trees with one or two address spaces because we set the tm_offset in commit 5b1283984fa3 ("thermal: tsens: Add support to split up register address space into two"). Signed-off-by: Amit Kucheria Reviewed-by: Matthias Kaehlcke Signed-off-by: Eduardo Valentin commit 6017e2a9d727809bfae9a4decfe8d00e2a0f0242 Author: Anson Huang Date: Thu Aug 30 10:14:46 2018 +0800 thermal: qoriq: add i.mx8mq support Add i.mx8mq specific compatible string. Signed-off-by: Anson Huang Signed-off-by: Eduardo Valentin commit 9b96566063c5511982c33df747e239e77cb75f78 Author: Rob Herring Date: Mon Aug 27 20:52:46 2018 -0500 thermal: Convert to using %pOFn instead of device_node.name In preparation to remove the node name pointer from struct device_node, convert printf users to use the %pOFn format specifier. Cc: Zhang Rui Cc: Eduardo Valentin Cc: Daniel Lezcano Cc: linux-pm@vger.kernel.org Signed-off-by: Rob Herring Acked-by: Daniel Lezcano Signed-off-by: Eduardo Valentin commit b537149a2fb45ef9936b7a55aa801fbab8ea2a8a Merge: 6214a9fe2aec 7b9734dbc5b0 Author: Linus Torvalds Date: Tue Oct 23 01:26:05 2018 +0100 Merge tag 'spi-v5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "One new core feature here, a small collection of new drivers and a bunch of small improvements in existing drivers: - A new CS_WORD flag for transfers where the chip select is toggled at every word, with both a generic implementation and the ability for controllers to do this automatically (including a DaVinci one). - New drivers for Mediatek MT2712, Qualcomm GENI and QSPI, Spreadtrum SPI and ST STM32 QSPI plus new IDs for several existing ones" * tag 'spi-v5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (86 commits) spi: lpspi: add imx8qxp compatible string spi: Allow building SPI_BCM63XX_HSSPI on ARM-based SoCs spi: omap2-mcspi: Add slave mode support spi: omap2-mcspi: Set FIFO DMA trigger level to word length spi: omap2-mcspi: Switch to readl_poll_timeout() spi: spi-mem: add stm32 qspi controller dt-bindings: spi: add stm32 qspi controller spi: sh-msiof: document R8A779{7|8}0 bindings spi: pic32-sqi: don't pass GFP_DMA32 to dma_alloc_coherent MAINTAINERS: Add entry for Broadcom SPI controller spi: sh-msiof: fix deferred probing spi: imx: use PIO mode if size is small spi: imx: correct wml as the last sg length spi: imx: move wml setting to later than setup_transfer PCI: Provide pci_match_id() with CONFIG_PCI=n spi: Make GPIO CSs honour the SPI_NO_CS flag spi/spi-pxa2xx: add PXA2xx SSP SPI Controller spi: pxa2xx: Add devicetree support spi: pxa2xx: Use an enum for type spi: spi-geni-qcom: Add SPI driver support for GENI based QUP ... commit 6214a9fe2aeca5e22184b20954774424e2efc1f6 Merge: a36cf6865120 ae2399c48c02 Author: Linus Torvalds Date: Tue Oct 23 01:17:27 2018 +0100 Merge tag 'regmap-v5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap updates from Mark Brown: "A small update with a couple of new APIs that are useful for some small sets of devices: - Split up the single_rw flagging to map read and write separately as some devices support bulk operations for only read or only write. - Add a write version of the noinc API. - Clean up the code for LOG_DEVICE a bit" * tag 'regmap-v5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: use less #ifdef for LOG_DEVICE regmap: Add regmap_noinc_write API regmap: split up regmap_config.use_single_rw regmap: fix comment for regmap.use_single_write commit b6ae3550c8e2ca8f7ce1b7f04585dc12a0eb5cbd Author: Christophe Leroy Date: Thu Oct 18 05:22:27 2018 +0000 powerpc/8xx: add missing header in 8xx_mmu.c arch/powerpc/mm/8xx_mmu.c:174:6: error: no previous prototype for ‘set_context’ [-Werror=missing-prototypes] void set_context(unsigned long id, pgd_t *pgd) Signed-off-by: Christophe Leroy Signed-off-by: Scott Wood commit e738c5f15562635c02a03365cb62cad35051babe Author: Christophe Leroy Date: Thu Oct 18 13:57:22 2018 +0000 powerpc/8xx: Add DT node for using the SEC engine of the MPC885 The MPC885 has SEC engine version 1.2 with the following details: - Number of Crypto channels: 1 - Exec Units: DEU, MDEU and AESU - Available descriptors: 00010, 00100, 00110, 01000, 11000, 11010 It is also supposed to have descriptor 00000, but it doesn't work properly so we keep it out for the moment. Signed-off-by: Christophe Leroy Signed-off-by: Scott Wood commit a36cf6865120d7534fcb132d311f03e5159f2da7 Merge: b8e445b6895c 042c1a5a6021 Author: Linus Torvalds Date: Tue Oct 23 01:09:22 2018 +0100 Merge tag 'mtd/for-4.20' of git://git.infradead.org/linux-mtd Pull mtd updates from Boris Brezillon: "SPI NOR core changes: - Support non-uniform erase size - Support controllers with limited TX fifo size Driver changes: - m25p80: Re-issue a WREN command after each write access - cadence: Pass a proper dir value to dma_[un]map_single() - fsl-qspi: Check fsl_qspi_get_seqid() return val make sure 4B addressing opcodes are properly handled - intel-spi: Add a new PCI entry for Ice Lake Raw NAND core changes: - Two batchs of cleanups of the NAND API, including: * Deprecating a lot of interfaces (now replaced by ->exec_op()). * Moving code in separate drivers (JEDEC, ONFI), in private files (internals), in platform drivers, etc. * Functions/structures reordering. * Exclusive use of the nand_chip structure instead of the MTD one all across the subsystem. - Addition of the nand_wait_readrdy/rdy_op() helpers. Raw NAND controllers drivers changes: - Various coccinelle patches. - Marvell: * Use regmap_update_bits() for syscon access. * More documentation. * BCH failure path rework. * More layouts to be supported. * IRQ handler complete() condition fixed. - Fsl_ifc: * SRAM initialization fixed for newer controller versions. - Denali: * Fix licenses mismatch and use a SPDX tag. * Set SPARE_AREA_SKIP_BYTES register to 8 if unset. - Qualcomm: * Do not include dma-direct.h. - Docg4: * Removed. - Ams-delta: * Use of a GPIO lookup table * Internal machinery changes. Raw NAND chip drivers changes: - Toshiba: * Add support for Toshiba memory BENAND * Pass a single nand_chip object to the status helper. - ESMT: * New driver to retrieve the ECC requirements from the 5th ID byte. MTD changes: - physmap cleanups/fixe - gpio-addr-flash cleanups/fixes" * tag 'mtd/for-4.20' of git://git.infradead.org/linux-mtd: (93 commits) jffs2: free jffs2_sb_info through jffs2_kill_sb() mtd: spi-nor: fsl-quadspi: fix read error for flash size larger than 16MB mtd: spi-nor: intel-spi: Add support for Intel Ice Lake SPI serial flash mtd: maps: gpio-addr-flash: Convert to gpiod mtd: maps: gpio-addr-flash: Replace array with an integer mtd: maps: gpio-addr-flash: Use order instead of size mtd: spi-nor: fsl-quadspi: Don't let -EINVAL on the bus mtd: devices: m25p80: Make sure WRITE_EN is issued before each write mtd: spi-nor: Support controllers with limited TX FIFO size mtd: spi-nor: cadence-quadspi: Use proper enum for dma_[un]map_single mtd: spi-nor: parse SFDP Sector Map Parameter Table mtd: spi-nor: add support to non-uniform SFDP SPI NOR flash memories mtd: rawnand: marvell: fix the IRQ handler complete() condition mtd: rawnand: denali: set SPARE_AREA_SKIP_BYTES register to 8 if unset mtd: rawnand: r852: fix spelling mistake "card_registred" -> "card_registered" mtd: rawnand: toshiba: Pass a single nand_chip object to the status helper mtd: maps: gpio-addr-flash: Use devm_* functions mtd: maps: gpio-addr-flash: Fix ioremapped size mtd: maps: gpio-addr-flash: Replace custom printk mtd: physmap_of: Release resources on error ... commit 8b20d2db0a6d2761e0fc156eb74f7a55b92b3147 Author: Anup Patel Date: Tue Oct 2 12:15:07 2018 -0700 RISC-V: Show IPI stats This patch provides arch_show_interrupts() implementation to show IPI stats via /proc/interrupts. Now the contents of /proc/interrupts" will look like below: CPU0 CPU1 CPU2 CPU3 8: 17 7 6 14 SiFive PLIC 8 virtio0 10: 10 10 9 11 SiFive PLIC 10 ttyS0 IPI0: 170 673 251 79 Rescheduling interrupts IPI1: 1 12 27 1 Function call interrupts Signed-off-by: Anup Patel [Atish - Fixed checkpatch errors] Signed-off-by: Atish Patra Reviewed-by: Palmer Dabbelt Changes since v2: - Remove use of IPI_CALL_WAKEUP because it's being removed Changes since v1: - Add stub inline show_ipi_stats() function for !CONFIG_SMP - Make ipi_names[] dynamically sized at compile time - Minor beautification of ipi_names[] using tabs Signed-off-by: Palmer Dabbelt commit 4b26d22fdff1e39647cc5952b01d329e83dedfe1 Author: Anup Patel Date: Tue Oct 2 12:15:06 2018 -0700 RISC-V: Show CPU ID and Hart ID separately in /proc/cpuinfo Currently, /proc/cpuinfo show logical CPU ID as Hart ID which is in-correct. This patch shows CPU ID and Hart ID separately in /proc/cpuinfo using cpuid_to_hardid_map(). With this patch, contents of /proc/cpuinfo looks as follows: processor : 0 hart : 1 isa : rv64imafdc mmu : sv48 processor : 1 hart : 0 isa : rv64imafdc mmu : sv48 processor : 2 hart : 2 isa : rv64imafdc mmu : sv48 processor : 3 hart : 3 isa : rv64imafdc mmu : sv48 Signed-off-by: Anup Patel Signed-off-by: Atish Patra Signed-off-by: Palmer Dabbelt commit f99fb607fb2bc0d4ce6b9adb764c65e37f40a92b Author: Atish Patra Date: Tue Oct 2 12:15:05 2018 -0700 RISC-V: Use Linux logical CPU number instead of hartid Setup the cpu_logical_map during boot. Moreover, every SBI call and PLIC context are based on the physical hartid. Use the logical CPU to hartid mapping to pass correct hartid to respective functions. Signed-off-by: Atish Patra Reviewed-by: Anup Patel Reviewed-by: Christoph Hellwig Signed-off-by: Palmer Dabbelt commit 6825c7a80f1863b975a00042abe140ea24813af2 Author: Atish Patra Date: Tue Oct 2 12:15:04 2018 -0700 RISC-V: Add logical CPU indexing for RISC-V Currently, both Linux CPU id and hart id are same. This is not recommended as it will lead to discontinuous CPU indexing in Linux. Moreover, kdump kernel will run from CPU0 which would be absent if we follow existing scheme. Implement a logical mapping between Linux CPU id and hart id to decouple these two. Always mark the boot processor as CPU0 and all other CPUs get the logical CPU id based on their booting order. Signed-off-by: Atish Patra Reviewed-by: Anup Patel Reviewed-by: Christoph Hellwig Signed-off-by: Palmer Dabbelt commit a37d56fc401108f39dec9ba83ed923a453937a26 Author: Atish Patra Date: Tue Oct 2 12:15:03 2018 -0700 RISC-V: Use WRITE_ONCE instead of direct access The secondary harts spin on couple of per cpu variables until both of these are non-zero so it's not necessary to have any ordering here. However, WRITE_ONCE should be used to avoid tearing. Signed-off-by: Atish Patra Reviewed-by: Christoph Hellwig Signed-off-by: Palmer Dabbelt commit 46373cb442c56d2f8a4c8b3f777c89d20546c9d5 Author: Palmer Dabbelt Date: Tue Oct 2 12:15:02 2018 -0700 RISC-V: Use mmgrab() commit f1f1007644ff ("mm: add new mmgrab() helper") added a helper that we missed out on. Signed-off-by: Palmer Dabbelt Reviewed-by: Christoph Hellwig Signed-off-by: Atish Patra Signed-off-by: Palmer Dabbelt commit 177fae4515889e2407810c5167a5227da8b37cce Author: Palmer Dabbelt Date: Tue Oct 2 12:15:01 2018 -0700 RISC-V: Rename im_okay_therefore_i_am to found_boot_cpu The old name was a bit odd. Signed-off-by: Palmer Dabbelt Signed-off-by: Atish Patra Reviewed-by: Christoph Hellwig Signed-off-by: Palmer Dabbelt commit b2f8cfa7ac34202e5fd9551b6507fcd424634c1b Author: Palmer Dabbelt Date: Tue Oct 2 12:15:00 2018 -0700 RISC-V: Rename riscv_of_processor_hart to riscv_of_processor_hartid It's a bit confusing exactly what this function does: it actually returns the hartid of an OF processor node, failing with -1 on invalid nodes. I've changed the name to _hartid() in order to make that a bit more clear, as well as adding a comment. Signed-off-by: Palmer Dabbelt [Atish: code comment formatting update] Signed-off-by: Atish Patra Reviewed-by: Christoph Hellwig Signed-off-by: Palmer Dabbelt commit 9639a44394b9859a5576cb36630105733a552bd6 Author: Palmer Dabbelt Date: Tue Oct 2 12:14:59 2018 -0700 RISC-V: Provide a cleaner raw_smp_processor_id() I'm not sure how I managed to miss this the first time, but this is much better. Signed-off-by: Palmer Dabbelt [Atish: code comment formatting and other fixes] Signed-off-by: Atish Patra Reviewed-by: Christoph Hellwig Signed-off-by: Palmer Dabbelt commit 6db170ff4c088caaf7806c00b29a55f6df07d7b6 Author: Atish Patra Date: Tue Oct 2 12:14:58 2018 -0700 RISC-V: Disable preemption before enabling interrupts Currently, irq is enabled before preemption disabling happens. If the scheduler fired right here and cpu is scheduled then it may blow up. Signed-off-by: Palmer Dabbelt [Atish: Commit text and code comment formatting update] Signed-off-by: Atish Patra Reviewed-by: Christoph Hellwig Signed-off-by: Palmer Dabbelt commit b18d6f05252d6b3f725c08d8831a46b003df5b6b Author: Palmer Dabbelt Date: Tue Oct 2 12:14:57 2018 -0700 RISC-V: Comment on the TLB flush in smp_callin() This isn't readily apparent from reading the code. Signed-off-by: Palmer Dabbelt [Atish: code comment formatting update] Signed-off-by: Atish Patra Reviewed-by: Christoph Hellwig Signed-off-by: Palmer Dabbelt commit 19ccf29bb18f08a4583aa899a8cc8c11e5ea85a6 Author: Palmer Dabbelt Date: Tue Oct 2 12:14:56 2018 -0700 RISC-V: Filter ISA and MMU values in cpuinfo We shouldn't be directly passing device tree values to userspace, both because there could be mistakes in device trees and because the kernel doesn't support arbitrary ISAs. Signed-off-by: Palmer Dabbelt [Atish: checkpatch fix and code comment formatting update] Signed-off-by: Atish Patra Reviewed-by: Christoph Hellwig Signed-off-by: Palmer Dabbelt commit 566d6c428eadf9dc06df8b2195dff58d9a97c9e6 Author: Palmer Dabbelt Date: Tue Oct 2 12:14:55 2018 -0700 RISC-V: Don't set cacheinfo.{physical_line_partition,attributes} These are just hard coded in the RISC-V port, which doesn't make any sense. We should probably be setting these from device tree entries when they exist, but for now I think it's saner to just leave them all as their default values. Signed-off-by: Palmer Dabbelt Reviewed-by: Christoph Hellwig Reviewed-by: Jeremy Linton Signed-off-by: Palmer Dabbelt commit 1ed4237ab616a05225e11d07bf42d5474deec905 Author: Anup Patel Date: Tue Oct 2 12:14:54 2018 -0700 RISC-V: No need to pass scause as arg to do_IRQ() The scause is already part of pt_regs so no need to pass scause as separate arg to do_IRQ(). Reviewed-by: Christoph Hellwig Signed-off-by: Anup Patel Signed-off-by: Palmer Dabbelt commit 827a438156e4c423b6875a092e272933952a2910 Author: Vincent Chen Date: Tue Oct 2 16:52:31 2018 +0800 RISC-V: Avoid corrupting the upper 32-bit of phys_addr_t in ioremap For 32bit, the upper 32-bit of phys_addr_t will be flushed to zero after AND with PAGE_MASK because the data type of PAGE_MASK is unsigned long. To fix this problem, the page alignment is done by subtracting the page offset instead of AND with PAGE_MASK. Signed-off-by: Vincent Chen Reviewed-by: Christoph Hellwig Signed-off-by: Palmer Dabbelt commit 757331db921428295948fed5e7377a436e66d34e Author: Zong Li Date: Tue Oct 2 16:52:30 2018 +0800 RISC-V: Select GENERIC_LIB_UMODDI3 on RV32 On 32-bit, it need to use __umoddi3 by some drivers. Signed-off-by: Zong Li Signed-off-by: Palmer Dabbelt commit 6315730e9eab7de5fa9864bb13a352713f48aef1 Author: Zong Li Date: Tue Oct 2 16:52:29 2018 +0800 lib: Add umoddi3 and udivmoddi4 of GCC library routines Add umoddi3 and udivmoddi4 support for 32-bit. The RV32 need the umoddi3 to do modulo when the operands are long long type, like other libraries implementation such as ucmpdi2, lshrdi3 and so on. I encounter the undefined reference 'umoddi3' when I use the in house dma driver, although it is in house driver, but I think that umoddi3 is a common function for RV32. The udivmoddi4 and umoddi3 are copies from libgcc in gcc. There are other functions use the udivmoddi4 in libgcc, so I separate the umoddi3 and udivmoddi4 for flexible extension in the future. Signed-off-by: Zong Li Signed-off-by: Palmer Dabbelt commit 51858aaf9bea3ddf166bf9d252a1fc351260b497 Author: Zong Li Date: Tue Oct 2 16:52:28 2018 +0800 RISC-V: Use swiotlb on RV64 only Only RV64 supports swiotlb. On RV32, it don't select the SWIOTLB. Signed-off-by: Zong Li Reviewed-by: Christoph Hellwig Signed-off-by: Palmer Dabbelt commit 7f47c73b355f300cf162f3a664e43d557d2cb30d Author: Zong Li Date: Tue Oct 2 16:52:27 2018 +0800 RISC-V: Build tishift only on 64-bit Only RV64 supports 128 integer size. Signed-off-by: Zong Li Reviewed-by: Christoph Hellwig Signed-off-by: Palmer Dabbelt commit 9411ec60c23d868124d9c1b1d491937aebe07afa Author: Alan Kao Date: Tue Oct 9 10:18:34 2018 +0800 Auto-detect whether a FPU exists We expect that a kernel with CONFIG_FPU=y can still support no-FPU machines. To do so, the kernel should first examine the existence of a FPU, then do nothing if a FPU does exist; otherwise, it should disable/bypass all FPU-related functions. In this patch, a new global variable, has_fpu, is created and determined when parsing the hardware capability from device tree during booting. This variable is used in those FPU-related functions. Signed-off-by: Alan Kao Cc: Greentime Hu Cc: Vincent Chen Cc: Zong Li Cc: Nick Hu Signed-off-by: Palmer Dabbelt commit 9671f7061433e2c58b9894093eada1898595b85d Author: Alan Kao Date: Tue Oct 9 10:18:33 2018 +0800 Allow to disable FPU support FPU codes have been separated from common part in previous patches. This patch add the CONFIG_FPU option and some stubs, so that a no-FPU configuration is allowed. Signed-off-by: Alan Kao Cc: Greentime Hu Cc: Vincent Chen Cc: Zong Li Cc: Nick Hu Reviewed-by: Christoph Hellwig Signed-off-by: Palmer Dabbelt commit e8be5302330281bd9f77834600f63e8cc4560d3d Author: Alan Kao Date: Tue Oct 9 10:18:32 2018 +0800 Cleanup ISA string setting This patch cleanup the MARCH string passing to both compiler and assembler. Note that the CFLAGS should not contain "fd" before we have mechnisms like kernel_fpu_begin/end in other architectures. Signed-off-by: Alan Kao Cc: Greentime Hu Cc: Vincent Chen Cc: Zong Li Cc: Nick Hu Signed-off-by: Palmer Dabbelt commit 007f5c35895786fdc797f13313b9493fe5d5e655 Author: Alan Kao Date: Tue Oct 9 10:18:31 2018 +0800 Refactor FPU code in signal setup/return procedures FPU-related logic is separated from normal signal handling path in this patch. Kernel can easily be configured to exclude those procedures for no-FPU systems. Signed-off-by: Alan Kao Cc: Greentime Hu Cc: Vincent Chen Cc: Zong Li Cc: Nick Hu Reviewed-by: Christoph Hellwig Signed-off-by: Palmer Dabbelt commit e68ad867f77e1a839ad496ffcbd88b9c96769b5b Author: Alan Kao Date: Tue Oct 9 10:18:30 2018 +0800 Extract FPU context operations from entry.S We move __fstate_save and __fstate_restore to a new source file, fpu.S. Signed-off-by: Alan Kao Cc: Greentime Hu Cc: Vincent Chen Cc: Zong Li Cc: Nick Hu Reviewed-by: Christoph Hellwig Signed-off-by: Palmer Dabbelt commit b8e445b6895cfe76c5959a7135a3216703fe32d4 Merge: cff229491af5 e7c6a55606b5 Author: Linus Torvalds Date: Tue Oct 23 00:58:12 2018 +0100 Merge tag 'hwmon-for-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: - Add support for trace events to hwmon core - Add support for NCT6797D, NCT6798D, MAX31725/6, LTM4686 - Support all AMD Family 15h Model 6xh and Model 7xh processors in k10temp driver - Convert ina3221 driver to _info API - Fixes, cleanups, and improvements in various drivers * tag 'hwmon-for-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (46 commits) hwmon: (pmbus) Fix page count auto-detection. hwmon: (pmbus) remove redundant 'default n' from Kconfig hwmon: (core) Add trace events to _attr_show/store functions hwmon: (ina3221) Use _info API to register hwmon device hwmon: (npcm-750-pwm-fan) Change initial pwm target to 255 hwmon: (ina3221) Validate shunt resistor value from DT hwmon: (tmp421) make const array 'names' static hwmon: (core) Add hwmon_in_enable attribute hwmon: (ina3221) mark PM functions as __maybe_unused hwmon: (ina3221) Read channel input source info from DT dt-bindings: hwmon: Add ina3221 documentation hwmon: (ina3221) Add suspend and resume functions hwmon: (ina3221) Fix INA3221_CONFIG_MODE macros hwmon: (ina3221) Add INA3221_CONFIG to volatile_table MAINTAINERS: Update PMBUS maintainer entry hwmon: (pwm-fan) Set fan speed to 0 on suspend hwmon: (pwm-fan) Silence error on probe deferral hwmon: (scpi-hwmon) remove redundant continue hwmon: (nct6775) Add support for NCT6798D hwmon: (nct6775) Add support for NCT6797D ... commit ecd4c19f3df7f3687867a2183934efb54a7d3c14 Author: David S. Miller Date: Sun Oct 21 22:36:17 2018 -0700 sparc: Validate VDSO for undefined symbols. There should be no undefined symbols in the resulting VDSO image(s). On sparc, fixed register usage can result in undefined symbols ending up in the image. To combat this, we do two things: 1) Define current_thread_info() specially when BUILD_DSO. 2) Ignore "#scratch" register undefined symbols in the output. Signed-off-by: David S. Miller commit 3c2b2d9408b11022614bf656ae56c8fc12001ecc Author: David S. Miller Date: Sun Oct 21 22:33:07 2018 -0700 sparc: Really use linker with LDFLAGS. Rather than funneling through CC. Also, use --hash-style=both just like other VDSO architectures and glibc do. Signed-off-by: David S. Miller commit 5615edcca99a0ceb47940fb8e89d1f72bc35398b Author: David S. Miller Date: Sun Oct 21 22:22:54 2018 -0700 sparc: Improve VDSO CFLAGS. Do not set any special register usage options, use the default which is exactly what we should use for userspace code. Make sure we remove the gcc plugin options from the 64-bit build. The 32-bit cflags got it right already. Signed-off-by: David S. Miller commit 44231b7fee3f086cf367588c7c79ec3b5d7619b2 Author: David S. Miller Date: Sun Oct 21 22:14:01 2018 -0700 sparc: Set DISABLE_BRANCH_PROFILING in VDSO CFLAGS. Not in vclock_gettime.c itself. Signed-off-by: David S. Miller commit 3fe5d7e861286c0b80573f094e32dd9736370d69 Author: David S. Miller Date: Sun Oct 21 22:10:51 2018 -0700 sparc: Don't bother masking out TICK_PRIV_BIT in VDSO code. If the TICK_PRIV_BIT was set, we would not be able to read the tick register in user space, which is where this code runs. Signed-off-by: David S. Miller commit 794b88e047588965ad8f716245857b452f118e13 Author: David S. Miller Date: Sun Oct 21 22:09:40 2018 -0700 sparc: Inline VDSO gettime code aggressively. One interesting thing we need to do is stop using __builtin_return_address() in get_vvar_data(). Simply read the %pc register instead. Signed-off-by: David S. Miller commit 2f6c9bf31a0b16aeccb42b73f8d0ddf9bea88f3f Author: David S. Miller Date: Sun Oct 21 21:44:33 2018 -0700 sparc: Improve VDSO instruction patching. The current VDSO patch mechanism has several problems: 1) It assumes how gcc will emit a function, with a register window, an initial save instruction and then immediately the %tick read when compiling vread_tick(). There is no such guarantees, code generation could change at any time, gcc could put a nop between the save and the %tick read, etc. So this is extremely fragile and would fail some day. 2) It disallows us to properly inline vread_tick() into the callers and thus get the best possible code sequences. So fix this to patch properly, with location based annotations. We have to be careful because we cannot do it the way we do patches elsewhere in the kernel. Those use a sequence like: 1: insn .section .whatever_patch, "ax" .word 1b replacement_insn .previous This is a dynamic shared object, so that .word cannot be resolved at build time, and thus cannot be used to execute the patches when the kernel initializes the images. Even trying to use label difference equations doesn't work in the above kind of scheme: 1: insn .section .whatever_patch, "ax" .word . - 1b replacement_insn .previous The assembler complains that it cannot resolve that computation. The issue is that this is contained in an executable section. Borrow the sequence used by x86 alternatives, which is: 1: insn .pushsection .whatever_patch, "a" .word . - 1b, . - 1f .popsection .pushsection .whatever_patch_replacements, "ax" 1: replacement_insn .previous This works, allows us to inline vread_tick() as much as we like, and can be used for arbitrary kinds of VDSO patching in the future. Also, reverse the condition for patching. Most systems are %stick based, so if we only patch on %tick systems the patching code will get little or no testing. Signed-off-by: David S. Miller commit 5e3cdecf7834a764b9d24f6e696adf3e03813fab Merge: b5a229350b72 65dfb6d6dd28 Author: Takashi Iwai Date: Mon Oct 22 23:26:37 2018 +0200 Merge tag 'asoc-v5.0' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for v5.0/v4.20 As ever there's a lot of small and driver specific changes going on here, but we do also have some relatively large changes in the core thanks to the hard work of Charles and Morimoto-san: - More component transitions from Morimoto-san, I think we're about finished with this. Thanks for all the hard work! - Morimoto-san also added a bunch of for_each_foo macros - A bunch of cleanups and fixes for DAPM from Charles. - MCLK support for several different devices, including CS42L51, STM32 SAI, and MAX98373. - Support for Allwinner A64 CODEC analog, Intel boards with DA7219 and MAX98927, Meson AXG PDM inputs, Nuvoton NAU8822, Renesas R8A7744 and TI PCM3060. commit 3b2ad16dc4288dab05862aeacf1e124c4662d475 Author: Evan Quan Date: Fri Oct 19 15:41:20 2018 +0800 drm/amd/powerplay: bump the PPtable version supported As the matching VBIOS is already ready. Also drop the temporary workarounds applied before. Signed-off-by: Evan Quan Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit b44ec6a3eb386d398c6c8b8c60d1c8473ff9cb7e Author: Evan Quan Date: Thu Oct 18 17:54:06 2018 +0800 drm/amd/powerplay: drop highest UCLK setting after display configuration change The UCLK is forced to highest at the start of display configuration change. Downgrade the UCLK from highest after display configuration change. Otherwise, we may see the UCLK stuck in the highest in some cases. Signed-off-by: Evan Quan Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit f7becf9a0803030ae125189823328e2d62b90f7b Author: Joseph Greathouse Date: Thu Oct 18 14:57:45 2018 -0500 drm/amd/pp: enable power limit increase in OD mode OverDrive mode allows users to increase the maximum SCLK and MCLK frequencies beyond the default on the GPU. However, this may not results in large performance gains if the GPU then runs into its TDP power limit. This patch adds the capability to increase the power limit of a GPU above its default maximum. This is only allowed when overdrive is enabled in the ppfeaturemask, since this is an overdrive feature. The TDPODLimit value from the VBIOS describes how how much higher the TDP should be allowed to go over its default, in percentage. v2: Moved dereference of hwmgr to after its validity check Signed-off-by: Joseph Greathouse Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit f191415b24a3ad3fa22088af7cd7fc328a2f469f Author: David Francis Date: Thu Oct 18 11:21:15 2018 -0400 powerplay: Respect units on max dcfclk watermark In a refactor, the watermark clock inputs to powerplay from DC were changed from units of 10kHz to kHz clocks. One division by 100 was not converted into a division by 1000. Signed-off-by: David Francis Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit 91eec27ebbc4f4e7cf4ee6a589d2f060ba9d0d79 Author: Emily Deng Date: Thu Oct 18 15:01:05 2018 +0800 drm/amdgpu: Fix null pointer amdgpu_device_fw_loading Need to check adev->powerplay.pp_funcs. Signed-off-by: Emily Deng Reviewed-by: Huang Rui Signed-off-by: Alex Deucher commit 241dbbb1fb21bfff0c46c6873cee5c7923d05378 Author: Evan Quan Date: Wed Oct 17 16:36:02 2018 +0800 drm/amd/powerplay: error out when force clock level under auto dpm mode V2 Forcing clock level is supported under manual dpm mode only. Error out when trying to set under manual mode. Instead of doing nothing and reporting success. V2: update for mclk/pcie clock level settings also Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit cacd9759eea2f1c7e8792ecd91ed4602f963b1a5 Merge: 13c1c5e4d7f8 f39f8688888a Author: Dmitry Torokhov Date: Mon Oct 22 12:04:33 2018 -0700 Merge branch 'next' into for-linus Prepare input updates for 4.20 merge window. commit 9084cb6a24bf5838a665af92ded1af8363f9e563 Author: Filipe Manana Date: Mon Oct 22 10:43:06 2018 +0100 Btrfs: fix use-after-free when dumping free space We were iterating a block group's free space cache rbtree without locking first the lock that protects it (the free_space_ctl->free_space_offset rbtree is protected by the free_space_ctl->tree_lock spinlock). KASAN reported an use-after-free problem when iterating such a rbtree due to a concurrent rbtree delete: [ 9520.359168] ================================================================== [ 9520.359656] BUG: KASAN: use-after-free in rb_next+0x13/0x90 [ 9520.359949] Read of size 8 at addr ffff8800b7ada500 by task btrfs-transacti/1721 [ 9520.360357] [ 9520.360530] CPU: 4 PID: 1721 Comm: btrfs-transacti Tainted: G L 4.19.0-rc8-nbor #555 [ 9520.360990] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 [ 9520.362682] Call Trace: [ 9520.362887] dump_stack+0xa4/0xf5 [ 9520.363146] print_address_description+0x78/0x280 [ 9520.363412] kasan_report+0x263/0x390 [ 9520.363650] ? rb_next+0x13/0x90 [ 9520.363873] __asan_load8+0x54/0x90 [ 9520.364102] rb_next+0x13/0x90 [ 9520.364380] btrfs_dump_free_space+0x146/0x160 [btrfs] [ 9520.364697] dump_space_info+0x2cd/0x310 [btrfs] [ 9520.364997] btrfs_reserve_extent+0x1ee/0x1f0 [btrfs] [ 9520.365310] __btrfs_prealloc_file_range+0x1cc/0x620 [btrfs] [ 9520.365646] ? btrfs_update_time+0x180/0x180 [btrfs] [ 9520.365923] ? _raw_spin_unlock+0x27/0x40 [ 9520.366204] ? btrfs_alloc_data_chunk_ondemand+0x2c0/0x5c0 [btrfs] [ 9520.366549] btrfs_prealloc_file_range_trans+0x23/0x30 [btrfs] [ 9520.366880] cache_save_setup+0x42e/0x580 [btrfs] [ 9520.367220] ? btrfs_check_data_free_space+0xd0/0xd0 [btrfs] [ 9520.367518] ? lock_downgrade+0x2f0/0x2f0 [ 9520.367799] ? btrfs_write_dirty_block_groups+0x11f/0x6e0 [btrfs] [ 9520.368104] ? kasan_check_read+0x11/0x20 [ 9520.368349] ? do_raw_spin_unlock+0xa8/0x140 [ 9520.368638] btrfs_write_dirty_block_groups+0x2af/0x6e0 [btrfs] [ 9520.368978] ? btrfs_start_dirty_block_groups+0x870/0x870 [btrfs] [ 9520.369282] ? do_raw_spin_unlock+0xa8/0x140 [ 9520.369534] ? _raw_spin_unlock+0x27/0x40 [ 9520.369811] ? btrfs_run_delayed_refs+0x1b8/0x230 [btrfs] [ 9520.370137] commit_cowonly_roots+0x4b9/0x610 [btrfs] [ 9520.370560] ? commit_fs_roots+0x350/0x350 [btrfs] [ 9520.370926] ? btrfs_run_delayed_refs+0x1b8/0x230 [btrfs] [ 9520.371285] btrfs_commit_transaction+0x5e5/0x10e0 [btrfs] [ 9520.371612] ? btrfs_apply_pending_changes+0x90/0x90 [btrfs] [ 9520.371943] ? start_transaction+0x168/0x6c0 [btrfs] [ 9520.372257] transaction_kthread+0x21c/0x240 [btrfs] [ 9520.372537] kthread+0x1d2/0x1f0 [ 9520.372793] ? btrfs_cleanup_transaction+0xb50/0xb50 [btrfs] [ 9520.373090] ? kthread_park+0xb0/0xb0 [ 9520.373329] ret_from_fork+0x3a/0x50 [ 9520.373567] [ 9520.373738] Allocated by task 1804: [ 9520.373974] kasan_kmalloc+0xff/0x180 [ 9520.374208] kasan_slab_alloc+0x11/0x20 [ 9520.374447] kmem_cache_alloc+0xfc/0x2d0 [ 9520.374731] __btrfs_add_free_space+0x40/0x580 [btrfs] [ 9520.375044] unpin_extent_range+0x4f7/0x7a0 [btrfs] [ 9520.375383] btrfs_finish_extent_commit+0x15f/0x4d0 [btrfs] [ 9520.375707] btrfs_commit_transaction+0xb06/0x10e0 [btrfs] [ 9520.376027] btrfs_alloc_data_chunk_ondemand+0x237/0x5c0 [btrfs] [ 9520.376365] btrfs_check_data_free_space+0x81/0xd0 [btrfs] [ 9520.376689] btrfs_delalloc_reserve_space+0x25/0x80 [btrfs] [ 9520.377018] btrfs_direct_IO+0x42e/0x6d0 [btrfs] [ 9520.377284] generic_file_direct_write+0x11e/0x220 [ 9520.377587] btrfs_file_write_iter+0x472/0xac0 [btrfs] [ 9520.377875] aio_write+0x25c/0x360 [ 9520.378106] io_submit_one+0xaa0/0xdc0 [ 9520.378343] __se_sys_io_submit+0xfa/0x2f0 [ 9520.378589] __x64_sys_io_submit+0x43/0x50 [ 9520.378840] do_syscall_64+0x7d/0x240 [ 9520.379081] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 9520.379387] [ 9520.379557] Freed by task 1802: [ 9520.379782] __kasan_slab_free+0x173/0x260 [ 9520.380028] kasan_slab_free+0xe/0x10 [ 9520.380262] kmem_cache_free+0xc1/0x2c0 [ 9520.380544] btrfs_find_space_for_alloc+0x4cd/0x4e0 [btrfs] [ 9520.380866] find_free_extent+0xa99/0x17e0 [btrfs] [ 9520.381166] btrfs_reserve_extent+0xd5/0x1f0 [btrfs] [ 9520.381474] btrfs_get_blocks_direct+0x60b/0xbd0 [btrfs] [ 9520.381761] __blockdev_direct_IO+0x10ee/0x58a1 [ 9520.382059] btrfs_direct_IO+0x25a/0x6d0 [btrfs] [ 9520.382321] generic_file_direct_write+0x11e/0x220 [ 9520.382623] btrfs_file_write_iter+0x472/0xac0 [btrfs] [ 9520.382904] aio_write+0x25c/0x360 [ 9520.383172] io_submit_one+0xaa0/0xdc0 [ 9520.383416] __se_sys_io_submit+0xfa/0x2f0 [ 9520.383678] __x64_sys_io_submit+0x43/0x50 [ 9520.383927] do_syscall_64+0x7d/0x240 [ 9520.384165] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 9520.384439] [ 9520.384610] The buggy address belongs to the object at ffff8800b7ada500 which belongs to the cache btrfs_free_space of size 72 [ 9520.385175] The buggy address is located 0 bytes inside of 72-byte region [ffff8800b7ada500, ffff8800b7ada548) [ 9520.385691] The buggy address belongs to the page: [ 9520.385957] page:ffffea0002deb680 count:1 mapcount:0 mapping:ffff880108a1d700 index:0x0 compound_mapcount: 0 [ 9520.388030] flags: 0x8100(slab|head) [ 9520.388281] raw: 0000000000008100 ffffea0002deb608 ffffea0002728808 ffff880108a1d700 [ 9520.388722] raw: 0000000000000000 0000000000130013 00000001ffffffff 0000000000000000 [ 9520.389169] page dumped because: kasan: bad access detected [ 9520.389473] [ 9520.389658] Memory state around the buggy address: [ 9520.389943] ffff8800b7ada400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 9520.390368] ffff8800b7ada480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 9520.390796] >ffff8800b7ada500: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc [ 9520.391223] ^ [ 9520.391461] ffff8800b7ada580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 9520.391885] ffff8800b7ada600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 9520.392313] ================================================================== [ 9520.392772] BTRFS critical (device vdc): entry offset 2258497536, bytes 131072, bitmap no [ 9520.393247] BUG: unable to handle kernel NULL pointer dereference at 0000000000000011 [ 9520.393705] PGD 800000010dbab067 P4D 800000010dbab067 PUD 107551067 PMD 0 [ 9520.394059] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI [ 9520.394378] CPU: 4 PID: 1721 Comm: btrfs-transacti Tainted: G B L 4.19.0-rc8-nbor #555 [ 9520.394858] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 [ 9520.395350] RIP: 0010:rb_next+0x3c/0x90 [ 9520.396461] RSP: 0018:ffff8801074ff780 EFLAGS: 00010292 [ 9520.396762] RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff81b5ac4c [ 9520.397115] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000011 [ 9520.397468] RBP: ffff8801074ff7a0 R08: ffffed0021d64ccc R09: ffffed0021d64ccc [ 9520.397821] R10: 0000000000000001 R11: ffffed0021d64ccb R12: ffff8800b91e0000 [ 9520.398188] R13: ffff8800a3ceba48 R14: ffff8800b627bf80 R15: 0000000000020000 [ 9520.398555] FS: 0000000000000000(0000) GS:ffff88010eb00000(0000) knlGS:0000000000000000 [ 9520.399007] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9520.399335] CR2: 0000000000000011 CR3: 0000000106b52000 CR4: 00000000000006a0 [ 9520.399679] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 9520.400023] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 9520.400400] Call Trace: [ 9520.400648] btrfs_dump_free_space+0x146/0x160 [btrfs] [ 9520.400974] dump_space_info+0x2cd/0x310 [btrfs] [ 9520.401287] btrfs_reserve_extent+0x1ee/0x1f0 [btrfs] [ 9520.401609] __btrfs_prealloc_file_range+0x1cc/0x620 [btrfs] [ 9520.401952] ? btrfs_update_time+0x180/0x180 [btrfs] [ 9520.402232] ? _raw_spin_unlock+0x27/0x40 [ 9520.402522] ? btrfs_alloc_data_chunk_ondemand+0x2c0/0x5c0 [btrfs] [ 9520.402882] btrfs_prealloc_file_range_trans+0x23/0x30 [btrfs] [ 9520.403261] cache_save_setup+0x42e/0x580 [btrfs] [ 9520.403570] ? btrfs_check_data_free_space+0xd0/0xd0 [btrfs] [ 9520.403871] ? lock_downgrade+0x2f0/0x2f0 [ 9520.404161] ? btrfs_write_dirty_block_groups+0x11f/0x6e0 [btrfs] [ 9520.404481] ? kasan_check_read+0x11/0x20 [ 9520.404732] ? do_raw_spin_unlock+0xa8/0x140 [ 9520.405026] btrfs_write_dirty_block_groups+0x2af/0x6e0 [btrfs] [ 9520.405375] ? btrfs_start_dirty_block_groups+0x870/0x870 [btrfs] [ 9520.405694] ? do_raw_spin_unlock+0xa8/0x140 [ 9520.405958] ? _raw_spin_unlock+0x27/0x40 [ 9520.406243] ? btrfs_run_delayed_refs+0x1b8/0x230 [btrfs] [ 9520.406574] commit_cowonly_roots+0x4b9/0x610 [btrfs] [ 9520.406899] ? commit_fs_roots+0x350/0x350 [btrfs] [ 9520.407253] ? btrfs_run_delayed_refs+0x1b8/0x230 [btrfs] [ 9520.407589] btrfs_commit_transaction+0x5e5/0x10e0 [btrfs] [ 9520.407925] ? btrfs_apply_pending_changes+0x90/0x90 [btrfs] [ 9520.408262] ? start_transaction+0x168/0x6c0 [btrfs] [ 9520.408582] transaction_kthread+0x21c/0x240 [btrfs] [ 9520.408870] kthread+0x1d2/0x1f0 [ 9520.409138] ? btrfs_cleanup_transaction+0xb50/0xb50 [btrfs] [ 9520.409440] ? kthread_park+0xb0/0xb0 [ 9520.409682] ret_from_fork+0x3a/0x50 [ 9520.410508] Dumping ftrace buffer: [ 9520.410764] (ftrace buffer empty) [ 9520.411007] CR2: 0000000000000011 [ 9520.411297] ---[ end trace 01a0863445cf360a ]--- [ 9520.411568] RIP: 0010:rb_next+0x3c/0x90 [ 9520.412644] RSP: 0018:ffff8801074ff780 EFLAGS: 00010292 [ 9520.412932] RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff81b5ac4c [ 9520.413274] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000011 [ 9520.413616] RBP: ffff8801074ff7a0 R08: ffffed0021d64ccc R09: ffffed0021d64ccc [ 9520.414007] R10: 0000000000000001 R11: ffffed0021d64ccb R12: ffff8800b91e0000 [ 9520.414349] R13: ffff8800a3ceba48 R14: ffff8800b627bf80 R15: 0000000000020000 [ 9520.416074] FS: 0000000000000000(0000) GS:ffff88010eb00000(0000) knlGS:0000000000000000 [ 9520.416536] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9520.416848] CR2: 0000000000000011 CR3: 0000000106b52000 CR4: 00000000000006a0 [ 9520.418477] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 9520.418846] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 9520.419204] Kernel panic - not syncing: Fatal exception [ 9520.419666] Dumping ftrace buffer: [ 9520.419930] (ftrace buffer empty) [ 9520.420168] Kernel Offset: disabled [ 9520.420406] ---[ end Kernel panic - not syncing: Fatal exception ]--- Fix this by acquiring the respective lock before iterating the rbtree. Reported-by: Nikolay Borisov CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit ef0f02fd69a02b50e468a4ddbe33e3d81671e248 Author: Nathan Chancellor Date: Fri Oct 19 13:43:45 2018 -0700 rtc: s35390a: Change buf's type to u8 in s35390a_init Clang warns: drivers/rtc/rtc-s35390a.c:124:27: warning: implicit conversion from 'int' to 'char' changes value from 192 to -64 [-Wconstant-conversion] buf = S35390A_FLAG_RESET | S35390A_FLAG_24H; ~ ~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~ 1 warning generated. Update buf to be an unsigned 8-bit integer, which matches the buf member in struct i2c_msg. https://github.com/ClangBuiltLinux/linux/issues/145 Signed-off-by: Nathan Chancellor Signed-off-by: Alexandre Belloni commit 3e71c70c946b5d5e7b21397c621b14951e5c0fcf Author: Adrian Hunter Date: Mon Oct 1 09:28:35 2018 +0300 perf scripts python: call-graph-from-sql.py: Use SPDX license identifier Use SPDX license identifier in call-graph-from-sql.py. Signed-off-by: Adrian Hunter Cc: Andi Kleen Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20181001062853.28285-2-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit a9c5e6c1e9bff42ca5f01ceb3092a27a010755fb Author: Arnaldo Carvalho de Melo Date: Mon Oct 22 14:14:16 2018 -0300 perf trace: Introduce per-event maximum number of events property Call it 'nr', as in this context it should be expressive enough, i.e.: # perf trace -e sched:*waking/nr=8,call-graph=fp/ 0.000 :0/0 sched:sched_waking:comm=rcu_sched pid=10 prio=120 target_cpu=001 try_to_wake_up ([kernel.kallsyms]) sched_clock ([kernel.kallsyms]) 3.933 :0/0 sched:sched_waking:comm=rcu_sched pid=10 prio=120 target_cpu=001 try_to_wake_up ([kernel.kallsyms]) sched_clock ([kernel.kallsyms]) 3.970 IPDL Backgroun/3622 sched:sched_waking:comm=Gecko_IOThread pid=3569 prio=120 target_cpu=003 try_to_wake_up ([kernel.kallsyms]) __libc_write (/usr/lib64/libpthread-2.26.so) 20.069 IPDL Backgroun/3622 sched:sched_waking:comm=Gecko_IOThread pid=3569 prio=120 target_cpu=003 try_to_wake_up ([kernel.kallsyms]) __libc_write (/usr/lib64/libpthread-2.26.so) 37.170 IPDL Backgroun/3622 sched:sched_waking:comm=Gecko_IOThread pid=3569 prio=120 target_cpu=003 try_to_wake_up ([kernel.kallsyms]) __libc_write (/usr/lib64/libpthread-2.26.so) 53.267 IPDL Backgroun/3622 sched:sched_waking:comm=Gecko_IOThread pid=3569 prio=120 target_cpu=003 try_to_wake_up ([kernel.kallsyms]) __libc_write (/usr/lib64/libpthread-2.26.so) 70.365 IPDL Backgroun/3622 sched:sched_waking:comm=Gecko_IOThread pid=3569 prio=120 target_cpu=003 try_to_wake_up ([kernel.kallsyms]) __libc_write (/usr/lib64/libpthread-2.26.so) 75.781 Web Content/3649 sched:sched_waking:comm=JS Helper pid=3670 prio=120 target_cpu=000 try_to_wake_up ([kernel.kallsyms]) try_to_wake_up ([kernel.kallsyms]) wake_up_q ([kernel.kallsyms]) futex_wake ([kernel.kallsyms]) do_futex ([kernel.kallsyms]) __x64_sys_futex ([kernel.kallsyms]) do_syscall_64 ([kernel.kallsyms]) entry_SYSCALL_64_after_hwframe ([kernel.kallsyms]) pthread_cond_signal@@GLIBC_2.3.2 (/usr/lib64/libpthread-2.26.so) # # perf trace -e sched:*switch/nr=2/,block:*_plug/nr=4/,block:*_unplug/nr=1/,net:*dev_queue/nr=3,max-stack=16/ 0.000 :0/0 sched:sched_switch:swapper/0:0 [120] S ==> trace:3367 [120] 0.046 :0/0 sched:sched_switch:swapper/1:0 [120] S ==> kworker/u16:58:2722 [120] 570.670 irq/50-iwlwifi/680 net:net_dev_queue:dev=wlp3s0 skbaddr=0xffff93498051ef00 len=66 __dev_queue_xmit ([kernel.kallsyms]) 1106.141 jbd2/dm-0-8/476 block:block_plug:[jbd2/dm-0-8] 1106.175 jbd2/dm-0-8/476 block:block_unplug:[jbd2/dm-0-8] 1 1618.088 kworker/u16:30/2694 block:block_plug:[kworker/u16:30] 1810.000 :0/0 net:net_dev_queue:dev=vnet0 skbaddr=0xffff93498051ef00 len=52 __dev_queue_xmit ([kernel.kallsyms]) 3857.974 :0/0 net:net_dev_queue:dev=vnet0 skbaddr=0xffff93498051f900 len=52 __dev_queue_xmit ([kernel.kallsyms]) 4790.277 jbd2/dm-2-8/748 block:block_plug:[jbd2/dm-2-8] 4790.448 jbd2/dm-2-8/748 block:block_plug:[jbd2/dm-2-8] # The global --max-events has precendence: # trace --max-events 3 -e sched:*switch/nr=2/,block:*_plug/nr=4/,block:*_unplug/nr=1/,net:*dev_queue/nr=3,max-stack=16/ 0.000 :0/0 sched:sched_switch:swapper/0:0 [120] S ==> qemu-system-x86:2252 [120] 0.029 qemu-system-x8/2252 sched:sched_switch:qemu-system-x86:2252 [120] D ==> swapper/0:0 [120] 58.047 DNS Res~er #14/31661 net:net_dev_queue:dev=wlp3s0 skbaddr=0xffff9346966af100 len=84 __dev_queue_xmit ([kernel.kallsyms]) __libc_send (/usr/lib64/libpthread-2.26.so) # Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-s4jswltvh660ughvg9nwngah@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 7ee40678af935fb489b0c6cf0f75808175214cd7 Author: Milian Wolff Date: Sun Oct 21 21:14:24 2018 +0200 perf script: Flush output stream after events in verbose mode When the perf script output is written to a terminal stream, the normal output of `perf script` would get buffered, but its debug output would be written directly. This made it quite hard to figure out where a given debug output is coming from. We can improve on this by flushing the output buffer after processing an event. To see the value, compare the following output for a `perf script -v` run: Before this patch: ``` unwind: reg 16, val 7faf7dfdc000 unwind: reg 7, val 7ffc80811e30 unwind: find_proc_info dso /usr/lib/ld-2.28.so unwind: reg 6, val 0 unwind: _start:ip = 0x7faf7dfdc000 (0x2000) unwind: reg 16, val 7faf7dfdc000 unwind: reg 7, val 7ffc80811e30 unwind: find_proc_info dso /usr/lib/ld-2.28.so unwind: reg 6, val 0 unwind: _start:ip = 0x7faf7dfdc000 (0x2000) unwind: reg 16, val 7faf7dfdc000 unwind: reg 7, val 7ffc80811e30 unwind: find_proc_info dso /usr/lib/ld-2.28.so unwind: reg 6, val 0 unwind: _start:ip = 0x7faf7dfdc000 (0x2000) unwind: reg 16, val 7faf7dfdc000 unwind: reg 7, val 7ffc80811e30 ... lots and lots of verbose debug output cpp-inlining 24617 90229.122036534: 1 cycles:uppp: 7faf7dfdc000 _start+0x0 (/usr/lib/ld-2.28.so) cpp-inlining 24617 90229.122043974: 1 cycles:uppp: 7faf7dfdc000 _start+0x0 (/usr/lib/ld-2.28.so) ... ``` After this patch: ``` ... unwind: reg 16, val 7faf7dfdc000 unwind: reg 7, val 7ffc80811e30 unwind: find_proc_info dso /usr/lib/ld-2.28.so unwind: reg 6, val 0 unwind: _start:ip = 0x7faf7dfdc000 (0x2000) cpp-inlining 24617 90229.122036534: 1 cycles:uppp: 7faf7dfdc000 _start+0x0 (/usr/lib/ld-2.28.so) unwind: reg 16, val 7faf7dfdc000 unwind: reg 7, val 7ffc80811e30 unwind: find_proc_info dso /usr/lib/ld-2.28.so unwind: reg 6, val 0 unwind: _start:ip = 0x7faf7dfdc000 (0x2000) cpp-inlining 24617 90229.122043974: 1 cycles:uppp: 7faf7dfdc000 _start+0x0 (/usr/lib/ld-2.28.so) ... ``` This new output format makes it much easier to use perf script output for debugging purposes, e.g. to investigate broken dwarf unwinding. Signed-off-by: Milian Wolff Acked-by: Jiri Olsa Link: http://lkml.kernel.org/r/20181021191424.16183-2-milian.wolff@kdab.com Signed-off-by: Arnaldo Carvalho de Melo commit cff229491af5df946781edfbeafd43e9cf66a3b4 Merge: 13775dacca5c b9fd04262a8a Author: Linus Torvalds Date: Mon Oct 22 18:16:03 2018 +0100 Merge tag 'dma-mapping-4.20' of git://git.infradead.org/users/hch/dma-mapping Pull dma mapping updates from Christoph Hellwig: "First batch of dma-mapping changes for 4.20. There will be a second PR as some big changes were only applied just before the end of the merge window, and I want to give them a few more days in linux-next. Summary: - mostly more consolidation of the direct mapping code, including converting over hexagon, and merging the coherent and non-coherent code into a single dma_map_ops instance (me) - cleanups for the dma_configure/dma_unconfigure callchains (me) - better handling of dma_masks in odd setups (me, Alexander Duyck) - better debugging of passing vmalloc address to the DMA API (Stephen Boyd) - CMA command line parsing fix (He Zhe)" * tag 'dma-mapping-4.20' of git://git.infradead.org/users/hch/dma-mapping: (27 commits) dma-direct: respect DMA_ATTR_NO_WARN dma-mapping: translate __GFP_NOFAIL to DMA_ATTR_NO_WARN dma-direct: document the zone selection logic dma-debug: Check for drivers mapping invalid addresses in dma_map_single() dma-direct: fix return value of dma_direct_supported dma-mapping: move dma_default_get_required_mask under ifdef dma-direct: always allow dma mask <= physiscal memory size dma-direct: implement complete bus_dma_mask handling dma-direct: refine dma_direct_alloc zone selection dma-direct: add an explicit dma_direct_get_required_mask dma-mapping: make the get_required_mask method available unconditionally unicore32: remove swiotlb support Revert "dma-mapping: clear dev->dma_ops in arch_teardown_dma_ops" dma-mapping: support non-coherent devices in dma_common_get_sgtable dma-mapping: consolidate the dma mmap implementations dma-mapping: merge direct and noncoherent ops dma-mapping: move the dma_coherent flag to struct device MIPS: don't select DMA_MAYBE_COHERENT from DMA_PERDEV_COHERENT dma-mapping: add the missing ARCH_HAS_SYNC_DMA_FOR_CPU_ALL declaration dma-mapping: fix panic caused by passing empty cma command line argument ... commit 13775dacca5c158a257320f4b47e1220b82e3b21 Merge: 6ab9e09238fd b3cd92db6ecd Author: Linus Torvalds Date: Mon Oct 22 18:03:31 2018 +0100 Merge tag 'for-4.20/libata-20181021' of git://git.kernel.dk/linux-block Pull libata updates from Jens Axboe: "Here are the libata changes queued up for 4.20: - %pOFn device_node.name conversion (Rob Herring) - Use LBAM/LBAH password defines instead of hardcoding (Linus Walleij) - Series adding support for the allwinner R40 AHCI controller (Corentin Labbe) - Disable ALPM for Ampere Computing device (Suman Tripathi) - ahci bcrm fixes (Florian Fainelli) - Redundant Kconfig defaults (Bartlomiej Zolnierkiewicz) - Code cleanups (Nathan Chancellor)" * tag 'for-4.20/libata-20181021' of git://git.kernel.dk/linux-block: ata: remove redundant 'default n' from Kconfig ata: ep93xx: Use proper enums for directions ata: ahci_brcm: Allow using driver or DSL SoCs ata: ahci_brcm: Match BCM63138 compatible strings ata: ahci_brcm: Allow optional reset controller to be used dt-bindings: ata: Document BCM63138 compatible string pata_atiixp: Remove unnecessary parentheses ata: Disable AHCI ALPM feature for Ampere Computing eMAG SATA dt-bindings: ata: update ahci_sunxi bindings ata: ahci_sunxi: add support for r40 dt-bindings: ata: ahci-platform: document phy-supply ata: ahci_platform: add support for PHY controller regulator dt-bindings: ata: ahci-platform: document ahci-supply ata: ahci_platform: add support for AHCI controller regulator dt-bindings: ata: ahci-platform: fix indentation of target-supply libata: Use SMART LBAM/LBAH password defines ata: ahci: Convert to using %pOFn instead of device_node.name commit 6ab9e09238fdfd742fe23b81e2d385a1cab49d9b Merge: 528985117126 52990a5fb0c9 Author: Linus Torvalds Date: Mon Oct 22 17:46:08 2018 +0100 Merge tag 'for-4.20/block-20181021' of git://git.kernel.dk/linux-block Pull block layer updates from Jens Axboe: "This is the main pull request for block changes for 4.20. This contains: - Series enabling runtime PM for blk-mq (Bart). - Two pull requests from Christoph for NVMe, with items such as; - Better AEN tracking - Multipath improvements - RDMA fixes - Rework of FC for target removal - Fixes for issues identified by static checkers - Fabric cleanups, as prep for TCP transport - Various cleanups and bug fixes - Block merging cleanups (Christoph) - Conversion of drivers to generic DMA mapping API (Christoph) - Series fixing ref count issues with blkcg (Dennis) - Series improving BFQ heuristics (Paolo, et al) - Series improving heuristics for the Kyber IO scheduler (Omar) - Removal of dangerous bio_rewind_iter() API (Ming) - Apply single queue IPI redirection logic to blk-mq (Ming) - Set of fixes and improvements for bcache (Coly et al) - Series closing a hotplug race with sysfs group attributes (Hannes) - Set of patches for lightnvm: - pblk trace support (Hans) - SPDX license header update (Javier) - Tons of refactoring patches to cleanly abstract the 1.2 and 2.0 specs behind a common core interface. (Javier, Matias) - Enable pblk to use a common interface to retrieve chunk metadata (Matias) - Bug fixes (Various) - Set of fixes and updates to the blk IO latency target (Josef) - blk-mq queue number updates fixes (Jianchao) - Convert a bunch of drivers from the old legacy IO interface to blk-mq. This will conclude with the removal of the legacy IO interface itself in 4.21, with the rest of the drivers (me, Omar) - Removal of the DAC960 driver. The SCSI tree will introduce two replacement drivers for this (Hannes)" * tag 'for-4.20/block-20181021' of git://git.kernel.dk/linux-block: (204 commits) block: setup bounce bio_sets properly blkcg: reassociate bios when make_request() is called recursively blkcg: fix edge case for blk_get_rl() under memory pressure nvme-fabrics: move controller options matching to fabrics nvme-rdma: always have a valid trsvcid mtip32xx: fully switch to the generic DMA API rsxx: switch to the generic DMA API umem: switch to the generic DMA API sx8: switch to the generic DMA API sx8: remove dead IF_64BIT_DMA_IS_POSSIBLE code skd: switch to the generic DMA API ubd: remove use of blk_rq_map_sg nvme-pci: remove duplicate check drivers/block: Remove DAC960 driver nvme-pci: fix hot removal during error handling nvmet-fcloop: suppress a compiler warning nvme-core: make implicit seed truncation explicit nvmet-fc: fix kernel-doc headers nvme-fc: rework the request initialization code nvme-fc: introduce struct nvme_fcp_op_w_sgl ... commit 528985117126f11beea339cf39120ee99da04cd2 Merge: 84df9525b0c2 4debef551007 Author: Linus Torvalds Date: Mon Oct 22 17:30:06 2018 +0100 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 updates from Catalin Marinas: "Apart from some new arm64 features and clean-ups, this also contains the core mmu_gather changes for tracking the levels of the page table being cleared and a minor update to the generic compat_sys_sigaltstack() introducing COMPAT_SIGMINSKSZ. Summary: - Core mmu_gather changes which allow tracking the levels of page-table being cleared together with the arm64 low-level flushing routines - Support for the new ARMv8.5 PSTATE.SSBS bit which can be used to mitigate Spectre-v4 dynamically without trapping to EL3 firmware - Introduce COMPAT_SIGMINSTKSZ for use in compat_sys_sigaltstack - Optimise emulation of MRS instructions to ID_* registers on ARMv8.4 - Support for Common Not Private (CnP) translations allowing threads of the same CPU to share the TLB entries - Accelerated crc32 routines - Move swapper_pg_dir to the rodata section - Trap WFI instruction executed in user space - ARM erratum 1188874 workaround (arch_timer) - Miscellaneous fixes and clean-ups" * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (78 commits) arm64: KVM: Guests can skip __install_bp_hardening_cb()s HYP work arm64: cpufeature: Trap CTR_EL0 access only where it is necessary arm64: cpufeature: Fix handling of CTR_EL0.IDC field arm64: cpufeature: ctr: Fix cpu capability check for late CPUs Documentation/arm64: HugeTLB page implementation arm64: mm: Use __pa_symbol() for set_swapper_pgd() arm64: Add silicon-errata.txt entry for ARM erratum 1188873 Revert "arm64: uaccess: implement unsafe accessors" arm64: mm: Drop the unused cpu parameter MAINTAINERS: fix bad sdei paths arm64: mm: Use #ifdef for the __PAGETABLE_P?D_FOLDED defines arm64: Fix typo in a comment in arch/arm64/mm/kasan_init.c arm64: xen: Use existing helper to check interrupt status arm64: Use daifflag_restore after bp_hardening arm64: daifflags: Use irqflags functions for daifflags arm64: arch_timer: avoid unused function warning arm64: Trap WFI executed in userspace arm64: docs: Document SSBS HWCAP arm64: docs: Fix typos in ELF hwcaps arm64/kprobes: remove an extra semicolon in arch_prepare_kprobe ... commit af9b926de9c5986ab009e64917de87c9758bab10 Author: Xiao Ni Date: Sat Oct 20 08:09:25 2018 +0800 MD: Memory leak when flush bio size is zero flush_pool is leaked when flush bio size is zero Fixes: 5a409b4f56d5 ("MD: fix lock contention for flush bios") Signed-off-by: David Jeffery Signed-off-by: Xiao Ni Signed-off-by: Shaohua Li commit 6aaa58c994277647f8b05ffef3b9b225a2d08f36 Author: Jack Wang Date: Fri Oct 19 16:21:31 2018 +0200 md: fix memleak for mempool I noticed kmemleak report memory leak when run create/stop md in a loop, backtrace: [<000000001ca975e7>] mempool_create_node+0x86/0xd0 [<0000000095576bcd>] md_run+0x1057/0x1410 [md_mod] [<000000007b45c5fc>] do_md_run+0x15/0x130 [md_mod] [<000000001ede9ec0>] md_ioctl+0x1f49/0x25d0 [md_mod] [<000000004142cacf>] blkdev_ioctl+0x680/0xd00 The root cause is we alloc mddev->flush_pool and mddev->flush_bio_pool in md_run, but from do_md_stop will not call into md_stop but __md_stop, move the mempool_destroy to __md_stop fixes the problem for me. The bug was introduced in 5a409b4f56d5, the fixes should go to 4.18+ Fixes: 5a409b4f56d5 ("MD: fix lock contention for flush bios") Signed-off-by: Jack Wang Reviewed-by: Xiao Ni Signed-off-by: Shaohua Li commit 7dceef78f310f5351735060d78a1777c69606016 Author: Soeren Moch Date: Mon Oct 22 14:38:12 2018 +0200 rtc: ds1307: fix ds1339 wakealarm support Commit 51ed73eb998a1c79a2b0e9bed68f75a8a2c93b9b ("rtc: ds1340: Add support for trickle charger.") breaks ds1339 wakealarm support by limiting accessible registers. Fix this. Fixes: 51ed73eb998a ("rtc: ds1340: Add support for trickle charger.") Cc: stable@vger.kernel.org Signed-off-by: Soeren Moch Signed-off-by: Alexandre Belloni commit 6f5b390b3abe690ac3875a226e96a1528647f948 Author: Wolfram Sang Date: Sun Oct 21 22:00:41 2018 +0200 rtc: ds1685: simplify getting .driver_data We should get 'driver_data' from 'struct device' directly. Going via platform_device is an unneeded step back and forth. Signed-off-by: Wolfram Sang Signed-off-by: Alexandre Belloni commit c1c9b9695cc8868048f45c7e2559f65bc0be7382 Author: Milian Wolff Date: Sun Oct 21 21:14:23 2018 +0200 perf script: Allow extended console debug output The script tool isn't using a browser, yet use_browser wasn't set explicitly to zero. This in turn lead to confusing output such as: ``` $ perf script -vvv ... ... overlapping maps in /home/milian/foobar (disable tui for more info) ... ``` Explicitly set use_browser to 0 now, which gives us the extended debug information now in perf script as expected. Signed-off-by: Milian Wolff Acked-by: Jiri Olsa Tested-by: Arnaldo Carvalho de Melo Link: http://lkml.kernel.org/r/20181021191424.16183-1-milian.wolff@kdab.com Signed-off-by: Arnaldo Carvalho de Melo commit cbb5df7e96070f1f728ff7885443646ebba703d4 Author: Jiri Olsa Date: Mon Oct 22 11:30:15 2018 +0200 perf stat: Poll for monitored tasks being alive Adding the check for tasks we monitor via -p/-t options, and finish stat if there's no longer task to monitor. Requested-by: Stephane Eranian Signed-off-by: Jiri Olsa Cc: Alexander Shishkin Cc: Jin Yao Cc: Namhyung Kim Cc: Peter Zijlstra Tested-by: Arnaldo Carvalho de Melo Link: http://lkml.kernel.org/r/20181022093015.9106-1-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit a937c6658b8e77e1f65cde2be9970811752121bb Author: Arnaldo Carvalho de Melo Date: Sat Oct 20 09:27:52 2018 -0300 perf trace: Drop thread refcount in trace__event_handler() We must pair: thread = machine__findnew_thread(); with thread__put(thread). Fix it. Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Fixes: c4191e55b874 ("perf trace: Show comm and tid for tracepoint events") Link: https://lkml.kernel.org/n/tip-dkxsb8cwg87rmkrzrbns1o4z@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 4291bf5cb93918232f88a3a70d8f70a72fbb6ab0 Author: Arnaldo Carvalho de Melo Date: Sat Oct 20 09:18:50 2018 -0300 perf trace: Drop addr_location refcounts When we use machine__resolve() we grab a reference to addr_location.thread (and in the future to other elements there) via machine__findnew_thread(), so we must pair that with addr_location__put(), else we'll never drop that thread when it exits and no other remaining data structures have pointers to it. Fix it. Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-ivg9hifzeuokb1f5jxc2wob4@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit b7e8452b860c299f342a012922bdd9ab8f2bb722 Author: Arnaldo Carvalho de Melo Date: Sat Oct 20 09:04:41 2018 -0300 perf evsel: Mark a evsel as disabled when asking the kernel do disable it Because there may be more such events in the ring buffer that should be discarded when an app decides to stop considering them. At some point we'll do this with eBPF, this way we stop them at origin, before they are placed in the ring buffer. Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-uzufuxws4hufigx07ue1dpv6@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit da4ad3a23af3d7f357b24b33e9fec7531b59ee49 Author: Mike Snitzer Date: Mon Oct 22 10:59:52 2018 -0400 dm writecache: remove disabled code in memory_entry() This dead branch was missed during review. It only makes memory_entry() more inefficient due to needless call to is_power_of_2(), etc. Reported-by: shenghui Signed-off-by: Mike Snitzer commit 1227daa43bce1318ff6fb54e6cd862b4f60245c7 Author: Kees Cook Date: Wed Oct 17 17:20:35 2018 -0700 pstore/ram: Clarify resource reservation labels When ramoops reserved a memory region in the kernel, it had an unhelpful label of "persistent_memory". When reading /proc/iomem, it would be repeated many times, did not hint that it was ramoops in particular, and didn't clarify very much about what each was used for: 400000000-407ffffff : Persistent Memory (legacy) 400000000-400000fff : persistent_memory 400001000-400001fff : persistent_memory ... 4000ff000-4000fffff : persistent_memory Instead, this adds meaningful labels for how the various regions are being used: 400000000-407ffffff : Persistent Memory (legacy) 400000000-400000fff : ramoops:dump(0/252) 400001000-400001fff : ramoops:dump(1/252) ... 4000fc000-4000fcfff : ramoops:dump(252/252) 4000fd000-4000fdfff : ramoops:console 4000fe000-4000fe3ff : ramoops:ftrace(0/3) 4000fe400-4000fe7ff : ramoops:ftrace(1/3) 4000fe800-4000febff : ramoops:ftrace(2/3) 4000fec00-4000fefff : ramoops:ftrace(3/3) 4000ff000-4000fffff : ramoops:pmsg Signed-off-by: Kees Cook Reviewed-by: Joel Fernandes (Google) Tested-by: Sai Prakash Ranjan Tested-by: Guenter Roeck commit 95047b0519c17a28e09df5f38750f5354e3db4c4 Author: Kees Cook Date: Wed Oct 17 14:00:12 2018 -0700 pstore: Refactor compression initialization This refactors compression initialization slightly to better handle getting potentially called twice (via early pstore_register() calls and later pstore_init()) and improves the comments and reporting to be more verbose. Signed-off-by: Kees Cook Tested-by: Guenter Roeck commit 416031653eb55f844e3547fb8f8576399a800da0 Author: Joel Fernandes (Google) Date: Wed Oct 17 03:13:55 2018 -0700 pstore: Allocate compression during late_initcall() ramoops's call of pstore_register() was recently moved to run during late_initcall() because the crypto backend may not have been ready during postcore_initcall(). This meant early-boot crash dumps were not getting caught by pstore any more. Instead, lets allow calls to pstore_register() earlier, and once crypto is ready we can initialize the compression. Reported-by: Sai Prakash Ranjan Signed-off-by: Joel Fernandes (Google) Tested-by: Sai Prakash Ranjan Fixes: cb3bee0369bc ("pstore: Use crypto compress API") [kees: trivial rebase] Signed-off-by: Kees Cook Tested-by: Guenter Roeck commit cb095afd44768bf495894b9ad063bd078e4bb201 Author: Kees Cook Date: Thu Oct 18 11:17:42 2018 -0700 pstore: Centralize init/exit routines In preparation for having additional actions during init/exit, this moves the init/exit into platform.c, centralizing the logic to make call outs to the fs init/exit. Signed-off-by: Kees Cook Tested-by: Guenter Roeck commit 173ee3962959a1985a109f81539a403b5cd07ae7 Author: Rob Herring Date: Mon Oct 22 09:03:54 2018 -0500 of: Add missing exports of node name compare functions Commit f42b0e18f2e5 ("of: add node name compare helper functions") failed to add the module exports to of_node_name_eq() and of_node_name_prefix(). Add them now. Fixes: f42b0e18f2e5 ("of: add node name compare helper functions") Signed-off-by: Rob Herring commit ea4cdc548e5e74a529cdd1aea885d74b4aa8f1b3 Author: Luis Henriques Date: Mon Oct 15 16:46:00 2018 +0100 ceph: new mount option to disable usage of copy-from op Add a new mount option 'nocopyfrom' that will prevent the usage of the RADOS 'copy-from' operation in cephfs. This could be useful, for example, for an administrator to temporarily mitigate any possible bugs in the 'copy-from' implementation. Currently, only copy_file_range uses this RADOS operation. Setting this mount option will result in this syscall reverting to the default VFS implementation, i.e. to perform the copies locally instead of doing remote object copies. Signed-off-by: Luis Henriques Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 503f82a9932d311c12430779627f7a130bbe462a Author: Luis Henriques Date: Mon Oct 15 16:45:59 2018 +0100 ceph: support copy_file_range file operation This commit implements support for the copy_file_range syscall in cephfs. It is implemented using the RADOS 'copy-from' operation, which allows to do a remote object copy, without the need to download/upload data from/to the OSDs. Some manual copy may however be required if the source/destination file offsets aren't object aligned or if the copy length is smaller than the object size. Signed-off-by: Luis Henriques Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 23ddf9bea900b4ce39e5707e1ddf66062cfe6d91 Author: Luis Henriques Date: Mon Oct 15 16:45:58 2018 +0100 libceph: support the RADOS copy-from operation Add support for performing remote object copies using the 'copy-from' operation. [ Add COPY_FROM to get_num_data_items(). ] Signed-off-by: Luis Henriques Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 2ee9dd958d474252510b8c4dc216aa1dab7ad272 Author: Luis Henriques Date: Mon Oct 15 16:45:57 2018 +0100 ceph: add non-blocking parameter to ceph_try_get_caps() ceph_try_get_caps currently calls try_get_cap_refs with the nonblock parameter always set to 'true'. This change adds a new parameter that allows to set it's value. This will be useful for a follow-up patch that will need to get two sets of capabilities for two different inodes without risking a deadlock. Signed-off-by: Luis Henriques Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 98c4bfe9d89b22d7bfddf6469241658920b6fafe Author: Ilya Dryomov Date: Wed Oct 17 14:23:04 2018 +0200 libceph: check reply num_data_items in setup_request_data() setup_request_data() adds message data items to both request and reply messages, but only checks request num_data_items before proceeding with the loop. This is wrong because if an op doesn't have any request data items but has a reply data item (e.g. read), a duplicate data item gets added to the message on every resend attempt. This went unnoticed for years but now that message data items are preallocated, it promptly crashes in ceph_msg_data_add(). Amend the signature to make it clear that setup_request_data() operates on both request and reply messages. Also, remove data_len assert -- we have another one in prepare_write_message(). Signed-off-by: Ilya Dryomov commit 0d9c1ab3be4c0187663096a6a084421d0a1e45c6 Author: Ilya Dryomov Date: Mon Oct 15 17:38:23 2018 +0200 libceph: preallocate message data items Currently message data items are allocated with ceph_msg_data_create() in setup_request_data() inside send_request(). send_request() has never been allowed to fail, so each allocation is followed by a BUG_ON: data = ceph_msg_data_create(...); BUG_ON(!data); It's been this way since support for multiple message data items was added in commit 6644ed7b7e04 ("libceph: make message data be a pointer") in 3.10. There is no reason to delay the allocation of message data items until the last possible moment and we certainly don't need a linked list of them as they are only ever appended to the end and never erased. Make ceph_msg_new2() take max_data_items and adapt the rest of the code. Reported-by: Jerry Lee Signed-off-by: Ilya Dryomov commit 26f887e0a3c43f67b550e2e5d8a76e86ca11d188 Author: Ilya Dryomov Date: Mon Oct 15 16:11:37 2018 +0200 libceph, rbd, ceph: move ceph_osdc_alloc_messages() calls The current requirement is that ceph_osdc_alloc_messages() should be called after oid and oloc are known. In preparation for preallocating message data items, move ceph_osdc_alloc_messages() further down, so that it is called when OSD op codes are known. Signed-off-by: Ilya Dryomov commit 39e58c3425b1816c84724e8a77f9f9daa0143263 Author: Ilya Dryomov Date: Mon Oct 15 15:26:27 2018 +0200 libceph: introduce alloc_watch_request() ceph_osdc_alloc_messages() call will be moved out of alloc_linger_request() in the next commit, which means that ceph_osdc_watch() will need to call ceph_osdc_alloc_messages() twice. Add a helper for that. Signed-off-by: Ilya Dryomov commit 81c65213d73cc51f2f2e4326d602e107c07afb05 Author: Ilya Dryomov Date: Thu Oct 11 12:58:33 2018 +0200 libceph: assign cookies in linger_submit() Register lingers directly in linger_submit(). This avoids allocating memory for notify pagelist while holding osdc->lock and simplifies both callers of linger_submit(). Signed-off-by: Ilya Dryomov commit 3b83f60da6dd1becd865c1e2745123a8ae378c25 Author: Ilya Dryomov Date: Thu Oct 11 17:04:33 2018 +0200 libceph: enable fallback to ceph_msg_new() in ceph_msgpool_get() ceph_msgpool_get() can fall back to ceph_msg_new() when it is asked for a message whose front portion is larger than pool->front_len. However the caller always passes 0, effectively disabling that code path. The allocation goes to the message pool and returns a message with a front that is smaller than requested, setting us up for a crash. One example of this is a directory with a large number of snapshots. If its snap context doesn't fit, we oops in encode_request_partial(). Signed-off-by: Ilya Dryomov commit 61d2f855042cfcce9b78fa10fe7cd2020598263b Author: Ilya Dryomov Date: Thu Oct 11 16:15:38 2018 +0200 ceph: num_ops is off by one in ceph_aio_retry_work() Two OSD op slots are allocated, but only one is ever used. Signed-off-by: Ilya Dryomov commit 41a264e1b30ccde9ac83a314559ddacb78a85e91 Author: Ilya Dryomov Date: Sat Oct 13 11:36:52 2018 +0200 libceph: no need to call osd_req_opcode_valid() in osd_req_encode_op() Any uninitialized or unknown ops will be caught by the default clause anyway. Signed-off-by: Ilya Dryomov commit 668028844174aa7069da1f8ea89a5dbc93e86216 Author: Xuehan Xu Date: Thu Oct 11 17:55:39 2018 +0800 ceph: set timeout conditionally in __cap_delay_requeue __cap_delay_requeue could be invoked through ceph_check_caps when there exists caps that needs to be sent and are delayed by "i_hold_caps_min" or "i_hold_caps_max". If __cap_delay_requeue sets timeout unconditionally, there could be a chance that some "wanted" caps can not be release for a long since their timeouts are reset every time they get delayed. Fixes: http://tracker.ceph.com/issues/36369 Signed-off-by: Xuehan Xu Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 894868330a1e038ea4a65dbb81741eef70ad71b1 Author: Ilya Dryomov Date: Fri Sep 28 16:02:53 2018 +0200 libceph: don't consume a ref on pagelist in ceph_msg_data_add_pagelist() Because send_mds_reconnect() wants to send a message with a pagelist and pass the ownership to the messenger, ceph_msg_data_add_pagelist() consumes a ref which is then put in ceph_msg_data_destroy(). This makes managing pagelists in the OSD client (where they are wrapped in ceph_osd_data) unnecessarily hard because the handoff only happens in ceph_osdc_start_request() instead of when the pagelist is passed to ceph_osd_data_pagelist_init(). I counted several memory leaks on various error paths. Fix up ceph_msg_data_add_pagelist() and carry a pagelist ref in ceph_osd_data. Signed-off-by: Ilya Dryomov commit 33165d472310262d8c79c7e4d1a17dc60cea7e35 Author: Ilya Dryomov Date: Fri Sep 28 15:38:34 2018 +0200 libceph: introduce ceph_pagelist_alloc() struct ceph_pagelist cannot be embedded into anything else because it has its own refcount. Merge allocation and initialization together. Signed-off-by: Ilya Dryomov commit 24639ce56040a8ea890ad8836068c1ad8bd177c7 Author: Ilya Dryomov Date: Wed Sep 26 19:12:07 2018 +0200 libceph: osd_req_op_cls_init() doesn't need to take opcode Signed-off-by: Ilya Dryomov commit 94e6992bb560be8bffb47f287194adf070b57695 Author: Ilya Dryomov Date: Wed Sep 26 18:03:16 2018 +0200 libceph: bump CEPH_MSG_MAX_DATA_LEN If the read is large enough, we end up spinning in the messenger: libceph: osd0 192.168.122.1:6801 io error libceph: osd0 192.168.122.1:6801 io error libceph: osd0 192.168.122.1:6801 io error This is a receive side limit, so only reads were affected. Cc: stable@vger.kernel.org Signed-off-by: Ilya Dryomov commit bddff633ab7bc60a18a86ac8b322695b6f8594d0 Author: Luis Henriques Date: Tue Oct 9 18:54:28 2018 +0100 ceph: only allow punch hole mode in fallocate Current implementation of cephfs fallocate isn't correct as it doesn't really reserve the space in the cluster, which means that a subsequent call to a write may actually fail due to lack of space. In fact, it is currently possible to fallocate an amount space that is larger than the free space in the cluster. It has behaved this way since the initial commit ad7a60de882a ("ceph: punch hole support"). Since there's no easy solution to fix this at the moment, this patch simply removes support for all fallocate operations but FALLOC_FL_PUNCH_HOLE (which implies FALLOC_FL_KEEP_SIZE). Link: https://tracker.ceph.com/issues/36317 Signed-off-by: Luis Henriques Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit fce7a9744bdf3baa9d08c52d2c78f53ab49918a4 Author: Yan, Zheng Date: Sat Sep 29 16:02:19 2018 +0800 ceph: refactor ceph_sync_read() Avoid allocating memory for the entire user request: striped_read() does a synchronous OSD request per object, so it doesn't need more than object size worth of pages at a time. [ Preserve the comment, changelog. ] Signed-off-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 74c9e6bf4c888e41bc7db340fb94fade96394038 Author: Yan, Zheng Date: Fri Sep 28 11:34:42 2018 +0800 ceph: check if LOOKUPNAME request was aborted when filling trace d_lookup()/d_alloc() require parent inode locked. Parent inode is not locked if request is aborted. Signed-off-by: "Yan, Zheng" Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit c58f450bd61511d897efc2ea472c69630635b557 Author: Yan, Zheng Date: Fri Sep 28 09:10:29 2018 +0800 ceph: fix dentry leak in ceph_readdir_prepopulate Signed-off-by: "Yan, Zheng" Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit efe328230dc01aa0b1269aad0b5fae73eea4677a Author: Yan, Zheng Date: Thu Sep 27 21:16:05 2018 +0800 Revert "ceph: fix dentry leak in splice_dentry()" This reverts commit 8b8f53af1ed9df88a4c0fbfdf3db58f62060edf3. splice_dentry() is used by three places. For two places, req->r_dentry is passed to splice_dentry(). In the case of error, req->r_dentry does not get updated. So splice_dentry() should not drop reference. Cc: stable@vger.kernel.org # 4.18+ Signed-off-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 5da207993e396f445d813338dd3540ddd6d26816 Author: Chengguang Xu Date: Sun Sep 2 23:21:09 2018 +0800 ceph: check snap first in ceph_set_acl() Do the snap check first in ceph_set_acl(), so we can avoid unnecessary operations when the inode has snap. Signed-off-by: Chengguang Xu Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit 7d8dc53414c5770afb8b83db096ecab0cd53ec93 Author: Chengguang Xu Date: Sun Aug 12 23:06:54 2018 +0800 rbd: add __init/__exit annotations Add __init/__exit annotation to init/cleanup helpers which are only called once in the module. Signed-off-by: Chengguang Xu Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 3167893ae60e847b5a44d582fedb544cd0ae7ef5 Author: Chengguang Xu Date: Mon Jul 30 23:55:36 2018 +0800 ceph: reset cap hold timeout only for requeued inode __cap_delay_requeue() only requeue inode which does not have CEPH_I_FLUSH flag, so avoid reset cap hold timeout for that inode. Signed-off-by: Chengguang Xu Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov commit cd6ba41c192deca20d9add5554bc8c51d0f07de2 Author: Alexey Khoroshilov Date: Sat Oct 13 23:51:03 2018 +0300 watchdog: ts4800: release syscon device node in ts4800_wdt_probe() Put syscon device node when it is not needed anymore. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit f822ad2c2c03af85a531c5174136b6d5b1abc566 Author: Harald Freudenberger Date: Fri Oct 19 10:36:28 2018 +0200 s390/pkey: move pckmo subfunction available checks away from module init The init of the pkey module currently fails if the pckmo instruction or the subfunctions are not available. However, customers may restrict their LPAR to switch off exactly these functions and work with secure key only. So it is a valid case to have the pkey module active and use it for secure key to protected key transfer only. This patch moves the pckmo subfunction check from the pkey module init function into the internal function where the pckmo instruction is called. So now only on invocation of the pckmo instruction the check for the required subfunction is done. If not available EOPNOTSUPP is returned to the caller. The check for having the pckmo instruction available is still done during module init. This instruction came in with MSA 3 together with the basic set of kmc instructions needed to work with protected keys. Signed-off-by: Harald Freudenberger Reviewed-by: Ingo Franzki Signed-off-by: Martin Schwidefsky commit cf3dbe5dacb3a95d497ace9c714306d17cb05b11 Author: Vasily Gorbik Date: Fri Oct 19 12:13:58 2018 +0200 s390/kasan: support preemptible kernel build When the kernel is built with: CONFIG_PREEMPT=y CONFIG_PREEMPT_COUNT=y "stfle" function used by kasan initialization code makes additional call to preempt_count_add/preempt_count_sub. To avoid removing kasan instrumentation from sched code where those functions leave split stfle function and provide __stfle variant without preemption handling to be used by Kasan. Reported-by: Benjamin Block Acked-by: Heiko Carstens Signed-off-by: Vasily Gorbik Signed-off-by: Martin Schwidefsky commit a19c59cc10a5ebc6b5a542e56bfd9f427ce01d74 Merge: 92303c86b7e9 fe8ecccc10b3 Author: David S. Miller Date: Sun Oct 21 21:11:46 2018 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Daniel Borkmann says: ==================== pull-request: bpf-next 2018-10-21 The following pull-request contains BPF updates for your *net-next* tree. The main changes are: 1) Implement two new kind of BPF maps, that is, queue and stack map along with new peek, push and pop operations, from Mauricio. 2) Add support for MSG_PEEK flag when redirecting into an ingress psock sk_msg queue, and add a new helper bpf_msg_push_data() for insert data into the message, from John. 3) Allow for BPF programs of type BPF_PROG_TYPE_CGROUP_SKB to use direct packet access for __skb_buff, from Song. 4) Use more lightweight barriers for walking perf ring buffer for libbpf and perf tool as well. Also, various fixes and improvements from verifier side, from Daniel. 5) Add per-symbol visibility for DSO in libbpf and hide by default global symbols such as netlink related functions, from Andrey. 6) Two improvements to nfp's BPF offload to check vNIC capabilities in case prog is shared with multiple vNICs and to protect against mis-initializing atomic counters, from Jakub. 7) Fix for bpftool to use 4 context mode for the nfp disassembler, also from Jakub. 8) Fix a return value comparison in test_libbpf.sh and add several bpftool improvements in bash completion, documentation of bpf fs restrictions and batch mode summary print, from Quentin. 9) Fix a file resource leak in BPF selftest's load_kallsyms() helper, from Peng. 10) Fix an unused variable warning in map_lookup_and_delete_elem(), from Alexei. 11) Fix bpf_skb_adjust_room() signature in BPF UAPI helper doc, from Nicolas. 12) Add missing executables to .gitignore in BPF selftests, from Anders. ==================== Signed-off-by: David S. Miller commit 92303c86b7e9b7d3895ccafb441a0354143e2a18 Merge: 21ea1d36f6df 2c67e33de2d3 Author: David S. Miller Date: Sun Oct 21 21:10:12 2018 -0700 Merge branch 'net-simplify-getting-driver_data' Wolfram Sang says: ==================== net: simplify getting .driver_data I got tired of fixing this in Renesas drivers manually, so I took the big hammer. Remove this cumbersome code pattern which got copy-pasted too much already: - struct platform_device *pdev = to_platform_device(dev); - struct ep93xx_keypad *keypad = platform_get_drvdata(pdev); + struct ep93xx_keypad *keypad = dev_get_drvdata(dev); A branch, tested by buildbot, can be found here: git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux.git coccinelle/get_drvdata I have been asked if it couldn't be done for dev_set_drvdata as well. I checked it and did not find one occasion where it could be simplified like this. Not much of a surprise because driver_data is usually set in probe() functions which access struct platform_device in many other ways. I am open for other comments, suggestions, too, of course. Here is the cocci-script I created: @@ struct device* d; identifier pdev; expression *ptr; @@ ( - struct platform_device *pdev = to_platform_device(d); | - struct platform_device *pdev; ... - pdev = to_platform_device(d); ) <... when != pdev - &pdev->dev + d ...> ptr = - platform_get_drvdata(pdev) + dev_get_drvdata(d) <... when != pdev - &pdev->dev + d ...> ==================== Signed-off-by: David S. Miller commit 2c67e33de2d3f2350cff2e131f5aa8d7f1ff6f9f Author: Wolfram Sang Date: Sun Oct 21 22:00:20 2018 +0200 net: phy: mdio-mux-bcm-iproc: simplify getting .driver_data We should get 'driver_data' from 'struct device' directly. Going via platform_device is an unneeded step back and forth. Signed-off-by: Wolfram Sang Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 44f5ccdbc97debd03d10c1b0fde3f60e2294f001 Author: Wolfram Sang Date: Sun Oct 21 22:00:19 2018 +0200 net: ethernet: wiznet: w5300: simplify getting .driver_data We should get 'driver_data' from 'struct device' directly. Going via platform_device is an unneeded step back and forth. Signed-off-by: Wolfram Sang Signed-off-by: David S. Miller commit 762b9e9abb58375ba7eb06c3522c777debebe289 Author: Wolfram Sang Date: Sun Oct 21 22:00:18 2018 +0200 net: ethernet: ti: davinci_emac: simplify getting .driver_data We should get 'driver_data' from 'struct device' directly. Going via platform_device is an unneeded step back and forth. Signed-off-by: Wolfram Sang Signed-off-by: David S. Miller commit 4e13c252276d3aa56f028cada2bd7cb41694d03f Author: Wolfram Sang Date: Sun Oct 21 22:00:17 2018 +0200 net: ethernet: ti: cpsw: simplify getting .driver_data We should get 'driver_data' from 'struct device' directly. Going via platform_device is an unneeded step back and forth. Signed-off-by: Wolfram Sang Signed-off-by: David S. Miller commit 9dd8360c763af52a8c6357f509c9a700ea3fc0bf Author: Wolfram Sang Date: Sun Oct 21 22:00:16 2018 +0200 net: ethernet: smsc: smc91x: simplify getting .driver_data We should get 'driver_data' from 'struct device' directly. Going via platform_device is an unneeded step back and forth. Signed-off-by: Wolfram Sang Signed-off-by: David S. Miller commit 3fcdaad316f204d6280a65cf80a7c21c9fd499c3 Author: Wolfram Sang Date: Sun Oct 21 22:00:15 2018 +0200 net: ethernet: davicom: dm9000: simplify getting .driver_data We should get 'driver_data' from 'struct device' directly. Going via platform_device is an unneeded step back and forth. Signed-off-by: Wolfram Sang Signed-off-by: David S. Miller commit ce886a4748aa58fd12280d793305b3d844f202c4 Author: Wolfram Sang Date: Sun Oct 21 22:00:14 2018 +0200 net: ethernet: cadence: macb_main: simplify getting .driver_data We should get 'driver_data' from 'struct device' directly. Going via platform_device is an unneeded step back and forth. Signed-off-by: Wolfram Sang Signed-off-by: David S. Miller commit 717de3705dc4cf37d88392e1bdfb0135bd3ac2df Author: Wolfram Sang Date: Sun Oct 21 22:00:13 2018 +0200 net: dsa: qca8k: simplify getting .driver_data We should get 'driver_data' from 'struct device' directly. Going via platform_device is an unneeded step back and forth. Signed-off-by: Wolfram Sang Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 63382e0afeda1da79fe0c1ebcfbb6fb38e530fa1 Author: Wolfram Sang Date: Sun Oct 21 22:00:12 2018 +0200 net: dsa: bcm_sf2: simplify getting .driver_data We should get 'driver_data' from 'struct device' directly. Going via platform_device is an unneeded step back and forth. Signed-off-by: Wolfram Sang Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 977e4be5eb714c48a67afc26a6c477f24130a1f2 Author: Christophe Leroy Date: Sat Oct 20 09:26:49 2018 +0200 x86/stackprotector: Remove the call to boot_init_stack_canary() from cpu_startup_entry() The following commit: d7880812b359 ("idle: Add the stack canary init to cpu_startup_entry()") ... added an x86 specific boot_init_stack_canary() call to the generic cpu_startup_entry() as a temporary hack, with the intention to remove the #ifdef CONFIG_X86 later. More than 5 years later let's finally realize that plan! :-) While implementing stack protector support for PowerPC, we found that calling boot_init_stack_canary() is also needed for PowerPC which uses per task (TLS) stack canary like the X86. However, calling boot_init_stack_canary() would break architectures using a global stack canary (ARM, SH, MIPS and XTENSA). Instead of modifying the #ifdef CONFIG_X86 to an even messier: #if defined(CONFIG_X86) || defined(CONFIG_PPC) PowerPC implemented the call to boot_init_stack_canary() in the function calling cpu_startup_entry(). Let's try the same cleanup on the x86 side as well. On x86 we have two functions calling cpu_startup_entry(): - start_secondary() - cpu_bringup_and_idle() start_secondary() already calls boot_init_stack_canary(), so it's good, and this patch adds the call to boot_init_stack_canary() in cpu_bringup_and_idle(). I.e. now x86 catches up to the rest of the world and the ugly init sequence in init/main.c can be removed from cpu_startup_entry(). As a final benefit we can also remove the dependency from . [ mingo: Improved the changelog a bit, added language explaining x86 borkage and sched.h change. ] Signed-off-by: Christophe Leroy Reviewed-by: Juergen Gross Cc: Boris Ostrovsky Cc: Borislav Petkov Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linuxppc-dev@lists.ozlabs.org Cc: xen-devel@lists.xenproject.org Link: http://lkml.kernel.org/r/20181020072649.5B59310483E@pc16082vm.idsi0.si.c-s.fr Signed-off-by: Ingo Molnar commit 2e62024c265aa69315ed02835623740030435380 Author: Masami Hiramatsu Date: Sat Oct 20 18:47:53 2018 +0900 kprobes/x86: Use preempt_enable() in optimized_callback() The following commit: a19b2e3d7839 ("kprobes/x86: Remove IRQ disabling from ftrace-based/optimized kprobes”) removed local_irq_save/restore() from optimized_callback(), the handler might be interrupted by the rescheduling interrupt and might be rescheduled - so we must not use the preempt_enable_no_resched() macro. Use preempt_enable() instead, to not lose preemption events. [ mingo: Improved the changelog. ] Reported-by: Nadav Amit Signed-off-by: Masami Hiramatsu Acked-by: Peter Zijlstra (Intel) Cc: Cc: Alexei Starovoitov Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Linus Torvalds Cc: Oleg Nesterov Cc: Thomas Gleixner Cc: dwmw@amazon.co.uk Fixes: a19b2e3d7839 ("kprobes/x86: Remove IRQ disabling from ftrace-based/optimized kprobes”) Link: http://lkml.kernel.org/r/154002887331.7627.10194920925792947001.stgit@devbox Signed-off-by: Ingo Molnar commit b5a229350b72b929edac5ba77c825f8ebb413533 Author: Connor McAdams Date: Sun Oct 21 13:53:03 2018 -0400 ALSA: hda/ca0132 - Actually fix microphone issue This patch fixes the microphone issue for all cards. The previous fix worked on the ZxR, but not on the AE-5 or Z. This patch has been tested to work for all cards. Signed-off-by: Connor McAdams Signed-off-by: Takashi Iwai commit cfb347979e71d3ce6be59a988b3357f541c9eacf Author: Gustavo A. R. Silva Date: Thu Oct 4 15:56:36 2018 +0200 power: max8925: mark expected switch fall-through In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Addresses-Coverity-ID: 201510 ("Missing break in switch") Signed-off-by: Gustavo A. R. Silva Signed-off-by: Sebastian Reichel commit 415d602b226b3ed7b24edd8f0c2bfc111684d2b1 Author: Colin Ian King Date: Sat Oct 13 16:27:27 2018 +0100 power: supply: fix spelling mistake "Gauage" -> "Gauge" Trivial fix to spelling mistake in MODULE_DESCRIPTION text Signed-off-by: Colin Ian King Signed-off-by: Sebastian Reichel commit 21ea1d36f6dfcb1d59184937c672022d5d01902a Merge: d92060bc6923 23469de647c4 Author: David S. Miller Date: Sun Oct 21 11:54:28 2018 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net David Ahern's dump indexing bug fix in 'net' overlapped the change of the function signature of inet6_fill_ifaddr() in 'net-next'. Trivially resolved. Signed-off-by: David S. Miller commit fe8ecccc10b3adc071de05ca7af728ca1a4ac9aa Author: Quentin Monnet Date: Sat Oct 20 23:01:50 2018 +0100 tools: bpftool: fix completion for "bpftool map update" When trying to complete "bpftool map update" commands, the call to printf would print an error message that would show on the command line if no map is found to complete the command line. Fix it by making sure we have map ids to complete the line with, before we try to print something. Signed-off-by: Quentin Monnet Reviewed-by: Jakub Kicinski Signed-off-by: Daniel Borkmann commit 06ee9da6a8b49e0e12b7a825dbe6ad243d5463e2 Author: Quentin Monnet Date: Sat Oct 20 23:01:49 2018 +0100 tools: bpftool: print nb of cmds to stdout (not stderr) for batch mode When batch mode is used and all commands succeeds, bpftool prints the number of commands processed to stderr. There is no particular reason to use stderr for this, we could as well use stdout. It would avoid getting unnecessary output on stderr if the standard ouptut is redirected, for example. Reported-by: David Beckett Signed-off-by: Quentin Monnet Reviewed-by: Jakub Kicinski Signed-off-by: Daniel Borkmann commit 882731e06c669a8626f2d4bfb351ca19264be029 Author: Quentin Monnet Date: Sat Oct 20 23:01:48 2018 +0100 tools: bpftool: document restriction on '.' in names to pin in bpffs Names used to pin eBPF programs and maps under the eBPF virtual file system cannot contain a dot character, which is reserved for future extensions of this file system. Document this in bpftool man pages to avoid users getting confused if pinning fails because of a dot. Signed-off-by: Quentin Monnet Reviewed-by: Jakub Kicinski Signed-off-by: Daniel Borkmann commit 52990a5fb0c991ecafebdab43138b5ed41376852 Author: Jens Axboe Date: Sun Oct 21 12:02:36 2018 -0600 block: setup bounce bio_sets properly We're only setting up the bounce bio sets if we happen to need bouncing for regular HIGHMEM, not if we only need it for ISA devices. Protect the ISA bounce setup with a mutex, since it's being invoked from driver init functions and can thus be called in parallel. Cc: stable@vger.kernel.org Reported-by: Ondrej Zary Tested-by: Ondrej Zary Signed-off-by: Jens Axboe commit 7b9734dbc5b042bb8d8d930797f346b280057c4e Merge: 4b51c747e4a5 5f143af7501e Author: Mark Brown Date: Sun Oct 21 17:00:17 2018 +0100 Merge remote-tracking branch 'spi/topic/of' into spi-next commit 4b51c747e4a52175e63d125db8365b38b06f0343 Merge: 92d58fd13af2 0c903aafc852 Author: Mark Brown Date: Sun Oct 21 17:00:14 2018 +0100 Merge branch 'spi-4.20' into spi-next commit 92d58fd13af269552b65853d2c3a63970c4090bf Merge: 35a7f35ad1b1 4585add948b1 Author: Mark Brown Date: Sun Oct 21 17:00:10 2018 +0100 Merge branch 'spi-4.19' into spi-linus commit f35b1e53a66ab06e6d04cdff96f686e8b88959ef Merge: 4fd1f509e89f eb108c3611dd db6565af68db Author: Mark Brown Date: Sun Oct 21 17:00:05 2018 +0100 Merge remote-tracking branches 'regulator/topic/bd718xx' and 'regulator/topic/pfuze100' into regulator-next commit 4fd1f509e89f0e8ea28b1baa41d314636ae2064e Merge: 35a7f35ad1b1 d8b2a8e9c06b Author: Mark Brown Date: Sun Oct 21 17:00:02 2018 +0100 Merge branch 'regulator-4.20' into regulator-next commit 65dfb6d6dd2850f3f99f08536d2b14190350c854 Merge: 576b354ac25b 7f91e2af1a4a Author: Mark Brown Date: Sun Oct 21 16:59:23 2018 +0100 Merge branch 'asoc-4.20' into asoc-next commit 576b354ac25b544a31f27c365410d59fcbfee064 Merge: 35a7f35ad1b1 747df19747bc Author: Mark Brown Date: Sun Oct 21 16:59:19 2018 +0100 Merge branch 'asoc-4.19' into asoc-linus commit 0c903aafc8529f64d24d2cd6df32f2bf16aad20b Author: A.s. Dong Date: Thu Oct 18 18:19:34 2018 +0000 spi: lpspi: add imx8qxp compatible string Add imx8qxp compatible string Signed-off-by: Dong Aisheng Reviewed-by: Rob Herring Signed-off-by: Mark Brown commit 7f91e2af1a4a2c34fc2e8fb046c722e1a9c85399 Author: Vasily Khoruzhick Date: Sun Oct 21 08:39:11 2018 -0700 ASoC: sun4i-i2s: move code from startup/shutdown hooks into pm_runtime hooks startup() and shutdown() hooks are called for both substreams, so stopping either substream when another is running breaks the latter. E.g. playback breaks if capture is stopped when playback is running. Move code from startup() and shutdown() to resume() and suspend() hooks respectively to fix this issue Signed-off-by: Vasily Khoruzhick Acked-by: Maxime Ripard Signed-off-by: Mark Brown commit 3a08cd52c37c793ffc199f6fc2ecfc368e284b2d Author: Matthew Wilcox Date: Sat Sep 22 16:14:30 2018 -0400 radix tree: Remove multiorder support All users have now been converted to the XArray. Removing the support reduces code size and ensures new users will use the XArray instead. Signed-off-by: Matthew Wilcox commit 542980aa9318edcfb68aa7bf6eacf2814dc137dd Author: Matthew Wilcox Date: Sat Sep 22 16:12:41 2018 -0400 radix tree test: Convert multiorder tests to XArray This is the last remaining user of the multiorder functionality of the radix tree. Test the XArray instead. Signed-off-by: Matthew Wilcox commit b66b5a48b8a0e43dc114573da11c1a9c586a2d4f Author: Matthew Wilcox Date: Sat Sep 22 15:34:28 2018 -0400 radix tree tests: Convert item_delete_rcu to XArray In preparation for the removal of the multiorder radix tree code, convert item_delete_rcu() to use the XArray so it can still be called for XArrays containing multi-index entries. Signed-off-by: Matthew Wilcox commit ccc89e30fac790e3a175dbfc863c67286fce96b0 Author: Matthew Wilcox Date: Thu Sep 13 10:15:41 2018 -0400 radix tree tests: Convert item_kill_tree to XArray In preparation for the removal of the multiorder radix tree code, convert item_kill_tree() to use the XArray so it can still be called for XArrays containing multi-index entries. Signed-off-by: Matthew Wilcox commit 4bb53bdda0d1e061035774ed4868bdeb4d889044 Author: Matthew Wilcox Date: Wed Sep 12 23:29:32 2018 -0400 radix tree tests: Move item_insert_order The remaining tests are not suitable for moving in-kernel, so move item_insert_order() into multiorder.c, make it static and make it use the XArray. Signed-off-by: Matthew Wilcox commit 879a9ae7b5bc046f195a725d62bbc96258e5d0c8 Author: Matthew Wilcox Date: Wed Sep 12 23:12:47 2018 -0400 radix tree test suite: Remove multiorder benchmarking The multiorder radix tree code is being removed, so remove the benchmarking of its performance. Signed-off-by: Matthew Wilcox commit 9076b33d7dad8e316c90918845417e85347f682c Author: Matthew Wilcox Date: Wed Sep 12 12:52:45 2018 -0400 radix tree test suite: Remove __item_insert Inline it into its one caller Signed-off-by: Matthew Wilcox commit bcfa4b72111c9a4d483024cb1f877803b354aa11 Author: Matthew Wilcox Date: Wed Aug 15 14:22:16 2018 -0400 memremap: Convert to XArray Use the new xa_store_range function instead of the radix tree. Signed-off-by: Matthew Wilcox commit 0e9446c35a80931044b6d8d2d74a9cabd248539f Author: Matthew Wilcox Date: Wed Aug 15 14:13:29 2018 -0400 xarray: Add range store functionality This version of xa_store_range() really only supports load and store. Our only user only needs basic load and store functionality, so there's no need to do the extra work to support marking and overlapping stores correctly yet. Signed-off-by: Matthew Wilcox commit 4f06d6302da682157890f72c0573e12a73536814 Author: Matthew Wilcox Date: Sun Sep 9 01:52:17 2018 -0400 xarray: Move multiorder_check to in-kernel tests This version is a little less thorough in order to be a little quicker, but tests the important edge cases. Also test adding a multiorder entry at a non-canonical index, and erasing it. Signed-off-by: Matthew Wilcox commit 93eb07f72c8d86f8fe5e90907df1cc037f6ffbb7 Author: Matthew Wilcox Date: Sat Sep 8 12:09:52 2018 -0400 xarray: Move multiorder_shrink to kernel tests Test this functionality inside the kernel as well as in userspace. Also remove insert_bug() as there's no comparable thing to test in the XArray code. Signed-off-by: Matthew Wilcox commit d6427f8179b5dd65eb468c61fc8cc24657c336c9 Author: Matthew Wilcox Date: Tue Aug 28 16:13:16 2018 -0400 xarray: Move multiorder account test in-kernel Move this test to the in-kernel test suite, and enhance it to test several different orders. Signed-off-by: Matthew Wilcox commit 47e0fab2b15155e33fdff777c791bebfd5855bbc Author: Matthew Wilcox Date: Mon Aug 20 15:48:46 2018 -0400 radix tree test suite: Convert iteration test to XArray With no code left in the kernel using the multiorder radix tree, convert the iteration test from the radix tree to the XArray. It's unlikely to suffer the same bug as the radix tree, but this test will prevent that bug from ever creeping into the XArray implementation. Signed-off-by: Matthew Wilcox commit 372266ba0267803564824b1c09f1bb7f3f3fc761 Author: Matthew Wilcox Date: Sat Aug 18 07:09:22 2018 -0400 radix tree test suite: Convert tag_tagged_items to XArray The tag_tagged_items() function is supposed to test the page-writeback tagging code. Since that has been converted to the XArray, there's not much point in testing the radix tree's tagging code. This requires using the pthread mutex embedded in the xarray instead of an external lock, so remove the pthread mutexes which protect xarrays/radix trees. Also remove radix_tree_iter_tag_set() as this was the last user. Signed-off-by: Matthew Wilcox commit adb9d9c4ccb1ff0bf1d376e65f36aa5573c75c1a Author: Matthew Wilcox Date: Mon Apr 9 16:52:21 2018 -0400 radix tree: Remove radix_tree_clear_tags The page cache was the only user of this interface and it has now been converted to the XArray. Transform the test into a test of xas_init_marks(). Signed-off-by: Matthew Wilcox commit 8cf2f98411e3a0865026a1061af637161b16d32b Author: Matthew Wilcox Date: Sat May 19 16:47:47 2018 -0400 radix tree: Remove radix_tree_maybe_preload_order This function was only used by the page cache which is now converted to the XArray. Signed-off-by: Matthew Wilcox commit 2956c6644bfd9aab9f6b21a12e1bd75876d9dd73 Author: Matthew Wilcox Date: Sat May 19 16:47:47 2018 -0400 radix tree: Remove split/join code radix_tree_split and radix_tree_join were never used upstream. Remove them; if they're needed in future they will be replaced by XArray equivalents. Signed-off-by: Matthew Wilcox commit 1cf56f9d670b88b2e947a7ccdb8ba32e6477915d Author: Matthew Wilcox Date: Mon Apr 9 16:24:45 2018 -0400 radix tree: Remove radix_tree_update_node_t The only user of this functionality was the workingset code, and it's now been converted to the XArray. Remove __radix_tree_delete_node() entirely as it was also only used by the workingset code. Signed-off-by: Matthew Wilcox commit a28334862993b5c6a8766f6963ee69048403817c Author: Matthew Wilcox Date: Tue Dec 5 19:04:20 2017 -0500 page cache: Finish XArray conversion With no more radix tree API users left, we can drop the GFP flags and use xa_init() instead of INIT_RADIX_TREE(). Signed-off-by: Matthew Wilcox commit b15cd800682fcaf27048b05e42f5c208e4c756c0 Author: Matthew Wilcox Date: Thu Mar 29 22:58:27 2018 -0400 dax: Convert page fault handlers to XArray This is the last part of DAX to be converted to the XArray so remove all the old helper functions. Signed-off-by: Matthew Wilcox commit 9f32d221301c3e754b24c77ab11bf793b19f51b5 Author: Matthew Wilcox Date: Tue Jun 12 09:46:30 2018 -0400 dax: Convert dax_lock_mapping_entry to XArray Instead of always retrying when we slept, only retry if the page has moved. Signed-off-by: Matthew Wilcox commit 9fc747f68d49f4b63029e3a1e87c49d23771a199 Author: Matthew Wilcox Date: Wed Mar 28 16:03:45 2018 -0400 dax: Convert dax writeback to XArray Use XArray iteration instead of a pagevec. Signed-off-by: Matthew Wilcox commit 07f2d89cc270936ac314e7cc4ac57077d7f08aef Author: Matthew Wilcox Date: Wed Mar 28 15:40:41 2018 -0400 dax: Convert __dax_invalidate_entry to XArray Avoids walking the radix tree multiple times looking for tags. Signed-off-by: Matthew Wilcox commit 084a899008cec6db91dbf06453b2e3a36ceed02d Author: Matthew Wilcox Date: Thu May 17 13:03:48 2018 -0400 dax: Convert dax_layout_busy_page to XArray Instead of using a pagevec, just use the XArray iterators. Add a conditional rescheduling point which probably should have been there in the original. Signed-off-by: Matthew Wilcox commit cfc93c6c6c963d96ef7081c17fb95d2738a75f55 Author: Matthew Wilcox Date: Wed Mar 28 11:48:03 2018 -0400 dax: Convert dax_insert_pfn_mkwrite to XArray Add some XArray-based helper functions to replace the radix tree based metaphors currently in use. The biggest change is that converted code doesn't see its own lock bit; get_unlocked_entry() always returns an entry with the lock bit clear. So we don't have to mess around loading the current entry and clearing the lock bit; we can just store the unlocked entry that we already have. Signed-off-by: Matthew Wilcox commit ec4907ff69fb16161d9d9370260303a73dd5acde Author: Matthew Wilcox Date: Wed Mar 28 11:01:43 2018 -0400 dax: Hash on XArray instead of mapping Since the XArray is embedded in the struct address_space, its address contains exactly as much entropy as the address of the mapping. This patch is purely preparatory for later patches which will simplify the wait/wake interfaces. Signed-off-by: Matthew Wilcox commit a77d19f46a37c0fed48676739e8e0277f43d74e6 Author: Matthew Wilcox Date: Tue Mar 27 13:39:38 2018 -0400 dax: Rename some functions Remove mentions of 'radix' and 'radix tree'. Simplify some names by dropping the word 'mapping'. Signed-off-by: Matthew Wilcox commit 5ec2d99de7427c84bb7250d23f5acf49a3670a63 Author: Matthew Wilcox Date: Mon Dec 4 20:25:25 2017 -0500 f2fs: Convert to XArray This is a straightforward conversion. Signed-off-by: Matthew Wilcox commit f611ff63751afa421edc1eddf4281de13e082c51 Author: Matthew Wilcox Date: Mon Dec 4 19:33:30 2017 -0500 nilfs2: Convert to XArray This is close to a 1:1 replacement of radix tree APIs with their XArray equivalents. It would be possible to optimise nilfs_copy_back_pages(), but that doesn't seem to be in the performance path. Also, I think it has a pre-existing bug, and I've added a note to that effect in the source code. Signed-off-by: Matthew Wilcox commit 04edf02cdd37a7e2e23ce8de77cb06d22ef2f503 Author: Matthew Wilcox Date: Mon Dec 4 10:46:23 2017 -0500 fs: Convert writeback to XArray A couple of short loops. Signed-off-by: Matthew Wilcox commit ec82e1c1c89ce02d7703b841e6ee7d429feed609 Author: Matthew Wilcox Date: Mon Dec 4 10:40:41 2017 -0500 fs: Convert buffer to XArray Mostly comment fixes, but one use of __xa_set_mark. Signed-off-by: Matthew Wilcox commit 0a943c65e7d7207dce2a63e9d14a925c0d9a7d96 Author: Matthew Wilcox Date: Mon Dec 4 10:37:22 2017 -0500 btrfs: Convert page cache to XArray Signed-off-by: Matthew Wilcox Acked-by: David Sterba commit 7f4446eefe9fbbe68e9543946c9a20f67897ff9b Author: Matthew Wilcox Date: Mon Dec 4 03:31:13 2017 -0500 shmem: Comment fixups Remove the last mentions of radix tree from various comments. Signed-off-by: Matthew Wilcox commit ef3038a573aa8bf2f3797b110f7244b55a0e519c Author: Matthew Wilcox Date: Wed Nov 22 08:37:38 2017 -0500 memfd: Convert memfd_tag_pins to XArray Switch to a batch-processing model like memfd_wait_for_pins() and use the xa_state previously set up by memfd_wait_for_pins(). Signed-off-by: Matthew Wilcox Reviewed-by: Mike Kravetz commit 2313216f861f955c2091f1593ea95d5dc88493f4 Author: Matthew Wilcox Date: Wed Nov 22 11:11:31 2017 -0500 memfd: Convert memfd_wait_for_pins to XArray Simplify the locking by taking the spinlock while we walk the tree on the assumption that many acquires and releases of the lock will be worse than holding the lock while we process an entire batch of pages. Signed-off-by: Matthew Wilcox Reviewed-by: Mike Kravetz commit 7ae3424fb4b5587d9b2db12a4b1040c52073dd5c Author: Matthew Wilcox Date: Mon Dec 4 03:28:00 2017 -0500 shmem: Convert shmem_partial_swap_usage to XArray Simpler code because the xarray takes care of things like the limit and dereferencing the slot. Signed-off-by: Matthew Wilcox commit c121d3bb717ee932caf031c6a7923547f7f83163 Author: Matthew Wilcox Date: Mon Dec 4 03:13:54 2017 -0500 shmem: Convert shmem_free_swap to XArray Since we are conditionally storing NULL in the XArray, we do not need to allocate memory and the GFP flags will be unused. Signed-off-by: Matthew Wilcox commit 7b8d046fba91d62beb8a8f78244aaa3c23a60cdd Author: Matthew Wilcox Date: Fri Dec 1 22:13:06 2017 -0500 shmem: Convert shmem_alloc_hugepage to XArray xa_find() is a slightly easier API to use than radix_tree_gang_lookup_slot() because it contains its own RCU locking. This commit removes the last user of radix_tree_gang_lookup_slot() so remove the function too. Signed-off-by: Matthew Wilcox commit 552446a4166189a8c2515571dd6e25fd64a2dc78 Author: Matthew Wilcox Date: Fri Dec 1 13:25:14 2017 -0500 shmem: Convert shmem_add_to_page_cache to XArray We can use xas_find_conflict() instead of radix_tree_gang_lookup_slot() to find any conflicting entry and combine the three paths through this function into one. Signed-off-by: Matthew Wilcox commit e21a29552fa3f44ea41c53488875015ae70fd7f8 Author: Matthew Wilcox Date: Wed Nov 22 08:36:00 2017 -0500 shmem: Convert find_swap_entry to XArray This is a 1:1 conversion. The major part of this patch is converting the test framework from userspace to kernel space and mirroring the algorithm now used in find_swap_entry(). Signed-off-by: Matthew Wilcox commit a12831bf4293d38518e41b80dd897af0122bb268 Author: Matthew Wilcox Date: Wed Nov 22 08:34:58 2017 -0500 shmem: Convert shmem_confirm_swap to XArray xa_load has its own RCU locking, so we can eliminate it here. Signed-off-by: Matthew Wilcox commit 62f945b6a7b8cda6d1f35941eb374276f7b8749a Author: Matthew Wilcox Date: Fri Nov 17 10:22:37 2017 -0500 shmem: Convert shmem_radix_tree_replace to XArray Rename shmem_radix_tree_replace() to shmem_replace_entry() and convert it to use the XArray API. Signed-off-by: Matthew Wilcox commit 10bbd235859bf483f9a8a4ebe95463d700bae394 Author: Matthew Wilcox Date: Tue Dec 5 17:30:38 2017 -0500 pagevec: Use xa_mark_t Removes sparse warnings. Signed-off-by: Matthew Wilcox commit 67891ffff2f5cf10e89e348207f687a05c8bd2d6 Author: Matthew Wilcox Date: Sun Jun 10 07:34:39 2018 -0400 mm: Convert is_page_cache_freeable to XArray This is just a variable rename and comment change. Signed-off-by: Matthew Wilcox commit 85b392dbace77bf91050e6e07f3dd0f262e4babf Author: Matthew Wilcox Date: Mon Dec 4 15:06:23 2017 -0500 mm: Convert khugepaged_scan_shmem to XArray Slightly shorter and easier to read code. Signed-off-by: Matthew Wilcox commit 77da9389b9d5f07d54fda092d1ab56002ec0019a Author: Matthew Wilcox Date: Mon Dec 4 14:56:08 2017 -0500 mm: Convert collapse_shmem to XArray I found another victim of the radix tree being hard to use. Because there was no call to radix_tree_preload(), khugepaged was allocating radix_tree_nodes using GFP_ATOMIC. I also converted a local_irq_save()/restore() pair to disable()/enable(). Signed-off-by: Matthew Wilcox commit aa5dc07f70c50a3c56bf3fa07bde0b22a95aa381 Author: Matthew Wilcox Date: Mon Dec 4 10:16:10 2017 -0500 mm: Convert huge_memory to XArray Quite a straightforward conversion. Signed-off-by: Matthew Wilcox commit 89eb946a7432be639b452fac295c0c2e5186c4a4 Author: Matthew Wilcox Date: Mon Dec 4 04:35:16 2017 -0500 mm: Convert page migration to XArray Signed-off-by: Matthew Wilcox commit 560d454bae08b5d5a132c5520177dede066334b7 Author: Matthew Wilcox Date: Mon Dec 4 04:30:18 2017 -0500 mm: Convert __do_page_cache_readahead to XArray This one is trivial. Signed-off-by: Matthew Wilcox commit 4e17ec250fce0eba9b70a91c9622da2748a3ec50 Author: Matthew Wilcox Date: Wed Nov 29 08:32:39 2017 -0500 mm: Convert delete_from_swap_cache to XArray Both callers of __delete_from_swap_cache have the swp_entry_t already, so pass that in to make constructing the XA_STATE easier. Signed-off-by: Matthew Wilcox commit 8d93b41c09d1b74f376e3b9779eb3badeb550301 Author: Matthew Wilcox Date: Mon Nov 27 15:46:54 2017 -0500 mm: Convert add_to_swap_cache to XArray Combine __add_to_swap_cache and add_to_swap_cache into one function since there is no more need to preload. Signed-off-by: Matthew Wilcox commit 69b6c1319b6588b65d853055d5336f662f6cb1a2 Author: Matthew Wilcox Date: Sat Nov 25 22:52:46 2017 -0500 mm: Convert truncate to XArray This is essentially xa_cmpxchg() with the locking handled above us, and it doesn't have to handle replacing a NULL entry. Signed-off-by: Matthew Wilcox commit a97e7904c0806309fd77103005bb7820c3f1c5e4 Author: Matthew Wilcox Date: Fri Nov 24 14:24:59 2017 -0500 mm: Convert workingset to XArray We construct an XA_STATE and use it to delete the node with xas_store() rather than adding a special function for this unique use case. Includes a test that simulates this usage for the test suite. Signed-off-by: Matthew Wilcox commit ff9c745b81ff1e482167fd73558450e66ad43a33 Author: Matthew Wilcox Date: Wed Nov 22 11:41:23 2017 -0500 mm: Convert page-writeback to XArray Includes moving mapping_tagged() to fs.h as a static inline, and changing it to return bool. Signed-off-by: Matthew Wilcox commit 8fa8e538e4be359e9042573737632dda35a8700d Author: Matthew Wilcox Date: Tue Jan 16 06:26:49 2018 -0500 page cache: Convert filemap_range_has_page to XArray Instead of calling find_get_pages_range() and putting any reference, use xas_find() to iterate over any entries in the range, skipping the shadow/swap entries. Signed-off-by: Matthew Wilcox commit 22ecdb4f8b7dbfefa3deaf6b144093b5c4cd2aff Author: Matthew Wilcox Date: Mon Dec 4 04:02:00 2017 -0500 page cache: Remove stray radix comment Signed-off-by: Matthew Wilcox commit ef8e5717db01bfa4f425d2cda551a6fccc85529d Author: Matthew Wilcox Date: Mon Dec 4 03:59:45 2017 -0500 page cache: Convert delete_batch to XArray Rename the function from page_cache_tree_delete_batch to just page_cache_delete_batch. Signed-off-by: Matthew Wilcox commit a332125fc3223e1092f765db442b7afb9fd4ecde Author: Matthew Wilcox Date: Thu May 17 00:13:27 2018 -0400 radix tree test suite: Convert regression1 to XArray Now the page cache lookup is using the XArray, let's convert this regression test from the radix tree API to the XArray so it's testing roughly the same thing it was testing before. Signed-off-by: Matthew Wilcox commit 070e807c690bf9a648d4a878f3c68ea9f5f5ce14 Author: Matthew Wilcox Date: Thu May 17 00:08:30 2018 -0400 page cache: Convert filemap_map_pages to XArray Slight change of strategy here; if we have trouble getting hold of a page for whatever reason (eg a compound page is split underneath us), don't spin to stabilise the page, just continue the iteration, like we would if we failed to trylock the page. Since this is a speculative optimisation, it feels like we should allow the process to take an extra fault if it turns out to need this page instead of spending time to pin down a page it may not need. Signed-off-by: Matthew Wilcox commit c1901cd33cf407d77a181f8dd4ffff98041ef480 Author: Matthew Wilcox Date: Wed May 16 23:56:04 2018 -0400 page cache: Convert find_get_entries_tag to XArray Slightly shorter and simpler code. Signed-off-by: Matthew Wilcox commit a6906972fe67fb6f73ba04088f7897227fd1cd8f Author: Matthew Wilcox Date: Wed May 16 18:12:54 2018 -0400 page cache; Convert find_get_pages_range_tag to XArray The 'end' parameter of the xas_for_each iterator avoids a useless iteration at the end of the range. Signed-off-by: Matthew Wilcox commit 3ece58a270cd1e5026282abe778bd50db7a11d08 Author: Matthew Wilcox Date: Wed May 16 18:00:33 2018 -0400 page cache: Convert find_get_pages_contig to XArray There's no direct replacement for radix_tree_for_each_contig() in the XArray API as it's an unusual thing to do. Instead, open-code a loop using xas_next(). This removes the only user of radix_tree_for_each_contig() so delete the iterator from the API and the test suite code for it. Signed-off-by: Matthew Wilcox commit fd1b3cee2a867868d39bb8cbcc4b00c36d07cc01 Author: Matthew Wilcox Date: Wed May 16 17:38:56 2018 -0400 page cache: Convert find_get_pages_range to XArray The 'end' parameter of the xas_for_each iterator avoids a useless iteration at the end of the range. Signed-off-by: Matthew Wilcox commit f280bf092d48ff2db12b4a01127cd855c9e0ffb0 Author: Matthew Wilcox Date: Wed May 16 17:20:45 2018 -0400 page cache: Convert find_get_entries to XArray Slightly shorter and simpler code. Signed-off-by: Matthew Wilcox commit 4c7472c0df2f889df417a37571e622e02b5058fe Author: Matthew Wilcox Date: Wed May 16 16:12:50 2018 -0400 page cache: Convert find_get_entry to XArray Slightly shorter and simpler code. Signed-off-by: Matthew Wilcox commit 5c024e6a4ebc1740db9f0f075aaa476210108a97 Author: Matthew Wilcox Date: Tue Nov 21 09:17:59 2017 -0500 page cache: Convert page deletion to XArray The code is slightly shorter and simpler. Signed-off-by: Matthew Wilcox commit 74d609585d8bd6083bd9d75bc1fd2c0d3851bcc5 Author: Matthew Wilcox Date: Fri Nov 17 10:01:45 2017 -0500 page cache: Add and replace pages using the XArray Use the XArray APIs to add and replace pages in the page cache. This removes two uses of the radix tree preload API and is significantly shorter code. It also removes the last user of __radix_tree_create() outside radix-tree.c itself, so make it static. Signed-off-by: Matthew Wilcox commit 0d3f92966629e536b0c5c2355c1ada8e21c245f6 Author: Matthew Wilcox Date: Tue Nov 21 14:07:06 2017 -0500 page cache: Convert hole search to XArray The page cache offers the ability to search for a miss in the previous or next N locations. Rather than teach the XArray about the page cache's definition of a miss, use xas_prev() and xas_next() to search the page array. This should be more efficient as it does not have to start the lookup from the top for each index. Signed-off-by: Matthew Wilcox commit eb797a8ee0ab4cd03df556980ce7bf167cadaa50 Author: Matthew Wilcox Date: Mon Mar 5 22:46:03 2018 -0500 page cache: Rearrange address_space Change i_pages from a radix_tree_root to an xarray, convert the documentation into kernel-doc format and change the order of the elements to pack them better on 64-bit systems. Signed-off-by: Matthew Wilcox commit f32f004cddf86d63a9c42994bbce9f4e2f07c9fa Author: Matthew Wilcox Date: Wed Jul 4 15:42:46 2018 -0400 ida: Convert to XArray Use the XA_TRACK_FREE ability to track which entries have a free bit, similarly to how it uses the radix tree's IDR_FREE tag. This eliminates the per-cpu ida_bitmap preload, and fixes the memory consumption regression I introduced when making the IDR able to store any pointer. Signed-off-by: Matthew Wilcox commit 371c752dc66948714ee3b66c3306f3ff1ff71d2e Author: Matthew Wilcox Date: Wed Jul 4 10:50:12 2018 -0400 xarray: Track free entries in an XArray Add the optional ability to track which entries in an XArray are free and provide xa_alloc() to replace most of the functionality of the IDR. Signed-off-by: Matthew Wilcox commit 3d5bd6e1a04ae779bc5e0de9ba2e92aa55c40fe8 Author: Matthew Wilcox Date: Mon Nov 27 15:32:05 2017 -0500 xarray: Add MAINTAINERS entry Add myself as XArray and IDR maintainer. Signed-off-by: Matthew Wilcox commit 9f14d4f1f1045f161fd4db8a8e194b7825c2874a Author: Matthew Wilcox Date: Mon Oct 1 14:54:59 2018 -0400 xarray: Add xa_reserve and xa_release This function reserves a slot in the XArray for users which need to acquire multiple locks before storing their entry in the tree and so cannot use a plain xa_store(). Signed-off-by: Matthew Wilcox commit 2264f5132fe45571139727ebdeb78696b35d1506 Author: Matthew Wilcox Date: Mon Dec 4 00:11:48 2017 -0500 xarray: Add xas_create_range This hopefully temporary function is useful for users who have not yet been converted to multi-index entries. Signed-off-by: Matthew Wilcox commit 4e99d4e9579d3b950bf4b38d0d64eb1b9be78761 Author: Matthew Wilcox Date: Fri Jun 1 22:46:02 2018 -0400 xarray: Add xas_for_each_conflict This iterator iterates over each entry that is stored in the index or indices specified by the xa_state. This is intended for use for a conditional store of a multiindex entry, or to allow entries which are about to be removed from the xarray to be disposed of properly. Signed-off-by: Matthew Wilcox commit 64d3e9a9e0cc51957d243dd2b0adc5d74ff5e128 Author: Matthew Wilcox Date: Fri Dec 1 00:06:52 2017 -0500 xarray: Step through an XArray The xas_next and xas_prev functions move the xas index by one position, and adjust the rest of the iterator state to match it. This is more efficient than calling xas_set() as it keeps the iterator at the leaves of the tree instead of walking the iterator from the root each time. Signed-off-by: Matthew Wilcox commit 687149fca1f37c447e5d161e0a4a04cb2c880cb6 Author: Matthew Wilcox Date: Fri Nov 17 08:16:34 2017 -0500 xarray: Destroy an XArray This function frees all the internal memory allocated to the xarray and reinitialises it to be empty. Signed-off-by: Matthew Wilcox commit 80a0a1a9a3cde9b23851e8eb7160e2786549306a Author: Matthew Wilcox Date: Tue Nov 14 16:42:22 2017 -0500 xarray: Extract entries from an XArray The xa_extract function combines the functionality of radix_tree_gang_lookup() and radix_tree_gang_lookup_tagged(). It extracts entries matching the specified filter into a normal array. Signed-off-by: Matthew Wilcox commit b803b42823d0d9e8b6deccf01ffc2aba5d0738df Author: Matthew Wilcox Date: Tue Nov 14 08:30:11 2017 -0500 xarray: Add XArray iterators The xa_for_each iterator allows the user to efficiently walk a range of the array, executing the loop body once for each entry in that range that matches the filter. This commit also includes xa_find() and xa_find_after() which are helper functions for xa_for_each() but may also be useful in their own right. In the xas family of functions, we have xas_for_each(), xas_find(), xas_next_entry(), xas_for_each_tagged(), xas_find_tagged(), xas_next_tagged() and xas_pause(). Signed-off-by: Matthew Wilcox commit 41aec91f55985e7f14ee75fe2f6e7bcfff0d0fae Author: Matthew Wilcox Date: Fri Nov 10 15:34:55 2017 -0500 xarray: Add XArray conditional store operations Like cmpxchg(), xa_cmpxchg will only store to the index if the current entry matches the old entry. It returns the current entry, which is usually more useful than the errno returned by radix_tree_insert(). For the users who really only want the errno, the xa_insert() wrapper provides a more convenient calling convention. Signed-off-by: Matthew Wilcox commit 58d6ea3085f2e53714810a513c61629f6d2be0a6 Author: Matthew Wilcox Date: Fri Nov 10 15:15:08 2017 -0500 xarray: Add XArray unconditional store operations xa_store() differs from radix_tree_insert() in that it will overwrite an existing element in the array rather than returning an error. This is the behaviour which most users want, and those that want more complex behaviour generally want to use the xas family of routines anyway. For memory allocation, xa_store() will first attempt to request memory from the slab allocator; if memory is not immediately available, it will drop the xa_lock and allocate memory, keeping a pointer in the xa_state. It does not use the per-CPU cache, although those will continue to exist until all radix tree users are converted to the xarray. This patch also includes xa_erase() and __xa_erase() for a streamlined way to store NULL. Since there is no need to allocate memory in order to store a NULL in the XArray, we do not need to trouble the user with deciding what memory allocation flags to use. Signed-off-by: Matthew Wilcox commit 9b89a0355144685a787b0dc5bcf7bdd6f2d02968 Author: Matthew Wilcox Date: Fri Nov 10 09:34:31 2017 -0500 xarray: Add XArray marks XArray marks are like the radix tree tags, only slightly more strongly typed. They are renamed in order to distinguish them from tagged pointers. This commit adds the basic get/set/clear operations. Signed-off-by: Matthew Wilcox commit ad3d6c7263e368abdc151e1cc13dc78aa39cc7a7 Author: Matthew Wilcox Date: Tue Nov 7 14:57:46 2017 -0500 xarray: Add XArray load operation The xa_load function brings with it a lot of infrastructure; xa_empty(), xa_is_err(), and large chunks of the XArray advanced API that are used to implement xa_load. As the test-suite demonstrates, it is possible to use the XArray functions on a radix tree. The radix tree functions depend on the GFP flags being stored in the root of the tree, so it's not possible to use the radix tree functions on an XArray. Signed-off-by: Matthew Wilcox commit 992a8e60e3fea77c55589fc1c5af2304e78a5baa Author: Matthew Wilcox Date: Thu Nov 23 22:57:20 2017 -0500 xarray: Add documentation This is documentation on how to use the XArray, not details about its internal implementation. Signed-off-by: Matthew Wilcox Acked-by: Josef Bacik commit 01959dfe771c6893365482ec78dc1d9cbbbe6de8 Author: Matthew Wilcox Date: Thu Nov 9 09:23:56 2017 -0500 xarray: Define struct xa_node This is a direct replacement for struct radix_tree_node. A couple of struct members have changed name, so convert those. Use a #define so that radix tree users continue to work without change. Signed-off-by: Matthew Wilcox Reviewed-by: Josef Bacik commit f8d5d0cc145cc21bfc56ef807dc28102aebbf228 Author: Matthew Wilcox Date: Tue Nov 7 16:30:10 2017 -0500 xarray: Add definition of struct xarray This is a direct replacement for struct radix_tree_root. Some of the struct members have changed name; convert those, and use a #define so that radix_tree users continue to work without change. Signed-off-by: Matthew Wilcox Reviewed-by: Josef Bacik commit 79a15f4974ce9613134648e6e1dd0eb7ca199de6 Author: Florian Fainelli Date: Fri Oct 19 11:12:32 2018 -0700 spi: Allow building SPI_BCM63XX_HSSPI on ARM-based SoCs ARM-based 63xx DSL platforms have the spi-bcm63xx-hsspi controller present, allow using this driver there as well. Signed-off-by: Florian Fainelli Signed-off-by: Mark Brown commit ae2399c48c023ef8a6e0d260950420296252b3e9 Merge: 9ef688410506 cdf6b11daa77 1c96a2f67cd9 Author: Mark Brown Date: Sun Oct 21 12:07:26 2018 +0100 Merge remote-tracking branches 'regmap/topic/noinc' and 'regmap/topic/single-rw' into regmap-next commit 9ef688410506b8702010765e98a5c20a93561d2e Merge: 35a7f35ad1b1 950937624079 Author: Mark Brown Date: Sun Oct 21 12:07:24 2018 +0100 Merge branch 'regmap-4.20' into regmap-next commit c5d09485def41cab9e75ba23abbf87080183183c Author: Lucas Tanure Date: Fri Oct 19 17:44:22 2018 +0100 ASoC: wm2000: Remove wm2000_read helper function The return type "unsigned int" was used by the wm2000_read() function despite of the aspect that it will eventually return a negative error code. The resulting function doesn't add much to the code, so replace wm2000_read with regmap_read. Signed-off-by: Lucas Tanure Acked-by: Charles Keepax Signed-off-by: Mark Brown commit 574c0cfbc7159c5a5a59d5608e422c95917a9b7c Merge: cbe3f898d159 6e301a8e56e4 Author: Paolo Bonzini Date: Sun Oct 21 11:47:01 2018 +0200 Merge tag 'kvm-ppc-next-4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc into HEAD Second PPC KVM update for 4.20. Two commits; one is an optimization for PCI pass-through, and the other disables nested HV-KVM on early POWER9 chips that need a particular hardware bug workaround. commit 162041425193602b15774c61740ad8e7dc157df3 Author: Dave Hansen Date: Fri Oct 19 07:08:42 2018 -0700 x86/mm: Kill stray kernel fault handling comment I originally had matching user and kernel comments, but the kernel one got improved. Some errant conflict resolution kicked the commment somewhere wrong. Kill it. Reported-by: Eric W. Biederman Signed-off-by: Dave Hansen Cc: Andy Lutomirski Cc: Jann Horn Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Sean Christopherson Cc: Thomas Gleixner Fixes: aa37c51b94 ("x86/mm: Break out user address space handling") Link: http://lkml.kernel.org/r/20181019140842.12F929FA@viggo.jf.intel.com Signed-off-by: Ingo Molnar commit 0f99153def98134403c9149128e59d3e1786cf04 Author: Christophe Leroy Date: Fri Oct 19 06:12:50 2018 +0000 powerpc/msi: Fix compile error on mpc83xx mpic_get_primary_version() is not defined when not using MPIC. The compile error log like: arch/powerpc/sysdev/built-in.o: In function `fsl_of_msi_probe': fsl_msi.c:(.text+0x150c): undefined reference to `fsl_mpic_primary_get_version' Signed-off-by: Jia Hongtao Signed-off-by: Scott Wood Reported-by: Radu Rendec Fixes: 807d38b73b6 ("powerpc/mpic: Add get_version API both for internal and external use") Cc: stable@vger.kernel.org Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit b6aeddea74b08518289fc86545297cf18a0b53a7 Author: Michael Ellerman Date: Fri Oct 19 16:19:10 2018 +1100 powerpc: Fix stack protector crashes on CPU hotplug Recently in commit 7241d26e8175 ("powerpc/64: properly initialise the stackprotector canary on SMP.") we fixed a crash with stack protector on SMP by initialising the stack canary in cpu_idle_thread_init(). But this can also causes crashes, when a CPU comes back online after being offline: Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: pnv_smp_cpu_kill_self+0x2a0/0x2b0 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.19.0-rc3-gcc-7.3.1-00168-g4ffe713b7587 #94 Call Trace: dump_stack+0xb0/0xf4 (unreliable) panic+0x144/0x328 __stack_chk_fail+0x2c/0x30 pnv_smp_cpu_kill_self+0x2a0/0x2b0 cpu_die+0x48/0x70 arch_cpu_idle_dead+0x20/0x40 do_idle+0x274/0x390 cpu_startup_entry+0x38/0x50 start_secondary+0x5e4/0x600 start_secondary_prolog+0x10/0x14 Looking at the stack we see that the canary value in the stack frame doesn't match the canary in the task/paca. That is because we have reinitialised the task/paca value, but then the CPU coming online has returned into a function using the old canary value. That causes the comparison to fail. Instead we can call boot_init_stack_canary() from start_secondary() which never returns. This is essentially what the generic code does in cpu_startup_entry() under #ifdef X86, we should make that non-x86 specific in a future patch. Fixes: 7241d26e8175 ("powerpc/64: properly initialise the stackprotector canary on SMP.") Reported-by: Joel Stanley Signed-off-by: Michael Ellerman Reviewed-by: Christophe Leroy commit c5fa5d602221362f8341ecd9e32d83194abf5bd9 Author: Quentin Monnet Date: Sat Oct 20 22:58:44 2018 +0100 selftests/bpf: fix return value comparison for tests in test_libbpf.sh The return value for each test in test_libbpf.sh is compared with if (( $? == 0 )) ; then ... This works well with bash, but not with dash, that /bin/sh is aliased to on some systems (such as Ubuntu). Let's replace this comparison by something that works on both shells. Signed-off-by: Quentin Monnet Reviewed-by: Jakub Kicinski Signed-off-by: Alexei Starovoitov commit 76b5e30397ebe9f9dd58511d32945018f8196be9 Merge: 2576b96757e4 3dca21156b5f Author: Alexei Starovoitov Date: Sat Oct 20 23:13:33 2018 -0700 Merge branch 'misc-improvements' Daniel Borkmann says: ==================== Last batch of misc patches I had in queue: first one removes some left-over bits from ULP, second is a fix in the verifier where we wrongly use register number as type to fetch the string for the dump, third disables xadd on flow keys and subsequent one removes the flow key type from check_helper_mem_access() as they cannot be passed into any helper as of today. Next one lets map push, pop, peek avoid having to go through retpoline, and last one has a couple of minor fixes and cleanups for the ring buffer walk. ==================== Signed-off-by: Alexei Starovoitov commit 3dca21156b5f809510e8c3efe7f1046e27242e3d Author: Daniel Borkmann Date: Sun Oct 21 02:09:28 2018 +0200 bpf, libbpf: simplify and cleanup perf ring buffer walk Simplify bpf_perf_event_read_simple() a bit and fix up some minor things along the way: the return code in the header is not of type int but enum bpf_perf_event_ret instead. Once callback indicated to break the loop walking event data, it also needs to be consumed in data_tail since it has been processed already. Moreover, bpf_perf_event_print_t callback should avoid void * as we actually get a pointer to struct perf_event_header and thus applications can make use of container_of() to have type checks. The walk also doesn't have to use modulo op since the ring size is required to be power of two. Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov commit 84430d4232c36cb858564374f839d233fd6f623a Author: Daniel Borkmann Date: Sun Oct 21 02:09:27 2018 +0200 bpf, verifier: avoid retpoline for map push/pop/peek operation Extend prior work from 09772d92cd5a ("bpf: avoid retpoline for lookup/update/delete calls on maps") to also apply to the recently added map helpers that perform push/pop/peek operations so that the indirect call can be avoided. Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov commit ad38911dcdb6978a415db65b3e00e0f3fcd9edfc Author: Daniel Borkmann Date: Sun Oct 21 02:09:26 2018 +0200 bpf, verifier: remove unneeded flow key in check_helper_mem_access They PTR_TO_FLOW_KEYS is not used today to be passed into a helper as memory, so it can be removed from check_helper_mem_access(). Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov commit 4b5defdec398491c5b301a6255cdf468eedfb228 Author: Daniel Borkmann Date: Sun Oct 21 02:09:25 2018 +0200 bpf, verifier: reject xadd on flow key memory We should not enable xadd operation for flow key memory if not needed there anyway. There is no such issue as described in the commit f37a8cb84cce ("bpf: reject stores into ctx via st and xadd") since there's no context rewriter for flow keys today, but it also shouldn't become part of the user facing behavior to allow for it. After patch: 0: (79) r7 = *(u64 *)(r1 +144) 1: (b7) r3 = 4096 2: (db) lock *(u64 *)(r7 +0) += r3 BPF_XADD stores into R7 flow_keys is not allowed Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov commit 2a159c6f82381a458bc56e7e202b6bee57a2ccb7 Author: Daniel Borkmann Date: Sun Oct 21 02:09:24 2018 +0200 bpf, verifier: fix register type dump in xadd and st Using reg_type_str[insn->dst_reg] is incorrect since insn->dst_reg contains the register number but not the actual register type. Add a small reg_state() helper and use it to get to the type. Also fix up the test_verifier test cases that have an incorrect errstr. Fixes: 9d2be44a7f33 ("bpf: Reuse canonical string formatter for ctx errs") Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov commit c16ee04c9b305d57719344922c4d48379e206a79 Author: Daniel Borkmann Date: Sun Oct 21 02:09:23 2018 +0200 ulp: remove uid and user_visible members They are not used anymore and therefore should be removed. Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov commit 0400d65501930e6e99848572b3818914c3b94256 Author: Camelia Groza Date: Thu Sep 20 14:47:01 2018 +0300 powerpc/dts/fsl: t2080rdb: reorder the Cortina PHY XFI lanes According to the T2080RDB schematics, for the CS4315 PHY, the XFI 1 lane is connected to SFP 2 and the XFI 2 lane is connected to SFP 1. Change the device tree to reflect the correct PHY order and port association. Signed-off-by: Camelia Groza Signed-off-by: Scott Wood commit d459d853c2edc793135e4bfa4e345c758f1cc859 Author: Dennis Zhou Date: Sat Oct 20 14:56:12 2018 -0400 blkcg: reassociate bios when make_request() is called recursively When submitting a bio, multiple recursive calls to make_request() may occur. This causes the initial associate done in blkcg_bio_issue_check() to be incorrect and reference the prior request_queue. This introduces a helper to do reassociation when make_request() is recursively called. Fixes: a7b39b4e961c ("blkcg: always associate a bio with a blkg") Reported-by: Valdis Kletnieks Signed-off-by: Dennis Zhou Tested-by: Valdis Kletnieks Signed-off-by: Jens Axboe commit b2c3fa546705944e748666b474ffdaebaec0569f Author: Dennis Zhou Date: Sat Oct 20 14:56:11 2018 -0400 blkcg: fix edge case for blk_get_rl() under memory pressure It is possible for blkg creation to fail when in blk_get_rl(). In this situation, the fallback logic returns the nearest created blkg. There is however special handling for the request_list for the root blkcg. This fixes the missing edge case from the earlier series changing blk_get_rl(). Fixes: e2b0989954ae ("blkcg: cleanup and make blk_get_rl use blkg_lookup_create") Signed-off-by: Dennis Zhou Signed-off-by: Jens Axboe commit 2576b96757e481fb40f097517763ccf75f935037 Merge: 5032d079909d 84fbfe026aca Author: Daniel Borkmann Date: Sat Oct 20 21:37:12 2018 +0200 Merge branch 'bpf-msg-push-data' John Fastabend says: ==================== This series adds a new helper bpf_msg_push_data to be used by sk_msg programs. The helper can be used to insert extra bytes into the message that can then be used by the program as metadata tags among other things. The first patch adds the helper, second patch the libbpf support, and last patch updates test_sockmap to run msg_push_data tests. v2: rebase after queue map and in filter.c convert int -> u32 ==================== Signed-off-by: Daniel Borkmann commit 84fbfe026acaa6d91e2f71f1635992bf472e2496 Author: John Fastabend Date: Fri Oct 19 19:56:51 2018 -0700 bpf: test_sockmap add options to use msg_push_data Add options to run msg_push_data, this patch creates two more flags in test_sockmap that can be used to specify the offset and length of bytes to be added. The new options are --txmsg_start_push to specify where bytes should be inserted and --txmsg_end_push to specify how many bytes. This is analagous to the options that are used to pull data, --txmsg_start and --txmsg_end. In addition to adding the options tests are added to the test suit to run the tests similar to what was done for msg_pull_data. Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann commit f908d26b2c41d9a924371099c4979e4b5d385165 Author: John Fastabend Date: Fri Oct 19 19:56:50 2018 -0700 bpf: libbpf support for msg_push_data Add support for new bpf_msg_push_data in libbpf. Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann commit 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 Author: John Fastabend Date: Fri Oct 19 19:56:49 2018 -0700 bpf: sk_msg program helper bpf_msg_push_data This allows user to push data into a msg using sk_msg program types. The format is as follows, bpf_msg_push_data(msg, offset, len, flags) this will insert 'len' bytes at offset 'offset'. For example to prepend 10 bytes at the front of the message the user can, bpf_msg_push_data(msg, 0, 10, 0); This will invalidate data bounds so BPF user will have to then recheck data bounds after calling this. After this the msg size will have been updated and the user is free to write into the added bytes. We allow any offset/len as long as it is within the (data, data_end) range. However, a copy will be required if the ring is full and its possible for the helper to fail with ENOMEM or EINVAL errors which need to be handled by the BPF program. This can be used similar to XDP metadata to pass data between sk_msg layer and lower layers. Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann commit d92060bc69233a8175a0c2bfa0d2bce123cace2d Author: Florian Westphal Date: Sat Oct 20 12:25:27 2018 +0200 r8169: add support for Byte Queue Limits This patch is basically a resubmit of 1e918876853a ("r8169: add support for Byte Queue Limits") which was reverted later. The problems causing the revert seem to have been fixed in the meantime. Only change to the original patch is that the call to netdev_reset_queue was moved to rtl8169_tx_clear. The Tested-by refers to a system using the RTL8168evl chip version. Signed-off-by: Florian Westphal Signed-off-by: Heiner Kallweit Tested-by: Holger Hoffstätte Signed-off-by: David S. Miller commit 38caff5a445bf7cc6b312b9925320ae969b796c2 Author: Heiner Kallweit Date: Thu Oct 18 22:19:28 2018 +0200 r8169: handle all interrupt events in the hard irq handler Having a separate "slow event" handler isn't needed because all interrupt events trigger asynchronous activity. And in case of SYSErr we have bigger problems than performance anyway. This patch also allows to get rid of acking interrupt events in the NAPI poll callback. Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 342149c557e16d72aefa440143abc8560dc687cc Merge: a4efbaf62255 c614ca3f7476 Author: David S. Miller Date: Sat Oct 20 12:33:48 2018 -0700 Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next Johan Hedberg says: ==================== pull request: bluetooth-next 2018-10-20 Here's one more bluetooth-next pull request for the 4.20 kernel. - Added new USB ID for QCA_ROME controller - Added debug trace support from QCA wcn3990 controllers - Updated L2CAP to conform to latest Errata Service Release - Fix binding to non-removable BCM43430 devices Please let me know if there are any issues pulling. Thanks. ==================== Signed-off-by: David S. Miller commit a4efbaf6225577fd40940a4542d69bb5e79f88ad Merge: 4c16128b6271 af510ebd8913 Author: David S. Miller Date: Sat Oct 20 12:32:44 2018 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following patchset contains Netfilter updates for your net-next tree: 1) Use lockdep_is_held() in ipset_dereference_protected(), from Lance Roy. 2) Remove unused variable in cttimeout, from YueHaibing. 3) Add ttl option for nft_osf, from Fernando Fernandez Mancera. 4) Use xfrm family to deal with IPv6-in-IPv4 packets from nft_xfrm, from Florian Westphal. 5) Simplify xt_osf_match_packet(). 6) Missing ct helper alias definition in snmp_trap helper, from Taehee Yoo. 7) Remove unnecessary parameter in nf_flow_table_cleanup(), from Taehee Yoo. 8) Remove unused variable definitions in nft_{dup,fwd}, from Weongyo Jeong. 9) Remove empty net/netfilter/nfnetlink_log.h file, from Taehee Yoo. 10) Revert xt_quota updates remain option due to problems in the listing path for 32-bit arches, from Maze. ==================== Signed-off-by: David S. Miller commit e543b3a620296a18aaf0d66475b68d6a85e8fcd4 Author: Helge Deller Date: Fri Oct 19 22:13:49 2018 +0200 parisc: Retrieve and display the PDC PAT capabilities Signed-off-by: Helge Deller commit 4c5fe5db1ac6420ec9c0a62ab764572ef79472b3 Author: John David Anglin Date: Fri Oct 19 20:48:12 2018 -0400 parisc: Optimze cache flush algorithms The attached patch implements three optimizations: 1) Loops in flush_user_dcache_range_asm, flush_kernel_dcache_range_asm, purge_kernel_dcache_range_asm, flush_user_icache_range_asm, and flush_kernel_icache_range_asm are unrolled to reduce branch overhead. 2) The static branch prediction for cmpb instructions in pacache.S have been reviewed and the operand order adjusted where necessary. 3) For flush routines in cache.c, we purge rather flush when we have no context. The pdc instruction at level 0 is not required to write back dirty lines to memory. This provides a performance improvement over the fdc instruction if the feature is implemented. Version 2 adds alternative patching. The patch provides an average improvement of about 2%. Signed-off-by: John David Anglin Signed-off-by: Helge Deller commit 5a23237f14c5f35afbbf9d4a5bdfb2421a7af665 Author: John David Anglin Date: Fri Oct 19 20:33:29 2018 -0400 parisc: Remove pte_inserted define The attached change removes the pte_inserted from pgtable.h. As a result, we always flush the TLB entry when the associated page table entry is changed. This change doesn't impact performance signifcantly and it may catch some cases where the TLB needs flushing but wasn't. Signed-off-by: John David Anglin Signed-off-by: Helge Deller commit 663569db6476795c7955289529ea0154e3d768bf Merge: 7e4e95897663 1ce78ce09430 Author: Bjorn Helgaas Date: Sat Oct 20 11:45:56 2018 -0500 Merge branch 'remotes/lorenzo/pci/tools' - Convert pcitest build process to that used by other tools (iio, perf, etc) (Gustavo Pimentel) * remotes/lorenzo/pci/tools: tools: PCI: Change pcitest compiling process tools: PCI: Fix compilation warnings commit 7e4e95897663595323f3bbcf5b75d5bcaf5c1401 Merge: 4dd4d9963677 dc8af3a827df Author: Bjorn Helgaas Date: Sat Oct 20 11:45:55 2018 -0500 Merge branch 'remotes/lorenzo/pci/vmd' - Detach VMD resources after stopping root bus to prevent orphan resources (Jon Derrick) * remotes/lorenzo/pci/vmd: PCI: vmd: Detach resources after stopping root bus commit 4dd4d99636778ab610ad7ccb96a20b015991bdcf Merge: fc23af0cb1ef 031337ace2d1 Author: Bjorn Helgaas Date: Sat Oct 20 11:45:53 2018 -0500 Merge branch 'remotes/lorenzo/pci/mediatek' - Fix Mediatek unchecked return value from devm_pci_remap_iospace() (Gustavo A. R. Silva) - Fix Mediatek endpoint/port matching logic (Honghui Zhang) - Change Mediatek Root Port Class Code to PCI_CLASS_BRIDGE_PCI (Honghui Zhang) - Remove redundant Mediatek PM domain check (Honghui Zhang) - Convert Mediatek to pci_host_probe() (Honghui Zhang) - Fix Mediatek MSI enablement (Honghui Zhang) - Add Mediatek system PM support for MT2712 and MT7622 (Honghui Zhang) - Add Mediatek loadable module support (Honghui Zhang) * remotes/lorenzo/pci/mediatek: PCI: mediatek: Add loadable kernel module support PCI: mediatek: Add system PM support for MT2712 and MT7622 PCI: mediatek: Fixup MSI enablement logic by enabling MSI before clocks PCI: mediatek: Convert to use pci_host_probe() PCI: mediatek: Remove the redundant dev->pm_domain check PCI: mediatek: Fix class type for MT7622 to PCI_CLASS_BRIDGE_PCI PCI: mediatek: Fix mtk_pcie_find_port() endpoint/port matching logic PCI: mediatek: Fix unchecked return value commit fc23af0cb1efa4c5b0c7ecd226d827e4824a4dcf Merge: deab1f261cd3 261de72f0169 Author: Bjorn Helgaas Date: Sat Oct 20 11:45:51 2018 -0500 Merge branch 'remotes/lorenzo/pci/keystone' - Quirk Keystone K2G to limit MRRS to 256 (Kishon Vijay Abraham I) - Update Keystone to use MRRS quirk for host bridge instead of open coding (Kishon Vijay Abraham I) - Refactor Keystone link establishment (Kishon Vijay Abraham I) - Simplify and speed up Keystone link training (Kishon Vijay Abraham I) - Remove unused Keystone host_init argument (Kishon Vijay Abraham I) - Merge Keystone driver files into one (Kishon Vijay Abraham I) - Remove redundant Keystone platform_set_drvdata() (Kishon Vijay Abraham I) - Rename Keystone functions for uniformity (Kishon Vijay Abraham I) - Add Keystone device control module DT binding (Kishon Vijay Abraham I) - Use SYSCON API to get Keystone control module device IDs (Kishon Vijay Abraham I) - Clean up Keystone PHY handling (Kishon Vijay Abraham I) - Use runtime PM APIs to enable Keystone clock (Kishon Vijay Abraham I) - Clean up Keystone config space access checks (Kishon Vijay Abraham I) - Get Keystone outbound window count from DT (Kishon Vijay Abraham I) - Clean up Keystone outbound window configuration (Kishon Vijay Abraham I) - Clean up Keystone DBI setup (Kishon Vijay Abraham I) - Clean up Keystone ks_pcie_link_up() (Kishon Vijay Abraham I) - Fix Keystone IRQ status checking (Kishon Vijay Abraham I) - Add debug messages for all Keystone errors (Kishon Vijay Abraham I) - Clean up Keystone includes and macros (Kishon Vijay Abraham I) * remotes/lorenzo/pci/keystone: PCI: keystone: Cleanup macros defined in pci-keystone.c PCI: keystone: Reorder header file in alphabetical order PCI: keystone: Add debug error message for all errors PCI: keystone: Use ERR_IRQ_STATUS instead of ERR_IRQ_STATUS_RAW to get interrupt status PCI: keystone: Cleanup ks_pcie_link_up() PCI: keystone: Cleanup set_dbi_mode() and get_dbi_mode() PCI: keystone: Cleanup outbound window configuration PCI: keystone: Get number of outbound windows from DT PCI: keystone: Cleanup configuration space access PCI: keystone: Invoke runtime PM APIs to enable clock PCI: keystone: Cleanup PHY handling PCI: keystone: Use SYSCON APIs to get device ID from control module dt-bindings: PCI: keystone: Add bindings to get device control module PCI: keystone: Use uniform function naming convention PCI: keystone: Remove redundant platform_set_drvdata() invocation PCI: keystone: Merge pci-keystone-dw.c and pci-keystone.c PCI: keystone: Remove unused argument from ks_dw_pcie_host_init() PCI: keystone: Do not initiate link training multiple times PCI: keystone: Move dw_pcie_setup_rc() out of ks_pcie_establish_link() PCI: keystone: Use quirk to set MRRS for PCI host bridge PCI: keystone: Use quirk to limit MRRS for K2G commit deab1f261cd34ed1c0d9b6558c6ce90fd49a431e Merge: 525fde075039 4da6b4480766 Author: Bjorn Helgaas Date: Sat Oct 20 11:45:50 2018 -0500 Merge branch 'remotes/lorenzo/pci/iproc' - Remove iproc PAXC slot check to allow VF support (Jitendra Bhivare) * remotes/lorenzo/pci/iproc: PCI: iproc: Remove PAXC slot check to allow VF support commit 525fde0750394dd3874937361570764f6a368e33 Merge: b7c18dc06ad1 f4e833ba2a95 Author: Bjorn Helgaas Date: Sat Oct 20 11:45:49 2018 -0500 Merge branch 'remotes/lorenzo/pci/dwc' - Support 100MHz/200MHz refclocks for i.MX6 (Lucas Stach) - Add initial power management for i.MX7 (Leonard Crestez) - Add PME_Turn_Off support for i.MX7 (Leonard Crestez) - Fix qcom runtime power management error handling (Bjorn Andersson) - Update TI dra7xx unaligned access errata workaround for host mode as well as endpoint mode (Vignesh R) - Fix kirin section mismatch warning (Nathan Chancellor) * remotes/lorenzo/pci/dwc: PCI: imx: Add PME_Turn_Off support ARM: dts: imx7d: Add turnoff reset dt-bindings: imx6q-pcie: Add turnoff reset for imx7d reset: imx7: Add PCIE_CTRL_APPS_TURNOFF PCI: kirin: Fix section mismatch warning PCI: dwc: pci-dra7xx: Enable errata i870 for both EP and RC mode dt-bindings: PCI: dra7xx: Add bindings for unaligned access in host mode PCI: qcom: Fix error handling in runtime PM support PCI: imx: Initial imx7d pm support PCI: imx6: Support MPLL reconfiguration for 100MHz and 200MHz refclock commit b7c18dc06ad12059abc0961522d446553f8a755b Merge: 61ce5809570b 8a3ebd8de328 Author: Bjorn Helgaas Date: Sat Oct 20 11:45:47 2018 -0500 Merge branch 'remotes/lorenzo/pci/controller-misc' - Remove redundant controller tests for "device_type == pci" (Rob Herring) - Document R-Car E3 (R8A77990) bindings (Tho Vu) - Add device tree support for R-Car r8a7744 (Biju Das) - Drop unused mvebu PCIe capability code (Thomas Petazzoni) - Add shared PCI bridge emulation code (Thomas Petazzoni) - Convert mvebu to use shared PCI bridge emulation (Thomas Petazzoni) - Add aardvark Root Port emulation (Thomas Petazzoni) * remotes/lorenzo/pci/controller-misc: PCI: aardvark: Implement emulated root PCI bridge config space PCI: mvebu: Convert to PCI emulated bridge config space PCI: mvebu: Drop unused PCI express capability code PCI: Introduce PCI bridge emulated config space common logic dt-bindings: PCI: rcar: Add device tree support for r8a7744 dt-bindings: PCI: rcar: Add device tree support for r8a7744 DT: pci: rcar-pci: document R8A77990 bindings PCI: Remove unnecessary check of device_type == pci commit 61ce5809570b38710f08ebfcd44a5b067eeee77d Merge: 6aa0459e75b7 e81e36a96bb5 Author: Bjorn Helgaas Date: Sat Oct 20 11:45:45 2018 -0500 Merge branch 'remotes/lorenzo/pci/cadence' - Fix Cadence PHY handling during probe (Alan Douglas) - Signal Cadence Endpoint interrupts via AXI region 0 instead of last region (Alan Douglas) - Write Cadence Endpoint MSI interrupts with 32 bits of data (Alan Douglas) * remotes/lorenzo/pci/cadence: PCI: cadence: Write MSI data with 32bits PCI: cadence: Use AXI region 0 to signal interrupts from EP PCI: cadence: Correct probe behaviour when failing to get PHY commit 6aa0459e75b71eee94c91f414c45a2d724997154 Merge: eff81b6f7b1e 4f475e8e0a6d Author: Bjorn Helgaas Date: Sat Oct 20 11:45:44 2018 -0500 Merge branch 'pci/host-vmd' - Fix VMD AERSID quirk Device ID matching (Jon Derrick) * pci/host-vmd: x86/PCI: Apply VMD's AERSID fixup generically commit eff81b6f7b1ecad7e8cdf4f44b010b54ef438864 Merge: 1734715493e0 4c243716e77d Author: Bjorn Helgaas Date: Sat Oct 20 11:45:35 2018 -0500 Merge branch 'pci/virtualization' - Cache VF config space size to optimize enumeration of many VFs (KarimAllah Ahmed) - Remove unnecessary include (Bjorn Helgaas) * pci/virtualization: PCI/IOV: Remove unnecessary include of PCI/IOV: Use VF0 cached config space size for other VFs commit 1734715493e010d034ae8d65c9a228ee7ad24a08 Merge: 0af616639513 c6925093d0b2 Author: Bjorn Helgaas Date: Sat Oct 20 11:45:33 2018 -0500 Merge branch 'pci/peer-to-peer' - Add PCI support for peer-to-peer DMA (Logan Gunthorpe) - Add sysfs group for PCI peer-to-peer memory statistics (Logan Gunthorpe) - Add PCI peer-to-peer DMA scatterlist mapping interface (Logan Gunthorpe) - Add PCI configfs/sysfs helpers for use by peer-to-peer users (Logan Gunthorpe) - Add PCI peer-to-peer DMA driver writer's documentation (Logan Gunthorpe) - Add block layer flag to indicate driver support for PCI peer-to-peer DMA (Logan Gunthorpe) - Map Infiniband scatterlists for peer-to-peer DMA if they contain P2P memory (Logan Gunthorpe) - Register nvme-pci CMB buffer as PCI peer-to-peer memory (Logan Gunthorpe) - Add nvme-pci support for PCI peer-to-peer memory in requests (Logan Gunthorpe) - Use PCI peer-to-peer memory in nvme (Stephen Bates, Steve Wise, Christoph Hellwig, Logan Gunthorpe) * pci/peer-to-peer: nvmet: Optionally use PCI P2P memory nvmet: Introduce helper functions to allocate and free request SGLs nvme-pci: Add support for P2P memory in requests nvme-pci: Use PCI p2pmem subsystem to manage the CMB IB/core: Ensure we map P2P memory correctly in rdma_rw_ctx_[init|destroy]() block: Add PCI P2P flag for request queue PCI/P2PDMA: Add P2P DMA driver writer's documentation docs-rst: Add a new directory for PCI documentation PCI/P2PDMA: Introduce configfs/sysfs enable attribute helpers PCI/P2PDMA: Add PCI p2pmem DMA mappings to adjust the bus offset PCI/P2PDMA: Add sysfs group to display p2pmem stats PCI/P2PDMA: Support peer-to-peer memory commit 0af6166395130b87713550c84c9518332f27cc28 Merge: ee8360fdafac 4c1ef72e9b71 Author: Bjorn Helgaas Date: Sat Oct 20 11:45:31 2018 -0500 Merge branch 'pci/msi' - Avoid panic when drivers enable MSI/MSI-X twice (Tonghao Zhang) * pci/msi: PCI/MSI: Warn and return error if driver enables MSI/MSI-X twice commit ee8360fdafac54eefd0df69fbd99338896cf806b Merge: 20634dc361e1 fe73c23d7a09 Author: Bjorn Helgaas Date: Sat Oct 20 11:45:30 2018 -0500 Merge branch 'pci/misc' - Remove unused Netronome NFP32xx Device IDs (Jakub Kicinski) - Use bitmap_zalloc() for dma_alias_mask (Andy Shevchenko) - Add switch fall-through annotations (Gustavo A. R. Silva) - Remove unused Switchtec quirk variable (Joshua Abraham) - Fix pci.c kernel-doc warning (Randy Dunlap) - Remove trivial PCI wrappers for DMA APIs (Christoph Hellwig) - Add Intel GPU device IDs to spurious interrupt quirk (Bin Meng) - Run Switchtec DMA aliasing quirk only on NTB endpoints to avoid useless dmesg errors (Logan Gunthorpe) - Update Switchtec NTB documentation (Wesley Yung) - Remove redundant "default n" from Kconfig (Bartlomiej Zolnierkiewicz) * pci/misc: PCI: pcie: Remove redundant 'default n' from Kconfig NTB: switchtec_ntb: Update switchtec documentation with prerequisites for NTB PCI: Fix Switchtec DMA aliasing quirk dmesg noise PCI: Add macro for Switchtec quirk declarations PCI: Add Device IDs for Intel GPU "spurious interrupt" quirk PCI: Remove pci_set_dma_max_seg_size() PCI: Remove pci_set_dma_seg_boundary() PCI: Remove pci_unmap_addr() wrappers for DMA API PCI / ACPI: Mark expected switch fall-through PCI: Remove set but unused variable PCI: Fix pci.c kernel-doc parameter warning PCI: Allocate dma_alias_mask with bitmap_zalloc() PCI: Remove unused NFP32xx IDs commit 20634dc361e1c5fe2dae380a7d0a21ca7f32c4f7 Merge: de468b755464 e51cd9ce5dd3 Author: Bjorn Helgaas Date: Sat Oct 20 11:45:29 2018 -0500 Merge branch 'pci/hotplug' - Differentiate between pciehp surprise and safe removal (Lukas Wunner) - Remove unnecessary pciehp includes (Lukas Wunner) - Drop pciehp hotplug_slot_ops wrappers (Lukas Wunner) - Tolerate PCIe Slot Presence Detect being hardwired to zero to workaround broken hardware, e.g., the Wilocity switch/wireless device (Lukas Wunner) - Unify pciehp controller & slot structs (Lukas Wunner) - Constify hotplug_slot_ops (Lukas Wunner) - Drop hotplug_slot_info (Lukas Wunner) - Embed hotplug_slot struct into users instead of allocating it separately (Lukas Wunner) - Initialize PCIe port service drivers directly instead of relying on initcall ordering (Keith Busch) - Restore PCI config state after a slot reset (Keith Busch) - Save/restore DPC config state along with other PCI config state (Keith Busch) - Reference count devices during AER handling to avoid race issue with concurrent hot removal (Keith Busch) - If an Upstream Port reports ERR_FATAL, don't try to read the Port's config space because it is probably unreachable (Keith Busch) - During error handling, use slot-specific reset instead of secondary bus reset to avoid link up/down issues on hotplug ports (Keith Busch) - Restore previous AER/DPC handling that does not remove and re-enumerate devices on ERR_FATAL (Keith Busch) - Notify all drivers that may be affected by error recovery resets (Keith Busch) - Always generate error recovery uevents, even if a driver doesn't have error callbacks (Keith Busch) - Make PCIe link active reporting detection generic (Keith Busch) - Support D3cold in PCIe hierarchies during system sleep and runtime, including hotplug and Thunderbolt ports (Mika Westerberg) - Handle hpmemsize/hpiosize kernel parameters uniformly, whether slots are empty or occupied (Jon Derrick) - Remove duplicated include from pci/pcie/err.c and unused variable from cpqphp (YueHaibing) - Remove driver pci_cleanup_aer_uncorrect_error_status() calls (Oza Pawandeep) - Uninline PCI bus accessors for better ftracing (Keith Busch) - Remove unused AER Root Port .error_resume method (Keith Busch) - Use kfifo in AER instead of a local version (Keith Busch) - Use threaded IRQ in AER bottom half (Keith Busch) - Use managed resources in AER core (Keith Busch) - Reuse pcie_port_find_device() for AER injection (Keith Busch) - Abstract AER interrupt handling to disconnect error injection (Keith Busch) - Refactor AER injection callbacks to simplify future improvments (Keith Busch) * pci/hotplug: PCI/AER: Refactor error injection fallbacks PCI/AER: Abstract AER interrupt handling PCI/AER: Reuse existing pcie_port_find_device() interface PCI/AER: Use managed resource allocations PCI/AER: Use threaded IRQ for bottom half PCI/AER: Use kfifo_in_spinlocked() to insert locked elements PCI/AER: Use kfifo for tracking events instead of reimplementing it PCI/AER: Remove error source from AER struct aer_rpc PCI/AER: Remove unused aer_error_resume() PCI: Uninline PCI bus accessors for better ftracing PCI/AER: Remove pci_cleanup_aer_uncorrect_error_status() calls PCI: pnv_php: Use kmemdup() PCI: cpqphp: Remove set but not used variable 'physical_slot' PCI/ERR: Remove duplicated include from err.c PCI: Equalize hotplug memory and io for occupied and empty slots PCI / ACPI: Whitelist D3 for more PCIe hotplug ports ACPI / property: Allow multiple property compatible _DSD entries PCI/PME: Implement runtime PM callbacks PCI: pciehp: Implement runtime PM callbacks PCI/portdrv: Add runtime PM hooks for port service drivers PCI/portdrv: Resume upon exit from system suspend if left runtime suspended PCI: pciehp: Do not handle events if interrupts are masked PCI: pciehp: Disable hotplug interrupt during suspend PCI / ACPI: Enable wake automatically for power managed bridges PCI: Do not skip power-managed bridges in pci_enable_wake() PCI: Make link active reporting detection generic PCI: Unify device inaccessible PCI/ERR: Always report current recovery status for udev PCI/ERR: Simplify broadcast callouts PCI/ERR: Run error recovery callbacks for all affected devices PCI/ERR: Handle fatal error recovery PCI/ERR: Use slot reset if available PCI/AER: Don't read upstream ports below fatal errors PCI/AER: Take reference on error devices PCI/DPC: Save and restore config state PCI: portdrv: Restore PCI config state on slot reset PCI: portdrv: Initialize service drivers directly PCI: hotplug: Document TODOs PCI: hotplug: Embed hotplug_slot PCI: hotplug: Drop hotplug_slot_info PCI: hotplug: Constify hotplug_slot_ops PCI: pciehp: Reshuffle controller struct for clarity PCI: pciehp: Rename controller struct members for clarity PCI: pciehp: Unify controller and slot structs PCI: pciehp: Tolerate Presence Detect hardwired to zero PCI: pciehp: Drop hotplug_slot_ops wrappers PCI: pciehp: Drop unnecessary includes PCI: pciehp: Differentiate between surprise and safe removal PCI: Simplify disconnected marking commit de468b755464426c276df2daf1e54bcd64186020 Merge: b1801bf05964 d6112f8def51 Author: Bjorn Helgaas Date: Sat Oct 20 11:45:28 2018 -0500 Merge branch 'pci/enumeration' - Remove x86 and arm64 node-local allocation for host bridge structures (Punit Agrawal) - Pay attention to device-specific _PXM node values (Jonathan Cameron) - Support new Immediate Readiness bit (Felipe Balbi) * pci/enumeration: PCI: Add support for Immediate Readiness ACPI/PCI: Pay attention to device-specific _PXM node values x86/PCI: Remove node-local allocation when initialising host controller arm64: PCI: Remove node-local allocations when initialising host controller commit b1801bf05964321d79fbbeae96c8ab09da2e2e49 Merge: 7876320f8880 17c91487364f Author: Bjorn Helgaas Date: Sat Oct 20 11:45:27 2018 -0500 Merge branch 'pci/aspm' - Fix ASPM link_state teardown on removal (Lukas Wunner) - Fix misleading _OSC ASPM message (Sinan Kaya) - Make _OSC optional for PCI (Sinan Kaya) - Don't initialize ASPM link state when ACPI_FADT_NO_ASPM is set (Patrick Talbert) * pci/aspm: PCI/ASPM: Do not initialize link state when aspm_disabled is set PCI/ACPI: Allow _OSC presence to be optional for PCI PCI/ACPI: Correct error message for ASPM disabling PCI/ASPM: Fix link_state teardown on device removal commit 6e301a8e56e429d6b01d83d427a9e54fdbb0fa60 Author: Alexey Kardashevskiy Date: Mon Oct 15 21:08:41 2018 +1100 KVM: PPC: Optimize clearing TCEs for sparse tables The powernv platform maintains 2 TCE tables for VFIO - a hardware TCE table and a table with userspace addresses. These tables are radix trees, we allocate indirect levels when they are written to. Since the memory allocation is problematic in real mode, we have 2 accessors to the entries: - for virtual mode: it allocates the memory and it is always expected to return non-NULL; - fr real mode: it does not allocate and can return NULL. Also, DMA windows can span to up to 55 bits of the address space and since we never have this much RAM, such windows are sparse. However currently the SPAPR TCE IOMMU driver walks through all TCEs to unpin DMA memory. Since we maintain a userspace addresses table for VFIO which is a mirror of the hardware table, we can use it to know which parts of the DMA window have not been mapped and skip these so does this patch. The bare metal systems do not have this problem as they use a bypass mode of a PHB which maps RAM directly. This helps a lot with sparse DMA windows, reducing the shutdown time from about 3 minutes per 1 billion TCEs to a few seconds for 32GB sparse guest. Just skipping the last level seems to be good enough. As non-allocating accessor is used now in virtual mode as well, rename it from IOMMU_TABLE_USERSPACE_ENTRY_RM (real mode) to _RO (read only). Signed-off-by: Alexey Kardashevskiy Signed-off-by: Paul Mackerras commit 4c16128b6271e70c8743178e90cccee147858503 Author: Eric Dumazet Date: Fri Oct 19 19:11:26 2018 -0700 net: loopback: clear skb->tstamp before netif_rx() At least UDP / TCP stacks can now cook skbs with a tstamp using MONOTONIC base (or arbitrary values with SCM_TXTIME) Since loopback driver does not call (directly or indirectly) skb_scrub_packet(), we need to clear skb->tstamp so that net_timestamp_check() can eventually resample the time, using ktime_get_real(). Fixes: 80b14dee2bea ("net: Add a new socket option for a future transmit time.") Fixes: fb420d5d91c1 ("tcp/fq: move back to CLOCK_MONOTONIC") Signed-off-by: Eric Dumazet Cc: Willem de Bruijn Cc: Soheil Hassas Yeganeh Acked-by: Soheil Hassas Yeganeh Signed-off-by: David S. Miller commit daf00ae71dad8aa05965713c62558aeebf2df48e Author: Christophe Leroy Date: Sat Oct 13 09:16:22 2018 +0000 powerpc/traps: restore recoverability of machine_check interrupts commit b96672dd840f ("powerpc: Machine check interrupt is a non- maskable interrupt") added a call to nmi_enter() at the beginning of machine check restart exception handler. Due to that, in_interrupt() always returns true regardless of the state before entering the exception, and die() panics even when the system was not already in interrupt. This patch calls nmi_exit() before calling die() in order to restore the interrupt state we had before calling nmi_enter() Fixes: b96672dd840f ("powerpc: Machine check interrupt is a non-maskable interrupt") Signed-off-by: Christophe Leroy Reviewed-by: Nicholas Piggin Signed-off-by: Michael Ellerman commit b851ba02a6f3075f0f99c60c4bc30a4af80cf428 Author: Nicholas Piggin Date: Wed Aug 29 21:56:56 2018 +1000 powerpc/64/module: REL32 relocation range check The recent module relocation overflow crash demonstrated that we have no range checking on REL32 relative relocations. This patch implements a basic check, the same kernel that previously oopsed and rebooted now continues with some of these errors when loading the module: module_64: x_tables: REL32 527703503449812 out of range! Possibly other relocations (ADDR32, REL16, TOC16, etc.) should also have overflow checks. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman commit dd76ff5af35350fd6d5bb5b069e73b6017f66893 Author: Nicholas Piggin Date: Tue Aug 28 18:11:27 2018 +1000 powerpc/64s/radix: Fix radix__flush_tlb_collapsed_pmd double flushing pmd Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman commit b7683fc66eba91674e52c30f4d8e596bfb5cbcf4 Author: Michael Ellerman Date: Tue Jul 24 15:53:22 2018 +1000 selftests/powerpc: Add a test of wild bctr This tests that a bctr (Branch to counter and link), ie. a function call, to a wildly out-of-bounds address is handled correctly. Some old kernel versions didn't handle it correctly, see eg: "powerpc/slb: Force a full SLB flush when we insert for a bad EA" https://lists.ozlabs.org/pipermail/linuxppc-dev/2017-April/157397.html Signed-off-by: Michael Ellerman commit 0d923962ab69c27cca664a2d535e90ef655110ca Author: Michael Ellerman Date: Wed Aug 15 21:29:45 2018 +1000 powerpc/mm: Fix page table dump to work on Radix When we're running on Book3S with the Radix MMU enabled the page table dump currently prints the wrong addresses because it uses the wrong start address. Fix it to use PAGE_OFFSET rather than KERN_VIRT_START. Signed-off-by: Michael Ellerman commit afb6d0647fd250a068efd985987b5ff2c0d1b853 Author: Michael Ellerman Date: Wed Oct 17 23:53:38 2018 +1100 powerpc/mm/radix: Display if mappings are exec or not At boot we print the ranges we've mapped for the linear mapping and what page size we've used. Also track whether the range is mapped executable or not and display that as well. Signed-off-by: Michael Ellerman commit 232aa407633cef2b43806c1603fc8689aecf826c Author: Michael Ellerman Date: Tue Aug 14 22:37:32 2018 +1000 powerpc/mm/radix: Simplify split mapping logic If we look closely at the logic in create_physical_mapping(), when we're doing STRICT_KERNEL_RWX, we do the following steps: - determine the gap from where we are to the end of the range - choose an appropriate mapping_size based on the gap - check if that mapping_size would overlap the __init_begin boundary, and if not choose an appropriate mapping_size We can simplify the logic by taking the __init_begin boundary into account when we calculate the initial gap. So add a next_boundary() function which tells us what the next boundary is, either the __init_begin boundary or end. In future we can add more boundaries. Signed-off-by: Michael Ellerman commit 57306c663d53f2e4fd856950703dc6bcfc98f7cb Author: Michael Ellerman Date: Tue Aug 14 22:01:44 2018 +1000 powerpc/mm/radix: Remove the retry in the split mapping logic When we have CONFIG_STRICT_KERNEL_RWX enabled, we want to split the linear mapping at the text/data boundary so we can map the kernel text read only. The current logic uses a goto inside the for loop, which works, but is hard to reason about. When we hit the goto retry case we set max_mapping_size to PMD_SIZE and go back to the start. Setting max_mapping_size means we skip the PUD case and go to the PMD case. We know we will pass the alignment and gap checks because the only reason we are there is we hit the goto retry, and that is guarded by mapping_size == PUD_SIZE, which means addr is PUD aligned and gap is greater or equal to PUD_SIZE. So the only part of the check that can fail is the mmu_psize_defs check for the 2M page size. If we just duplicate that check we can avoid the goto, and we get the same result. Signed-off-by: Michael Ellerman commit 81d1b54dec95209ab5e5be2cf37182885f998753 Author: Michael Ellerman Date: Tue Aug 14 21:05:20 2018 +1000 powerpc/mm/radix: Fix small page at boundary when splitting When we have CONFIG_STRICT_KERNEL_RWX enabled, we want to split the linear mapping at the text/data boundary so we can map the kernel text read only. Currently we always use a small page at the text/data boundary, even when that's not necessary: Mapped 0x0000000000000000-0x0000000000e00000 with 2.00 MiB pages Mapped 0x0000000000e00000-0x0000000001000000 with 64.0 KiB pages Mapped 0x0000000001000000-0x0000000040000000 with 2.00 MiB pages This is because the check that the mapping crosses the __init_begin boundary is too strict, it also returns true when we map exactly up to the boundary. So fix it to check that the mapping would actually map past __init_begin, and with that we see: Mapped 0x0000000000000000-0x0000000040000000 with 2.00 MiB pages Mapped 0x0000000040000000-0x0000000100000000 with 1.00 GiB pages Signed-off-by: Michael Ellerman commit 3b5657ed5b4e27ccf593a41ff3c5aa27dae8df18 Author: Michael Ellerman Date: Tue Aug 14 20:48:22 2018 +1000 powerpc/mm/radix: Fix overuse of small pages in splitting logic When we have CONFIG_STRICT_KERNEL_RWX enabled, we want to split the linear mapping at the text/data boundary so we can map the kernel text read only. But the current logic uses small pages for the entire text section, regardless of whether a larger page size would fit. eg. with the boundary at 16M we could use 2M pages, but instead we use 64K pages up to the 16M boundary: Mapped 0x0000000000000000-0x0000000001000000 with 64.0 KiB pages Mapped 0x0000000001000000-0x0000000040000000 with 2.00 MiB pages Mapped 0x0000000040000000-0x0000000100000000 with 1.00 GiB pages This is because the test is checking if addr is < __init_begin and addr + mapping_size is >= _stext. But that is true for all pages between _stext and __init_begin. Instead what we want to check is if we are crossing the text/data boundary, which is at __init_begin. With that fixed we see: Mapped 0x0000000000000000-0x0000000000e00000 with 2.00 MiB pages Mapped 0x0000000000e00000-0x0000000001000000 with 64.0 KiB pages Mapped 0x0000000001000000-0x0000000040000000 with 2.00 MiB pages Mapped 0x0000000040000000-0x0000000100000000 with 1.00 GiB pages ie. we're correctly using 2MB pages below __init_begin, but we still drop down to 64K pages unnecessarily at the boundary. Signed-off-by: Michael Ellerman commit 5c6499b7041b43807dfaeda28aa87fc0e62558f7 Author: Michael Ellerman Date: Fri Aug 10 22:29:26 2018 +1000 powerpc/mm/radix: Fix off-by-one in split mapping logic When we have CONFIG_STRICT_KERNEL_RWX enabled, we try to split the kernel linear (1:1) mapping so that the kernel text is in a separate page to kernel data, so we can mark the former read-only. We could achieve that just by always using 64K pages for the linear mapping, but we try to be smarter. Instead we use huge pages when possible, and only switch to smaller pages when necessary. However we have an off-by-one bug in that logic, which causes us to calculate the wrong boundary between text and data. For example with the end of the kernel text at 16M we see: radix-mmu: Mapped 0x0000000000000000-0x0000000001200000 with 64.0 KiB pages radix-mmu: Mapped 0x0000000001200000-0x0000000040000000 with 2.00 MiB pages radix-mmu: Mapped 0x0000000040000000-0x0000000100000000 with 1.00 GiB pages ie. we mapped from 0 to 18M with 64K pages, even though the boundary between text and data is at 16M. With the fix we see we're correctly hitting the 16M boundary: radix-mmu: Mapped 0x0000000000000000-0x0000000001000000 with 64.0 KiB pages radix-mmu: Mapped 0x0000000001000000-0x0000000040000000 with 2.00 MiB pages radix-mmu: Mapped 0x0000000040000000-0x0000000100000000 with 1.00 GiB pages Signed-off-by: Michael Ellerman commit 67361cf80712867329a9cd3ff0e3171545cfc867 Author: Naveen N. Rao Date: Wed Oct 17 01:55:00 2018 +0530 powerpc/ftrace: Handle large kernel configs Currently, we expect to be able to reach ftrace_caller() from all ftrace-enabled functions through a single relative branch. With large kernel configs, we see functions outside of 32MB of ftrace_caller() causing ftrace_init() to bail. In such configurations, gcc/ld emits two types of trampolines for mcount(): 1. A long_branch, which has a single branch to mcount() for functions that are one hop away from mcount(): c0000000019e8544 <00031b56.long_branch._mcount>: c0000000019e8544: 4a 69 3f ac b c00000000007c4f0 <._mcount> 2. A plt_branch, for functions that are farther away from mcount(): c0000000051f33f8 <0008ba04.plt_branch._mcount>: c0000000051f33f8: 3d 82 ff a4 addis r12,r2,-92 c0000000051f33fc: e9 8c 04 20 ld r12,1056(r12) c0000000051f3400: 7d 89 03 a6 mtctr r12 c0000000051f3404: 4e 80 04 20 bctr We can reuse those trampolines for ftrace if we can have those trampolines go to ftrace_caller() instead. However, with ABIv2, we cannot depend on r2 being valid. As such, we use only the long_branch trampolines by patching those to instead branch to ftrace_caller or ftrace_regs_caller. In addition, we add additional trampolines around .text and .init.text to catch locations that are covered by the plt branches. This allows ftrace to work with most large kernel configurations. For now, we always patch the trampolines to go to ftrace_regs_caller, which is slightly inefficient. This can be optimized further at a later point. Signed-off-by: Naveen N. Rao Signed-off-by: Michael Ellerman commit dd0e144a632bcf2b5a6f04e2628e32b16d499277 Author: Aneesh Kumar K.V Date: Sat Oct 13 22:18:15 2018 +0530 powerpc/mm: Fix WARN_ON with THP NUMA migration WARNING: CPU: 12 PID: 4322 at /arch/powerpc/mm/pgtable-book3s64.c:76 set_pmd_at+0x4c/0x2b0 Modules linked in: CPU: 12 PID: 4322 Comm: qemu-system-ppc Tainted: G W 4.19.0-rc3-00758-g8f0c636b0542 #36 NIP: c0000000000872fc LR: c000000000484eec CTR: 0000000000000000 REGS: c000003fba876fe0 TRAP: 0700 Tainted: G W (4.19.0-rc3-00758-g8f0c636b0542) MSR: 900000010282b033 CR: 24282884 XER: 00000000 CFAR: c000000000484ee8 IRQMASK: 0 GPR00: c000000000484eec c000003fba877268 c000000001f0ec00 c000003fbd229f80 GPR04: 00007c8fe8e00000 c000003f864c5a38 860300853e0000c0 0000000000000080 GPR08: 0000000080000000 0000000000000001 0401000000000080 0000000000000001 GPR12: 0000000000002000 c000003fffff5400 c000003fce292000 00007c9024570000 GPR16: 0000000000000000 0000000000ffffff 0000000000000001 c000000001885950 GPR20: 0000000000000000 001ffffc0004807c 0000000000000008 c000000001f49d05 GPR24: 00007c8fe8e00000 c0000000020f2468 ffffffffffffffff c000003fcd33b090 GPR28: 00007c8fe8e00000 c000003fbd229f80 c000003f864c5a38 860300853e0000c0 NIP [c0000000000872fc] set_pmd_at+0x4c/0x2b0 LR [c000000000484eec] do_huge_pmd_numa_page+0xb1c/0xc20 Call Trace: [c000003fba877268] [c00000000045931c] mpol_misplaced+0x1bc/0x230 (unreliable) [c000003fba8772c8] [c000000000484eec] do_huge_pmd_numa_page+0xb1c/0xc20 [c000003fba877398] [c00000000040d344] __handle_mm_fault+0x5e4/0x2300 [c000003fba8774d8] [c00000000040f400] handle_mm_fault+0x3a0/0x420 [c000003fba877528] [c0000000003ff6f4] __get_user_pages+0x2e4/0x560 [c000003fba877628] [c000000000400314] get_user_pages_unlocked+0x104/0x2a0 [c000003fba8776c8] [c000000000118f44] __gfn_to_pfn_memslot+0x284/0x6a0 [c000003fba877748] [c0000000001463a0] kvmppc_book3s_radix_page_fault+0x360/0x12d0 [c000003fba877838] [c000000000142228] kvmppc_book3s_hv_page_fault+0x48/0x1300 [c000003fba877988] [c00000000013dc08] kvmppc_vcpu_run_hv+0x1808/0x1b50 [c000003fba877af8] [c000000000126b44] kvmppc_vcpu_run+0x34/0x50 [c000003fba877b18] [c000000000123268] kvm_arch_vcpu_ioctl_run+0x288/0x2d0 [c000003fba877b98] [c00000000011253c] kvm_vcpu_ioctl+0x1fc/0x8c0 [c000003fba877d08] [c0000000004e9b24] do_vfs_ioctl+0xa44/0xae0 [c000003fba877db8] [c0000000004e9c44] ksys_ioctl+0x84/0xf0 [c000003fba877e08] [c0000000004e9cd8] sys_ioctl+0x28/0x80 We removed the pte_protnone check earlier with the understanding that we mark the pte invalid before the set_pte/set_pmd usage. But the huge pmd autonuma still use the set_pmd_at directly. This is ok because a protnone pte won't have translation cache in TLB. Fixes: da7ad366b497 ("powerpc/mm/book3s: Update pmd_present to look at _PAGE_PRESENT bit") Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman commit d8a2fe29d3c97038c8efcc328d5e7940c5310565 Author: Michael Ellerman Date: Fri Oct 19 00:11:33 2018 +1100 selftests/powerpc: Fix out-of-tree build errors Some of our Makefiles don't do the right thing when building the selftests with O=, fix them up. Signed-off-by: Michael Ellerman commit 51eeef9e135ac00cf706fad1a3bde775ca578462 Author: Christophe Leroy Date: Thu Aug 2 07:54:01 2018 +0000 powerpc/time: no steal_time when CONFIG_PPC_SPLPAR is not selected If CONFIG_PPC_SPLPAR is not selected, steal_time will always be NUL, so accounting it is pointless Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit abcff86df2d2ec0a0ca9470fa5d2a184af18928a Author: Christophe Leroy Date: Thu Aug 2 07:53:59 2018 +0000 powerpc/time: Only set CONFIG_ARCH_HAS_SCALED_CPUTIME on PPC64 scaled cputime is only meaningfull when the processor has SPURR and/or PURR, which means only on PPC64. Removing it on PPC32 significantly reduces the size of vtime_account_system() and vtime_account_idle() on an 8xx: Before: 00000000 l F .text 000000a8 vtime_delta 00000280 g F .text 0000010c vtime_account_system 0000038c g F .text 00000048 vtime_account_idle After: (vtime_delta gets inlined inside the two functions) 000001d8 g F .text 000000a0 vtime_account_system 00000278 g F .text 00000038 vtime_account_idle In terms of performance, we also get approximatly 7% improvement on task switch. The following small benchmark app is run with perf stat: void *thread(void *arg) { int i; for (i = 0; i < atoi((char*)arg); i++) pthread_yield(); } int main(int argc, char **argv) { pthread_t th1, th2; pthread_create(&th1, NULL, thread, argv[1]); pthread_create(&th2, NULL, thread, argv[1]); pthread_join(th1, NULL); pthread_join(th2, NULL); return 0; } Before the patch: Performance counter stats for 'chrt -f 98 ./sched 100000' (50 runs): 8228.476465 task-clock (msec) # 0.954 CPUs utilized ( +- 0.23% ) 200004 context-switches # 0.024 M/sec ( +- 0.00% ) After the patch: Performance counter stats for 'chrt -f 98 ./sched 100000' (50 runs): 7649.070444 task-clock (msec) # 0.955 CPUs utilized ( +- 0.27% ) 200004 context-switches # 0.026 M/sec ( +- 0.00% ) Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit b38a181c11d0b5e84b40732dbb06cc9d68140d60 Author: Christophe Leroy Date: Thu Aug 2 07:53:57 2018 +0000 powerpc/time: isolate scaled cputime accounting in dedicated functions. scaled cputime is only meaningfull when the processor has SPURR and/or PURR, which means only on PPC64. In preparation of the following patch that will remove CONFIG_ARCH_HAS_SCALED_CPUTIME on PPC32, this patch moves all scaled cputing accounting logic into dedicated functions. This patch doesn't change any functionality. It's only code reorganisation. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit fb978ca207743badfe7efd9eebe68bcbb4969f79 Author: Christophe Leroy Date: Tue Sep 18 09:26:03 2018 +0000 powerpc/kgdb: add kgdb_arch_set/remove_breakpoint() Generic implementation fails to remove breakpoints after init when CONFIG_STRICT_KERNEL_RWX is selected: [ 13.251285] KGDB: BP remove failed: c001c338 [ 13.259587] kgdbts: ERROR PUT: end of test buffer on 'do_fork_test' line 8 expected OK got $E14#aa [ 13.268969] KGDB: re-enter exception: ALL breakpoints killed [ 13.275099] CPU: 0 PID: 1 Comm: init Not tainted 4.18.0-g82bbb913ffd8 #860 [ 13.282836] Call Trace: [ 13.285313] [c60e1ba0] [c0080ef0] kgdb_handle_exception+0x6f4/0x720 (unreliable) [ 13.292618] [c60e1c30] [c000e97c] kgdb_handle_breakpoint+0x3c/0x98 [ 13.298709] [c60e1c40] [c000af54] program_check_exception+0x104/0x700 [ 13.305083] [c60e1c60] [c000e45c] ret_from_except_full+0x0/0x4 [ 13.310845] [c60e1d20] [c02a22ac] run_simple_test+0x2b4/0x2d4 [ 13.316532] [c60e1d30] [c0081698] put_packet+0xb8/0x158 [ 13.321694] [c60e1d60] [c00820b4] gdb_serial_stub+0x230/0xc4c [ 13.327374] [c60e1dc0] [c0080af8] kgdb_handle_exception+0x2fc/0x720 [ 13.333573] [c60e1e50] [c000e928] kgdb_singlestep+0xb4/0xcc [ 13.339068] [c60e1e70] [c000ae1c] single_step_exception+0x90/0xac [ 13.345100] [c60e1e80] [c000e45c] ret_from_except_full+0x0/0x4 [ 13.350865] [c60e1f40] [c000e11c] ret_from_syscall+0x0/0x38 [ 13.356346] Kernel panic - not syncing: Recursive entry to debugger This patch creates powerpc specific version of kgdb_arch_set_breakpoint() and kgdb_arch_remove_breakpoint() using patch_instruction() Fixes: 1e0fc9d1eb2b ("powerpc/Kconfig: Enable STRICT_KERNEL_RWX for some configs") Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 6beb3381b12793726783a5e9428250743659c6cf Author: Christophe Leroy Date: Mon Aug 27 08:27:27 2018 +0000 powerpc/sysdev/ipic: check primary_ipic NULL pointer before using it ipic_get_mcp_status() is used by targets implementing NMI watchdog in target specific machine check handler in order to known whether a machine check results from a watchdog NMI reset. In case of very early machine check, primary_ipic pointer might not have been set yet, so ipic_get_mcp_status() needs to check it for nullity before using it. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 37e9c674e7e6f445e12cb1151017bd4bacdd1e2d Author: Christophe Leroy Date: Thu Aug 2 09:25:55 2018 +0000 powerpc/mm: fix always true/false warning in slice.c This patch fixes the following warnings (obtained with make W=1). arch/powerpc/mm/slice.c: In function 'slice_range_to_mask': arch/powerpc/mm/slice.c:73:12: error: comparison is always true due to limited range of data type [-Werror=type-limits] if (start < SLICE_LOW_TOP) { ^ arch/powerpc/mm/slice.c:81:20: error: comparison is always false due to limited range of data type [-Werror=type-limits] if ((start + len) > SLICE_LOW_TOP) { ^ arch/powerpc/mm/slice.c: In function 'slice_mask_for_free': arch/powerpc/mm/slice.c:136:17: error: comparison is always true due to limited range of data type [-Werror=type-limits] if (high_limit <= SLICE_LOW_TOP) ^ arch/powerpc/mm/slice.c: In function 'slice_check_range_fits': arch/powerpc/mm/slice.c:185:12: error: comparison is always true due to limited range of data type [-Werror=type-limits] if (start < SLICE_LOW_TOP) { ^ arch/powerpc/mm/slice.c:195:39: error: comparison is always false due to limited range of data type [-Werror=type-limits] if (SLICE_NUM_HIGH && ((start + len) > SLICE_LOW_TOP)) { ^ arch/powerpc/mm/slice.c: In function 'slice_scan_available': arch/powerpc/mm/slice.c:306:11: error: comparison is always true due to limited range of data type [-Werror=type-limits] if (addr < SLICE_LOW_TOP) { ^ arch/powerpc/mm/slice.c: In function 'get_slice_psize': arch/powerpc/mm/slice.c:709:11: error: comparison is always true due to limited range of data type [-Werror=type-limits] if (addr < SLICE_LOW_TOP) { ^ Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit aa5456abdc20568f5da348209148a9c75a32468a Author: Christophe Leroy Date: Fri Jun 22 13:49:48 2018 +0000 powerpc/mm: fix missing prototypes in slice.c This patch fixes the following warnings (obtained with make W=1). arch/powerpc/mm/slice.c: At top level: arch/powerpc/mm/slice.c:682:15: error: no previous prototype for 'arch_get_unmapped_area' [-Werror=missing-prototypes] unsigned long arch_get_unmapped_area(struct file *filp, ^ arch/powerpc/mm/slice.c:692:15: error: no previous prototype for 'arch_get_unmapped_area_topdown' [-Werror=missing-prototypes] unsigned long arch_get_unmapped_area_topdown(struct file *filp, ^ Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 8114c36ea6486aba2269d0590c5d553108ee9558 Author: Christophe Leroy Date: Wed Mar 21 15:17:00 2018 +0100 powerpc/mm: Trace tlbia instruction Add a trace point for tlbia (Translation Lookaside Buffer Invalidate All) instruction. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit cf4a6085151ae3f4e78dd91981833e65aaae8bc6 Author: Christophe Leroy Date: Wed Mar 21 15:16:58 2018 +0100 powerpc/mm: Add missing tracepoint for tlbie commit 0428491cba927 ("powerpc/mm: Trace tlbie(l) instructions") added tracepoints for tlbie calls, but _tlbil_va() was forgotten Fixes: 0428491cba927 ("powerpc/mm: Trace tlbie(l) instructions") Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 3ff38e1874863827374b02b4f31c73faa3744e1c Author: Christophe Leroy Date: Mon Oct 15 06:37:41 2018 +0000 powerpc/book3s64: fix dump_linuxpagetables "present" flag Since commit bd0dbb73e013 ("powerpc/mm/books3s: Add new pte bit to mark pte temporarily invalid."), _PAGE_PRESENT doesn't mean exactly that a page is present. A page is also considered preset when _PAGE_INVALID is set. This patch changes the meaning of "present" and adds a status "valid" associated to the _PAGE_PRESENT flag. Fixes: bd0dbb73e013 ("powerpc/mm/books3s: Add new pte bit to mark pte temporarily invalid.") Signed-off-by: Christophe Leroy Reviewed-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman commit c6c26fb55e8e4b3fc376be5611685990a17de27a Author: Aravinda Prasad Date: Tue Oct 16 17:20:05 2018 +0530 powerpc/pseries: Export raw per-CPU VPA data via debugfs This patch exports the raw per-CPU VPA data via debugfs. A per-CPU file is created which exports the VPA data of that CPU to help debug some of the VPA related issues or to analyze the per-CPU VPA related statistics. v3: Removed offline CPU check. v2: Included offline CPU check and other review comments. Signed-off-by: Aravinda Prasad Signed-off-by: Michael Ellerman commit d2bf793237b3aa9c4275a466eef3893eef593691 Author: Naveen N. Rao Date: Mon May 21 20:43:57 2018 +0530 selftests/powerpc: Add test to verify rfi flush across a system call This adds a test to verify proper functioning of the rfi flush capability implemented to mitigate meltdown. The test works by measuring the number of L1d cache misses encountered while loading data from memory. Across a system call, since the L1d cache is flushed when rfi_flush is enabled, the number of cache misses is expected to be relative to the number of cachelines corresponding to the data being loaded. The current system setting is reflected via powerpc/rfi_flush under debugfs (assumed to be /sys/kernel/debug/). This test verifies the expected result with rfi_flush enabled as well as when it is disabled. Signed-off-by: Anton Blanchard Signed-off-by: Michael Ellerman Signed-off-by: Naveen N. Rao [mpe: Add SPDX tags, clang format, skip if the debugfs is missing, use __u64 and SANE_USERSPACE_TYPES to avoid printf() build errors.] Signed-off-by: Michael Ellerman commit db3848515aff369404c31ef5a63699799913518f Author: Naveen N. Rao Date: Mon May 21 20:43:56 2018 +0530 selftests/powerpc: Move UCONTEXT_NIA() into utils.h ... so that it can be used by others. Signed-off-by: Naveen N. Rao Signed-off-by: Michael Ellerman commit 59fe7eaf3598a89cbcd72e645b1d08afd76f7b29 Author: Naveen N. Rao Date: Tue May 29 12:21:00 2018 +0530 powerpc64/module elfv1: Set opd addresses after module relocation module_frob_arch_sections() is called before the module is moved to its final location. The function descriptor section addresses we are setting here are thus invalid. Fix this by processing opd section during module_finalize() Fixes: 5633e85b2c313 ("powerpc64: Add .opd based function descriptor dereference") Cc: stable@vger.kernel.org # v4.16 Signed-off-by: Naveen N. Rao Signed-off-by: Michael Ellerman commit 7cd01b08d35f1b7d55686ed8cd57c94d3406ec8f Author: Naveen N. Rao Date: Thu Jun 7 15:22:02 2018 +0530 powerpc: Add support for function error injection We implement regs_set_return_value() and override_function_with_return() for this purpose. On powerpc, a return from a function (blr) just branches to the location contained in the link register. So, we can just update pt_regs rather than redirecting execution to a dummy function that returns. Signed-off-by: Naveen N. Rao Reviewed-by: Samuel Mendoza-Jonas Signed-off-by: Michael Ellerman commit b5b4185cfb61485e34c674c2a524d71531dc52e5 Author: Vladimir Zapolskiy Date: Fri Oct 19 02:25:11 2018 +0300 net: ethernet: lpc_eth: add device and device node local variables Trivial non-functional change added to simplify getting multiple references to device pointer in lpc_eth_drv_probe(). Signed-off-by: Vladimir Zapolskiy Signed-off-by: David S. Miller commit 081a1b123c4dfea09562bf5f66f7c2ae20b554a3 Author: Vladimir Zapolskiy Date: Fri Oct 19 02:06:53 2018 +0300 net: ethernet: lpc_eth: remove unused local variable A trivial change which removes an unused local variable, the issue is reported as a compile time warning: drivers/net/ethernet/nxp/lpc_eth.c: In function 'lpc_eth_drv_probe': drivers/net/ethernet/nxp/lpc_eth.c:1250:21: warning: variable 'phydev' set but not used [-Wunused-but-set-variable] struct phy_device *phydev; ^~~~~~ Signed-off-by: Vladimir Zapolskiy Signed-off-by: David S. Miller commit 643d813a0efd7e6fd78b49f69643af66731e05c8 Author: Vladimir Zapolskiy Date: Fri Oct 19 01:58:41 2018 +0300 net: ethernet: lpc_eth: remove CONFIG_OF guard from the driver The MAC controller device is available on NXP LPC32xx platform only, and the LPC32xx platform supports OF builds only, so additional checks in the device driver are not needed. Signed-off-by: Vladimir Zapolskiy Signed-off-by: David S. Miller commit 1d9482092d248272d8279450717b426b2a4fea0f Author: Vladimir Zapolskiy Date: Fri Oct 19 01:53:25 2018 +0300 net: ethernet: lpc_eth: clean up the list of included headers The change removes all unnecessary included headers from the driver source code, the remaining list is sorted in alphabetical order. Signed-off-by: Vladimir Zapolskiy Signed-off-by: David S. Miller commit c8baae840fd1d5f871b674e7f99e9fcc405c910e Merge: c9fbd71f7309 806700bab41e Author: David S. Miller Date: Fri Oct 19 17:02:24 2018 -0700 Merge branch 'Microchip-Technology-KSZ9131' Yuiko Oshino says: ==================== Add support for Microchip Technology KSZ9131 10/100/1000 Ethernet PHY This is the initial driver for Microchip KSZ9131 10/100/1000 Ethernet PHY v3: - KSZ9131 uses picosecond units for values of devicetree properties. - rewrite micrel.c and micrel-ksz90x1.txt to use the picosecond values. v2: - Creating a series from two related patches. ==================== Signed-off-by: David S. Miller commit 806700bab41e9297c6ace1d1d0cabd77b020ad72 Author: Yuiko Oshino Date: Thu Oct 18 15:06:02 2018 -0400 dt-bindings: net: add support for Microchip KSZ9131 Add support for Microchip Technology KSZ9131 10/100/1000 Ethernet PHY Signed-off-by: Yuiko Oshino Reviewed-by: Rob Herring Signed-off-by: David S. Miller commit bff5b4b3737219195ca0caef4ff7884303cb5dc1 Author: Yuiko Oshino Date: Thu Oct 18 15:06:01 2018 -0400 net: phy: micrel: add Microchip KSZ9131 initial driver Add support for Microchip Technology KSZ9131 10/100/1000 Ethernet PHY Signed-off-by: Yuiko Oshino Signed-off-by: David S. Miller commit c9fbd71f73094311b31ee703a918e9e0df502cef Author: Debabrata Banerjee Date: Thu Oct 18 11:18:26 2018 -0400 netpoll: allow cleanup to be synchronous This fixes a problem introduced by: commit 2cde6acd49da ("netpoll: Fix __netpoll_rcu_free so that it can hold the rtnl lock") When using netconsole on a bond, __netpoll_cleanup can asynchronously recurse multiple times, each __netpoll_free_async call can result in more __netpoll_free_async's. This means there is now a race between cleanup_work queues on multiple netpoll_info's on multiple devices and the configuration of a new netpoll. For example if a netconsole is set to enable 0, reconfigured, and enable 1 immediately, this netconsole will likely not work. Given the reason for __netpoll_free_async is it can be called when rtnl is not locked, if it is locked, we should be able to execute synchronously. It appears to be locked everywhere it's called from. Generalize the design pattern from the teaming driver for current callers of __netpoll_free_async. CC: Neil Horman CC: "David S. Miller" Signed-off-by: Debabrata Banerjee Signed-off-by: David S. Miller commit 5032d079909d1ac5c2535acc32d5f01cd245d8ea Author: John Fastabend Date: Thu Oct 18 13:58:35 2018 -0700 bpf: skmsg, fix psock create on existing kcm/tls port Before using the psock returned by sk_psock_get() when adding it to a sockmap we need to ensure it is actually a sockmap based psock. Previously we were only checking this after incrementing the reference counter which was an error. This resulted in a slab-out-of-bounds error when the psock was not actually a sockmap type. This moves the check up so the reference counter is only used if it is a sockmap psock. Eric reported the following KASAN BUG, BUG: KASAN: slab-out-of-bounds in atomic_read include/asm-generic/atomic-instrumented.h:21 [inline] BUG: KASAN: slab-out-of-bounds in refcount_inc_not_zero_checked+0x97/0x2f0 lib/refcount.c:120 Read of size 4 at addr ffff88019548be58 by task syz-executor4/22387 CPU: 1 PID: 22387 Comm: syz-executor4 Not tainted 4.19.0-rc7+ #264 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113 print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412 check_memory_region_inline mm/kasan/kasan.c:260 [inline] check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267 kasan_check_read+0x11/0x20 mm/kasan/kasan.c:272 atomic_read include/asm-generic/atomic-instrumented.h:21 [inline] refcount_inc_not_zero_checked+0x97/0x2f0 lib/refcount.c:120 sk_psock_get include/linux/skmsg.h:379 [inline] sock_map_link.isra.6+0x41f/0xe30 net/core/sock_map.c:178 sock_hash_update_common+0x19b/0x11e0 net/core/sock_map.c:669 sock_hash_update_elem+0x306/0x470 net/core/sock_map.c:738 map_update_elem+0x819/0xdf0 kernel/bpf/syscall.c:818 Signed-off-by: John Fastabend Reported-by: Eric Dumazet Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: Daniel Borkmann commit a0db8a7516d9eb9ebb7400df21fc061fe472b8ad Author: Dan Carpenter Date: Fri Oct 19 12:18:19 2018 +0300 scsi: myrs: Fix the processor absent message in processor_show() If both processors are absent then it's supposed to print that, but instead we print that just the second processor is absent. Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)") Signed-off-by: Dan Carpenter Signed-off-by: Martin K. Petersen commit 9a231caa77c3afdf775bcc9b7c403244deb3d539 Author: Dan Carpenter Date: Fri Oct 19 12:16:28 2018 +0300 scsi: myrs: Fix a logical vs bitwise bug The || was supposed to be |. The original code just sets ->result to 1. Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)") Signed-off-by: Dan Carpenter Signed-off-by: Martin K. Petersen commit f4445bb93d82a984657b469e63118c2794a4c3d3 Author: Gustavo A. R. Silva Date: Thu Oct 18 18:59:39 2018 +0200 scsi: hisi_sas: Fix NULL pointer dereference There is a NULL pointer dereference in case *slot* happens to be NULL at lines 1053 and 1878: struct hisi_sas_cq *cq = &hisi_hba->cq[slot->dlvry_queue]; Notice that *slot* is being NULL checked at lines 1057 and 1881: if (slot), which implies it may be NULL. Fix this by placing the declaration and definition of variable cq, which contains the pointer dereference slot->dlvry_queue, after slot has been properly NULL checked. Addresses-Coverity-ID: 1474515 ("Dereference before null check") Addresses-Coverity-ID: 1474520 ("Dereference before null check") Fixes: 584f53fe5f52 ("scsi: hisi_sas: Fix the race between IO completion and timeout for SMP/internal IO") Signed-off-by: Gustavo A. R. Silva Reviewed-by: Xiang Chen Signed-off-by: Martin K. Petersen commit d592dd64006f8026e2639e81b9705b20824b73fc Author: James Bottomley Date: Thu Oct 18 16:50:56 2018 -0700 scsi: myrs: fix build failure on 32 bit For 32 bit versions we have to be careful about divisions of 64 bit quantities so use do_div() instead of a direct division. This fixes a warning about _uldivmod being undefined in certain configurations Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller") Reported-by: kbuild test robot Signed-off-by: James Bottomley Reviewed-by: Hannes Reinecke Tested-by: Randy Dunlap # build-tested Signed-off-by: Martin K. Petersen commit 540fefc08f75aedb517acbf525d393b8efddabd9 Author: Alexei Starovoitov Date: Fri Oct 19 13:52:38 2018 -0700 bpf: remove unused variable fix the following warning ../kernel/bpf/syscall.c: In function ‘map_lookup_and_delete_elem’: ../kernel/bpf/syscall.c:1010:22: warning: unused variable ‘ptr’ [-Wunused-variable] void *key, *value, *ptr; ^~~ Fixes: bd513cd08f10 ("bpf: add MAP_LOOKUP_AND_DELETE_ELEM syscall") Signed-off-by: Alexei Starovoitov commit d375e344781d099697cdc0fb4ee8b9170558f272 Merge: 2929ad29a301 2cb494a36c98 Author: Alexei Starovoitov Date: Fri Oct 19 13:49:35 2018 -0700 Merge branch 'cg_skb_direct_pkt_access' Song Liu says: ==================== Changes v7 -> v8: 1. Dynamically allocate the dummy sk to avoid race conditions. Changes v6 -> v7: 1. Make dummy sk a global variable (test_run_sk). Changes v5 -> v6: 1. Fixed dummy sk in bpf_prog_test_run_skb() as suggested by Eric Dumazet. Changes v4 -> v5: 1. Replaced bpf_compute_and_save_data_pointers() with bpf_compute_and_save_data_end(); Replaced bpf_restore_data_pointers() with bpf_restore_data_end(). 2. Fixed indentation in test_verifier.c Changes v3 -> v4: 1. Fixed crash issue reported by Alexei. Changes v2 -> v3: 1. Added helper function bpf_compute_and_save_data_pointers() and bpf_restore_data_pointers(). Changes v1 -> v2: 1. Updated the list of read-only fields, and read-write fields. 2. Added dummy sk to bpf_prog_test_run_skb(). This set enables BPF program of type BPF_PROG_TYPE_CGROUP_SKB to access some __skb_buff data directly. ==================== Signed-off-by: Alexei Starovoitov commit 2cb494a36c98279c5c6ce8e99cf9776f15449ade Author: Song Liu Date: Fri Oct 19 09:57:58 2018 -0700 bpf: add tests for direct packet access from CGROUP_SKB Tests are added to make sure CGROUP_SKB cannot access: tc_classid, data_meta, flow_keys and can read and write: mark, prority, and cb[0-4] and can read other fields. To make selftest with skb->sk work, a dummy sk is added in bpf_prog_test_run_skb(). Signed-off-by: Song Liu Signed-off-by: Alexei Starovoitov commit b39b5f411dcfce28ff954e5d6acb2c11be3cb0ec Author: Song Liu Date: Fri Oct 19 09:57:57 2018 -0700 bpf: add cg_skb_is_valid_access for BPF_PROG_TYPE_CGROUP_SKB BPF programs of BPF_PROG_TYPE_CGROUP_SKB need to access headers in the skb. This patch enables direct access of skb for these programs. Two helper functions bpf_compute_and_save_data_end() and bpf_restore_data_end() are introduced. There are used in __cgroup_bpf_run_filter_skb(), to compute proper data_end for the BPF program, and restore original data afterwards. Signed-off-by: Song Liu Signed-off-by: Alexei Starovoitov commit 2929ad29a3015120ab64c86f362fc2a590ceb69c Merge: 78de35460a5c a64af0ef1c1d Author: Alexei Starovoitov Date: Fri Oct 19 13:43:09 2018 -0700 Merge branch 'improve_perf_barriers' Daniel Borkmann says: ==================== This set first adds smp_* barrier variants to tools infrastructure and updates perf and libbpf to make use of them. For details, please see individual patches, thanks! Arnaldo, if there are no objections, could this be routed via bpf-next with Acked-by's due to later dependencies in libbpf? Alternatively, I could also get the 2nd patch out during merge window, but perhaps it's okay to do in one go as there shouldn't be much conflict in perf itself. Thanks! v1 -> v2: - add common helper and switch to acquire/release variants when possible, thanks Peter! ==================== Signed-off-by: Alexei Starovoitov commit a64af0ef1c1dbd1e8be65a6ebbf5950305b27e48 Author: Daniel Borkmann Date: Fri Oct 19 15:51:03 2018 +0200 bpf, libbpf: use correct barriers in perf ring buffer walk Given libbpf is a generic library and not restricted to x86-64 only, the compiler barrier in bpf_perf_event_read_simple() after fetching the head needs to be replaced with smp_rmb() at minimum. Also, writing out the tail we should use WRITE_ONCE() to avoid store tearing. Now that we have the logic in place in ring_buffer_read_head() and ring_buffer_write_tail() helper also used by perf tool which would select the correct and best variant for a given architecture (e.g. x86-64 can avoid CPU barriers entirely), make use of these in order to fix bpf_perf_event_read_simple(). Fixes: d0cabbb021be ("tools: bpf: move the event reading loop to libbpf") Fixes: 39111695b1b8 ("samples: bpf: add bpf_perf_event_output example") Signed-off-by: Daniel Borkmann Cc: Peter Zijlstra Cc: "Paul E. McKenney" Cc: Will Deacon Cc: Arnaldo Carvalho de Melo Signed-off-by: Alexei Starovoitov commit 09d62154f61316f7e97eae3f31ef8770c7e4b386 Author: Daniel Borkmann Date: Fri Oct 19 15:51:02 2018 +0200 tools, perf: add and use optimized ring_buffer_{read_head, write_tail} helpers Currently, on x86-64, perf uses LFENCE and MFENCE (rmb() and mb(), respectively) when processing events from the perf ring buffer which is unnecessarily expensive as we can do more lightweight in particular given this is critical fast-path in perf. According to Peter rmb()/mb() were added back then via a94d342b9cb0 ("tools/perf: Add required memory barriers") at a time where kernel still supported chips that needed it, but nowadays support for these has been ditched completely, therefore we can fix them up as well. While for x86-64, replacing rmb() and mb() with smp_*() variants would result in just a compiler barrier for the former and LOCK + ADD for the latter (__sync_synchronize() uses slower MFENCE by the way), Peter suggested we can use smp_{load_acquire,store_release}() instead for architectures where its implementation doesn't resolve in slower smp_mb(). Thus, e.g. in x86-64 we would be able to avoid CPU barrier entirely due to TSO. For architectures where the latter needs to use smp_mb() e.g. on arm, we stick to cheaper smp_rmb() variant for fetching the head. This work adds helpers ring_buffer_read_head() and ring_buffer_write_tail() for tools infrastructure that either switches to smp_load_acquire() for architectures where it is cheaper or uses READ_ONCE() + smp_rmb() barrier for those where it's not in order to fetch the data_head from the perf control page, and it uses smp_store_release() to write the data_tail. Latter is smp_mb() + WRITE_ONCE() combination or a cheaper variant if architecture allows for it. Those that rely on smp_rmb() and smp_mb() can further improve performance in a follow up step by implementing the two under tools/arch/*/include/asm/barrier.h such that they don't have to fallback to rmb() and mb() in tools/include/asm/barrier.h. Switch perf to use ring_buffer_read_head() and ring_buffer_write_tail() so it can make use of the optimizations. Later, we convert libbpf as well to use the same helpers. Side note [0]: the topic has been raised of whether one could simply use the C11 gcc builtins [1] for the smp_load_acquire() and smp_store_release() instead: __atomic_load_n(ptr, __ATOMIC_ACQUIRE); __atomic_store_n(ptr, val, __ATOMIC_RELEASE); Kernel and (presumably) tooling shipped along with the kernel has a minimum requirement of being able to build with gcc-4.6 and the latter does not have C11 builtins. While generally the C11 memory models don't align with the kernel's, the C11 load-acquire and store-release alone /could/ suffice, however. Issue is that this is implementation dependent on how the load-acquire and store-release is done by the compiler and the mapping of supported compilers must align to be compatible with the kernel's implementation, and thus needs to be verified/tracked on a case by case basis whether they match (unless an architecture uses them also from kernel side). The implementations for smp_load_acquire() and smp_store_release() in this patch have been adapted from the kernel side ones to have a concrete and compatible mapping in place. [0] http://patchwork.ozlabs.org/patch/985422/ [1] https://gcc.gnu.org/onlinedocs/gcc/_005f_005fatomic-Builtins.html Signed-off-by: Daniel Borkmann Acked-by: Peter Zijlstra (Intel) Cc: "Paul E. McKenney" Cc: Will Deacon Cc: Arnaldo Carvalho de Melo Signed-off-by: Alexei Starovoitov commit 78de35460a5cc206d42a239cb215c966a83ac283 Author: Anders Roxell Date: Fri Oct 19 16:24:36 2018 +0200 selftests/bpf: add missing executables to .gitignore Fixes: 371e4fcc9d96 ("selftests/bpf: cgroup local storage-based network counters") Fixes: 370920c47b26 ("selftests/bpf: Test libbpf_{prog,attach}_type_by_name") Signed-off-by: Anders Roxell Acked-by: Yonghong Song Signed-off-by: Alexei Starovoitov commit 43ed375ff249e9f2fc986f77ed9746561895aeb3 Merge: 3ddeac6705ab 43b987d23d6b Author: Alexei Starovoitov Date: Fri Oct 19 13:24:31 2018 -0700 Merge branch 'queue_stack_maps' Mauricio Vasquez says: ==================== In some applications this is needed have a pool of free elements, for example the list of free L4 ports in a SNAT. None of the current maps allow to do it as it is not possible to get any element without having they key it is associated to, even if it were possible, the lack of locking mecanishms in eBPF would do it almost impossible to be implemented without data races. This patchset implements two new kind of eBPF maps: queue and stack. Those maps provide to eBPF programs the peek, push and pop operations, and for userspace applications a new bpf_map_lookup_and_delete_elem() is added. Signed-off-by: Mauricio Vasquez B v2 -> v3: - Remove "almost dead code" in syscall.c - Remove unnecessary copy_from_user in bpf_map_lookup_and_delete_elem - Rebase v1 -> v2: - Put ARG_PTR_TO_UNINIT_MAP_VALUE logic into a separated patch - Fix missing __this_cpu_dec & preempt_enable calls in kernel/bpf/syscall.c RFC v4 -> v1: - Remove roundup to power of 2 in memory allocation - Remove count and use a free slot to check if queue/stack is empty - Use if + assigment for wrapping indexes - Fix some minor style issues - Squash two patches together RFC v3 -> RFC v4: - Revert renaming of kernel/bpf/stackmap.c - Remove restriction on value size - Remove len arguments from peek/pop helpers - Add new ARG_PTR_TO_UNINIT_MAP_VALUE RFC v2 -> RFC v3: - Return elements by value instead that by reference - Implement queue/stack base on array and head + tail indexes - Rename stack trace related files to avoid confusion and conflicts RFC v1 -> RFC v2: - Create two separate maps instead of single one + flags - Implement bpf_map_lookup_and_delete syscall - Support peek operation - Define replacement policy through flags in the update() method - Add eBPF side tests ==================== Acked-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov commit 43b987d23d6bd08db41a9c4a85aacfb3f0b2a94c Author: Mauricio Vasquez B Date: Thu Oct 18 15:16:41 2018 +0200 selftests/bpf: add test cases for queue and stack maps test_maps: Tests that queue/stack maps are behaving correctly even in corner cases test_progs: Tests new ebpf helpers Signed-off-by: Mauricio Vasquez B Acked-by: Song Liu Signed-off-by: Alexei Starovoitov commit da4e1b15f67613eca7ae998abd996cfee7cff1ba Author: Mauricio Vasquez B Date: Thu Oct 18 15:16:36 2018 +0200 Sync uapi/bpf.h to tools/include Sync both files. Signed-off-by: Mauricio Vasquez B Acked-by: Song Liu Signed-off-by: Alexei Starovoitov commit bd513cd08f10cbe28856f99ae951e86e86803861 Author: Mauricio Vasquez B Date: Thu Oct 18 15:16:30 2018 +0200 bpf: add MAP_LOOKUP_AND_DELETE_ELEM syscall The previous patch implemented a bpf queue/stack maps that provided the peek/pop/push functions. There is not a direct relationship between those functions and the current maps syscalls, hence a new MAP_LOOKUP_AND_DELETE_ELEM syscall is added, this is mapped to the pop operation in the queue/stack maps and it is still to implement in other kind of maps. Signed-off-by: Mauricio Vasquez B Acked-by: Song Liu Signed-off-by: Alexei Starovoitov commit f1a2e44a3aeccb3ff18d3ccc0b0203e70b95bd92 Author: Mauricio Vasquez B Date: Thu Oct 18 15:16:25 2018 +0200 bpf: add queue and stack maps Queue/stack maps implement a FIFO/LIFO data storage for ebpf programs. These maps support peek, pop and push operations that are exposed to eBPF programs through the new bpf_map[peek/pop/push] helpers. Those operations are exposed to userspace applications through the already existing syscalls in the following way: BPF_MAP_LOOKUP_ELEM -> peek BPF_MAP_LOOKUP_AND_DELETE_ELEM -> pop BPF_MAP_UPDATE_ELEM -> push Queue/stack maps are implemented using a buffer, tail and head indexes, hence BPF_F_NO_PREALLOC is not supported. As opposite to other maps, queue and stack do not use RCU for protecting maps values, the bpf_map[peek/pop] have a ARG_PTR_TO_UNINIT_MAP_VALUE argument that is a pointer to a memory zone where to save the value of a map. Basically the same as ARG_PTR_TO_UNINIT_MEM, but the size has not be passed as an extra argument. Our main motivation for implementing queue/stack maps was to keep track of a pool of elements, like network ports in a SNAT, however we forsee other use cases, like for exampling saving last N kernel events in a map and then analysing from userspace. Signed-off-by: Mauricio Vasquez B Acked-by: Song Liu Signed-off-by: Alexei Starovoitov commit 2ea864c58f19bf70a0e2415f9f1c53814e07f1b4 Author: Mauricio Vasquez B Date: Thu Oct 18 15:16:20 2018 +0200 bpf/verifier: add ARG_PTR_TO_UNINIT_MAP_VALUE ARG_PTR_TO_UNINIT_MAP_VALUE argument is a pointer to a memory zone used to save the value of a map. Basically the same as ARG_PTR_TO_UNINIT_MEM, but the size has not be passed as an extra argument. This will be used in the following patch that implements some new helpers that receive a pointer to be filled with a map value. Signed-off-by: Mauricio Vasquez B Acked-by: Song Liu Signed-off-by: Alexei Starovoitov commit c9d29f4658a5a6d2c2ba2afeb20ff763fc6286f9 Author: Mauricio Vasquez B Date: Thu Oct 18 15:16:14 2018 +0200 bpf/syscall: allow key to be null in map functions This commit adds the required logic to allow key being NULL in case the key_size of the map is 0. A new __bpf_copy_key function helper only copies the key from userpsace when key_size != 0, otherwise it enforces that key must be null. Signed-off-by: Mauricio Vasquez B Acked-by: Song Liu Signed-off-by: Alexei Starovoitov commit 144991602e6a14d667b295f1b099e609ce857772 Author: Mauricio Vasquez B Date: Thu Oct 18 15:16:09 2018 +0200 bpf: rename stack trace map operations In the following patches queue and stack maps (FIFO and LIFO datastructures) will be implemented. In order to avoid confusion and a possible name clash rename stack_map_ops to stack_trace_map_ops Signed-off-by: Mauricio Vasquez B Acked-by: Song Liu Signed-off-by: Alexei Starovoitov commit fe8376dbbd6ac1febb0fd6389e3ec4f349e70c71 Author: Helge Deller Date: Fri Oct 19 22:06:36 2018 +0200 parisc: Add PDC PAT cell_info() and pd_get_pdc_revisions() functions Add wrappers for the PDC_PAT_CELL_GET_INFO and PDC_PAT_PD_GET_PDC_INTERF_REV PAT PDC subfunctions. Both provide access to the PAT capability bitfield which can guide us if simultaneous PTLBs are allowed on the bus, and if firmware will rendezvous all processors within PDCE_Check in case of an HPMC. Signed-off-by: Helge Deller commit 32c1ceeabda3e37dd94129f915823e7cf0441fc9 Author: Helge Deller Date: Fri Oct 19 20:36:15 2018 +0200 parisc: Drop two instructions from pte lookup code Remove two instruction from the hot path. The temporary move to %r9 is unneccessary, and the zero-inialization of pte happens twice. Signed-off-by: Helge Deller commit a45a01160f1d46a3021755a2cf2f433aec008e38 Author: Helge Deller Date: Fri Oct 19 20:31:20 2018 +0200 parisc: Use zdep for shlw macro on PA1.1 and PA2.0 The zdep and depw,z mnemonics generate the same code. The assembler will accept the depw,z mnemonic when generating PA 1.x code. The zdep mnemonic is okay when generating PA 2.0 code. This patch changes depw,z to zdep in the current shlw macro, while the binary code will be the same. Signed-off-by: Helge Deller Signed-off-by: John David Anglin commit f18b7e914fd2ed5e8b5733644cefcf62f7582679 Author: Sibi Sankar Date: Wed Oct 17 19:25:27 2018 +0530 remoteproc: qcom: q6v5-mss: Register segments/dumpfn for coredump Register the MDT segments, custom dumpfn and private data with the remoteproc core dump functionality. Signed-off-by: Sibi Sankar Signed-off-by: Bjorn Andersson commit 7dd8ade24dc2a35e683c5eccdb81ee9e279b0348 Author: Sibi Sankar Date: Wed Oct 17 19:25:26 2018 +0530 remoteproc: qcom: q6v5-mss: Add custom dump function for modem The per segment dump function is responsible for loading the mba before device memory segments associated with coredump can be populated and for cleaning up the resources post coredump. Signed-off-by: Sibi Sankar Signed-off-by: Bjorn Andersson commit 0304530ddd29300aed7ef6e5b2fd409c7a0162e6 Author: Sibi Sankar Date: Wed Oct 17 19:25:25 2018 +0530 remoteproc: qcom: q6v5-mss: Refactor mba load/unload sequence Refactor re-useable parts of mba load/unload sequence into mba_load and mba_reclaim respectively. This is done in order to prevent code duplication for modem coredump, which requires the mba to be loaded before dumping the segments. The following changes in functionality are intended: * Add software bypass to avoid high MX current in mpss error path. * Remove the proxy votes of clk/regs only after the active/reset clks/regs. * Reclaim MBA memory after mpss_load failure in mba_reclaim func. * Set/Unset the dump_mba_loaded flag on mba_load/mba_reclaim respectively. Signed-off-by: Sibi Sankar Signed-off-by: Bjorn Andersson commit ab8f873bb90da7bbe40e2f41c92a4971c4f0dc76 Author: Sibi Sankar Date: Wed Oct 17 19:25:24 2018 +0530 remoteproc: Add mechanism for custom dump function assignment This patch adds a mechanism for assigning each rproc dump segment with a custom dump function and private data. The dump function is to be called for each rproc segment during coredump if assigned. Signed-off-by: Sibi Sankar [bjorn: reordred arguments to rproc_coredump_add_custom_segment()] Signed-off-by: Bjorn Andersson commit 2fda5ada07f36f6cde39a52e7f05d86ea8ffdc33 Author: Arnaldo Carvalho de Melo Date: Fri Oct 19 15:47:34 2018 -0300 perf evsel: Introduce per event max_events property This simply adds the field to 'struct perf_evsel' and allows setting it via the event parser, to test it lets trace trace: First look at where in a function that receives an evsel we can put a probe to read how evsel->max_events was setup: # perf probe -x ~/bin/perf -L trace__event_handler 0 static int trace__event_handler(struct trace *trace, struct perf_evsel *evsel, union perf_event *event __maybe_unused, struct perf_sample *sample) 3 { 4 struct thread *thread = machine__findnew_thread(trace->host, sample->pid, sample->tid); 5 int callchain_ret = 0; 7 if (sample->callchain) { 8 callchain_ret = trace__resolve_callchain(trace, evsel, sample, &callchain_cursor); 9 if (callchain_ret == 0) { 10 if (callchain_cursor.nr < trace->min_stack) 11 goto out; 12 callchain_ret = 1; } } See what variables we can probe at line 7: # perf probe -x ~/bin/perf -V trace__event_handler:7 Available variables at trace__event_handler:7 @ int callchain_ret struct perf_evsel* evsel struct perf_sample* sample struct thread* thread struct trace* trace union perf_event* event Add a probe at that line asking for evsel->max_events to be collected and named as "max_events": # perf probe -x ~/bin/perf trace__event_handler:7 'max_events=evsel->max_events' Added new event: probe_perf:trace__event_handler (on trace__event_handler:7 in /home/acme/bin/perf with max_events=evsel->max_events) You can now use it in all perf tools, such as: perf record -e probe_perf:trace__event_handler -aR sleep 1 Now use 'perf trace', here aliased to just 'trace' and trace trace, i.e. the first 'trace' is tracing just that 'probe_perf:trace__event_handler' event, while the traced trace is tracing all scheduler tracepoints, will stop at two events (--max-events 2) and will just set evsel->max_events for all the sched tracepoints to 9, we will see the output of both traces intermixed: # trace -e *perf:*event_handler trace --max-events 2 -e sched:*/nr=9/ 0.000 :0/0 sched:sched_waking:comm=rcu_sched pid=10 prio=120 target_cpu=000 0.009 :0/0 sched:sched_wakeup:comm=rcu_sched pid=10 prio=120 target_cpu=000 0.000 trace/23949 probe_perf:trace__event_handler:(48c34a) max_events=0x9 0.046 trace/23949 probe_perf:trace__event_handler:(48c34a) max_events=0x9 # Now, if the traced trace sends its output to /dev/null, we'll see just what the first level trace outputs: that evsel->max_events is indeed being set to 9: # trace -e *perf:*event_handler trace -o /dev/null --max-events 2 -e sched:*/nr=9/ 0.000 trace/23961 probe_perf:trace__event_handler:(48c34a) max_events=0x9 0.030 trace/23961 probe_perf:trace__event_handler:(48c34a) max_events=0x9 # Now that we can set evsel->max_events, we can go to the next step, honour that per-event property in 'perf trace'. Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Milian Wolff Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-og00yasj276joem6e14l1eas@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 4ab7e05dd070600833680bd318d6d962f010caa2 Author: Laurence Rochfort Date: Wed Oct 10 22:24:26 2018 +0100 staging: gasket: Fix sparse "incorrect type in assignment" warnings. Remove the coherent buffer __iomem cookie because the buffer is allocated from dma_alloc_coherent(). warning: incorrect type in assignment (different address spaces) expected unsigned char [noderef] [usertype] *virt_base got void *[assigned] mem warning: incorrect type in argument 3 (different address spaces) expected void *cpu_addr got unsigned char [noderef] [usertype] *virt_base Signed-off-by: Laurence Rochfort Reviewed-by: Todd Poynor Signed-off-by: Greg Kroah-Hartman commit 8ae925f02553240a4c15a1e80a6dfc5c0fa95e67 Author: Todd Poynor Date: Tue Oct 16 05:03:07 2018 -0700 staging: gasket: remove debug logs for callback invocation Debug logs for device-specific callback invocation aren't very useful, remove. Signed-off-by: Todd Poynor Signed-off-by: Greg Kroah-Hartman commit e21d5cca3a1bc1e7c1f61796e71c060704bfe863 Author: Todd Poynor Date: Tue Oct 16 05:03:08 2018 -0700 staging: gasket: remove debug logs in page table mapping calls Remove very noisy debug logs that also contain typos and incorrect output formats. Signed-off-by: Todd Poynor Signed-off-by: Greg Kroah-Hartman commit 95f7ed6b7d29052c30cfed47b838f39bf432a910 Author: Mamta Shukla Date: Sat Oct 13 12:26:06 2018 +0530 staging: rtl8188eu: core: Use sizeof(*p) instead of sizeof(struct P) for memory allocation Use sizeof(*ptr) instead of sizeof(ptr_type) makes memory allocation easy in case the type of pointer changes. Fix all checkpatch reported issues for "CHECK: Prefer kzalloc(sizeof(*

)...) over kzalloc(sizeof(struct

)...)". Signed-off-by: Mamta Shukla Reviewed-by: Daniel Vetter Signed-off-by: Greg Kroah-Hartman commit 8b8429b00086d0d2a4eb6dd0ec96d4020d5fe8c8 Author: Maya Nakamura Date: Tue Oct 16 00:53:09 2018 -0700 staging: ks7010: Remove extra blank line Remove extra blank line. Issue found by checkpatch.pl. Signed-off-by: Maya Nakamura Acked-by: Julia Lawall Reviewed-by: Vaishali Thakkar Signed-off-by: Greg Kroah-Hartman commit d6de4674d369c2af3a797a208a35ed53b39dc556 Author: Maya Nakamura Date: Tue Oct 16 23:15:21 2018 -0700 staging: gasket: Remove extra blank line Remove extra blank line. Issue found by checkpatch.pl. Signed-off-by: Maya Nakamura Reviewed-by: Vaishali Thakkar Acked-by: Todd Poynor Signed-off-by: Greg Kroah-Hartman commit bfff520b54ab04d6bc94220b4e028872442ea643 Author: Kimberly Brown Date: Wed Oct 17 21:14:27 2018 -0400 staging: media: davinci_vpfe: Fix spelling mistake in enum Fix the spelling mistake in enumerator identifier RESIZER_MODE_CONTINIOUS. 'CONTINIOUS' should be 'CONTINUOUS'. Issue found by checkpatch. Signed-off-by: Kimberly Brown Reviewed-by: Vaishali Thakkar Signed-off-by: Greg Kroah-Hartman commit 02e6b5ebeda1136f82ad685124918bab70e5107b Author: Maya Nakamura Date: Wed Oct 17 18:16:00 2018 -0700 staging: speakup: Add a pair of braces Add a pair of braces to make all arms of the if statement consistent. Issue found by checkpatch.pl. Signed-off-by: Maya Nakamura Acked-by: Samuel Thibault Signed-off-by: Greg Kroah-Hartman commit 2bc51572aa6ce39cb2e21b73e5278bb7cd98762b Author: Maya Nakamura Date: Thu Oct 18 01:29:42 2018 -0700 staging: wlan-ng: Replace long int with long Replace long int with long as int is unnecessary according to the checkpatch.pl warning. K&R write, 'The word int can be omitted... and typically is.' Signed-off-by: Maya Nakamura Signed-off-by: Greg Kroah-Hartman commit 3952105df4723abbd36b57e88c8dad42cf6c8b59 Author: Sibi Sankar Date: Wed Oct 17 19:25:23 2018 +0530 remoteproc: Introduce custom dump function for each remoteproc segment Introduce custom dump function and private data per remoteproc dump segment. The dump function is responsible for filling the device memory segment associated with coredump Signed-off-by: Sibi Sankar Signed-off-by: Bjorn Andersson commit 2e2d6f0342be7f73a34526077fa96f42f0e8c661 Merge: 9333f2079203 48995423143a Author: David S. Miller Date: Fri Oct 19 11:03:06 2018 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net net/sched/cls_api.c has overlapping changes to a call to nlmsg_parse(), one (from 'net') added rtm_tca_policy instead of NULL to the 5th argument, and another (from 'net-next') added cb->extack instead of NULL to the 6th argument. net/ipv4/ipmr_base.c is a case of a bug fix in 'net' being done to code which moved (to mr_table_dump)) in 'net-next'. Thanks to David Ahern for the heads up. Signed-off-by: David S. Miller commit 46b8306480fb424abd525acc1763da1c63a27d8a Author: David S. Miller Date: Fri Oct 19 10:52:52 2018 -0700 sparc: Fix parport build warnings. If PARPORT_PC_FIFO is not enabled, do not provide the dma lock macros and lock definition. Otherwise: ./arch/sparc/include/asm/parport.h:24:24: warning: ‘dma_spin_lock’ defined but not used [-Wunused-variable] static DEFINE_SPINLOCK(dma_spin_lock); ^~~~~~~~~~~~~ ./include/linux/spinlock_types.h:81:39: note: in definition of macro ‘DEFINE_SPINLOCK’ #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) Signed-off-by: David S. Miller commit 9333f207920336575cba4ed60603c1cdb79ace4f Author: YueHaibing Date: Fri Oct 19 12:02:59 2018 +0000 rocker: Drop pointless static qualifier There is no need to have the 'struct rocker_desc_info *desc_info' variable static since new value always be assigned before use it. Signed-off-by: YueHaibing Acked-by: Jiri Pirko Signed-off-by: David S. Miller commit f39f8688888ae74fa8deae2d01289b69b4727394 Author: Dmitry Torokhov Date: Tue Oct 16 17:07:35 2018 -0700 Input: synaptics - avoid using uninitialized variable when probing synaptics_detect() does not check whether sending commands to the device succeeds and instead relies on getting unique data from the device. Let's make sure we seed entire buffer with zeroes to make sure we will not use garbage on stack that just happen to be 0x47. Reported-by: syzbot+13cb3b01d0784e4ffc3f@syzkaller.appspotmail.com Reviewed-by: Benjamin Tissoires Reviewed-by: Peter Hutterer Signed-off-by: Dmitry Torokhov commit cbe3f898d159f4a6ed12121672c823b780df32d3 Author: Vitaly Kuznetsov Date: Fri Oct 19 16:16:03 2018 +0200 x86/kvm/nVMX: tweak shadow fields It seems we have some leftovers from times when 'unrestricted guest' wasn't exposed to L1. Stop shadowing GUEST_CS_{BASE,LIMIT,AR_SELECTOR} and GUEST_ES_BASE, shadow GUEST_SS_AR_BYTES as it was found that some hypervisors (e.g. Hyper-V without Enlightened VMCS) access it pretty often. Suggested-by: Paolo Bonzini Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 8e31582a9ab18093c0b7708b52d7f79eed9a8688 Author: Bob Peterson Date: Fri Oct 19 11:31:06 2018 -0500 gfs2: Fix minor typo: couln't versus couldn't. Signed-off-by: Bob Peterson commit 01b6b7e6e01e18b2b54bba478fd16b787f3635dd Author: Hans de Goede Date: Wed Oct 10 15:16:40 2018 +0200 platform/x86: touchscreen_dmi: Add info for the Onda V80 Plus v3 tablet Add touchscreen platform data for the Onda V80 Plus v3 tablet. Signed-off-by: Hans de Goede Signed-off-by: Andy Shevchenko commit 30394a8e8c5601eb6936402c0f94f619d002fa97 Author: Marian Cepok Date: Mon Oct 8 09:25:05 2018 +0200 platform/x86: touchscreen_dmi: Add info for the Trekstor Primetab T13B tablet Add touchscreen info for the Trekstor Primetab T13B tablet. Reviewed-by: Hans de Goede Signed-off-by: Marian Cepok Signed-off-by: Andy Shevchenko commit 1a7938a632ce476b01a2dd7676246ca319eb295a Author: Andy Shevchenko Date: Fri Aug 31 11:34:31 2018 +0300 platform/x86: intel_telemetry: Get rid of custom macro Replace custom grown macro with generic INTEL_CPU_FAM6() one. No functional change intended. Signed-off-by: Andy Shevchenko commit 8d98b1ef368feeb7720b8b9b6f3bd93f2ad892bc Author: Rajneesh Bhardwaj Date: Sat Oct 6 12:21:13 2018 +0530 platform/x86: intel_telemetry: report debugfs failure On some Goldmont based systems such as ASRock J3455M the BIOS may not enable the IPC1 device that provides access to the PMC and PUNIT. In such scenarios, the IOSS and PSS resources from the platform device can not be obtained and result in a invalid telemetry_plt_config which is an internal data structure that holds platform config and is maintained by the telemetry platform driver. This is also applicable to the platforms where the BIOS supports IPC1 device under debug configurations but IPC1 is disabled by user or the policy. This change allows user to know the reason for not seeing entries under /sys/kernel/debug/telemetry/* when there is no apparent failure at boot. Cc: Matt Turner Cc: Len Brown Cc: Souvik Kumar Chakravarty Cc: Kuppuswamy Sathyanarayanan Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=198779 Acked-by: Matt Turner Signed-off-by: Rajneesh Bhardwaj Signed-off-by: Andy Shevchenko commit 504f7e82d0a43b4fbf5ab34270aa80335ccb2b0b Author: David E. Box Date: Fri Oct 12 09:28:16 2018 -0700 MAINTAINERS: intel_telemetry: Update maintainers info Remove Souvik who has left this role. Add Rajneesh and David who work jointly on telemetry updates for new platforms. Signed-off-by: David E. Box Signed-off-by: Rajneesh Bhardwaj Signed-off-by: Andy Shevchenko commit dbf0c5a6b1f8e7bec5e17baa60a1e04c28d90f9b Author: Matan Ziv-Av Date: Fri Sep 28 17:34:06 2018 +0300 platform/x86: Add LG Gram laptop special features driver A driver for LG Gram laptop supporting features not available through the standard interfaces: - Support for the 5 Fn keys that generate ACPI or WMI events. - Two software controlled LEDs: keyboard backlight (also controlled by hardware) and touchpad LED. - Extra features: reader mode, Fn lock, cooling mode, USB charge mode, and maximal battery charging level. Signed-off-by: Matan Ziv-Av Signed-off-by: Andy Shevchenko commit f15ac811e80b857a443476de60ce70d3e6049ae5 Author: Anders Roxell Date: Fri Oct 19 16:38:16 2018 +0200 selftests/kvm: add missing executables to .gitignore Fixes: 18178ff86217 ("KVM: selftests: add Enlightened VMCS test") Signed-off-by: Anders Roxell Signed-off-by: Paolo Bonzini commit 318e741ee13b5a72f3051d9bb6852b1f4d02d0bb Author: Olivier Moysan Date: Fri Oct 19 17:56:35 2018 +0200 ASoC: cs42l51: fix mclk support The MCLK clock is made optional for cs42l51 codec. However, ASoC DAPM clock supply widget, expects the clock to be defined unconditionally. Register MCLK DAPM conditionally in codec driver, depending on clock presence in DT. Fixes: 5e8d63a726f8 ("ASoC: cs42l51: add mclk support") Signed-off-by: Olivier Moysan Signed-off-by: Mark Brown commit bbc152825afc869ed6e0b58fdc5e3e477a6c15d5 Merge: ee75fa2ae0e2 b7c7be6f6bd2 Author: Jens Axboe Date: Fri Oct 19 09:47:19 2018 -0600 Merge branch 'nvme-4.20' of git://git.infradead.org/nvme into for-4.20/block Pull NVMe updates from Christoph: "The second batch of updates for Linux 4.20: - lot of fixes for issues found by static type checkers from Bart - two small fixes from Keith - fabrics cleanups in preparation of the TCP transport from Sagi - more cleanups from Chaitanya" * 'nvme-4.20' of git://git.infradead.org/nvme: nvme-fabrics: move controller options matching to fabrics nvme-rdma: always have a valid trsvcid nvme-pci: remove duplicate check nvme-pci: fix hot removal during error handling nvmet-fcloop: suppress a compiler warning nvme-core: make implicit seed truncation explicit nvmet-fc: fix kernel-doc headers nvme-fc: rework the request initialization code nvme-fc: introduce struct nvme_fcp_op_w_sgl nvme-fc: fix kernel-doc headers nvmet: avoid integer overflow in the discard code nvmet-rdma: declare local symbols static nvmet: use strlcpy() instead of strcpy() nvme-pci: fix nvme_suspend_queue() kernel-doc header nvme-core: rework a NQN copying operation nvme-core: declare local symbols static nvmet-rdma: check for timeout in nvme_rdma_wait_for_cm() nvmet: use strcmp() instead of strncmp() for subsystem lookup nvmet: remove unreachable code nvme: update node paths after adding new path commit 746a923b863a1065ef77324e1e43f19b1a3eab5c Author: Lukas Wunner Date: Thu Oct 18 15:15:05 2018 +0200 genirq: Fix race on spurious interrupt detection Commit 1e77d0a1ed74 ("genirq: Sanitize spurious interrupt detection of threaded irqs") made detection of spurious interrupts work for threaded handlers by: a) incrementing a counter every time the thread returns IRQ_HANDLED, and b) checking whether that counter has increased every time the thread is woken. However for oneshot interrupts, the commit unmasks the interrupt before incrementing the counter. If another interrupt occurs right after unmasking but before the counter is incremented, that interrupt is incorrectly considered spurious: time | irq_thread() | irq_thread_fn() | action->thread_fn() | irq_finalize_oneshot() | unmask_threaded_irq() /* interrupt is unmasked */ | | /* interrupt fires, incorrectly deemed spurious */ | | atomic_inc(&desc->threads_handled); /* counter is incremented */ v This is observed with a hi3110 CAN controller receiving data at high volume (from a separate machine sending with "cangen -g 0 -i -x"): The controller signals a huge number of interrupts (hundreds of millions per day) and every second there are about a dozen which are deemed spurious. In theory with high CPU load and the presence of higher priority tasks, the number of incorrectly detected spurious interrupts might increase beyond the 99,900 threshold and cause disablement of the interrupt. In practice it just increments the spurious interrupt count. But that can cause people to waste time investigating it over and over. Fix it by moving the accounting before the invocation of irq_finalize_oneshot(). [ tglx: Folded change log update ] Fixes: 1e77d0a1ed74 ("genirq: Sanitize spurious interrupt detection of threaded irqs") Signed-off-by: Lukas Wunner Signed-off-by: Thomas Gleixner Cc: Mathias Duckeck Cc: Akshay Bhat Cc: Casey Fitzpatrick Cc: stable@vger.kernel.org # v3.16+ Link: https://lkml.kernel.org/r/1dfd8bbd16163940648045495e3e9698e63b50ad.1539867047.git.lukas@wunner.de commit 5067a8cdd4ce3588fca2e0ee554f0f081650de8f Author: Arnaldo Carvalho de Melo Date: Thu Oct 18 16:38:27 2018 -0300 perf trace: Introduce --max-events Allow stopping tracing after a number of events take place, considering strace-like syscalls formatting as one event per enter/exit pair or when in a multi-process tracing session a syscall is interrupted and printed ending with '...'. Examples included in the documentation: Trace the first 4 open, openat or open_by_handle_at syscalls (in the future more syscalls may match here): $ perf trace -e open* --max-events 4 [root@jouet perf]# trace -e open* --max-events 4 2272.992 ( 0.037 ms): gnome-shell/1370 openat(dfd: CWD, filename: /proc/self/stat) = 31 2277.481 ( 0.139 ms): gnome-shell/3039 openat(dfd: CWD, filename: /proc/self/stat) = 65 3026.398 ( 0.076 ms): gnome-shell/3039 openat(dfd: CWD, filename: /proc/self/stat) = 65 4294.665 ( 0.015 ms): sed/15879 openat(dfd: CWD, filename: /etc/ld.so.cache, flags: CLOEXEC) = 3 $ Trace the first minor page fault when running a workload: # perf trace -F min --max-stack=7 --max-events 1 sleep 1 0.000 ( 0.000 ms): sleep/18006 minfault [__clear_user+0x1a] => 0x5626efa56080 (?k) __clear_user ([kernel.kallsyms]) load_elf_binary ([kernel.kallsyms]) search_binary_handler ([kernel.kallsyms]) __do_execve_file.isra.33 ([kernel.kallsyms]) __x64_sys_execve ([kernel.kallsyms]) do_syscall_64 ([kernel.kallsyms]) entry_SYSCALL_64 ([kernel.kallsyms]) # Trace the next min page page fault to take place on the first CPU: # perf trace -F min --call-graph=dwarf --max-events 1 --cpu 0 0.000 ( 0.000 ms): Web Content/17136 minfault [js::gc::Chunk::fetchNextDecommittedArena+0x4b] => 0x7fbe6181b000 (?.) js::gc::FreeSpan::initAsEmpty (inlined) js::gc::Arena::setAsNotAllocated (inlined) js::gc::Chunk::fetchNextDecommittedArena (/usr/lib64/firefox/libxul.so) js::gc::Chunk::allocateArena (/usr/lib64/firefox/libxul.so) js::gc::GCRuntime::allocateArena (/usr/lib64/firefox/libxul.so) js::gc::ArenaLists::allocateFromArena (/usr/lib64/firefox/libxul.so) js::gc::GCRuntime::tryNewTenuredThing (inlined) js::AllocateString (/usr/lib64/firefox/libxul.so) js::Allocate (inlined) JSThinInlineString::new_<(js::AllowGC)1> (inlined) AllocateInlineString<(js::AllowGC)1, unsigned char> (inlined) js::ConcatStrings<(js::AllowGC)1> (/usr/lib64/firefox/libxul.so) [0x18b26e6bc2bd] (/tmp/perf-17136.map) Tracing the next four ext4 operations on a specific CPU: # perf trace -e ext4:*/call-graph=fp/ --max-events 4 --cpu 3 0.000 mutt/3849 ext4:ext4_es_lookup_extent_enter:dev 253,2 ino 57277 lblk 0 ext4_es_lookup_extent ([kernel.kallsyms]) read (/usr/lib64/libc-2.26.so) 0.097 mutt/3849 ext4:ext4_es_lookup_extent_exit:dev 253,2 ino 57277 found 0 [0/0) 0 ext4_es_lookup_extent ([kernel.kallsyms]) read (/usr/lib64/libc-2.26.so) 0.141 mutt/3849 ext4:ext4_ext_map_blocks_enter:dev 253,2 ino 57277 lblk 0 len 1 flags ext4_ext_map_blocks ([kernel.kallsyms]) read (/usr/lib64/libc-2.26.so) 0.184 mutt/3849 ext4:ext4_ext_load_extent:dev 253,2 ino 57277 lblk 1516511 pblk 18446744071750013657 __read_extent_tree_block ([kernel.kallsyms]) __read_extent_tree_block ([kernel.kallsyms]) ext4_find_extent ([kernel.kallsyms]) ext4_ext_map_blocks ([kernel.kallsyms]) ext4_map_blocks ([kernel.kallsyms]) ext4_mpage_readpages ([kernel.kallsyms]) read_pages ([kernel.kallsyms]) __do_page_cache_readahead ([kernel.kallsyms]) ondemand_readahead ([kernel.kallsyms]) generic_file_read_iter ([kernel.kallsyms]) __vfs_read ([kernel.kallsyms]) vfs_read ([kernel.kallsyms]) ksys_read ([kernel.kallsyms]) do_syscall_64 ([kernel.kallsyms]) entry_SYSCALL_64 ([kernel.kallsyms]) read (/usr/lib64/libc-2.26.so) # Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Milian Wolff Cc: Namhyung Kim Cc: Rudá Moura Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-sweh107bs7ol5bzls0m4tqdz@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 4ba8b3ebf4f8f583c2c01da20e4d110a5881ffdd Author: Arnaldo Carvalho de Melo Date: Thu Oct 18 15:24:07 2018 -0300 tools lib subcmd: Introduce OPTION_ULONG For completeness, will be used in 'perf trace --max-events'. Cc: Adrian Hunter Cc: Andi Kleen Cc: David Ahern Cc: Jiri Olsa Cc: Josh Poimboeuf Cc: Kim Phillips Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-glaj3pwespxfj2fdjs9a20b6@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 389373d3306553896a9e218493e5b6175c844eb0 Author: Hongxu Jia Date: Thu Oct 18 16:26:13 2018 +0800 perf arm64: Fix generate system call table failed with /tmp mounted with noexec When /tmp is mounted with noexec, mksyscalltbl fails. [snip] |perf-1.0/tools/perf/arch/arm64/entry/syscalls//mksyscalltbl: /tmp/create-table-6VGPSt: Permission denied [snip] Add variable TMPDIR as prefix dir of the temporary file, if it is set, replace default /tmp. Signed-off-by: Hongxu Jia Cc: Alexander Shishkin Cc: Hendrik Brueckner Cc: Jiri Olsa Cc: Kim Phillips Cc: Michael Ellerman Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Sébastien Boisvert Cc: Thomas Richter Fixes: 2b5882435606 ("perf arm64: Generate system call table from asm/unistd.h") LPU-Reference: 1539851173-14959-1-git-send-email-hongxu.jia@windriver.com Link: https://lkml.kernel.org/n/tip-1qrgq840ci0c5cy4oww957ge@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 4debef5510071032c6d5dace31ca1cc42a120073 Author: James Morse Date: Fri Sep 21 21:49:19 2018 +0100 arm64: KVM: Guests can skip __install_bp_hardening_cb()s HYP work enable_smccc_arch_workaround_1() passes NULL as the hyp_vecs start and end if the HVC conduit is in use, and ARM_SMCCC_ARCH_WORKAROUND_1 is detected. If the guest kernel happened to be built with KVM_INDIRECT_VECTORS, we go on to allocate a slot, memcpy() the empty workaround in and do the appropriate cache maintenance. This works as we always tell memcpy() the range is 0, so it never accesses the NULL src pointer, but we still do the cache maintenance. If hyp_vecs_start is NULL we know we're a guest, just update the fn like the !KVM_INDIRECT_VECTORS version. Reviewed-by: Julien Thierry Acked-by: Marc Zyngier Signed-off-by: James Morse Signed-off-by: Catalin Marinas commit d8b2a8e9c06bc389659716e81d1c2b1f147611d1 Author: Charles Keepax Date: Fri Oct 19 13:44:38 2018 +0100 regulator: lochnagar: Use a consisent comment style for SPDX header Update the rest of the comment at the start of the file to also use C++ style comments to match the required style of the SPDX header. Signed-off-by: Charles Keepax Signed-off-by: Mark Brown commit e42b4a507efa19a90c63e7968c93c4f82d3bc805 Merge: 1e58e5e59148 e4e11cc0f81e Author: Paolo Bonzini Date: Fri Oct 19 15:24:24 2018 +0200 Merge tag 'kvmarm-for-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm updates for 4.20 - Improved guest IPA space support (32 to 52 bits) - RAS event delivery for 32bit - PMU fixes - Guest entry hardening - Various cleanups commit b61b8bba18fe2b63d38fdaf9b83de25e2d787dfe Author: Jithu Joseph Date: Fri Oct 12 15:51:01 2018 -0700 x86/intel_rdt: Prevent pseudo-locking from using stale pointers When the last CPU in an rdt_domain goes offline, its rdt_domain struct gets freed. Current pseudo-locking code is unaware of this scenario and tries to dereference the freed structure in a few places. Add checks to prevent pseudo-locking code from doing this. While further work is needed to seamlessly restore resource groups (not just pseudo-locking) to their configuration when the domain is brought back online, the immediate issue of invalid pointers is addressed here. Fixes: f4e80d67a5274 ("x86/intel_rdt: Resctrl files reflect pseudo-locked information") Fixes: 443810fe61605 ("x86/intel_rdt: Create debugfs files for pseudo-locking testing") Fixes: 746e08590b864 ("x86/intel_rdt: Create character device exposing pseudo-locked region") Fixes: 33dc3e410a0d9 ("x86/intel_rdt: Make CPU information accessible for pseudo-locked regions") Signed-off-by: Jithu Joseph Signed-off-by: Reinette Chatre Signed-off-by: Thomas Gleixner Cc: fenghua.yu@intel.com Cc: tony.luck@intel.com Cc: gavin.hindman@intel.com Cc: hpa@zytor.com Link: https://lkml.kernel.org/r/231f742dbb7b00a31cc104416860e27dba6b072d.1539384145.git.reinette.chatre@intel.com commit 99c228a994ec8b1580c43631866fd2c5440f5bfd Author: Amir Goldstein Date: Thu Oct 18 14:22:55 2018 +0300 fs: group frequently accessed fields of struct super_block together Kernel test robot reported [1] a 6% performance regression in a concurrent unlink(2) workload on commit 60f7ed8c7c4d ("fsnotify: send path type events to group with super block marks"). The performance test was run with no fsnotify marks at all on the data set, so the only extra instructions added by the offending commit are tests of the super_block fields s_fsnotify_{marks,mask} and these tests happen on almost every single inode access. When adding those fields to the super_block struct, we did not give much thought of placing them on a hot cache lines (we just placed them at the end of the struct). Re-organize struct super_block to try and keep some frequently accessed fields on the same cache line. Move the frequently accessed fields s_fsnotify_{marks,mask} near the frequently accessed fields s_fs_info,s_time_gran, while filling a 64bit alignment hole after s_time_gran. Move the seldom accessed fields s_id,s_uuid,s_max_links,s_mode near the seldom accessed fields s_vfs_rename_mutex,s_subtype. Rong Chen confirmed that this patch solved the reported problem. [1] https://lkml.org/lkml/2018/9/30/206 Reported-by: kernel test robot Tested-by: kernel test robot Fixes: 1e6cb72399 ("fsnotify: add super block object type") Signed-off-by: Amir Goldstein Signed-off-by: Jan Kara commit 89e8b9cb846515e4435eb42df7009b824cf3405a Author: Vignesh R Date: Mon Oct 15 12:08:29 2018 +0530 spi: omap2-mcspi: Add slave mode support Add support to use McSPI controller as SPI slave. In slave mode, DMA TX completion does not mean entire data has been shifted out as data might still be stuck in FIFO waiting for master to clock the bus. Therefore, add an IRQ handler for slave mode to know when entire data in FIFO has been shifted out. Signed-off-by: Vignesh R Signed-off-by: Mark Brown commit b682cffa3ac6d9d9e16e9b413c45caee3b391fab Author: Vignesh R Date: Mon Oct 15 12:08:28 2018 +0530 spi: omap2-mcspi: Set FIFO DMA trigger level to word length McSPI has 32 byte FIFO in Transmit-Receive mode. Current code tries to configuration FIFO watermark level for DMA trigger to be GCD of transfer length and max FIFO size which would mean trigger level may be set to 32 for transmit-receive mode if length is aligned. This does not work in case of SPI slave mode where FIFO always needs to have data ready whenever master starts the clock. With DMA trigger size of 32 there will be a small window during slave TX where DMA is still putting data into FIFO but master would have started clock for next byte, resulting in shifting out of stale data. Similarly, on Slave RX side there may be RX FIFO overflow Fix this by setting FIFO watermark for DMA trigger to word length. This means DMA is triggered as soon as FIFO has space for word length bytes and DMA would make sure FIFO is almost always full therefore improving FIFO occupancy in both master and slave mode. Signed-off-by: Vignesh R Signed-off-by: Mark Brown commit 13d515c796adc49a49b0cd2212ccd7f43a37fc5a Author: Vignesh R Date: Mon Oct 15 12:08:27 2018 +0530 spi: omap2-mcspi: Switch to readl_poll_timeout() Use standard readl_poll_timeout() macro for polling on status bits. Signed-off-by: Vignesh R Signed-off-by: Mark Brown commit c530cd1d9d5e7741c641c5c366ddb4e23aa5caec Author: Ludovic Barre Date: Fri Oct 5 09:43:03 2018 +0200 spi: spi-mem: add stm32 qspi controller The qspi controller is a specialized communication interface targeting single, dual or quad SPI Flash memories (NOR/NAND). It can operate in any of the following modes: -indirect mode: all the operations are performed using the quadspi registers -read memory-mapped mode: the external Flash memory is mapped to the microcontroller address space and is seen by the system as if it was an internal memory tested on: -NOR: mx66l51235l -NAND: MT29F2G01ABAGD Signed-off-by: Ludovic Barre Signed-off-by: Mark Brown commit c3e6845ea0dd52f26675ad32d6a45e3991ba20a6 Author: Ludovic Barre Date: Fri Oct 5 09:43:02 2018 +0200 dt-bindings: spi: add stm32 qspi controller This patch adds the documentation of device tree bindings for the STM32 QSPI controller. It is a specialized communication interface targeting single, dual or quad SPI Flash memories (NOR/NAND). Signed-off-by: Ludovic Barre Reviewed-by: Rob Herring Signed-off-by: Mark Brown commit 7ece50c9f790270e82b77589d34e54547c895a66 Merge: e3a360b8cded 747df19747bc Author: Mark Brown Date: Fri Oct 19 13:31:41 2018 +0100 Merge remote-tracking branch 'asoc/for-4.19' into asoc-4.20 commit e3a360b8cdede74d25807fc405e5d8bfb025692f Author: Richard Fitzgerald Date: Fri Oct 19 13:25:16 2018 +0100 ASoC: wm_adsp: Log addresses as 8 digits in wm_adsp_buffer_populate Increase the address value width in the debug log from 4 digits to 8 digits to allow for DSP cores with larger memory address ranges. Signed-off-by: Richard Fitzgerald Signed-off-by: Mark Brown commit 2a2aefa41ce48ace8e1e963cb10c3f5ff43aa994 Author: Richard Fitzgerald Date: Fri Oct 19 13:25:15 2018 +0100 ASoC: wm_adsp: Rename memory fields in wm_adsp_buffer The wm_adsp_buffer struct is the control header of a circular buffer used to transfer data from the firmware over the control interface to an ALSA compressed stream. The original names of the fields pointing to the data buffer were based on ADSP2V2 memory layout where they correspond to {XM, XM, YM}. But this circular buffer could be used on other types of DSP core that have different memory region types. Also the names and description of the size fields were not very clear. The field names and descriptions have been changed to be generic and not imply any particular memory types. This patch updates the wm_adsp driver to the new field names. Signed-off-by: Richard Fitzgerald Signed-off-by: Mark Brown commit bcb047ebf28453da56f0265aeeb9edc52b797ea7 Author: Axel Lin Date: Thu Oct 4 15:25:58 2018 +0800 regulator: bd718x7: Remove struct bd718xx_pmic All the fields in struct bd718xx_pmic are not really necessary. Remove struct bd718xx_pmic to simplify the code. Signed-off-by: Axel Lin Reviewed-by: Matti Vaittinen Signed-off-by: Mark Brown commit b7c7be6f6bd28ffea7f608ac2d806b8a4bdc82fe Author: Sagi Grimberg Date: Thu Oct 18 17:40:40 2018 -0700 nvme-fabrics: move controller options matching to fabrics IP transports will most likely use the same controller options matching when detecting a duplicate connect. Move it to fabrics. Signed-off-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit 950937624079f8ab78939f1effbe21df8e39d420 Author: Ben Dooks Date: Tue Oct 2 11:42:05 2018 +0100 regmap: use less #ifdef for LOG_DEVICE Move the checking of the LOG_DEVICE into a function to reduce the number of #ifdefs and ensure more of the code gets compiled/checked, and make it easier to change this for internal debugging purposes (such as checking >1 device). Signed-off-by: Ben Dooks Signed-off-by: Mark Brown commit bb59b8e57493465fac8658bba103f7c4cc5d874a Author: Sagi Grimberg Date: Fri Oct 19 00:50:29 2018 -0700 nvme-rdma: always have a valid trsvcid If not passed, we set the default trsvcid. We can rely on having trsvcid and can simplify the controller matching logic. Signed-off-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit 5e8d63a726f8f2fef089515e9a501785cc67dcdc Author: Olivier Moysan Date: Mon Oct 15 16:03:36 2018 +0200 ASoC: cs42l51: add mclk support Add MCLK dapm to allow configuration of cirrus CS42l51 codec as a master clock consumer. Signed-off-by: Olivier Moysan Signed-off-by: Mark Brown commit 8307b2afd386ccce369821daa2196068c47fe8cd Author: Olivier Moysan Date: Mon Oct 15 16:03:35 2018 +0200 ASoC: stm32: sai: set sai as mclk clock provider Add master clock generation support in STM32 SAI. The master clock provided by SAI can be used to feed a codec. Signed-off-by: Olivier Moysan Signed-off-by: Mark Brown commit 1c5083b37deaa99e07cc3082e190a509efd2a225 Author: Olivier Moysan Date: Mon Oct 15 16:03:34 2018 +0200 ASoC: dt-bindings: add mclk support to cs42l51 Add clocks properties to cs42l51 Cirrus codec, to support master clock provider. Signed-off-by: Olivier Moysan Signed-off-by: Mark Brown commit af16112457d8175b444baa9aac02558a1e1154b5 Author: Olivier Moysan Date: Mon Oct 15 16:03:33 2018 +0200 ASoC: dt-bindings: add mclk provider support to stm32 sai add mclk provider support to stm32 sai Signed-off-by: Olivier Moysan Signed-off-by: Mark Brown commit 2c7b696a7589ab14854c132dc732973fbd498d5a Author: Marcel Ziswiler Date: Thu Oct 18 13:18:28 2018 +0200 ASoC: soc-core: fix trivial checkpatch issues Fix a few trivial aka cosmetic only checkpatch issues like long lines, wrong indentations, spurious blanks and newlines, missing newlines, multi-line comments etc. Signed-off-by: Marcel Ziswiler Signed-off-by: Mark Brown commit 3c01b0e129e9486c8004e43eba3a70de7393f645 Author: Charles Keepax Date: Thu Oct 11 17:28:28 2018 +0100 ASoC: dapm: Add support for hw_free on CODEC to CODEC links Currently, on power down for a CODEC to CODEC DAI link we only call digital_mute and shutdown. Provide a little more flexibility for drivers by adding a call to hw_free as well. Signed-off-by: Charles Keepax Signed-off-by: Mark Brown commit 3b796aa60af087f5fec75aee9b17f2130f2b9adc Author: Mauro Carvalho Chehab Date: Fri Oct 19 08:33:02 2018 -0300 media: rename soc_camera I2C drivers Those drivers are part of the legacy SoC camera framework. They're being converted to not use it, but sometimes we're keeping both legacy any new driver. This time, for example, we have two drivers on media with the same name: ov772x. That's bad. So, in order to prevent that to happen, let's prepend the SoC legacy drivers with soc_. No functional changes. Acked-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit af510ebd8913bee016492832f532ed919b51c09c Author: Pablo Neira Ayuso Date: Fri Oct 19 11:48:24 2018 +0200 Revert "netfilter: xt_quota: fix the behavior of xt_quota module" This reverts commit e9837e55b0200da544a095a1fca36efd7fd3ba30. When talking to Maze and Chenbo, we agreed to keep this back by now due to problems in the ruleset listing path with 32-bit arches. Signed-off-by: Maciej Żenczykowski Signed-off-by: Pablo Neira Ayuso commit 468c041cff57e87f18e1022cacf9f5c98bf00b58 Author: Taehee Yoo Date: Thu Oct 18 22:29:59 2018 +0900 netfilter: nfnetlink_log: remove empty nfnetlink_log.h header file /include/net/netfilter/nfnetlink_log.h file is empty. so that it can be removed. Signed-off-by: Taehee Yoo Signed-off-by: Pablo Neira Ayuso commit da8a705ccbe1957c30bc6b6d2160a0fd0bb01c4d Author: Weongyo Jeong Date: Wed Oct 17 21:45:17 2018 +0900 netfilter: remove two unused variables. nft_dup_netdev_ingress_ops and nft_fwd_netdev_ingress_ops variables are no longer used at the code. Signed-off-by: Weongyo Jeong Signed-off-by: Pablo Neira Ayuso commit cdf6b11daa77d4b55ddf0530842a551cc5562a93 Author: Ben Whitten Date: Fri Oct 19 10:33:50 2018 +0100 regmap: Add regmap_noinc_write API The regmap API had a noinc_read function added for instances where devices supported returning data from an internal FIFO in a single read. This commit adds the noinc_write variant to allow writing to a non incrementing register, this is used in devices such as the sx1301 for loading firmware. Signed-off-by: Ben Whitten Signed-off-by: Mark Brown commit 9fe44fc98ce45fe42004be9fd282775030c6b147 Author: Jian-Hong Pan Date: Thu Sep 27 16:50:09 2018 +0800 platform/x86: asus-wmi: Simplify the keyboard brightness updating process The original asus-wmi queues a work which calls the ACPI/WMI methods to update the keyboard LED brightness. Similar drivers - acer-wmi, dell-wmi-led just call the ACPI/WMI methods directly without workqueues. This patch simplifies the keyboard brightness updating process which calls the kbd_led_update function directly without workqueue in asus-wmi. Signed-off-by: Jian-Hong Pan Signed-off-by: Andy Shevchenko commit 9ab2a1bd81f7eaef4b496168dd93e0f23e8906fe Author: Dan Carpenter Date: Thu Oct 18 10:34:30 2018 +0300 ASoC: Intel: kbl_da7219_max98927: minor white space clean up I just added a couple missing tabs. Signed-off-by: Dan Carpenter Signed-off-by: Mark Brown commit a3fb3698cadf27dc142b24394c401625e14d80d0 Author: Taehee Yoo Date: Fri Oct 12 03:46:29 2018 +0900 netfilter: nf_flow_table: do not remove offload when other netns's interface is down When interface is down, offload cleanup function(nf_flow_table_do_cleanup) is called and that checks whether interface index of offload and index of link down interface is same. but only interface index checking is not enough because flowtable is not pernet list. So that, if other netns's interface that has index is same with offload is down, that offload will be removed. This patch adds netns checking code to the offload cleanup routine. Fixes: 59c466dd68e7 ("netfilter: nf_flow_table: add a new flow state for tearing down offloading") Signed-off-by: Taehee Yoo Signed-off-by: Pablo Neira Ayuso commit 5f1be84aad4b520a36246d0c289ad73641277630 Author: Taehee Yoo Date: Fri Oct 12 03:01:54 2018 +0900 netfilter: nf_flow_table: remove unnecessary parameter of nf_flow_table_cleanup() parameter net of nf_flow_table_cleanup() is not used. So that it can be removed. Signed-off-by: Taehee Yoo Signed-off-by: Pablo Neira Ayuso commit b7f1a16d29b2e28d3dcbb070511bd703e306281b Author: Taehee Yoo Date: Tue Oct 2 02:17:14 2018 +0900 netfilter: nf_flow_table: remove flowtable hook flush routine in netns exit routine When device is unregistered, flowtable flush routine is called by notifier_call(nf_tables_flowtable_event). and exit callback of nftables pernet_operation(nf_tables_exit_net) also has flowtable flush routine. but when network namespace is destroyed, both notifier_call and pernet_operation are called. hence flowtable flush routine in pernet_operation is unnecessary. test commands: %ip netns add vm1 %ip netns exec vm1 nft add table ip filter %ip netns exec vm1 nft add flowtable ip filter w \ { hook ingress priority 0\; devices = { lo }\; } %ip netns del vm1 splat looks like: [ 265.187019] WARNING: CPU: 0 PID: 87 at net/netfilter/core.c:309 nf_hook_entry_head+0xc7/0xf0 [ 265.187112] Modules linked in: nf_flow_table_ipv4 nf_flow_table nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink ip_tables x_tables [ 265.187390] CPU: 0 PID: 87 Comm: kworker/u4:2 Not tainted 4.19.0-rc3+ #5 [ 265.187453] Workqueue: netns cleanup_net [ 265.187514] RIP: 0010:nf_hook_entry_head+0xc7/0xf0 [ 265.187546] Code: 8d 81 68 03 00 00 5b c3 89 d0 83 fa 04 48 8d 84 c7 e8 11 00 00 76 81 0f 0b 31 c0 e9 78 ff ff ff 0f 0b 48 83 c4 08 31 c0 5b c3 <0f> 0b 31 c0 e9 65 ff ff ff 0f 0b 31 c0 e9 5c ff ff ff 48 89 0c 24 [ 265.187573] RSP: 0018:ffff88011546f098 EFLAGS: 00010246 [ 265.187624] RAX: ffffffff8d90e135 RBX: 1ffff10022a8de1c RCX: 0000000000000000 [ 265.187645] RDX: 0000000000000000 RSI: 0000000000000005 RDI: ffff880116298040 [ 265.187645] RBP: ffff88010ea4c1a8 R08: 0000000000000000 R09: 0000000000000000 [ 265.187645] R10: ffff88011546f1d8 R11: ffffed0022c532c1 R12: ffff88010ea4c1d0 [ 265.187645] R13: 0000000000000005 R14: dffffc0000000000 R15: ffff88010ea4c1c4 [ 265.187645] FS: 0000000000000000(0000) GS:ffff88011b200000(0000) knlGS:0000000000000000 [ 265.187645] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 265.187645] CR2: 00007fdfb8d00000 CR3: 0000000057a16000 CR4: 00000000001006f0 [ 265.187645] Call Trace: [ 265.187645] __nf_unregister_net_hook+0xca/0x5d0 [ 265.187645] ? nf_hook_entries_free.part.3+0x80/0x80 [ 265.187645] ? save_trace+0x300/0x300 [ 265.187645] nf_unregister_net_hooks+0x2e/0x40 [ 265.187645] nf_tables_exit_net+0x479/0x1340 [nf_tables] [ 265.187645] ? find_held_lock+0x39/0x1c0 [ 265.187645] ? nf_tables_abort+0x30/0x30 [nf_tables] [ 265.187645] ? inet_frag_destroy_rcu+0xd0/0xd0 [ 265.187645] ? trace_hardirqs_on+0x93/0x210 [ 265.187645] ? __bpf_trace_preemptirq_template+0x10/0x10 [ 265.187645] ? inet_frag_destroy_rcu+0xd0/0xd0 [ 265.187645] ? inet_frag_destroy_rcu+0xd0/0xd0 [ 265.187645] ? __mutex_unlock_slowpath+0x17f/0x740 [ 265.187645] ? wait_for_completion+0x710/0x710 [ 265.187645] ? bucket_table_free+0xb2/0x1f0 [ 265.187645] ? nested_table_free+0x130/0x130 [ 265.187645] ? __lock_is_held+0xb4/0x140 [ 265.187645] ops_exit_list.isra.10+0x94/0x140 [ 265.187645] cleanup_net+0x45b/0x900 [ ... ] This WARNING means that hook unregisteration is failed because all flowtables hooks are already unregistered by notifier_call. Network namespace exit routine guarantees that all devices will be unregistered first. then, other exit callbacks of pernet_operations are called. so that removing flowtable flush routine in exit callback of pernet_operation(nf_tables_exit_net) doesn't make flowtable leak. Signed-off-by: Taehee Yoo Signed-off-by: Pablo Neira Ayuso commit 421f0922a2cfb0c75acd9746454aaa576c711a65 Author: Filipe Manana Date: Fri Oct 12 13:02:48 2018 +0100 Btrfs: fix use-after-free during inode eviction At inode.c:evict_inode_truncate_pages(), when we iterate over the inode's extent states, we access an extent state record's "state" field after we unlocked the inode's io tree lock. This can lead to a use-after-free issue because after we unlock the io tree that extent state record might have been freed due to being merged into another adjacent extent state record (a previous inflight bio for a read operation finished in the meanwhile which unlocked a range in the io tree and cause a merge of extent state records, as explained in the comment before the while loop added in commit 6ca0709756710 ("Btrfs: fix hang during inode eviction due to concurrent readahead")). Fix this by keeping a copy of the extent state's flags in a local variable and using it after unlocking the io tree. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=201189 Fixes: b9d0b38928e2 ("btrfs: Add handler for invalidate page") CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit c495144bc6962186feae31d687596d2472000e45 Author: Josef Bacik Date: Fri Oct 12 15:32:32 2018 -0400 btrfs: move the dio_sem higher up the callchain We're getting a lockdep splat because we take the dio_sem under the log_mutex. What we really need is to protect fsync() from logging an extent map for an extent we never waited on higher up, so just guard the whole thing with dio_sem. ====================================================== WARNING: possible circular locking dependency detected 4.18.0-rc4-xfstests-00025-g5de5edbaf1d4 #411 Not tainted ------------------------------------------------------ aio-dio-invalid/30928 is trying to acquire lock: 0000000092621cfd (&mm->mmap_sem){++++}, at: get_user_pages_unlocked+0x5a/0x1e0 but task is already holding lock: 00000000cefe6b35 (&ei->dio_sem){++++}, at: btrfs_direct_IO+0x3be/0x400 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #5 (&ei->dio_sem){++++}: lock_acquire+0xbd/0x220 down_write+0x51/0xb0 btrfs_log_changed_extents+0x80/0xa40 btrfs_log_inode+0xbaf/0x1000 btrfs_log_inode_parent+0x26f/0xa80 btrfs_log_dentry_safe+0x50/0x70 btrfs_sync_file+0x357/0x540 do_fsync+0x38/0x60 __ia32_sys_fdatasync+0x12/0x20 do_fast_syscall_32+0x9a/0x2f0 entry_SYSENTER_compat+0x84/0x96 -> #4 (&ei->log_mutex){+.+.}: lock_acquire+0xbd/0x220 __mutex_lock+0x86/0xa10 btrfs_record_unlink_dir+0x2a/0xa0 btrfs_unlink+0x5a/0xc0 vfs_unlink+0xb1/0x1a0 do_unlinkat+0x264/0x2b0 do_fast_syscall_32+0x9a/0x2f0 entry_SYSENTER_compat+0x84/0x96 -> #3 (sb_internal#2){.+.+}: lock_acquire+0xbd/0x220 __sb_start_write+0x14d/0x230 start_transaction+0x3e6/0x590 btrfs_evict_inode+0x475/0x640 evict+0xbf/0x1b0 btrfs_run_delayed_iputs+0x6c/0x90 cleaner_kthread+0x124/0x1a0 kthread+0x106/0x140 ret_from_fork+0x3a/0x50 -> #2 (&fs_info->cleaner_delayed_iput_mutex){+.+.}: lock_acquire+0xbd/0x220 __mutex_lock+0x86/0xa10 btrfs_alloc_data_chunk_ondemand+0x197/0x530 btrfs_check_data_free_space+0x4c/0x90 btrfs_delalloc_reserve_space+0x20/0x60 btrfs_page_mkwrite+0x87/0x520 do_page_mkwrite+0x31/0xa0 __handle_mm_fault+0x799/0xb00 handle_mm_fault+0x7c/0xe0 __do_page_fault+0x1d3/0x4a0 async_page_fault+0x1e/0x30 -> #1 (sb_pagefaults){.+.+}: lock_acquire+0xbd/0x220 __sb_start_write+0x14d/0x230 btrfs_page_mkwrite+0x6a/0x520 do_page_mkwrite+0x31/0xa0 __handle_mm_fault+0x799/0xb00 handle_mm_fault+0x7c/0xe0 __do_page_fault+0x1d3/0x4a0 async_page_fault+0x1e/0x30 -> #0 (&mm->mmap_sem){++++}: __lock_acquire+0x42e/0x7a0 lock_acquire+0xbd/0x220 down_read+0x48/0xb0 get_user_pages_unlocked+0x5a/0x1e0 get_user_pages_fast+0xa4/0x150 iov_iter_get_pages+0xc3/0x340 do_direct_IO+0xf93/0x1d70 __blockdev_direct_IO+0x32d/0x1c20 btrfs_direct_IO+0x227/0x400 generic_file_direct_write+0xcf/0x180 btrfs_file_write_iter+0x308/0x58c aio_write+0xf8/0x1d0 io_submit_one+0x3a9/0x620 __ia32_compat_sys_io_submit+0xb2/0x270 do_int80_syscall_32+0x5b/0x1a0 entry_INT80_compat+0x88/0xa0 other info that might help us debug this: Chain exists of: &mm->mmap_sem --> &ei->log_mutex --> &ei->dio_sem Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&ei->dio_sem); lock(&ei->log_mutex); lock(&ei->dio_sem); lock(&mm->mmap_sem); *** DEADLOCK *** 1 lock held by aio-dio-invalid/30928: #0: 00000000cefe6b35 (&ei->dio_sem){++++}, at: btrfs_direct_IO+0x3be/0x400 stack backtrace: CPU: 0 PID: 30928 Comm: aio-dio-invalid Not tainted 4.18.0-rc4-xfstests-00025-g5de5edbaf1d4 #411 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 Call Trace: dump_stack+0x7c/0xbb print_circular_bug.isra.37+0x297/0x2a4 check_prev_add.constprop.45+0x781/0x7a0 ? __lock_acquire+0x42e/0x7a0 validate_chain.isra.41+0x7f0/0xb00 __lock_acquire+0x42e/0x7a0 lock_acquire+0xbd/0x220 ? get_user_pages_unlocked+0x5a/0x1e0 down_read+0x48/0xb0 ? get_user_pages_unlocked+0x5a/0x1e0 get_user_pages_unlocked+0x5a/0x1e0 get_user_pages_fast+0xa4/0x150 iov_iter_get_pages+0xc3/0x340 do_direct_IO+0xf93/0x1d70 ? __alloc_workqueue_key+0x358/0x490 ? __blockdev_direct_IO+0x14b/0x1c20 __blockdev_direct_IO+0x32d/0x1c20 ? btrfs_run_delalloc_work+0x40/0x40 ? can_nocow_extent+0x490/0x490 ? kvm_clock_read+0x1f/0x30 ? can_nocow_extent+0x490/0x490 ? btrfs_run_delalloc_work+0x40/0x40 btrfs_direct_IO+0x227/0x400 ? btrfs_run_delalloc_work+0x40/0x40 generic_file_direct_write+0xcf/0x180 btrfs_file_write_iter+0x308/0x58c aio_write+0xf8/0x1d0 ? kvm_clock_read+0x1f/0x30 ? __might_fault+0x3e/0x90 io_submit_one+0x3a9/0x620 ? io_submit_one+0xe5/0x620 __ia32_compat_sys_io_submit+0xb2/0x270 do_int80_syscall_32+0x5b/0x1a0 entry_INT80_compat+0x88/0xa0 CC: stable@vger.kernel.org # 4.14+ Reviewed-by: Filipe Manana Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit 30928e9baac238a7330085a1c5747f0b5df444b4 Author: Josef Bacik Date: Thu Oct 11 15:54:31 2018 -0400 btrfs: don't run delayed_iputs in commit This could result in a really bad case where we do something like evict evict_refill_and_join btrfs_commit_transaction btrfs_run_delayed_iputs evict evict_refill_and_join btrfs_commit_transaction ... forever We have plenty of other places where we run delayed iputs that are much safer, let those do the work. CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Filipe Manana Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 80ee54bfe8a3850015585ebc84e8d207fcae6831 Author: Josef Bacik Date: Thu Oct 11 15:54:22 2018 -0400 btrfs: fix insert_reserved error handling We were not handling the reserved byte accounting properly for data references. Metadata was fine, if it errored out the error paths would free the bytes_reserved count and pin the extent, but it even missed one of the error cases. So instead move this handling up into run_one_delayed_ref so we are sure that both cases are properly cleaned up in case of a transaction abort. CC: stable@vger.kernel.org # 4.18+ Reviewed-by: Nikolay Borisov Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 49940bdd57779c78462da7aa5a8650b2fea8c2ff Author: Josef Bacik Date: Thu Oct 11 15:54:21 2018 -0400 btrfs: only free reserved extent if we didn't insert it When we insert the file extent once the ordered extent completes we free the reserved extent reservation as it'll have been migrated to the bytes_used counter. However if we error out after this step we'll still clear the reserved extent reservation, resulting in a negative accounting of the reserved bytes for the block group and space info. Fix this by only doing the free if we didn't successfully insert a file extent for this extent. CC: stable@vger.kernel.org # 4.14+ Reviewed-by: Omar Sandoval Reviewed-by: Filipe Manana Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit fb5c39d7a887108087de6ff93d3f326b01b4ef41 Author: Josef Bacik Date: Thu Oct 11 15:54:09 2018 -0400 btrfs: don't use ctl->free_space for max_extent_size max_extent_size is supposed to be the largest contiguous range for the space info, and ctl->free_space is the total free space in the block group. We need to keep track of these separately and _only_ use the max_free_space if we don't have a max_extent_size, as that means our original request was too large to search any of the block groups for and therefore wouldn't have a max_extent_size set. CC: stable@vger.kernel.org # 4.14+ Reviewed-by: Filipe Manana Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit ad22cf6ea47fa20fbe11ac324a0a15c0a9a4a2a9 Author: Josef Bacik Date: Fri Oct 12 15:32:33 2018 -0400 btrfs: set max_extent_size properly We can't use entry->bytes if our entry is a bitmap entry, we need to use entry->max_extent_size in that case. Fix up all the logic to make this consistent. CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 21a94f7acf0f748599ea552af5d9ee7d7e41c72f Author: Josef Bacik Date: Thu Oct 11 15:54:03 2018 -0400 btrfs: reset max_extent_size properly If we use up our block group before allocating a new one we'll easily get a max_extent_size that's set really really low, which will result in a lot of fragmentation. We need to make sure we're resetting the max_extent_size when we add a new chunk or add new space. CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Filipe Manana Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit b2b5b6502c3ddc448be825974036ef4d8966e888 Author: Josef Bacik Date: Thu Oct 11 15:54:24 2018 -0400 MAINTAINERS: update my email address for btrfs My work email is completely useless, switch it to my personal address so I get emails on a account I actually pay attention to. Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit e4e11cc0f81ee7be17d6f6fb96128a6d51c0e838 Author: Christoffer Dall Date: Wed Oct 17 20:21:16 2018 +0200 KVM: arm64: Safety check PSTATE when entering guest and handle IL This commit adds a paranoid check when entering the guest to make sure we don't attempt running guest code in an equally or more privilged mode than the hypervisor. We also catch other accidental programming of the SPSR_EL2 which results in an illegal exception return and report this safely back to the user. Signed-off-by: Christoffer Dall Signed-off-by: Marc Zyngier commit 8d9fcacff9dc4445de4ced2dbe63b792174206d5 Author: Paul Mackerras Date: Fri Oct 19 20:44:04 2018 +1100 KVM: PPC: Book3S HV: Don't use streamlined entry path on early POWER9 chips This disables the use of the streamlined entry path for radix guests on early POWER9 chips that need the workaround added in commit a25bd72badfa ("powerpc/mm/radix: Workaround prefetch issue with KVM", 2017-07-24), because the streamlined entry path does not include that workaround. This also means that we can't do nested HV-KVM on those chips. Since the chips that need that workaround are the same ones that can't run both radix and HPT guests at the same time on different threads of a core, we use the existing 'no_mixing_hpt_and_radix' variable that identifies those chips to identify when we can't use the new guest entry path, and when we can't do nested virtualization. Signed-off-by: Paul Mackerras commit 7b0f61e91b6056c71649efa3204112a4b6cf5fc8 Author: Lyude Paul Date: Mon Oct 8 19:24:31 2018 -0400 drm/nouveau: Fix nv50_mstc->best_encoder() As mentioned in the previous commit, we currently prevent new modesets on recently-removed MST connectors by returning no encoder from our ->best_encoder() callback once the MST port has disappeared. This is wrong however, because it prevents legacy modesetting users from being able to disable CRTCs on MST connectors after the connector's respective topology has disappeared. So, fix this by instead by just always returning a valid encoder. Changes since v2: - Remove usage of atomic MST helper for now, since that got replaced with a much simpler solution Signed-off-by: Lyude Paul Reviewed-by: Daniel Vetter Reviewed-by: Ben Skeggs Cc: stable@vger.kernel.org Link: https://patchwork.freedesktop.org/patch/msgid/20181008232437.5571-3-lyude@redhat.com (cherry picked from commit e87b0bbc9f0380d403f8f2f6abba0d51c74d944f) Signed-off-by: Joonas Lahtinen commit de9f8eea5a44b0b756d3d6345af7f8e630a3c8c0 Author: Lyude Paul Date: Tue Oct 16 16:39:46 2018 -0400 drm/atomic_helper: Stop modesets on unregistered connectors harder Unfortunately, it appears our fix in: commit b5d29843d8ef ("drm/atomic_helper: Allow DPMS On<->Off changes for unregistered connectors") Which attempted to work around the problems introduced by: commit 4d80273976bf ("drm/atomic_helper: Disallow new modesets on unregistered connectors") Is still not the right solution, as modesets can still be triggered outside of drm_atomic_set_crtc_for_connector(). So in order to fix this, while still being careful that we don't break modesets that a driver may perform before being registered with userspace, we replace connector->registered with a tristate member, connector->registration_state. This allows us to keep track of whether or not a connector is still initializing and hasn't been exposed to userspace, is currently registered and exposed to userspace, or has been legitimately removed from the system after having once been present. Using this info, we can prevent userspace from performing new modesets on unregistered connectors while still allowing the driver to perform modesets on unregistered connectors before the driver has finished being registered. Changes since v1: - Fix WARN_ON() in drm_connector_cleanup() that CI caught with this patchset in igt@drv_module_reload@basic-reload-inject and igt@drv_module_reload@basic-reload by checking if the connector is registered instead of unregistered, as calling drm_connector_cleanup() on a connector that hasn't been registered with userspace yet should stay valid. - Remove unregistered_connector_check(), and just go back to what we were doing before in commit 4d80273976bf ("drm/atomic_helper: Disallow new modesets on unregistered connectors") except replacing READ_ONCE(connector->registered) with drm_connector_is_unregistered(). This gets rid of the behavior of allowing DPMS On<->Off, but that should be fine as it's more consistent with the UAPI we had before - danvet - s/drm_connector_unregistered/drm_connector_is_unregistered/ - danvet - Update documentation, fix some typos. Fixes: b5d29843d8ef ("drm/atomic_helper: Allow DPMS On<->Off changes for unregistered connectors") Cc: Ville Syrjälä Cc: Daniel Vetter Cc: Rodrigo Vivi Cc: stable@vger.kernel.org Cc: David Airlie Signed-off-by: Lyude Paul Reviewed-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20181016203946.9601-1-lyude@redhat.com (cherry picked from commit 39b50c603878f4f8ae541ac4088a805d588abc79) Fixes: e96550956fbc ("drm/atomic_helper: Disallow new modesets on unregistered connectors") Fixes: 34ca26a98ad6 ("drm/atomic_helper: Allow DPMS On<->Off changes for unregistered connectors") Cc: stable@vger.kernel.org Signed-off-by: Joonas Lahtinen commit 34ca26a98ad67edd6e4870fe2d4aa047d41a51dd Author: Lyude Paul Date: Tue Oct 9 16:44:24 2018 -0400 drm/atomic_helper: Allow DPMS On<->Off changes for unregistered connectors It appears when testing my previous fix for some of the legacy modesetting issues with MST, I misattributed some kernel splats that started appearing on my machine after a rebase as being from upstream. But it appears they actually came from my patch series: [ 2.980512] [drm:drm_atomic_helper_check_modeset [drm_kms_helper]] Updating routing for [CONNECTOR:65:eDP-1] [ 2.980516] [drm:drm_atomic_helper_check_modeset [drm_kms_helper]] [CONNECTOR:65:eDP-1] is not registered [ 2.980516] ------------[ cut here ]------------ [ 2.980519] Could not determine valid watermarks for inherited state [ 2.980553] WARNING: CPU: 3 PID: 551 at drivers/gpu/drm/i915/intel_display.c:14983 intel_modeset_init+0x14d7/0x19f0 [i915] [ 2.980556] Modules linked in: i915(O+) i2c_algo_bit drm_kms_helper(O) syscopyarea sysfillrect sysimgblt fb_sys_fops drm(O) intel_rapl x86_pkg_temp_thermal iTCO_wdt wmi_bmof coretemp crc32_pclmul psmouse i2c_i801 mei_me mei i2c_core lpc_ich mfd_core tpm_tis tpm_tis_core wmi tpm thinkpad_acpi pcc_cpufreq video ehci_pci crc32c_intel serio_raw ehci_hcd xhci_pci xhci_hcd [ 2.980577] CPU: 3 PID: 551 Comm: systemd-udevd Tainted: G O 4.19.0-rc7Lyude-Test+ #1 [ 2.980579] Hardware name: LENOVO 20BWS1KY00/20BWS1KY00, BIOS JBET63WW (1.27 ) 11/10/2016 [ 2.980605] RIP: 0010:intel_modeset_init+0x14d7/0x19f0 [i915] [ 2.980607] Code: 89 df e8 ec 27 02 00 e9 24 f2 ff ff be 03 00 00 00 48 89 df e8 da 27 02 00 e9 26 f2 ff ff 48 c7 c7 c8 d1 34 a0 e8 23 cf dc e0 <0f> 0b e9 7c fd ff ff f6 c4 04 0f 85 37 f7 ff ff 48 8b 83 60 08 00 [ 2.980611] RSP: 0018:ffffc90000287988 EFLAGS: 00010282 [ 2.980614] RAX: 0000000000000000 RBX: ffff88031b488000 RCX: 0000000000000006 [ 2.980617] RDX: 0000000000000007 RSI: 0000000000000086 RDI: ffff880321ad54d0 [ 2.980620] RBP: ffffc90000287a10 R08: 000000000000040a R09: 0000000000000065 [ 2.980623] R10: ffff88030ebb8f00 R11: ffffffff81416590 R12: ffff88031b488000 [ 2.980626] R13: ffff88031b4883a0 R14: ffffc900002879a8 R15: ffff880319099800 [ 2.980630] FS: 00007f475620d180(0000) GS:ffff880321ac0000(0000) knlGS:0000000000000000 [ 2.980633] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2.980636] CR2: 00007f9ef28018a0 CR3: 000000031b72c001 CR4: 00000000003606e0 [ 2.980639] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 2.980642] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 2.980645] Call Trace: [ 2.980675] i915_driver_load+0xb0e/0xdc0 [i915] [ 2.980681] ? kernfs_add_one+0xe7/0x130 [ 2.980709] i915_pci_probe+0x46/0x60 [i915] [ 2.980715] pci_device_probe+0xd4/0x150 [ 2.980719] really_probe+0x243/0x3b0 [ 2.980722] driver_probe_device+0xba/0x100 [ 2.980726] __driver_attach+0xe4/0x110 [ 2.980729] ? driver_probe_device+0x100/0x100 [ 2.980733] bus_for_each_dev+0x74/0xb0 [ 2.980736] driver_attach+0x1e/0x20 [ 2.980739] bus_add_driver+0x159/0x230 [ 2.980743] ? 0xffffffffa0393000 [ 2.980746] driver_register+0x70/0xc0 [ 2.980749] ? 0xffffffffa0393000 [ 2.980753] __pci_register_driver+0x57/0x60 [ 2.980780] i915_init+0x55/0x58 [i915] [ 2.980785] do_one_initcall+0x4a/0x1c4 [ 2.980789] ? do_init_module+0x27/0x210 [ 2.980793] ? kmem_cache_alloc_trace+0x131/0x190 [ 2.980797] do_init_module+0x60/0x210 [ 2.980800] load_module+0x2063/0x22e0 [ 2.980804] ? vfs_read+0x116/0x140 [ 2.980807] ? vfs_read+0x116/0x140 [ 2.980811] __do_sys_finit_module+0xbd/0x120 [ 2.980814] ? __do_sys_finit_module+0xbd/0x120 [ 2.980818] __x64_sys_finit_module+0x1a/0x20 [ 2.980821] do_syscall_64+0x5a/0x110 [ 2.980824] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2.980826] RIP: 0033:0x7f4754e32879 [ 2.980828] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d f7 45 2c 00 f7 d8 64 89 01 48 [ 2.980831] RSP: 002b:00007fff43fd97d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 2.980834] RAX: ffffffffffffffda RBX: 0000559a44ca64f0 RCX: 00007f4754e32879 [ 2.980836] RDX: 0000000000000000 RSI: 00007f475599f4cd RDI: 0000000000000018 [ 2.980838] RBP: 00007f475599f4cd R08: 0000000000000000 R09: 0000000000000000 [ 2.980839] R10: 0000000000000018 R11: 0000000000000246 R12: 0000000000000000 [ 2.980841] R13: 0000559a44c92fd0 R14: 0000000000020000 R15: 0000000000000000 [ 2.980881] WARNING: CPU: 3 PID: 551 at drivers/gpu/drm/i915/intel_display.c:14983 intel_modeset_init+0x14d7/0x19f0 [i915] [ 2.980884] ---[ end trace 5eb47a76277d4731 ]--- The cause of this appears to be due to the fact that if there's pre-existing display state that was set by the BIOS when i915 loads, it will attempt to perform a modeset before the driver is registered with userspace. Since this happens before the driver's registered with userspace, it's connectors are also unregistered and thus-states which would turn on DPMS on a connector end up getting rejected since the connector isn't registered. These bugs managed to get past Intel's CI partially due to the fact it never ran a full test on my patches for some reason, but also because all of the tests unload the GPU once before running. Since this bug is only really triggered when the drivers tries to perform a modeset before it's been fully registered with userspace when coming from whatever display configuration the firmware left us with, it likely would never have been picked up by CI in the first place. After some discussion with vsyrjala, we decided the best course of action would be to just move the unregistered connector checks out of update_connector_routing() and into drm_atomic_set_crtc_for_connector(). The reason for this being that legacy modesetting isn't going to be expecting failures anywhere (at least this is the case with X), so ideally we want to ensure that any DPMS changes will still work even on unregistered connectors. Instead, we now only reject new modesets which would change the current CRTC assigned to an unregistered connector unless no new CRTC is being assigned to replace the connector's previous one. Signed-off-by: Lyude Paul Reported-by: Ville Syrjälä Fixes: 4d80273976bf ("drm/atomic_helper: Disallow new modesets on unregistered connectors") Cc: Daniel Vetter Cc: Ville Syrjälä Cc: stable@vger.kernel.org Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20181009204424.21462-1-lyude@redhat.com (cherry picked from commit b5d29843d8ef86d4cde4742e095b81b7fd41e688) Fixes: e96550956fbc ("drm/atomic_helper: Disallow new modesets on unregistered connectors") Signed-off-by: Joonas Lahtinen commit e96550956fbcd090629c0e2b5b8cded2eded2adf Author: Lyude Paul Date: Mon Oct 8 19:24:30 2018 -0400 drm/atomic_helper: Disallow new modesets on unregistered connectors With the exception of modesets which would switch the DPMS state of a connector from on to off, we want to make sure that we disallow all modesets which would result in enabling a new monitor or a new mode configuration on a monitor if the connector for the display in question is no longer registered. This allows us to stop userspace from trying to enable new displays on connectors for an MST topology that were just removed from the system, without preventing userspace from disabling DPMS on those connectors. Changes since v5: - Fix typo in comment, nothing else Signed-off-by: Lyude Paul Reviewed-by: Daniel Vetter Cc: stable@vger.kernel.org Link: https://patchwork.freedesktop.org/patch/msgid/20181008232437.5571-2-lyude@redhat.com (cherry picked from commit 4d80273976bf880c4bed9359b8f2d45663140c86) Signed-off-by: Joonas Lahtinen commit 042c1a5a6021f73c10dc84958c287eb2a2a26f7c Merge: 5cc1b66e63ec 53c83b59759c Author: Boris Brezillon Date: Fri Oct 19 09:20:09 2018 +0200 Merge tag 'nand/for-4.20' of git://git.infradead.org/linux-mtd into mtd/next NAND core changes: - Two batchs of cleanups of the NAND API, including: * Deprecating a lot of interfaces (now replaced by ->exec_op()). * Moving code in separate drivers (JEDEC, ONFI), in private files (internals), in platform drivers, etc. * Functions/structures reordering. * Exclusive use of the nand_chip structure instead of the MTD one all across the subsystem. - Addition of the nand_wait_readrdy/rdy_op() helpers. Raw NAND controllers drivers changes: - Various coccinelle patches. - Marvell: * Use regmap_update_bits() for syscon access. * More documentation. * BCH failure path rework. * More layouts to be supported. * IRQ handler complete() condition fixed. - Fsl_ifc: * SRAM initialization fixed for newer controller versions. - Denali: * Fix licenses mismatch and use a SPDX tag. * Set SPARE_AREA_SKIP_BYTES register to 8 if unset. - Qualcomm: * Do not include dma-direct.h. - Docg4: * Removed. - Ams-delta: * Use of a GPIO lookup table * Internal machinery changes. Raw NAND chip drivers changes: - Toshiba: * Add support for Toshiba memory BENAND * Pass a single nand_chip object to the status helper. - ESMT: * New driver to retrieve the ECC requirements from the 5th ID byte. commit 5cc1b66e63ecb0661c00b26a733406eef7386da7 Merge: 92e2921f7eee 41fe242979e4 Author: Boris Brezillon Date: Fri Oct 19 09:16:55 2018 +0200 Merge tag 'spi-nor/for-4.20' of git://git.infradead.org/linux-mtd into mtd/next Core changes: * Support non-uniform erase size * Support controllers with limited TX fifo size Driver changes: * m25p80: Re-issue a WREN command after each write access * cadence: Pass a proper dir value to dma_[un]map_single() * fsl-qspi: Check fsl_qspi_get_seqid() return val make sure 4B addressing opcodes are properly handled * intel-spi: Add a new PCI entry for Ice Lake commit 886643b766321f15f63bd950be618cbb6dd22bbc Author: Christoph Hellwig Date: Mon Oct 8 09:12:01 2018 +0200 arm64: use the generic swiotlb_dma_ops Now that the generic swiotlb code supports non-coherent DMA we can switch to it for arm64. For that we need to refactor the existing alloc/free/mmap/pgprot helpers to be used as the architecture hooks, and implement the standard arch_sync_dma_for_{device,cpu} hooks for cache maintaincance in the streaming dma hooks, which also implies using the generic dma_coherent flag in struct device. Note that we need to keep the old is_device_dma_coherent function around for now, so that the shared arm/arm64 Xen code keeps working. Signed-off-by: Christoph Hellwig Acked-by: Catalin Marinas commit a4a4330db46a17289cf2ca5f9fb153d536267b97 Author: Christoph Hellwig Date: Fri Oct 19 08:51:53 2018 +0200 swiotlb: add support for non-coherent DMA Handle architectures that are not cache coherent directly in the main swiotlb code by calling arch_sync_dma_for_{device,cpu} in all the right places from the various dma_map/unmap/sync methods when the device is non-coherent. Because swiotlb now uses dma_direct_alloc for the coherent allocation that side is already taken care of by the dma-direct code calling into arch_dma_{alloc,free} for devices that are non-coherent. Signed-off-by: Christoph Hellwig Acked-by: Konrad Rzeszutek Wilk commit fafadcd16595c1df82df399f62421718ec9bf70a Author: Christoph Hellwig Date: Sun Sep 30 16:13:33 2018 -0700 swiotlb: don't dip into swiotlb pool for coherent allocations All architectures that support swiotlb also have a zone that backs up these less than full addressing allocations (usually ZONE_DMA32). Because of that it is rather pointless to fall back to the global swiotlb buffer if the normal dma direct allocation failed - the only thing this will do is to eat up bounce buffers that would be more useful to serve streaming mappings. Signed-off-by: Christoph Hellwig Acked-by: Catalin Marinas Acked-by: Konrad Rzeszutek Wilk commit 1ff2fea5e30ca15752777441ecb64a169fe22e9e Author: ndesaulniers@google.com Date: Mon Oct 15 14:24:27 2018 -0700 compiler-gcc: remove comment about gcc 4.5 from unreachable() Remove the comment about being unable to detect __builtin_unreachable. __builtin_unreachable was implemented in the GCC 4.5 timeframe. The kernel's minimum supported version of GCC is 4.6 since commit cafa0010cd51 ("Raise the minimum required gcc version to 4.6"). Commit cb984d101b30 ("compiler-gcc: integrate the various compiler-gcc[345].h files") shows that unreachable() had different guards based on GCC version. Suggested-by: Miguel Ojeda Signed-off-by: Nick Desaulniers Signed-off-by: Miguel Ojeda commit fe0640eb30b7da261ae84d252ed9ed3c7e68dfd8 Author: ndesaulniers@google.com Date: Mon Oct 15 10:22:21 2018 -0700 compiler.h: update definition of unreachable() Fixes the objtool warning seen with Clang: arch/x86/mm/fault.o: warning: objtool: no_context()+0x220: unreachable instruction Fixes commit 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h mutually exclusive") Josh noted that the fallback definition was meant to work around a pre-gcc-4.6 bug. GCC still needs to work around https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82365, so compiler-gcc.h defines its own version of unreachable(). Clang and ICC can use this shared definition. Link: https://github.com/ClangBuiltLinux/linux/issues/204 Suggested-by: Andy Lutomirski Suggested-by: Josh Poimboeuf Tested-by: Nathan Chancellor Signed-off-by: Nick Desaulniers Signed-off-by: Miguel Ojeda commit c4dae366925f929749b2a26efa53b561904a9a4f Author: Christoph Hellwig Date: Mon Aug 20 16:21:10 2018 +0200 swiotlb: refactor swiotlb_map_page Remove the somewhat useless map_single function, and replace it with a swiotlb_bounce_page handler that handles everything related to actually bouncing a page. Signed-off-by: Christoph Hellwig Reviewed-by: Robin Murphy Reviewed-by: Konrad Rzeszutek Wilk commit 4803b44e68fc08e76f00dec90074d199a11ad6f5 Author: Christoph Hellwig Date: Mon Aug 20 15:56:05 2018 +0200 swiotlb: use swiotlb_map_page in swiotlb_map_sg_attrs No need to duplicate the code - map_sg is equivalent to map_page for each page in the scatterlist. Signed-off-by: Christoph Hellwig Reviewed-by: Robin Murphy Reviewed-by: Konrad Rzeszutek Wilk commit 27744e0077f4c8b40aaa3126256708c21e56655d Author: Christoph Hellwig Date: Thu Apr 12 09:56:56 2018 +0200 swiotlb: merge swiotlb_unmap_page and unmap_single Signed-off-by: Christoph Hellwig Reviewed-by: Robin Murphy Reviewed-by: Konrad Rzeszutek Wilk commit dff8d6c1ed584de65aac40494d3e7468c50980c3 Author: Christoph Hellwig Date: Thu Aug 16 15:30:39 2018 +0300 swiotlb: remove the overflow buffer Like all other dma mapping drivers just return an error code instead of an actual memory buffer. The reason for the overflow buffer was that at the time swiotlb was invented there was no way to check for dma mapping errors, but this has long been fixed. Signed-off-by: Christoph Hellwig Acked-by: Catalin Marinas Reviewed-by: Robin Murphy Reviewed-by: Konrad Rzeszutek Wilk commit 8088546832aa2c0d8f99dd56edf6384f8a9b63b3 Author: Christoph Hellwig Date: Thu Apr 12 10:38:08 2018 +0200 swiotlb: do not panic on mapping failures All properly written drivers now have error handling in the dma_map_single / dma_map_page callers. As swiotlb_tbl_map_single already prints a useful warning when running out of swiotlb pool space we can also remove swiotlb_full entirely as it serves no purpose now. Signed-off-by: Christoph Hellwig Reviewed-by: Robin Murphy commit b65125c6acf38388d3342b37c18c3b6cc97eeb75 Author: Christoph Hellwig Date: Thu Apr 12 14:49:23 2018 +0200 swiotlb: mark is_swiotlb_buffer static Signed-off-by: Christoph Hellwig Reviewed-by: Robin Murphy Reviewed-by: Konrad Rzeszutek Wilk commit 21bb9d64c5adc0a87c3736bc9a2d386023b88a5b Author: Christoph Hellwig Date: Thu Apr 12 10:46:01 2018 +0200 swiotlb: remove a pointless comment This comments describes an aspect of the map_sg interface that isn't even exploited by swiotlb. Signed-off-by: Christoph Hellwig Reviewed-by: Robin Murphy Reviewed-by: Konrad Rzeszutek Wilk commit 63c19be095d0f8eb8992674991e44b4228bd4179 Author: Ingo Franzki Date: Wed Oct 17 17:24:43 2018 +0200 s390/pkey: Load pkey kernel module automatically With the recent enhancements of the pkey kernel module, the pkey kernel module should be loaded automatically during system startup, if MSA is available. When used for swap device encryption with random protected keys, pkey must be loaded before /etc/crypttab is processed, otherwise the sysfs attributes to read the key from are not available. Signed-off-by: Ingo Franzki Reviewed-by: Hendrik Brueckner Reviewed-by: Harald Freudenberger Signed-off-by: Martin Schwidefsky commit ec0c0bb489727de0d4dca6a00be6970ab8a3b30a Author: Thomas Richter Date: Mon Oct 15 14:39:29 2018 +0100 s390/perf: Return error when debug_register fails Return an error when the function debug_register() fails allocating the debug handle. Also remove the registered debug handle when the initialization fails later on. Signed-off-by: Thomas Richter Reviewed-by: Hendrik Brueckner Signed-off-by: Martin Schwidefsky commit 01a14bda11add9dcd4a59200f13834d634559935 Author: Waiman Long Date: Thu Oct 18 21:45:18 2018 -0400 locking/lockdep: Make global debug_locks* variables read-mostly Make the frequently used lockdep global variable debug_locks read-mostly. As debug_locks_silent is sometime used together with debug_locks, it is also made read-mostly so that they can be close together. With false cacheline sharing, cacheline contention problem can happen depending on what get put into the same cacheline as debug_locks. Signed-off-by: Waiman Long Cc: Andrew Morton Cc: Linus Torvalds Cc: Paul E. McKenney Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Will Deacon Link: http://lkml.kernel.org/r/1539913518-15598-2-git-send-email-longman@redhat.com Signed-off-by: Ingo Molnar commit 9506a7425b094d2f1d9c877ed5a78f416669269b Author: Waiman Long Date: Thu Oct 18 21:45:17 2018 -0400 locking/lockdep: Fix debug_locks off performance problem It was found that when debug_locks was turned off because of a problem found by the lockdep code, the system performance could drop quite significantly when the lock_stat code was also configured into the kernel. For instance, parallel kernel build time on a 4-socket x86-64 server nearly doubled. Further analysis into the cause of the slowdown traced back to the frequent call to debug_locks_off() from the __lock_acquired() function probably due to some inconsistent lockdep states with debug_locks off. The debug_locks_off() function did an unconditional atomic xchg to write a 0 value into debug_locks which had already been set to 0. This led to severe cacheline contention in the cacheline that held debug_locks. As debug_locks is being referenced in quite a few different places in the kernel, this greatly slow down the system performance. To prevent that trashing of debug_locks cacheline, lock_acquired() and lock_contended() now checks the state of debug_locks before proceeding. The debug_locks_off() function is also modified to check debug_locks before calling __debug_locks_off(). Signed-off-by: Waiman Long Cc: Andrew Morton Cc: Linus Torvalds Cc: Paul E. McKenney Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Will Deacon Link: http://lkml.kernel.org/r/1539913518-15598-1-git-send-email-longman@redhat.com Signed-off-by: Ingo Molnar commit f2bfc71aee75feff33ca659322b72ffeed5a243d Merge: c13bbf4a78aa 835fe6d75d14 Author: Dave Airlie Date: Fri Oct 19 14:28:10 2018 +1000 Merge tag 'drm-intel-next-fixes-2018-10-18' of git://anongit.freedesktop.org/drm/drm-intel into drm-next - Fix GPU hang on MacBook2,1 when booting in EFI mode (Bugzilla #105637) - Fix garbled console on Y tiled BIOS framebuffer configs (Bugzilla #108264) - Fix black screen on certain eDP panels eg. Dell XPS 9350 (Bugzilla #107489 and #105338) - MST fixes that Rodrigo dropped from drm-intel-fixes and bunch of Icelake fixes - Then assorted proactive code fixes caught by CI or developers Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20181018165725.GA2281@jlahtine-desk.ger.corp.intel.com commit b4d16ab58c41ff0125822464bdff074cebd0fe47 Author: Michael Ellerman Date: Wed Oct 17 23:39:41 2018 +1100 powerpc/time: Fix clockevent_decrementer initalisation for PR KVM In the recent commit 8b78fdb045de ("powerpc/time: Use clockevents_register_device(), fixing an issue with large decrementer") we changed the way we initialise the decrementer clockevent(s). We no longer initialise the mult & shift values of decrementer_clockevent itself. This has the effect of breaking PR KVM, because it uses those values in kvmppc_emulate_dec(). The symptom is guest kernels spin forever mid-way through boot. For now fix it by assigning back to decrementer_clockevent the mult and shift values. Fixes: 8b78fdb045de ("powerpc/time: Use clockevents_register_device(), fixing an issue with large decrementer") Signed-off-by: Michael Ellerman commit 6ce7bff045f6a0eaa94c63617d73ad0bc66ce40c Author: Michael Ellerman Date: Mon Oct 15 23:01:43 2018 +1100 powerpc/aout: Fix struct user definition to use user_pt_regs I'm pretty sure this is dead code, it's only used by the a.out core dump code, and we don't support a.out. We should remove it. But while it's in the tree it should be using the ABI version of pt_regs which is called user_pt_regs in the kernel, because the whole struct is written to the core dump and so its size shouldn't change. Note this isn't a uapi header so we don't need an ifdef. Fixes: 002af9391bfb ("powerpc: Split user/kernel definitions of struct pt_regs") Signed-off-by: Michael Ellerman commit 22a3d03d69dfd3bfc606d1996969820d619b7c27 Author: Michael Ellerman Date: Mon Oct 15 23:01:42 2018 +1100 powerpc/uapi: Fix sigcontext definition to use user_pt_regs My recent patch to split pt_regs between user and kernel missed the usage in struct sigcontext. Because this is a user visible struct it should be using the user visible definition, which when we're building for the kernel is called struct user_pt_regs. As far as I can see this hasn't actually caused a bug (yet), because we don't use the sizeof() the sigcontext->regs anywhere. But we should still fix it to avoid confusion and future bugs. Fixes: 002af9391bfb ("powerpc: Split user/kernel definitions of struct pt_regs") Reported-by: Madhavan Srinivasan Signed-off-by: Michael Ellerman commit 7d0ea2524202db5cb3f5bde9c0cdd6dea61bc0e3 Author: Masahiro Yamada Date: Wed Oct 10 00:05:39 2018 +0900 kbuild: use 'else ifeq' for checksrc to improve readability 'ifeq ... else ifeq ... endif' notation is supported by GNU Make 3.81 or later, which is the requirement for building the kernel since commit 37d69ee30808 ("docs: bump minimal GNU Make version to 3.81"). Use it to improve the readability. Signed-off-by: Masahiro Yamada commit 69ea912fda74a673d330d23595385e5b73e3a2b9 Author: Masahiro Yamada Date: Thu Oct 4 13:25:19 2018 +0900 kbuild: remove unneeded link_multi_deps Since commit c8589d1e9e01 ("kbuild: handle multi-objs dependency appropriately"), $^ really represents all the prerequisite of the composite object being built. Hence, $(filter %.o,$^) contains all the objects to link together, which is much simpler than link_multi_deps calculation. Please note $(filter-out FORCE,$^) does not work here. When a single object module is turned into a multi object module, $^ will contain header files that were previously included for building the single object, and recorded in the .*.cmd file. To filter out such headers, $(filter %.o,$^) should be used here. Signed-off-by: Masahiro Yamada commit 9df3e7a7d7d6d92df7c58fb17f900fdc2d8b5031 Author: Masahiro Yamada Date: Tue Oct 2 10:32:23 2018 +0900 kbuild: add -Wno-unused-but-set-variable flag unconditionally We have raised the compiler requirement from time to time. With commit cafa0010cd51 ("Raise the minimum required gcc version to 4.6"), the minimum for GCC is 4.6 now. This flag was added by GCC 4.6, and it is recognized by ICC as well. It is true that Clang does not support this flag but this commit is just touching the else part of the "ifeq ($(cc-name),clang)" check. Hence, Clang build is not affected. Let's rip off the cc-disable-warning switch, and see if somebody complains about it. Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit a33e7ae295d5bc20568c48ac217d07f011091c32 Author: Masahiro Yamada Date: Mon Oct 1 18:44:37 2018 +0900 kbuild: add -Wdeclaration-after-statement flag unconditionally We have raised the compiler requirement from time to time. With commit cafa0010cd51 ("Raise the minimum required gcc version to 4.6"), the minimum for GCC is 4.6 now. This flag has been here since the pre-git era. It is documented in the GCC 4.6 manual, and it is recognized by Clang and ICC as well. Let's rip off the cc-option switch, and see if somebody complains about it. Signed-off-by: Masahiro Yamada Tested-by: Nick Desaulniers commit fb073a4b473e5b854312dc819c66ded9d103e824 Author: Masahiro Yamada Date: Mon Oct 1 18:44:36 2018 +0900 kbuild: add -Wno-pointer-sign flag unconditionally We have raised the compiler requirement from time to time. With commit cafa0010cd51 ("Raise the minimum required gcc version to 4.6"), the minimum for GCC is 4.6 now. The -Wno-pointer-sign has been here since the pre-git era. It is documented in the GCC 4.6 manual, and it is recognized by Clang and ICC as well. Let's rip off the cc-disable-warning switch, and see if somebody complains about it. Signed-off-by: Masahiro Yamada Tested-by: Nick Desaulniers commit 153e04b373dd5a4fdb841a727e47c40b1ad10ffc Author: Masahiro Yamada Date: Fri Sep 28 15:21:55 2018 +0900 modpost: remove leftover symbol prefix handling for module device table Blackfin and metag were the only architectures that prefix symbols with an underscore. They were removed by commit 4ba66a976072 ("arch: remove blackfin port"), commit bb6fb6dfcc17 ("metag: Remove arch/metag/"), respectively. It is no longer necessary to handle part of module device table symbols. Signed-off-by: Masahiro Yamada commit e51cd9ce5dd3b10f9e67a30a4dc00fc1fa80c673 Author: Keith Busch Date: Thu Oct 11 12:34:12 2018 -0600 PCI/AER: Refactor error injection fallbacks Move the bus ops fallback into separate functions. No functional change here. Signed-off-by: Keith Busch Signed-off-by: Bjorn Helgaas commit 390e2db8248075ae2f31a7046a88eda0f9784310 Author: Keith Busch Date: Thu Oct 11 12:34:11 2018 -0600 PCI/AER: Abstract AER interrupt handling The aer_inject module was directly calling aer_irq(). This required the AER driver export its private IRQ handler for no other reason than to support error injection. A driver should not have to expose its private interfaces, so use the IRQ subsystem to route injection to the AER driver, and make aer_irq() a private interface. This provides additional benefits: First, directly calling the IRQ handler bypassed the IRQ subsytem so the injection wasn't really synthesizing what happens if a shared AER interrupt occurs. The error injection had to provide the callback data directly, which may be racing with a removal that is freeing that structure. The IRQ subsystem can handle that race. Finally, using the IRQ subsystem automatically reacts to threaded IRQs, keeping the error injection abstracted from that implementation detail. Signed-off-by: Keith Busch Signed-off-by: Bjorn Helgaas commit 0e98db259fd8760fde556e640b447dadeceefc96 Author: Keith Busch Date: Thu Oct 11 12:34:10 2018 -0600 PCI/AER: Reuse existing pcie_port_find_device() interface The port services driver already provides a method to find the pcie_device for a service. Export that function, use it from the aer_inject module, and remove the duplicate functionality. Signed-off-by: Keith Busch Signed-off-by: Bjorn Helgaas commit 369fd7b00fce169570d6a74cb369e60dbfc95fb4 Author: Keith Busch Date: Tue Sep 18 17:58:47 2018 -0600 PCI/AER: Use managed resource allocations Use the managed device resource allocations for the service data so the AER driver doesn't need to manage it, further simplifying this driver. Link: https://lore.kernel.org/linux-pci/20180918235848.26694-12-keith.busch@intel.com Signed-off-by: Keith Busch Signed-off-by: Bjorn Helgaas commit 85a585918fb4122ad26b6febaec5c3c90bf2535c Merge: 3f6caaf5ff33 13523bef1e21 Author: James Morris Date: Thu Oct 18 17:20:08 2018 -0700 Merge tag 'loadpin-security-next' of https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux into next-loadpin LoadPin: report improvement and parameter renaming - Report human-readable device name during init - Change boot parameter and Kconfig "enabled" to "enforce" commit 1107a674cc0499ba9b6b65cef0632ac7a0fa771c Author: Colin Ian King Date: Thu Oct 18 22:47:10 2018 +0100 qed: fix spelling mistake "transcevier" -> "transceiver" Trivial fix to spelling mistake in DP_INFO message. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller commit 02e6dae61e705485e23d1e4bbc62faa4f8cb7e28 Merge: 79861919b889 4cb4e98e5bba Author: David S. Miller Date: Thu Oct 18 17:01:12 2018 -0700 Merge tag 'mlx5-updates-2018-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5-updates-2018-10-18 This series provides misc updates to mlx5 core and netdevice driver. 1) From Tariq Toukan: Refactor fragmented buffer struct fields and init flow. 2) From Vlad Buslov, Flow counters cache improvements and fixes follow up. as a follow up work for the previous series of the mlx5 flow counters, Vlad provides two fixes: 2.1) Take fs_counters dellist before addlist Fixes: 6e5e22839136 ("net/mlx5: Add new list to store deleted flow counters") 2.2) Remove counter from idr after removing it from list Fixes: 12d6066c3b29 ("net/mlx5: Add flow counters idr") From Shay Agroskin, 3) Add FEC set/get FW commands and FEC ethtool callbacks support 4) Add new ethtool statistics to cover errors on rx, such as FEC errors. ==================== Signed-off-by: David S. Miller commit 7250f422da0480d8512b756640f131b9b893ccda Author: Joe Jin Date: Tue Oct 16 15:21:16 2018 -0700 xen-swiotlb: use actually allocated size on check physical continuous xen_swiotlb_{alloc,free}_coherent() allocate/free memory based on the order of the pages and not size argument (bytes). This is inconsistent with range_straddles_page_boundary and memset which use the 'size' value, which may lead to not exchanging memory with Xen (range_straddles_page_boundary() returned true). And then the call to xen_swiotlb_free_coherent() would actually try to exchange the memory with Xen, leading to the kernel hitting an BUG (as the hypercall returned an error). This patch fixes it by making the 'size' variable be of the same size as the amount of memory allocated. CC: stable@vger.kernel.org Signed-off-by: Joe Jin Cc: Konrad Rzeszutek Wilk Cc: Boris Ostrovsky Cc: Christoph Helwig Cc: Dongli Zhang Cc: John Sobecki Signed-off-by: Konrad Rzeszutek Wilk commit 79861919b8896e14b8e5707242721f2312c57ae4 Author: Eric Dumazet Date: Thu Oct 18 09:12:19 2018 -0700 tcp: fix TCP_REPAIR xmit queue setup Andrey reported the following warning triggered while running CRIU tests: tcp_clean_rtx_queue() ... last_ackt = tcp_skb_timestamp_us(skb); WARN_ON_ONCE(last_ackt == 0); This is caused by 5f6188a8003d ("tcp: do not change tcp_wstamp_ns in tcp_mstamp_refresh"), as we end up having skbs in retransmit queue with a zero skb->skb_mstamp_ns field. We could fix this bug in different ways, like making sure tp->tcp_wstamp_ns is not zero at socket creation, but as Neal pointed out, we also do not want that pacing status of a repaired socket could push tp->tcp_wstamp_ns far ahead in the future. So we prefer changing tcp_write_xmit() to not call tcp_update_skb_after_send() and instead do what is requested by TCP_REPAIR logic. Fixes: 5f6188a8003d ("tcp: do not change tcp_wstamp_ns in tcp_mstamp_refresh") Signed-off-by: Eric Dumazet Reported-by: Andrey Vagin Acked-by: Soheil Hassas Yeganeh Acked-by: Neal Cardwell Signed-off-by: David S. Miller commit cc18a7543d2f63a2c93fc61cfa7fd8be5464f75e Author: Zhao Chen Date: Thu Oct 18 15:02:51 2018 +0000 net-next/hinic: add checksum offload and TSO support This patch adds checksum offload and TSO support for the HiNIC driver. Perfomance test (Iperf) shows more than 100% improvement in TCP streams. Signed-off-by: Zhao Chen Signed-off-by: Xue Chaojing Signed-off-by: David S. Miller commit 40b06553c906a56ae31677b3ecbd49546947698d Author: Ganesh Goudar Date: Thu Oct 18 19:34:19 2018 +0530 cxgb4: fix the error path of cxgb4_uld_register() On multi adapter setup if the uld registration fails even on one adapter, the allocated resources for the uld on all the adapters are freed, rendering the functioning adapters unusable. This commit fixes the issue by freeing the allocated resources only for the failed adapter. Signed-off-by: Ganesh Goudar Signed-off-by: David S. Miller commit 35b842f25b603028fab7ff11b54a4410ee345c8a Author: Dan Carpenter Date: Thu Oct 18 11:02:39 2018 +0300 bnxt_en: Copy and paste bug in extended tx_stats The struct type was copied from the line before but it should be "tx" instead of "rx". I have reviewed the code and I can't immediately see that this bug causes a runtime issue. Fixes: 36e53349b60b ("bnxt_en: Add additional extended port statistics.") Signed-off-by: Dan Carpenter Acked-by: Michael Chan Signed-off-by: David S. Miller commit 817e929091e9a92cd7086ba816438a6c73e42543 Merge: 64b9d16e2d02 828092ef77ea Author: David S. Miller Date: Thu Oct 18 15:44:55 2018 -0700 Merge branch '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queue Jeff Kirsher says: ==================== Intel Wired LAN Doc Updates 2018-10-18 This series contains documentation fixes and updates for Intel wired LAN drivers. The following was done: - Updated incorrect URLs - removed document references which did not apply to the current in-kernel drivers - added documentation for fm10k driver - added missing documentation on existing or new features - added SPDX headers to all the documentation files Lastly, the documentation was converted over to the RST (reStructured Text) format, so that 'make htmldocs' produces pretty html driver documentation for our drivers. ==================== Signed-off-by: David S. Miller commit 9a1d6b232bed2117fa9608873be044a5e8965e76 Merge: 1578968f77e6 52091c256bdc 82a4de6f11dc Author: Stephen Boyd Date: Thu Oct 18 15:44:13 2018 -0700 Merge branches 'clk-fixed-rate-remove' and 'clk-qcom-cleanup' into clk-next * clk-fixed-rate-remove: clk: fixed-rate: fix of_node_get-put imbalance * clk-qcom-cleanup: clk: qcom: Remove unused arrays in SDM845 GCC commit 1578968f77e6759afe4882dc20882639eacb2977 Merge: 1fe7c040b61e 341ce3563e52 77612720a236 1b4d990b19d2 9c940bbe2bb4 Author: Stephen Boyd Date: Thu Oct 18 15:44:01 2018 -0700 Merge branches 'clk-imx6-mmdc', 'clk-qcom-krait', 'clk-rockchip' and 'clk-smp2s11-match' into clk-next - iMX6 MMDC clks - Qualcomm Krait CPU clk support * clk-imx6-mmdc: clk: imx6q: add mmdc0 ipg clock clk: imx6sl: add mmdc ipg clocks clk: imx6sll: add mmdc1 ipg clock clk: imx6sx: add mmdc1 ipg clock clk: imx6ul: add mmdc1 ipg clock * clk-qcom-krait: clk: qcom: Add safe switch hook for krait mux clocks dt-bindings: clock: Document qcom,krait-cc clk: qcom: Add Krait clock controller driver dt-bindings: arm: Document qcom,kpss-gcc clk: qcom: Add KPSS ACC/GCC driver clk: qcom: Add support for Krait clocks clk: qcom: Add IPQ806X's HFPLLs clk: qcom: Add MSM8960/APQ8064's HFPLLs dt-bindings: clock: Document qcom,hfpll clk: qcom: Add HFPLL driver clk: qcom: Add support for High-Frequency PLLs (HFPLLs) ARM: Add Krait L2 register accessor functions * clk-rockchip: clk: rockchip: Fix static checker warning in rockchip_ddrclk_get_parent call clk: rockchip: use the newly added clock-id for hdmi on RK3066 clk: rockchip: add clock-id for HCLK_HDMI on rk3066 clk: rockchip: fix wrong mmc sample phase shift for rk3328 clk: rockchip: improve rk3288 pll rates for better hdmi output * clk-smp2s11-match: clk: s2mps11: Add used attribute to s2mps11_dt_match clk: s2mps11: Fix matching when built as module and DT node contains compatible commit 1fe7c040b61ebcc72a6b3c29136937f1b9191988 Merge: c1f74dbe59b7 5ddf0cdf9395 0d09e668b70b 4917fb90eec7 62061d357c7f Author: Stephen Boyd Date: Thu Oct 18 15:43:48 2018 -0700 Merge branches 'clk-actions-reset', 'clk-imx7-init-critical', 'clk-mmp2-ids' and 'clk-at91-pmc-rework' into clk-next - Reset Controller (RMU) support for Actions Semi Owl S900 and S700 SoCs - Rework at91 PMC clock driver for new DT bindings * clk-actions-reset: clk: actions: Add Actions Semi S900 SoC Reset Management Unit support clk: actions: Add Actions Semi S700 SoC Reset Management Unit support clk: actions: Add Actions Semi Owl SoCs Reset Management Unit support dt-bindings: reset: Add binding constants for Actions Semi S900 RMU dt-bindings: reset: Add binding constants for Actions Semi S700 RMU dt-bindings: clock: Add reset controller bindings for Actions Semi Owl SoCs clk: actions: Cache regmap info in private clock descriptor * clk-imx7-init-critical: clk: imx7d: remove CLK_IS_CRITICAL flag for arm_a7_root_clk clk: imx: cpu clock should be always critical clk: imx: imx7d: remove clks_init_on array clk: imx: imx7d: remove unnecessary clocks from clks_init_on array * clk-mmp2-ids: clk: mmp2: fix the clock id for sdh2_clk and sdh3_clk * clk-at91-pmc-rework: clk: at91: move DT compatibility code to its own file clk: at91: add at91sam9rl PMC driver clk: at91: add at91sam9x5 PMCs driver clk: at91: add at91sam9260 PMC driver clk: at91: add sama5d2 PMC driver clk: at91: add sama5d4 pmc driver clk: at91: add new DT lookup function dt-bindings: clk: at91: Document new PMC binding clk: at91: add pmc_data struct and helpers clk: at91: allow clock registration from C code clk: at91: generated: set audio_pll_allowed in at91_clk_register_generated() clk: at91: audio-pll: separate registration from DT parsing clk: at91: h32mx: separate registration from DT parsing clk: at91: generated: SSCs don't have a gclk clk: at91: audio-pll: fix audio pmc type commit c1f74dbe59b74016adb8f96667fe27f135c5247f Merge: 19ef24654f2e c8da78e8a1da f08c2e2865f6 Author: Stephen Boyd Date: Thu Oct 18 15:43:38 2018 -0700 Merge branches 'clk-tegra' and 'clk-bulk-get-all' into clk-next - Nvidia Tegra clk driver MBIST workaround fix - clk_bulk_get_all() API and friends to get all the clks for a device * clk-tegra: clk: tegra210: Include size.h for compilation ease clk: tegra: Fixes for MBIST work around clk: tegra: probe deferral error reporting * clk-bulk-get-all: clk: add managed version of clk_bulk_get_all clk: add new APIs to operate on all available clocks clk: bulk: add of_clk_bulk_get() commit 19ef24654f2ef3f4392a8df431eccf8f42ac4878 Merge: fa4c0e490387 226dfa4726eb Author: Stephen Boyd Date: Thu Oct 18 15:43:24 2018 -0700 Merge branch 'clk-ingenic-jz4725b' into clk-next - Ingenic jz4725b CGU * clk-ingenic-jz4725b: clk: Add Ingenic jz4725b CGU driver dt-bindings: clock: Add jz4725b-cgu.h header dt-bindings: clock: ingenic: Explicitly list compatible strings clk: ingenic: Add proper Kconfig entries commit fa4c0e490387fc1eec6a7109450a7dfde24e419a Merge: 37163726e1fd 652f1813c113 Author: Stephen Boyd Date: Thu Oct 18 15:42:42 2018 -0700 Merge branch 'clk-qcom-qcs404' into clk-next - Qualcomm QCS404 GCC support * clk-qcom-qcs404: clk: qcom: gcc: Add global clock controller driver for QCS404 clk: qcom: Export clk_alpha_pll_configure() commit 37163726e1fdfbc428c3e01a1f1a16407228510a Merge: ffd3b1c880a9 2725991eca5c Author: Stephen Boyd Date: Thu Oct 18 15:41:51 2018 -0700 Merge branch 'clk-qcom-sdm660' into clk-next - Qualcomm SDM660 GCC support * clk-qcom-sdm660: clk: qcom: gcc-sdm660: Add MODULE_LICENSE clk: qcom: Add Global Clock controller (GCC) driver for SDM660 commit ffd3b1c880a9c5b5bfd977b4b33e61b6584ad943 Merge: 8a69f1d4707a 6df9543da2b2 c1a3308a0629 0f5cb0e6225c Author: Stephen Boyd Date: Thu Oct 18 15:41:36 2018 -0700 Merge branches 'clk-samsung', 'clk-hisi3670' and 'clk-at91-div-0' into clk-next - Hisilicon 3670 SoC support * clk-samsung: dt-bindings: clock: samsung: Add SPDX license identifiers clk: samsung: Use clk_hw API for calling clk framework from clk notifiers clk: samsung: exynos5420: Enable PERIS clocks for suspend clk: samsung: exynos5420: Define CLK_SECKEY gate clock only or Exynos5420 clk: samsung: exynos5433: Keep sclk_uart clocks enabled in suspend clk: samsung: Remove obsolete code for Exynos4412 ISP clocks clk: samsung: exynos5433: Add suspend state for TOP, CPIF & PERIC CMUs clk: samsung: Use NOIRQ stage for Exynos5433 clocks suspend/resume clk: samsung: exynos5420: Use generic helper for handling suspend/resume clk: samsung: exynos4: Use generic helper for handling suspend/resume clk: samsung: Add support for setting registers state before suspend clk: samsung: exynos5250: Use generic helper for handling suspend/resume clk: samsung: s5pv210: Use generic helper for handling suspend/resume clk: samsung: s3c64xx: Use generic helper for handling suspend/resume clk: samsung: s3c2443: Use generic helper for handling suspend/resume clk: samsung: s3c2412: Use generic helper for handling suspend/resume clk: samsung: s3c2410: Use generic helper for handling suspend/resume clk: samsung: Remove excessive include * clk-hisi3670: clk: hisilicon: Add clock driver for Hi3670 SoC dt-bindings: clk: hisilicon: Add bindings for Hi3670 clk * clk-at91-div-0: clk: at91: Fix division by zero in PLL recalc_rate() commit 8a69f1d4707a69faab58d9735c2cb1898140124a Merge: cc2adbe370f1 a72d785021cb Author: Stephen Boyd Date: Thu Oct 18 15:41:21 2018 -0700 Merge branch 'clk-ti' into clk-next * clk-ti: clk: ti: Prepare for remove of OF node name clk: Clean up suspend/resume coding style clk: ti: Add functions to save/restore clk context clk: clk: Add clk_gate_restore_context function clk: Add functions to save/restore clock context en-masse clk: ti: dra7: add new clkctrl data clk: ti: dra7xx: rename existing clkctrl data as compat data clk: ti: am43xx: add new clkctrl data for am43xx clk: ti: am43xx: rename existing clkctrl data as compat data clk: ti: am33xx: add new clkctrl data for am33xx clk: ti: am33xx: rename existing clkctrl data as compat data clk: ti: clkctrl: replace dashes from clkdm name with underscore clk: ti: clkctrl: support multiple clkctrl nodes under a cm node dt-bindings: clock: dra7xx: add clkctrl indices for new data layout dt-bindings: clock: am43xx: add clkctrl indices for new data layout dt-bindings: clock: am33xx: add clkctrl indices for new data layout commit cc2adbe370f190fb13531ba1f55a9b0d9dc8828a Merge: cd8ca3005269 9e6dbc3d5cfc Author: Stephen Boyd Date: Thu Oct 18 15:40:10 2018 -0700 Merge branch 'clk-k3-tisci' into clk-next - TI SCI clks on K3 SoCs * clk-k3-tisci: clk: keystone: add missing MODULE_LICENSE clk: keystone: Enable TISCI clocks if K3_ARCH commit 64b9d16e2d02ca6e5dc8fcd30cfd52b0ecaaa8f4 Author: Nathan Chancellor Date: Wed Oct 17 11:04:19 2018 -0700 atm: zatm: Fix empty body Clang warnings Clang warns: drivers/atm/zatm.c:513:7: error: while loop has empty body [-Werror,-Wempty-body] zwait; ^ drivers/atm/zatm.c:513:7: note: put the semicolon on a separate line to silence this warning Get rid of this warning by using an empty do-while loop. While we're at it, add parentheses to make it clear that this is a function-like macro. Link: https://github.com/ClangBuiltLinux/linux/issues/42 Suggested-by: Masahiro Yamada Signed-off-by: Nathan Chancellor Signed-off-by: David S. Miller commit cd8ca3005269ec327643b3cc39681a6fcde16b0d Merge: 5d3a48fe2cee 5beb1e60dba9 148edd50c807 e15d598b5c6f 6ffeddd6bca4 e3aaadb0f0d6 Author: Stephen Boyd Date: Thu Oct 18 15:39:08 2018 -0700 Merge branches 'clk-mvebu-periph-pm', 'clk-meson', 'clk-allwinner', 'clk-mvebu-dup' and 'clk-davinci' into clk-next - S2RAM support for Marvell mvebu periph clks * clk-mvebu-periph-pm: clk: mvebu: armada-37xx-periph: add suspend/resume support clk: mvebu: armada-37xx-periph: save the IP base address in the driver data * clk-meson: clk: meson: meson8b: use the regmap in the internal reset controller clk: meson: meson8b: register the clock controller early clk: meson-axg: pcie: drop the mpll3 clock parent clk: meson: axg: round audio system master clocks down clk: meson: clk-pll: drop hard-coded rates from pll tables clk: meson: clk-pll: remove od parameters clk: meson: clk-pll: drop CLK_GET_RATE_NOCACHE where unnecessary clk: meson: clk-pll: add enable bit * clk-allwinner: dt-bindings: clock: sun50i-a64-ccu: Add PLL_VIDEO0 macro clk: sunxi-ng: a64: Add max. rate constraint to video PLLs clk: sunxi-ng: a64: Add minimal rate for video PLLs clk: sunxi-ng: sun50i: h6: Add 2x fixed post-divider to MMC module clocks clk: sunxi-ng: a83t: Add max. rate constraint to video PLLs clk: sunxi-ng: nkmp: Add constraint for maximum rate clk: sunxi-ng: r40: Add max. rate constraint to video PLLs clk: sunxi-ng: h3/h5: Add max. rate constraint to pll-video clk: sunxi-ng: Add maximum rate constraint to NM PLLs clk: sunxi-ng: h6: fix PWM gate/reset offset clk: sunxi-ng: h6: fix bus clocks' divider position * clk-mvebu-dup: clk: mvebu: ap806: Remove superfluous of_clk_add_provider * clk-davinci: clk: davinci: kill davinci_clk_reset_assert/deassert() commit 5d3a48fe2cee0d9fde91b6552362e86a8efca298 Merge: faff3d8e852b 78412c262004 1adb0a9faabb Author: Stephen Boyd Date: Thu Oct 18 15:39:01 2018 -0700 Merge branches 'clk-qcom-sdm845-camcc' and 'clk-mtk-unused' into clk-next - Qualcomm SDM845 camera clock controller * clk-qcom-sdm845-camcc: clk: qcom: Add camera clock controller driver for SDM845 dt-bindings: clock: Introduce QCOM Camera clock bindings * clk-mtk-unused: clk: mediatek: remove unused array audio_parents commit faff3d8e852b1450e0e8e8f60c4e9af98549548a Merge: 9710ee14bec9 be783cc8d72b Author: Stephen Boyd Date: Thu Oct 18 15:38:51 2018 -0700 Merge branch 'clk-renesas' into clk-next * clk-renesas: (36 commits) clk: renesas: r7s9210: Add SPI clocks clk: renesas: r7s9210: Move table update to separate function clk: renesas: r7s9210: Convert some clocks to early clk: renesas: cpg-mssr: Add early clock support clk: renesas: r8a77970: Add TPU clock clk: renesas: r8a77990: Fix incorrect PLL0 divider in comment dt-bindings: clock: renesas: cpg-mssr: Document r8a774c0 clk: renesas: cpg-mssr: Add r8a774c0 support clk: renesas: Add r8a774c0 CPG Core Clock Definitions clk: renesas: r8a7743: Add r8a7744 support clk: renesas: Add r8a7744 CPG Core Clock Definitions dt-bindings: clock: renesas: cpg-mssr: Document r8a7744 binding dt-bindings: clock: renesas: Convert to SPDX identifiers clk: renesas: cpg-mssr: Add R7S9210 support clk: renesas: r8a77970: Add TMU clocks clk: renesas: r8a77970: Add CMT clocks clk: renesas: r9a06g032: Fix UART34567 clock rate clk: renesas: r8a77970: Add SD0H/SD0 clocks for SDHI clk: renesas: r8a77980: Add CMT clocks clk: renesas: r8a77990: Add missing I2C7 clock ... commit 3e73cc5cd8c03ebc930f1799cc984e746780414a Author: Nathan Chancellor Date: Wed Oct 17 11:03:34 2018 -0700 atm: eni: Move semicolon to a new line after empty for loop Clang warns: drivers/atm/eni.c:244:48: error: for loop has empty body [-Werror,-Wempty-body] for (order = 0; (1 << order) < *size; order++); ^ drivers/atm/eni.c:244:48: note: put the semicolon on a separate line to silence this warning In this case, that loop is expected to be empty so silence the warning in the way that Clang suggests. Link: https://github.com/ClangBuiltLinux/linux/issues/42 Suggested-by: Masahiro Yamada Signed-off-by: Nathan Chancellor Signed-off-by: David S. Miller commit 9710ee14bec9a7ffa385342ffb03f91d274b3d07 Merge: 1affdc35e0a6 e665f029a283 00a461cc32ec 480d99fdc3ee Author: Stephen Boyd Date: Thu Oct 18 15:33:52 2018 -0700 Merge branches 'clk-dt-name', 'clk-ti-of-node' and 'clk-sa' into clk-next - Use updated printk format for OF node names - Fix TI code to only search DT subnodes - Various static analysis finds * clk-dt-name: clk: Convert to using %pOFn instead of device_node.name * clk-ti-of-node: clk: ti: fix OF child-node lookup * clk-sa: clk: mvebu: armada-37xx-tbg: Switch to clk_get and balance it in probe reset: hisilicon: fix potential NULL pointer dereference clk: cdce925: release child device nodes clk: qcom: clk-branch: Use true and false for boolean values commit 1affdc35e0a69dc503fff6b8c02bc21bb97ac900 Merge: c3828949a21d 2bdb2a1cca86 8748b4a786a9 b567752144e3 4f83d9b848f6 Author: Stephen Boyd Date: Thu Oct 18 15:33:28 2018 -0700 Merge branches 'clk-spdx', 'clk-qcom-dfs', 'clk-smp2s11-include', 'clk-qcom-8996-missing' and 'clk-qcom-qspi' into clk-next - Tag various drivers with SPDX license tags - Support dynamic frequency switching (DFS) on qcom SDM845 GCC - Only use s2mps11 dt-binding defines instead of redefining them in the driver - Add some more missing clks to qcom MSM8996 GCC - Quad SPI clks on qcom SDM845 * clk-spdx: clk: mvebu: use SPDX-License-Identifier clk: renesas: Convert to SPDX identifiers clk: renesas: use SPDX identifier for Renesas drivers clk: s2mps11,s3c64xx: Add SPDX license identifiers clk: max77686: Add SPDX license identifiers * clk-qcom-dfs: clk: qcom: Allocate space for NULL terimation in DFS table clk: qcom: gcc: Register QUPv3 RCGs for DFS on SDM845 clk: qcom: Add support for RCG to register for DFS * clk-smp2s11-include: clk: s2mps11: Use existing defines from bindings for clock IDs * clk-qcom-8996-missing: clk: qcom: Add some missing gcc clks for msm8996 * clk-qcom-qspi: clk: qcom: Add qspi (Quad SPI) clocks for sdm845 clk: qcom: Add qspi (Quad SPI) clock defines for sdm845 to header commit 82a4de6f11dc8ecf4ca8b9d207bcae6484b8f261 Author: Evan Green Date: Thu Oct 18 15:03:50 2018 -0700 clk: qcom: Remove unused arrays in SDM845 GCC This change removes a parent map and parent name array that appear to be completely unreferenced. Signed-off-by: Evan Green Signed-off-by: Stephen Boyd commit 13523bef1e2154b6d02836cd0f6c0ffc89b2eae6 Author: Kees Cook Date: Mon Sep 24 14:43:59 2018 -0700 LoadPin: Rename boot param "enabled" to "enforce" LoadPin's "enabled" setting is really about enforcement, not whether or not the LSM is using LSM hooks. Instead, split this out so that LSM enabling can be logically distinct from whether enforcement is happening (for example, the pinning happens when the LSM is enabled, but the pin is only checked when "enforce" is set). This allows LoadPin to continue to operate sanely in test environments once LSM enable/disable is centrally handled (i.e. we want LoadPin to be enabled separately from its enforcement). Signed-off-by: Kees Cook Reviewed-by: Casey Schaufler Reviewed-by: John Johansen commit f4b626d6de15149329332796e96709e0c4c84577 Author: Kees Cook Date: Wed Oct 3 17:38:37 2018 -0700 LoadPin: Report friendly block device name Instead of only reporting major/minor, include the actual block device name, at least as seen by the kernel. Signed-off-by: Kees Cook commit d93adca7a807cf4a33f3ec96402f645cd8fbe158 Author: David Ahern Date: Thu Oct 18 13:15:49 2018 -0600 MAINTAINERS: Update contact info for VRF entry Update Shrijeet's email address for the VRF entry. Signed-off-by: David Ahern Signed-off-by: David S. Miller commit 93bdcf9fdb89646e9446fab25aec76a754969619 Merge: 826799e66e86 470443e0b379 Author: Trond Myklebust Date: Thu Oct 18 17:29:00 2018 -0400 Merge tag 'nfs-rdma-for-4.20-1' of git://git.linux-nfs.org/projects/anna/linux-nfs NFS RDMA client updates for Linux 4.20 Stable bugfixes: - Reset credit grant properly after a disconnect Other bugfixes and cleanups: - xprt_release_rqst_cong is called outside of transport_lock - Create more MRs at a time and toss out old ones during recovery - Various improvements to the RDMA connection and disconnection code: - Improve naming of trace events, functions, and variables - Add documenting comments - Fix metrics and stats reporting - Fix a tracepoint sparse warning Signed-off-by: Trond Myklebust commit 826799e66e8683e5698e140bb9ef69afc8c0014e Author: J. Bruce Fields Date: Thu Oct 18 15:27:02 2018 -0400 sunrpc: safely reallow resvport min/max inversion Commits ffb6ca33b04b and e08ea3a96fc7 prevent setting xprt_min_resvport greater than xprt_max_resvport, but may also break simple code that sets one parameter then the other, if the new range does not overlap the old. Also it looks racy to me, unless there's some serialization I'm not seeing. Granted it would probably require malicious privileged processes (unless there's a chance these might eventually be settable in unprivileged containers), but still it seems better not to let userspace panic the kernel. Simpler seems to be to allow setting the parameters to whatever you want but interpret xprt_min_resvport > xprt_max_resvport as the empty range. Fixes: ffb6ca33b04b "sunrpc: Prevent resvport min/max inversion..." Fixes: e08ea3a96fc7 "sunrpc: Prevent rexvport min/max inversion..." Signed-off-by: J. Bruce Fields Signed-off-by: Trond Myklebust commit fc187514d8af3a676c7bd7922439f9f5e5c6223f Author: Benjamin Coddington Date: Thu Oct 18 15:01:49 2018 -0400 nfs: remove redundant call to nfs_context_set_write_error() We don't need to call this in the direct, read, or pnfs resend paths and the only other caller is the write path in nfs_page_async_flush() which already checks and sets the pg_error on the context. Signed-off-by: Benjamin Coddington Signed-off-by: Trond Myklebust commit fdbd1a2e4a71adcb1ae219fcfd964930d77a7f84 Author: Benjamin Coddington Date: Thu Oct 18 15:01:48 2018 -0400 nfs: Fix a missed page unlock after pg_doio() We must check pg_error and call error_cleanup after any call to pg_doio. Currently, we are skipping the unlock of a page if we encounter an error in nfs_pageio_complete() before handing off the work to the RPC layer. Signed-off-by: Benjamin Coddington Cc: stable@vger.kernel.org Signed-off-by: Trond Myklebust commit ee75fa2ae0e23f575630923bc598e7dedbb8b21c Author: Christoph Hellwig Date: Thu Oct 18 15:15:16 2018 +0200 mtip32xx: fully switch to the generic DMA API The mtip32xx used an odd mix of the old PCI and the generic DMA API, so switch it over to the generic API entirely. Note that this also removes a weird fallback to just a 32-bit coherent dma mask if the 64-bit dma mask doesn't work, as that can't even happen. Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 77a12e51fcf8c6200818e29fe1e90d944bb1af4a Author: Christoph Hellwig Date: Thu Oct 18 15:15:15 2018 +0200 rsxx: switch to the generic DMA API The PCI DMA API is deprecated, switch to the generic DMA API instead. Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit b46d40daba968f6bac901b50e8fbc016b9c18c00 Author: Christoph Hellwig Date: Thu Oct 18 15:15:14 2018 +0200 umem: switch to the generic DMA API The PCI DMA API is deprecated, switch to the generic DMA API instead. Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 931da2f7a56b7e84a75f40472edf96a5689734a7 Author: Christoph Hellwig Date: Thu Oct 18 15:15:13 2018 +0200 sx8: switch to the generic DMA API The PCI DMA API is deprecated, switch to the generic DMA API instead. Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 64ab1fa5da058960fdd930b768c6c7b441d53d17 Author: Christoph Hellwig Date: Thu Oct 18 15:15:12 2018 +0200 sx8: remove dead IF_64BIT_DMA_IS_POSSIBLE code This code has effectively been commented out since the first commit, so remove it. Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 138126214868a741691edec92d4c94d428213302 Author: Christoph Hellwig Date: Thu Oct 18 15:15:11 2018 +0200 skd: switch to the generic DMA API The PCI DMA API is deprecated, switch to the generic DMA API instead. Also make use of the dma_set_mask_and_coherent helper to easily set the streaming an coherent DMA masks together. Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit ecb0a83e3198f2c1142901687afacbc73602a13b Author: Christoph Hellwig Date: Thu Oct 18 22:55:03 2018 +0200 ubd: remove use of blk_rq_map_sg There is no good reason to create a scatterlist in the ubd driver, it can just iterate the request directly. Signed-off-by: Christoph Hellwig [rw: Folded in improvements as discussed with hch and jens] Signed-off-by: Richard Weinberger Signed-off-by: Jens Axboe commit e732f4485a150492b286f3efc06f9b34dd6b9995 Author: Trond Myklebust Date: Thu Oct 18 17:03:56 2018 -0400 SUNRPC: Fix a compile warning for cmpxchg64() Signed-off-by: Trond Myklebust commit 52091c256bdcad0d01e2852a63f19cd2cce6af96 Author: Alan Tull Date: Thu Oct 18 14:54:11 2018 -0500 clk: fixed-rate: fix of_node_get-put imbalance When the fixed rate clock is created by devicetree, of_clk_add_provider is called. Add a call to of_clk_del_provider in the remove function to balance it out. Signed-off-by: Alan Tull Fixes: 435779fe1336 ("clk: fixed-rate: Convert into a module platform driver") Signed-off-by: Stephen Boyd commit 9c940bbe2bb47e03ca5e937d30b6a50bf9c0e671 Author: Nathan Chancellor Date: Thu Oct 18 12:13:40 2018 -0700 clk: s2mps11: Add used attribute to s2mps11_dt_match Clang warns after commit 8985167ecf57 ("clk: s2mps11: Fix matching when built as module and DT node contains compatible"): drivers/clk/clk-s2mps11.c:242:34: warning: variable 's2mps11_dt_match' is not needed and will not be emitted [-Wunneeded-internal-declaration] static const struct of_device_id s2mps11_dt_match[] = { ^ 1 warning generated. This warning happens when a variable is used in some construct that doesn't require a reference to that variable to be emitted in the symbol table; in this case, it's MODULE_DEVICE_TABLE, which only needs to hold the data of the variable, not the variable itself. $ nm -S drivers/clk/clk-s2mps11.o | rg s2mps11_dt_match 00000078 000003d4 R __mod_of__s2mps11_dt_match_device_table Normally, with device ID table variables, it means that the variable just needs to be tied to the device declaration at the bottom of the file, like s2mps11_clk_id: $ nm -S drivers/clk/clk-s2mps11.o | rg s2mps11_clk_id 00000000 00000078 R __mod_platform__s2mps11_clk_id_device_table 00000000 00000078 r s2mps11_clk_id However, because the comment above this deliberately doesn't want this variable added to .of_match_table, we need to mark s2mps11_dt_match as __used to silence this warning. This makes it clear to Clang that the variable is used for something, even if a reference to it isn't being emitted. Signed-off-by: Nathan Chancellor Fixes: 8985167ecf57 ("clk: s2mps11: Fix matching when built as module and DT node contains compatible") Signed-off-by: Stephen Boyd commit 4cb4e98e5bba6dce058582d78cc993fef6f0755a Author: Shay Agroskin Date: Mon Oct 8 10:28:29 2018 +0300 net/mlx5e: Added 'raw_errors_laneX' fields to ethtool statistics These are counters for errors received on rx side, such as FEC errors. Signed-off-by: Shay Agroskin Reviewed-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed commit 67daf1186086ad4b2ec09b8078b835936977d06a Author: Shay Agroskin Date: Sun Sep 30 09:58:08 2018 +0300 net/mlx5: Added "per_lane_error_counters" cap bit to PCAM Added "Per lane raw errors" capability bit in Ports Capabilities Mask (PCAM) enhanced features layout. This bit determines if the fields "phy_raw_errors_laneX" in "Physical Layer statistical" counters group are supported. Signed-off-by: Shay Agroskin Reviewed-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed commit 3ddeac6705aba31b7528c7d7a528eabb74475622 Author: Jakub Kicinski Date: Thu Oct 18 11:34:55 2018 -0700 tools: bpftool: use 4 context mode for the NFP disasm The nfp driver is currently always JITing the BPF for 4 context/thread mode of the NFP flow processors. Tell this to the disassembler, otherwise some registers may be incorrectly decoded. Signed-off-by: Jakub Kicinski Reviewed-by: Jiong Wang Signed-off-by: Daniel Borkmann commit 6cfa94605091b65cb2895a826750a30fbed99770 Author: Shay Agroskin Date: Tue Aug 28 10:37:52 2018 +0300 net/mlx5e: Ethtool driver callback for query/set FEC policy Driver callback function for 'ethtool --show-fec', 'ethtool --set-fec' commands. The query function returns active and configured FEC policy for current link speed. The set function sets FEC policy for all supported link speeds. 1) If current link speed doesn't support requested FEC policy, the function fails. 2) If a different link speed doesn't support requested FEC policy, FEC capbilities for this speed are turned off. Signed-off-by: Shay Agroskin Reviewed-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed commit 2095b264147753eee0f122b8c0c9f035a32f0a25 Author: Shay Agroskin Date: Wed Oct 10 14:50:34 2018 +0300 net/mlx5e: Add port FEC get/set functions Added functions to query and set link FEC policy. To get/set FEC capabilities in PPLM reg we need to query current link speed. 'mlx5_get_fec_speed_field' queries current link speed and returns correct field offset. FEC Query's return value is divided into 'active FEC policy', which is the FEC policy used by the link, and 'configured FEC policy', which is the FEC policy requested by the user. The two values may differ if: 1) FEC policy was configured to 'auto', in which case the active FEC policy would be the default FEC policy for current link speed. 2) FEC policy was changed, but no link reset is performed. In which case, the active FEC policy would become the configured one after a link reset. FEC set function sets FEC policy for all link speeds and perform link reset. 1) If current link speed doesn't support requested FEC policy, the function fails. 2) If a different link speed doesn't support requested FEC policy, FEC capbilities for this speed are turned off and a warning message is printed. Signed-off-by: Shay Agroskin Reviewed-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed commit 4b5b9c7d972e8a7b1e7691c7c921ec0d6dec33b9 Author: Shay Agroskin Date: Tue Oct 9 14:16:43 2018 +0300 net/mlx5: Add FEC fields to Port Phy Link Mode (PPLM) reg Added FEC related fields to PPLM layout. These fields are needed to set and query FEC policy for different link speeds. Signed-off-by: Shay Agroskin Reviewed-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed commit 2a4c4298025084ba61788dfa27bcf6ea3f3c789e Author: Vlad Buslov Date: Wed Sep 26 15:19:19 2018 +0300 net/mlx5: Remove counter from idr after removing it from list Fs_counters list can temporary become unsorted when new counters are created/deleted concurrently. Idr is used to quickly lookup position to insert new counter in logarithmic time. However, if new flows are concurrently inserted during time window when flows with adjacent ids are already removed from idr but are still present in counters list, mlx5_fc_stats_work() observes counters list in inconsistent state, which results following warning: [ 1839.561955] mlx5_core 0000:81:00.0: mlx5_cmd_fc_bulk_get:587:(pid 729): Flow counter id (0x102d5) out of range (0x1c0a8..0x1c10b). Counter ignored. Move idr_remove() call to be executed synchronously with counter deletion from list. Extract this code to mlx5_fc_stats_remove() helper function that is called by workqueue job handler mlx5_fc_stats_work(). Fixes: 12d6066c3b29 ("net/mlx5: Add flow counters idr") Signed-off-by: Vlad Buslov Reviewed-by: Roi Dayan commit fd3307130344ef5fa5af0089d343ca4fc074322e Author: Vlad Buslov Date: Wed Sep 26 13:09:44 2018 +0300 net/mlx5: Take fs_counters dellist before addlist In fs_counters elements from both addlist and dellist are removed by mlx5_fc_stats_work() without any locking. This introduces race condition when batch of new rules is created and then immediately deleted (for example, when error occurred during flow creation). In such case some of the rules might be in dellist, but not in addlist when mlx5_fc_stats_work() is executed concurrently with tc, which will result rule deletion and use-after-free on next iteration because deleted rules are still in addlist. Always take dellist first to guarantee that rules can only be deleted after they were removed from addlist. Fixes: 6e5e22839136 ("net/mlx5: Add new list to store deleted flow counters") Signed-off-by: Vlad Buslov Reported-by: Chris Mi Reviewed-by: Roi Dayan commit 4972e6fa3a04032830bc3d6bb343d08ab3546773 Author: Tariq Toukan Date: Wed Sep 12 15:36:41 2018 +0300 net/mlx5: Refactor fragmented buffer struct fields and init flow Take struct mlx5_frag_buf out of mlx5_frag_buf_ctrl, as it is not needed to manage and control the datapath of the fragmented buffers API. struct mlx5_frag_buf contains control info to manage the allocation and de-allocation of the fragmented buffer. Its fields are not relevant for datapath, so here I take them out of the struct mlx5_frag_buf_ctrl, except for the fragments array itself. In addition, modified mlx5_fill_fbc to initialise the frags pointers as well. This implies that the buffer must be allocated before the function is called. A set of type-specific *_get_byte_size() functions are replaced by a generic one. Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 1bd70d2eba9d90eb787634361f0f6fa2c86b3f6d Author: Peng Hao Date: Thu Oct 18 23:18:36 2018 +0800 selftests/bpf: fix file resource leak in load_kallsyms FILE pointer variable f is opened but never closed. Signed-off-by: Peng Hao Signed-off-by: Daniel Borkmann commit 828092ef77eacc6d8e344be1738dee3070719a45 Author: Jeff Kirsher Date: Wed Oct 10 12:16:13 2018 -0700 Documentation: intel: Convert to RST format Now that the documents have been updated to conform to the reStructured Text guidelines, we can now change the file extensions and update the other related references. This converts all of the Intel wired LAN driver documentation to *.rst. Signed-off-by: Jeff Kirsher Tested-by: Andrew Bowers Tested-by: Aaron Brown commit f12a84a9f650283551915e2dc65f282b9f2b8b76 Author: Jeff Kirsher Date: Wed Oct 10 12:16:12 2018 -0700 Documentation: fm10k: Add kernel documentation Added the fm10k kernel documentation, which apparently was missing. Signed-off-by: Jeff Kirsher Tested-by: Andrew Bowers Tested-by: Aaron Brown commit 1fae869bcf3dbb934d3550591eaf601b149a57a7 Author: Jeff Kirsher Date: Wed Oct 10 12:16:11 2018 -0700 Documentation: ice: Prepare documentation for RST conversion Before making the conversion to the RST (reStructured Text) format, there are changes needed to the documentation so that there are no build errors. Also fixed old/broken URLs to the correct or updated URL. Signed-off-by: Jeff Kirsher Tested-by: Andrew Bowers Tested-by: Aaron Brown commit 7bacc01d3e597fb29d874e60eb2e0c6fd6f01ec0 Author: Jeff Kirsher Date: Wed Oct 10 12:16:10 2018 -0700 Documentation: iavf: Prepare documentation for RST conversion Before making the conversion to the RST (reStructured Text) format, there are changes needed to the documentation so that there are no build errors. Also fixed old/broken URLs to the correct or updated URL. Signed-off-by: Jeff Kirsher Tested-by: Andrew Bowers Tested-by: Aaron Brown commit 1e06edcc2f22c6c637fe4cf77365c3e4595b2247 Author: Jeff Kirsher Date: Wed Oct 17 08:21:53 2018 -0700 Documentation: i40e: Prepare documentation for RST conversion Before making the conversion to the RST (reStructured Text) format, there are changes needed to the documentation so that there are no build errors. Also fixed old/broken URLs to the correct or updated URL. Signed-off-by: Jeff Kirsher Tested-by: Andrew Bowers Acked-by: Shannon Nelson commit 63e2ea2f89a4193a8e3ba2e63511a59778bcd038 Author: Jeff Kirsher Date: Wed Oct 10 12:16:08 2018 -0700 Documentation: ixgbevf: Prepare documentation for RST conversion Before making the conversion to the RST (reStructured Text) format, there are changes needed to the documentation so that there are no build errors. Also fixed old/broken URLs to the correct or updated URL. Signed-off-by: Jeff Kirsher Tested-by: Andrew Bowers Tested-by: Aaron Brown commit 4d256e4d8ae98ec824f60bcf98e5131e59d08337 Author: Jeff Kirsher Date: Wed Oct 10 12:16:07 2018 -0700 Documentation: ixgbe: Prepare documentation for RST conversion Before making the conversion to the RST (reStructured Text) format, there are changes needed to the documentation so that there are no build errors. Also fixed old/broken URLs to the correct or updated URL. Signed-off-by: Jeff Kirsher Tested-by: Andrew Bowers Tested-by: Aaron Brown commit 413548de58075cbae069669b3aca8fb9bead1c1b Author: Jeff Kirsher Date: Wed Oct 10 12:16:06 2018 -0700 Documentation: igbvf: Prepare documentation for RST conversion Before making the conversion to the RST (reStructured Text) format, there are changes needed to the documentation so that there are no build errors. Also fixed old/broken URLs to the correct or updated URL. Signed-off-by: Jeff Kirsher Tested-by: Andrew Bowers Tested-by: Aaron Brown commit cf673eee906788c6b2f2370d7cda67b62b00f946 Author: Jeff Kirsher Date: Wed Oct 10 12:16:05 2018 -0700 Documentation: igb: Prepare documentation for RST conversion Before making the conversion to the RST (reStructured Text) format, there are changes needed to the documentation so that there are no build errors. Also fixed old/broken URLs to the correct or updated URL. Signed-off-by: Jeff Kirsher Tested-by: Andrew Bowers Tested-by: Aaron Brown commit b87e7f246898d0ccd676fbac5cb3fe41b1735cf9 Author: Jeff Kirsher Date: Wed Oct 10 12:16:04 2018 -0700 Documentation: e1000e: Prepare documentation for RST conversion Before making the conversion to the RST (reStructured Text) format, there are changes needed to the documentation so that there are no build errors. Also fixed old/broken URLs to the correct or updated URL. Signed-off-by: Jeff Kirsher Tested-by: Andrew Bowers Tested-by: Aaron Brown commit 8d59045f11e3a001ae9b83d8feaab9d3a82dbfbc Author: Jeff Kirsher Date: Wed Oct 10 12:16:03 2018 -0700 Documentation: ixgb: Prepare documentation for RST conversion Before making the conversion to the RST (reStructured Text) format, there are changes needed to the documentation so that there are no build errors. Also fixed old/broken URLs to the correct or updated URL. Signed-off-by: Jeff Kirsher Tested-by: Andrew Bowers Tested-by: Aaron Brown commit 3d4e738311327bc4ba1d55fbe2f1da3de4a475f9 Author: Damien Le Moal Date: Wed Oct 17 18:05:08 2018 +0900 dm zoned: fix various dmz_get_mblock() issues dmz_fetch_mblock() called from dmz_get_mblock() has a race since the allocation of the new metadata block descriptor and its insertion in the cache rbtree with the READING state is not atomic. Two different contexts requesting the same block may end up each adding two different descriptors of the same block to the cache. Another problem for this function is that the BIO for processing the block read is allocated after the metadata block descriptor is inserted in the cache rbtree. If the BIO allocation fails, the metadata block descriptor is freed without first being removed from the rbtree. Fix the first problem by checking again if the requested block is not in the cache right before inserting the newly allocated descriptor, atomically under the mblk_lock spinlock. The second problem is fixed by simply allocating the BIO before inserting the new block in the cache. Finally, since dmz_fetch_mblock() also increments a block reference counter, rename the function to dmz_get_mblock_slow(). To be symmetric and clear, also rename dmz_lookup_mblock() to dmz_get_mblock_fast() and increment the block reference counter directly in that function rather than in dmz_get_mblock(). Fixes: 3b1a94c88b79 ("dm zoned: drive-managed zoned block device target") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Mike Snitzer commit 27642facf1b7428c37dc9972f39bdd746cbf9177 Author: Jeff Kirsher Date: Wed Oct 10 12:16:02 2018 -0700 Documentation: e100, e1000: Add missing SPDX header Add the SPDX-Lincense-Identifier to the Intel wired Ethernet *.rst kernel documentation. Signed-off-by: Jeff Kirsher Tested-by: Andrew Bowers Tested-by: Aaron Brown commit 33c2865f8d011a2ca9f67124ddab9dc89382e9f1 Author: Damien Le Moal Date: Wed Oct 17 18:05:07 2018 +0900 dm zoned: fix metadata block ref counting Since the ref field of struct dmz_mblock is always used with the spinlock of struct dmz_metadata locked, there is no need to use an atomic_t type. Change the type of the ref field to an unsigne integer. Fixes: 3b1a94c88b79 ("dm zoned: drive-managed zoned block device target") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Mike Snitzer commit d857ad75edf3c0066fcd920746f9dc75382b3324 Author: Heinz Mauelshagen Date: Fri Oct 12 20:24:25 2018 +0200 dm raid: avoid bitmap with raid4/5/6 journal device With raid4/5/6, journal device and write intent bitmap are mutually exclusive. Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit fe73c23d7a094f391dd358358f7dc358d430e7e1 Author: Bartlomiej Zolnierkiewicz Date: Thu Oct 18 14:05:29 2018 -0500 PCI: pcie: Remove redundant 'default n' from Kconfig 'default n' is the default value for any bool or tristate Kconfig setting so there is no need to write it explicitly. Also since commit f467c5640c29 ("kconfig: only write '# CONFIG_FOO is not set' for visible symbols") the Kconfig behavior is the same regardless of 'default n' being present or not: ... One side effect of (and the main motivation for) this change is making the following two definitions behave exactly the same: config FOO bool config FOO bool default n With this change, neither of these will generate a '# CONFIG_FOO is not set' line (assuming FOO isn't selected/implied). That might make it clearer to people that a bare 'default n' is redundant. ... Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Bjorn Helgaas commit c0e6f052f40b2d4a5e7792c21cbfb866e5e2ad0b Author: Corentin Labbe Date: Mon Jan 29 12:17:54 2018 +0000 Documentation: networking: ixgb: Remove reference to IXGB_NAPI NAPI is enabled by default and IXGB_NAPI was removed since commit 6d37ab282e24 ("ixgb: make NAPI the only option and the default") Update the doc accordingly. Signed-off-by: Corentin Labbe Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher commit aea74de4b216cdacda797d54220b8ac19daa1bf7 Author: Masanari Iida Date: Sat Oct 13 10:30:57 2018 +0900 docs: Fix typos in histogram.rst This patch fixes some spelling typos. Signed-off-by: Masanari Iida Acked-by: Randy Dunlap Acked-by: Steven Rostedt (VMware) Signed-off-by: Jonathan Corbet commit 3a3295bfa6f484bba91de0a804c1d0bf7d31dbd3 Merge: 2d0f0ca2c7b5 cd305c74b0f8 Author: David S. Miller Date: Thu Oct 18 11:23:47 2018 -0700 Merge branch 'sctp-fix-sk_wmem_queued-and-use-it-to-check-for-writable-space' Xin Long says: ==================== sctp: fix sk_wmem_queued and use it to check for writable space sctp doesn't count and use asoc sndbuf_used, sk sk_wmem_alloc and sk_wmem_queued properly, which also causes some problem. This patchset is to improve it. ==================== Signed-off-by: David S. Miller commit cd305c74b0f8b49748a79a8f67fc8e5e3e0c4794 Author: Xin Long Date: Wed Oct 17 03:07:51 2018 +0800 sctp: use sk_wmem_queued to check for writable space sk->sk_wmem_queued is used to count the size of chunks in out queue while sk->sk_wmem_alloc is for counting the size of chunks has been sent. sctp is increasing both of them before enqueuing the chunks, and using sk->sk_wmem_alloc to check for writable space. However, sk_wmem_alloc is also increased by 1 for the skb allocked for sending in sctp_packet_transmit() but it will not wake up the waiters when sk_wmem_alloc is decreased in this skb's destructor. If msg size is equal to sk_sndbuf and sendmsg is waiting for sndbuf, the check 'msg_len <= sctp_wspace(asoc)' in sctp_wait_for_sndbuf() will keep waiting if there's a skb allocked in sctp_packet_transmit, and later even if this skb got freed, the waiting thread will never get waked up. This issue has been there since very beginning, so we change to use sk->sk_wmem_queued to check for writable space as sk_wmem_queued is not increased for the skb allocked for sending, also as TCP does. SOCK_SNDBUF_LOCK check is also removed here as it's for tx buf auto tuning which I will add in another patch. Signed-off-by: Xin Long Signed-off-by: David S. Miller commit 605c0ac182c34867bda71bfbcc74958aabbe2fe0 Author: Xin Long Date: Wed Oct 17 03:07:50 2018 +0800 sctp: count both sk and asoc sndbuf with skb truesize and sctp_chunk size Now it's confusing that asoc sndbuf_used is doing memory accounting with SCTP_DATA_SNDSIZE(chunk) + sizeof(sk_buff) + sizeof(sctp_chunk) while sk sk_wmem_alloc is doing that with skb->truesize + sizeof(sctp_chunk). It also causes sctp_prsctp_prune to count with a wrong freed memory when sndbuf_policy is not set. To make this right and also keep consistent between asoc sndbuf_used, sk sk_wmem_alloc and sk_wmem_queued, use skb->truesize + sizeof(sctp_chunk) for them. Signed-off-by: Xin Long Signed-off-by: David S. Miller commit 84253c8be37d5f0b54d624be1bd1b90bbbfe14b3 Author: Kees Cook Date: Wed Oct 17 16:45:32 2018 -0700 docs: Introduce deprecated APIs list As discussed in the "API replacement/deprecation" thread[1], this makes an effort to document what things shouldn't get (re)added to the kernel, by introducing Documentation/process/deprecated.rst. [1] https://lists.linuxfoundation.org/pipermail/ksummit-discuss/2018-September/005282.html Signed-off-by: Kees Cook Signed-off-by: Jonathan Corbet commit 2725991eca5cc261d787b312d4d8518c42bd5e98 Author: Stephen Boyd Date: Thu Oct 18 11:20:11 2018 -0700 clk: qcom: gcc-sdm660: Add MODULE_LICENSE Add a module license to match the license at the top of this file and silence a build warning. Reported-by: Stephen Rothwell Signed-off-by: Stephen Boyd commit cf419d542f1d3de80034ebb0462d9ed9b1ae9277 Author: Randy Dunlap Date: Wed Oct 17 21:07:27 2018 -0700 kernel-doc: fix declaration type determination Make declaration type determination more robust. When scripts/kernel-doc is deciding if some kernel-doc notation contains an enum, a struct, a union, a typedef, or a function, it does a pattern match on the beginning of the string, looking for a match with one of "struct", "union", "enum", or "typedef", and otherwise defaults to a function declaration type. However, if a function or a function-like macro has a name that begins with "struct" (e.g., struct_size()), then kernel-doc incorrectly decides that this is a struct declaration. Fix this by looking for the declaration type keywords having an ending word boundary (\b), so that "struct_size" will not match a struct declaration. I compared lots of html before/after output from core-api, driver-api, and networking. There were no differences in any of the files that I checked. Signed-off-by: Randy Dunlap Acked-by: Jani Nikula Tested-by: Kees Cook Signed-off-by: Jonathan Corbet commit eef3dc34a1e0b01d53328b88c25237bcc7323777 Author: Nathan Chancellor Date: Wed Oct 17 17:54:00 2018 -0700 ARM: OMAP2+: prm44xx: Fix section annotation on omap44xx_prm_enable_io_wakeup When building the kernel with Clang, the following section mismatch warning appears: WARNING: vmlinux.o(.text+0x38b3c): Section mismatch in reference from the function omap44xx_prm_late_init() to the function .init.text:omap44xx_prm_enable_io_wakeup() The function omap44xx_prm_late_init() references the function __init omap44xx_prm_enable_io_wakeup(). This is often because omap44xx_prm_late_init lacks a __init annotation or the annotation of omap44xx_prm_enable_io_wakeup is wrong. Remove the __init annotation from omap44xx_prm_enable_io_wakeup so there is no more mismatch. Signed-off-by: Nathan Chancellor Signed-off-by: Tony Lindgren commit 22fc9db296fcf7ac30151c52765a7fba10870ab7 Author: Mike Marshall Date: Thu Oct 18 14:05:46 2018 -0400 orangefs: no need to check for service_operation returns > 0 service_operation returns > 0 is undefined. Signed-off-by: Mike Marshall commit 418ca3de75cd5e4130a6f2d5bd76ccb8e3f6e461 Author: Guillaume Dore Date: Thu Oct 18 17:47:50 2018 +0200 doc: fix a typo in adding-syscalls.rst There was a typo in adding-syscalls.rst that could mislead developers to add a C filename in a makefile instead of an object filename. This error, while not keeping developers from contributing could slow the development process down by introducing build errors. Signed-off-by: Guillaume Dore Signed-off-by: Jonathan Corbet commit 34e6148a2c75abdde44071d1605d009d0ad92e5e Author: Mike Marshall Date: Thu Oct 18 13:58:25 2018 -0400 orangefs: some error code paths missed kmem_cache_free If a slab cache object is allocated, it needs to be freed eventually, certainly before anyone unloads the module that allocated it. Signed-off-by: Mike Marshall commit b5d72cdc53bd13a363943a67a8c5537b9524c94d Author: Mike Marshall Date: Thu Oct 18 13:52:23 2018 -0400 orangefs: don't let orangefs_iget return NULL. Suggested by Dan Carpenter. Signed-off-by: Mike Marshall commit 56249998b25f602f8dedbe916ec5494b71da113d Author: Mike Marshall Date: Thu Oct 18 13:47:16 2018 -0400 orangefs: don't let orangefs_new_inode return NULL Suggested by Dan Carpenter Signed-off-by: Mike Marshall commit b8d9ee24493d862fbfeb3d209c032647f6073d5d Author: Dan Carpenter Date: Thu Oct 18 11:04:00 2018 +0300 usb: phy: ab8500: silence some uninitialized variable warnings Smatch complains that "reg" can be uninitialized if the abx500_get_register_interruptible() call fails. It's an interruptable function, so we should check if the user presses CTRL-C. Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman commit 6494a9ad86de921766afe91066f53a794f6c52ea Author: Jon Hunter Date: Tue Oct 16 14:22:43 2018 +0300 usb: xhci: tegra: Add genpd support The generic power-domain framework has been updated to allow devices that require more than one power-domain to create a new device for each power-domain required and then link these new power-domain devices to the consumer device. Update the Tegra xHCI driver to use the new APIs provided by the generic power-domain framework so we can use the generic power-domain framework for managing the xHCI controllers power-domains. Please note that to maintain backward compatibility with older device-tree blobs these new generic power-domain APIs are only used if the 'power-domains' property is present and otherwise we fall back to using the legacy Tegra APIs for managing the power-domains. Signed-off-by: Jon Hunter Acked-by: Thierry Reding Reviewed-by: Ulf Hansson Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman commit 8c14796b6b2485a31a50318d76d6bc4518dc9d39 Author: Jon Hunter Date: Tue Oct 16 14:22:42 2018 +0300 usb: xhci: tegra: Power-off power-domains on removal Currently the XUSB power domains used by the Tegra xHCI controller are never powered off on the removal of the driver, however, they will be powered off on probe failure. Update the removal code to be consistent with the probe failure path to power off the XUSB power domains. Signed-off-by: Jon Hunter Acked-by: Thierry Reding Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman commit e28fd56ad5273be67d0fae5bedc7e1680e729952 Author: Shuah Khan (Samsung OSG) Date: Thu Oct 18 10:19:29 2018 -0600 usbip:vudc: BUG kmalloc-2048 (Not tainted): Poison overwritten In rmmod path, usbip_vudc does platform_device_put() twice once from platform_device_unregister() and then from put_vudc_device(). The second put results in: BUG kmalloc-2048 (Not tainted): Poison overwritten error or BUG: KASAN: use-after-free in kobject_put+0x1e/0x230 if KASAN is enabled. [ 169.042156] calling init+0x0/0x1000 [usbip_vudc] @ 1697 [ 169.042396] ============================================================================= [ 169.043678] probe of usbip-vudc.0 returned 1 after 350 usecs [ 169.044508] BUG kmalloc-2048 (Not tainted): Poison overwritten [ 169.044509] ----------------------------------------------------------------------------- ... [ 169.057849] INFO: Freed in device_release+0x2b/0x80 age=4223 cpu=3 pid=1693 [ 169.057852] kobject_put+0x86/0x1b0 [ 169.057853] 0xffffffffc0c30a96 [ 169.057855] __x64_sys_delete_module+0x157/0x240 Fix it to call platform_device_del() instead and let put_vudc_device() do the platform_device_put(). Reported-by: Randy Dunlap Signed-off-by: Shuah Khan (Samsung OSG) Cc: Signed-off-by: Greg Kroah-Hartman commit e325808c0051b16729ffd472ff887c6cae5c6317 Author: Colin Ian King Date: Tue Oct 16 19:03:43 2018 +0100 usbip: tools: fix atoi() on non-null terminated string Currently the call to atoi is being passed a single char string that is not null terminated, so there is a potential read overrun along the stack when parsing for an integer value. Fix this by instead using a 2 char string that is initialized to all zeros to ensure that a 1 char read into the string is always terminated with a \0. Detected by cppcheck: "Invalid atoi() argument nr 1. A nul-terminated string is required." Fixes: 3391ba0e2792 ("usbip: tools: Extract generic code to be shared with vudc backend") Signed-off-by: Colin Ian King Signed-off-by: Greg Kroah-Hartman commit 090158555ff8d194a98616034100b16697dd80d0 Author: Mattias Jacobsson <2pi@mok.nu> Date: Tue Oct 16 14:20:08 2018 +0200 USB: misc: appledisplay: fix backlight update_status return code Upon success the update_status handler returns a positive number corresponding to the number of bytes transferred by usb_control_msg. However the return code of the update_status handler should indicate if an error occurred(negative) or how many bytes of the user's input to sysfs that was consumed. Return code zero indicates all bytes were consumed. The bug can for example result in the update_status handler being called twice, the second time with only the "unconsumed" part of the user's input to sysfs. Effectively setting an incorrect brightness. Change the update_status handler to return zero for all successful transactions and forward usb_control_msg's error code upon failure. Signed-off-by: Mattias Jacobsson <2pi@mok.nu> Signed-off-by: Greg Kroah-Hartman commit 644930cbad32c0a850aaeed11eb2a49b492bf51a Author: Lubomir Rintel Date: Mon Oct 15 16:45:38 2018 +0200 phy: phy-pxa-usb: add a new driver Turned from arch/arm/mach-mmp/devices.c into a proper PHY driver, so that in can be instantiated from a DT. Acked-by: Kishon Vijay Abraham I Signed-off-by: Lubomir Rintel Signed-off-by: Greg Kroah-Hartman commit 2d0f0ca2c7b56c1df29429dd5a768fc49e79ffae Merge: 99e9acd85ccb 208983f099d9 Author: David S. Miller Date: Thu Oct 18 10:27:20 2018 -0700 Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queue Jeff Kirsher says: ==================== 1GbE Intel Wired LAN Driver Updates 2018-10-17 This series adds support for the new igc driver. The igc driver is the new client driver supporting the Intel I225 Ethernet Controller, which supports 2.5GbE speeds. The reason for creating a new client driver, instead of adding support for the new device in e1000e, is that the silicon behaves more like devices supported in igb driver. It also did not make sense to add a client part, to the igb driver which supports only 1GbE server parts. This initial set of patches is designed for basic support (i.e. link and pass traffic). Follow-on patch series will add more advanced support like VLAN, Wake-on-LAN, etc.. ==================== Signed-off-by: David S. Miller commit 99e9acd85ccbdc8f5785f9e961d4956e96bd6aa5 Merge: 8f18da472115 bf07aa730a04 Author: David S. Miller Date: Thu Oct 18 10:25:37 2018 -0700 Merge tag 'mlx5-updates-2018-10-17' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux mlx5-updates-2018-10-17 ======================================================================== From Or Gerlitz : This series from Paul adds support to mlx5 e-switch tc offloading of multiple priorities and chains. This is made of four building blocks (along with few minor driver refactors): [1] Split FDB fast path prio to multiple namespaces Currently the FDB name-space contains two priorities, fast path (p0) and slow path (p1). The slow path contains the per representor SQ send-to-vport TX rule and the match-all RX miss rule. As a pre-step to support multi-chains and priorities, we split the FDB fast path to multiple namespaces (sub namespaces), each with multiple priorities. [2] E-Switch chains and priorities A chain is a group of priorities. We use the fdb parallel sub-namespaces to implement chains, and a flow table for each priority in them. Because these namespaces are parallel and in series to the slow path fdb, the chains aren't connected to each other (but to the slow path), and one must use a explicit goto action to reach a different chain. Flow tables for the priorities are created on demand and destroyed once not used. [3] Add a no-append flow insertion mode, use it for TC offloads Enhance the driver fs core, such that if a no-append flag is set by the caller, we add a new FTE, instead of appending the actions of the inserted rule when the same match already exists. For encap rules, we defer the HW offloading till we have a valid neighbor. This can result in the packet hitting a lower priority rule in the HW DP. Use the no-append API to push these packets to the slow path FDB table, so they go to the TC kernel DP as done before priorities where supported. [4] Offloading tc priorities and chains for eswitch flows Using [1], [2] and [3] above we add the support for offloading both chains and priorities. To get to a new chain, use the tc goto action. We support a fixed prio range 1-16, and chains 0-3. ============================================================================= Signed-off-by: David S. Miller commit 1b4d990b19d2de186b188da5b033110949c118fe Merge: 5b394b2ddf03 665636b2940d Author: Stephen Boyd Date: Thu Oct 18 10:15:37 2018 -0700 Merge tag 'v4.20-rockchip-clk1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into clk-rockchip Pull Rockchip clk driver updates from Heiko Stuebner: Fixes for static checker warning and a wrong shift value for the mmc on rk3328, as well as setting a hdmi-id on rk3066 for a later driver for the hdmi encoder on it and some adapted rk3288 pll rates to support more and better hdmi rates. * tag 'v4.20-rockchip-clk1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: clk: rockchip: Fix static checker warning in rockchip_ddrclk_get_parent call clk: rockchip: use the newly added clock-id for hdmi on RK3066 clk: rockchip: add clock-id for HCLK_HDMI on rk3066 clk: rockchip: fix wrong mmc sample phase shift for rk3328 clk: rockchip: improve rk3288 pll rates for better hdmi output commit 8f18da47211554f1ef674fef627c05f23b75a8e0 Merge: 82385b0d2d25 8d4b6bce2559 Author: David S. Miller Date: Thu Oct 18 09:57:42 2018 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next Steffen Klassert says: ==================== pull request (net-next): ipsec-next 2018-10-18 1) Remove an unnecessary dev->tstats check in xfrmi_get_stats64. From Li RongQing. 2) We currently do a sizeof(element) instead of a sizeof(array) check when initializing the ovec array of the secpath. Currently this array can have only one element, so code is OK but error-prone. Change this to do a sizeof(array) check so that we can add more elements in future. From Li RongQing. 3) Improve xfrm IPv6 address hashing by using the complete IPv6 addresses for a hash. From Michal Kubecek. Please pull or let me know if there are problems. ==================== Signed-off-by: David S. Miller commit 8a3ebd8de328301aacbe328650a59253be2ac82c Author: Zachary Zhang Date: Thu Oct 18 17:37:19 2018 +0200 PCI: aardvark: Implement emulated root PCI bridge config space The PCI controller in the Marvell Armada 3720 does not implement a software-accessible root port PCI bridge configuration space. This causes a number of problems when using PCIe switches or when the Max Payload size needs to be aligned between the root complex and the endpoint. Implementing an emulated root PCI bridge, like is already done in the pci-mvebu driver for older Marvell platforms allows to solve those issues, and also to support features such as ASR, PME, VC, HP. Signed-off-by: Zachary Zhang [Thomas: convert to the common emulated PCI bridge logic.] Signed-off-by: Thomas Petazzoni Signed-off-by: Lorenzo Pieralisi commit 1f08673eef1236f7d02d93fcf596bb8531ef0d12 Author: Thomas Petazzoni Date: Thu Oct 18 17:37:18 2018 +0200 PCI: mvebu: Convert to PCI emulated bridge config space Convert the pci-mvebu driver to use the pci-bridge-emul logic, that helps emulating a root port PCI bridge configuration space. Signed-off-by: Thomas Petazzoni [lorenzo.pieralisi@arm.com: updated commit log] Signed-off-by: Lorenzo Pieralisi commit eae6aaf8488ebbf0fd6e1588f0923db0462e4c5c Author: Thomas Petazzoni Date: Thu Oct 18 17:37:17 2018 +0200 PCI: mvebu: Drop unused PCI express capability code Commit dc0352ab0b2a0 ("PCI: mvebu: Add PCI Express root complex capability block") added support for emulating the PCI Express capability block. As part of this, the pcie_sltcap, pcie_devctl and pcie_rtctl fields were added to the mvebu_sw_pci_bridge structure, and used when reading the corresponding PCI Express capability block registers. However, those structure members are never set to any value other than zero. This makes them unneeded because: - pcie_devctl is used to OR *value, so with pcie_devctl always zero, it has no effect. - for pcie_sltcap and pcie_rtstl, the mvebu_sw_pci_bridge_read() function always returns 0 for registers that are not explicitly handled. In preparation for reworking the PCI bridge emulation logic in pci-mvebu, let's simplify the code by dropping those structure members. Signed-off-by: Thomas Petazzoni Signed-off-by: Lorenzo Pieralisi commit 23a5fba4d9411787c8e86ff5808e7d8e41bf3935 Author: Thomas Petazzoni Date: Thu Oct 18 17:37:16 2018 +0200 PCI: Introduce PCI bridge emulated config space common logic Some PCI host controllers do not expose a configuration space for the root port PCI bridge. Due to this, the Marvell Armada 370/38x/XP PCI controller driver (pci-mvebu) emulates a root port PCI bridge configuration space, and uses that to (among other things) dynamically create the memory windows that correspond to the PCI MEM and I/O regions. Since we now need to add a very similar logic for the Marvell Armada 37xx PCI controller driver (pci-aardvark), instead of duplicating the code, we create in this commit a common logic called pci-bridge-emul. The idea of this logic is to emulate a root port PCI bridge configuration space by providing configuration space read/write operations, and faking behind the scenes the configuration space of a PCI bridge. A PCI host controller driver simply has to call pci_bridge_emul_conf_read() and pci_bridge_emul_conf_write() to read/write the configuration space of the bridge. By default, the PCI bridge configuration space is simply emulated by a chunk of memory, but the PCI host controller can override the behavior of the read and write operations on a per-register basis to do additional actions if needed. We take care of complying with the behavior of the PCI configuration space registers in terms of bits that are read-write, read-only, reserved and write-1-to-clear. Signed-off-by: Thomas Petazzoni Signed-off-by: Lorenzo Pieralisi Acked-by: Bjorn Helgaas Reviewed-by: Russell King commit ea89238c0a7b346bc90552e0244e87edf3311920 Author: Guoqing Jiang Date: Thu Oct 18 16:37:48 2018 +0800 md-cluster: remove suspend_info Previously, we allow multiple nodes can resync device, but we had changed it to only support one node can do resync at one time, but suspend_info is still used. Now, let's remove the structure and use suspend_lo/hi to record the range. Reviewed-by: NeilBrown Signed-off-by: Guoqing Jiang Signed-off-by: Shaohua Li commit cb9ee154317b084a96a7c2b771d1688f39fc714c Author: Guoqing Jiang Date: Thu Oct 18 16:37:47 2018 +0800 md-cluster: send BITMAP_NEEDS_SYNC message if reshaping is interrupted We need to continue the reshaping if it was interrupted in original node. So original node should call resync_bitmap in case reshaping is aborted. Then BITMAP_NEEDS_SYNC message is broadcasted to other nodes, node which continues the reshaping should restart reshape from mddev->reshape_position instead of from the first beginning. Reviewed-by: NeilBrown Signed-off-by: Guoqing Jiang Signed-off-by: Shaohua Li commit cbce6863b6d04f6eac6b144bcfaaf11a189d6533 Author: Guoqing Jiang Date: Thu Oct 18 16:37:46 2018 +0800 md-cluster/bitmap: don't call md_bitmap_sync_with_cluster during reshaping stage When reshape is happening in one node, other nodes could receive lots of RESYNCING messages, so md_bitmap_sync_with_cluster is called. Since the resyncing window is typically small in these RESYNCING messages, so WARN is always triggered, so we should not call the func when reshape is happening. Reviewed-by: NeilBrown Signed-off-by: Guoqing Jiang Signed-off-by: Shaohua Li commit ca1e98e04a8d6cefbe8ad138df806434de6de7f3 Author: Guoqing Jiang Date: Thu Oct 18 16:37:45 2018 +0800 md-cluster/raid10: don't call remove_and_add_spares during reshaping stage remove_and_add_spares is not needed if reshape is happening in another node, because raid10_add_disk called inside raid10_start_reshape would handle the role changes of disk. Plus, remove_and_add_spares can't deal with the role change due to reshape. Reviewed-by: NeilBrown Signed-off-by: Guoqing Jiang Signed-off-by: Shaohua Li commit aefb2e5fc2be590e6bef8985f3d175c3d38b0b77 Author: Guoqing Jiang Date: Thu Oct 18 16:37:44 2018 +0800 md-cluster/raid10: call update_size in md_reap_sync_thread We need to change the capacity in all nodes after one node finishs reshape. And as we did before, we can't change the capacity directly in md_do_sync, instead, the capacity should be only changed in update_size or received CHANGE_CAPACITY msg. So master node calls update_size after completes reshape in md_reap_sync_thread, but we need to skip ops->update_size if MD_CLOSING is set since reshaping could not be finish. Reviewed-by: NeilBrown Signed-off-by: Guoqing Jiang Signed-off-by: Shaohua Li commit 5ebaf80bc8d5826edcc2d1cea26a7d5a4b8f01dd Author: Guoqing Jiang Date: Thu Oct 18 16:37:43 2018 +0800 md-cluster: introduce resync_info_get interface for sanity check Since the resync region from suspend_info means one node is reshaping this area, so the position of reshape_progress should be included in the area. Reviewed-by: NeilBrown Signed-off-by: Guoqing Jiang Signed-off-by: Shaohua Li commit 7564beda19b3646d781934d04fc382b738053e6f Author: Guoqing Jiang Date: Thu Oct 18 16:37:42 2018 +0800 md-cluster/raid10: support add disk under grow mode For clustered raid10 scenario, we need to let all the nodes know about that a new disk is added to the array, and the reshape caused by add new member just need to be happened in one node, but other nodes should know about the change. Since reshape means read data from somewhere (which is already used by array) and write data to unused region. Obviously, it is awful if one node is reading data from address while another node is writing to the same address. Considering we have implemented suspend writes in the resyncing area, so we can just broadcast the reading address to other nodes to avoid the trouble. For master node, it would call reshape_request then update sb during the reshape period. To avoid above trouble, we call resync_info_update to send RESYNC message in reshape_request. Then from slave node's view, it receives two type messages: 1. RESYNCING message Slave node add the address (where master node reading data from) to suspend list. 2. METADATA_UPDATED message Once slave nodes know the reshaping is started in master node, it is time to update reshape position and call start_reshape to follow master node's step. After reshape is done, only reshape position is need to be updated, so the majority task of reshaping is happened on the master node. Reviewed-by: NeilBrown Signed-off-by: Guoqing Jiang Signed-off-by: Shaohua Li commit afd75628608337cf427a1f9ca0e46698a74f25d8 Author: Guoqing Jiang Date: Thu Oct 18 16:37:41 2018 +0800 md-cluster/raid10: resize all the bitmaps before start reshape To support add disk under grow mode, we need to resize all the bitmaps of each node before reshape, so that we can ensure all nodes have the same view of the bitmap of the clustered raid. So after the master node resized the bitmap, it broadcast a message to other slave nodes, and it checks the size of each bitmap are same or not by compare pages. We can only continue the reshaping after all nodes update the bitmap to the same size (by checking the pages), otherwise revert bitmap size to previous value. The resize_bitmaps interface and BITMAP_RESIZE message are introduced in md-cluster.c for the purpose. Reviewed-by: NeilBrown Signed-off-by: Guoqing Jiang Signed-off-by: Shaohua Li commit dc8af3a827df6d4bb925d3b81b7ec94a7cce9482 Author: Jon Derrick Date: Mon Oct 15 18:48:07 2018 -0600 PCI: vmd: Detach resources after stopping root bus The VMD removal path calls pci_stop_root_busi(), which tears down the pcie tree, including detaching all of the attached drivers. During driver detachment, devices may use pci_release_region() to release resources. This path relies on the resource being accessible in resource tree. By detaching the child domain from the parent resource domain prior to stopping the bus, we are preventing the list traversal from finding the resource to be freed. If we instead detach the resource after stopping the bus, we will have properly freed the resource and detaching is simply accounting at that point. Without this order, the resource is never freed and is orphaned on VMD removal, leading to a warning: [ 181.940162] Trying to free nonexistent resource Fixes: 2c2c5c5cd213 ("x86/PCI: VMD: Attach VMD resources to parent domain's resource tree") Signed-off-by: Jon Derrick [lorenzo.pieralisi@arm.com: updated commit log] Signed-off-by: Lorenzo Pieralisi Reviewed-by: Keith Busch commit ed0302e83098db9b3a8c27f36c93deeafd6963d8 Author: Michał Mirosław Date: Tue Oct 9 22:13:43 2018 +0200 dm crypt: make workqueue names device-specific Make cpu-usage debugging easier by naming workqueues per device. Example ps output: root 413 0.0 0.0 0 0 ? I< paź02 0:00 [kcryptd_io/253:0] root 414 0.0 0.0 0 0 ? I< paź02 0:00 [kcryptd/253:0] root 415 0.0 0.0 0 0 ? S paź02 1:10 [dmcrypt_write/253:0] root 465 0.0 0.0 0 0 ? I< paź02 0:00 [kcryptd_io/253:2] root 466 0.0 0.0 0 0 ? I< paź02 0:00 [kcryptd/253:2] root 467 0.0 0.0 0 0 ? S paź02 2:06 [dmcrypt_write/253:2] root 15359 0.2 0.0 0 0 ? I< 19:43 0:25 [kworker/u17:8-kcryptd/253:0] root 16563 0.2 0.0 0 0 ? I< 20:10 0:18 [kworker/u17:0-kcryptd/253:2] root 23205 0.1 0.0 0 0 ? I< 21:21 0:04 [kworker/u17:4-kcryptd/253:0] root 13383 0.1 0.0 0 0 ? I< 21:32 0:02 [kworker/u17:2-kcryptd/253:2] root 2610 0.1 0.0 0 0 ? I< 21:42 0:01 [kworker/u17:12-kcryptd/253:2] root 20124 0.1 0.0 0 0 ? I< 21:56 0:01 [kworker/u17:1-kcryptd/253:2] Signed-off-by: Michał Mirosław Signed-off-by: Mike Snitzer commit e45506ac0af9b56b221863e9649fe122d8bb42ff Author: Yangtao Li Date: Thu Oct 18 10:21:33 2018 -0400 softirq: Fix typo in __do_softirq() comments s/s/as [ mingo: Also add a missing 'the', add proper punctuation and clarify what 'swap' means here. ] Signed-off-by: Yangtao Li Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: alexander.levin@verizon.com Cc: frederic@kernel.org Cc: joel@joelfernandes.org Cc: paulmck@linux.vnet.ibm.com Cc: rostedt@goodmis.org Link: http://lkml.kernel.org/r/20181018142133.12341-1-tiny.windzz@gmail.com Signed-off-by: Ingo Molnar commit f349b0a3e1f0d184374936f1b2a49352f8a4b1c8 Author: Michał Mirosław Date: Tue Oct 9 22:13:42 2018 +0200 dm: add dm_table_device_name() Add a shortcut for dm_device_name(dm_table_get_md(t)). Signed-off-by: Michał Mirosław Signed-off-by: Mike Snitzer commit 800a7340ab7dd667edf95e74d8e4f23a17e87076 Author: Wenwen Wang Date: Wed Oct 3 11:43:59 2018 -0500 dm ioctl: harden copy_params()'s copy_from_user() from malicious users In copy_params(), the struct 'dm_ioctl' is first copied from the user space buffer 'user' to 'param_kernel' and the field 'data_size' is checked against 'minimum_data_size' (size of 'struct dm_ioctl' payload up to its 'data' member). If the check fails, an error code EINVAL will be returned. Otherwise, param_kernel->data_size is used to do a second copy, which copies from the same user-space buffer to 'dmi'. After the second copy, only 'dmi->data_size' is checked against 'param_kernel->data_size'. Given that the buffer 'user' resides in the user space, a malicious user-space process can race to change the content in the buffer between the two copies. This way, the attacker can inject inconsistent data into 'dmi' (versus previously validated 'param_kernel'). Fix redundant copying of 'minimum_data_size' from user-space buffer by using the first copy stored in 'param_kernel'. Also remove the 'data_size' check after the second copy because it is now unnecessary. Cc: stable@vger.kernel.org Signed-off-by: Wenwen Wang Signed-off-by: Mike Snitzer commit d6afa561e1471ccfdaf7191230c0c59a37e45a5b Author: David Miller Date: Wed Oct 17 12:08:59 2018 -0700 perf symbols: Set PLT entry/header sizes properly on Sparc Using the sh_entsize for both values isn't correct. It happens to be correct on x86... For both 32-bit and 64-bit sparc, there are four PLT entries in the PLT section. Signed-off-by: David S. Miller Cc: Alexander Shishkin Cc: Alexis Berlemont Cc: David Tolnay Cc: Hanjun Guo Cc: Hemant Kumar Cc: Li Bin Cc: Masami Hiramatsu Cc: Milian Wolff Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Wang Nan Cc: zhangmengting@huawei.com Fixes: b2f7605076d6 ("perf symbols: Fix plt entry calculation for ARM and AARCH64") Link: http://lkml.kernel.org/r/20181017.120859.2268840244308635255.davem@davemloft.net Signed-off-by: Arnaldo Carvalho de Melo commit d87b9790b3deb7601872d34fd05af3da78147583 Author: David Miller Date: Tue Oct 16 21:15:45 2018 -0700 perf jitdump: Add Sparc support. Signed-off-by: David S. Miller Link: http://lkml.kernel.org/r/20181016.211545.1487970139012324624.davem@davemloft.net Signed-off-by: Arnaldo Carvalho de Melo commit 0ab41886648bb75b951bd41d8b5cecaca8e0ad66 Author: David Miller Date: Tue Oct 16 20:55:55 2018 -0700 perf annotate: Add Sparc support E.g.: $ perf annotate --stdio2 Samples: 7K of event 'cycles:ppp', 4000 Hz, Event count (approx.): 3086733887 __gettimeofday /lib32/libc-2.27.so [Percent: local period] Percent│ │ │ │ Disassembly of section .text: │ │ 000a6fa0 <__gettimeofday@@GLIBC_2.0>: 0.47 │ save %sp, -96, %sp 0.73 │ sethi %hi(0xe9000), %l7 │ → call __frame_state_for@@GLIBC_2.0+0x480 0.30 │ add %l7, 0x58, %l7 ! e9058 1.33 │ mov %i0, %o0 │ mov %i1, %o1 0.43 │ mov 0x74, %g1 │ ta 0x10 88.92 │ ↓ bcc 30 2.95 │ clr %g1 │ neg %o0 │ mov 1, %g1 0.31 │30: cmp %g1, 0 │ bne,pn %icc, a6fe4 <__gettimeofday@@GLIBC_2.0+0x44> │ mov %o0, %i0 1.96 │ ← return %i7 + 8 2.62 │ nop │ sethi %hi(0), %g1 │ neg %o0, %g2 │ add %g1, 0x160, %g1 │ ld [ %l7 + %g1 ], %g1 │ st %g2, [ %g7 + %g1 ] │ ← return %i7 + 8 │ mov -1, %o0 Signed-off-by: David S. Miller Link: http://lkml.kernel.org/r/20181016.205555.1070918198627611771.davem@davemloft.net Signed-off-by: Arnaldo Carvalho de Melo commit cf7905165fee15fe26ac4a91ee0a35b966249430 Author: Alexey Budankov Date: Tue Oct 9 17:36:24 2018 +0300 perf record: Encode -k clockid frequency into Perf trace Store -k clockid frequency into Perf trace to enable timestamps derived metrics conversion into wall clock time on reporting stage. Below is the example of perf report output: tools/perf/perf record -k raw -- ../../matrix/linux/matrix.gcc ... [ perf record: Captured and wrote 31.222 MB perf.data (818054 samples) ] tools/perf/perf report --header # ======== ... # event : name = cycles:ppp, , size = 112, { sample_period, sample_freq } = 4000, sample_type = IP|TID|TIME|PERIOD, disabled = 1, inherit = 1, mmap = 1, comm = 1, freq = 1, enable_on_exec = 1, task = 1, precise_ip = 3, sample_id_all = 1, exclude_guest = 1, mmap2 = 1, comm_exec = 1, use_clockid = 1, clockid = 4 ... # clockid frequency: 1000 MHz ... # ======== Signed-off-by: Alexey Budankov Cc: Alexander Shishkin Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/23a4a1dc-b160-85a0-347d-40a2ed6d007b@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo commit ce6c9da1113ad681bff27a3e376d2017f7f8a59c Merge: d4ae552982de 20e8e72d0fa8 Author: Arnaldo Carvalho de Melo Date: Thu Oct 18 11:13:01 2018 -0300 Merge remote-tracking branch 'tip/perf/urgent' into perf/core To pick up fixes. Signed-off-by: Arnaldo Carvalho de Melo commit a0e102914aa3f619a5bc68a0d33e17d1788cdf4c Author: Christophe Leroy Date: Tue Oct 16 12:33:40 2018 +0000 powerpc/io: remove old GCC version implementation GCC 4.6 is the minimum supported now. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 23ad1a2700725d46ee7760920974c68be81ab82d Author: Michael Ellerman Date: Wed Oct 10 16:13:06 2018 +1100 powerpc: Add -Werror at arch/powerpc level Back when I added -Werror in commit ba55bd74360e ("powerpc: Add configurable -Werror for arch/powerpc") I did it by adding it to most of the arch Makefiles. At the time we excluded math-emu, because apparently it didn't build cleanly. But that seems to have been fixed somewhere in the interim. So move the -Werror addition to the top-level of the arch, this saves us from repeating it in every Makefile and means we won't forget to add it to any new sub-dirs. Signed-off-by: Michael Ellerman commit c47ca98d32a22a412ddbc69916cf62bdcdfa1a4e Author: Michael Ellerman Date: Wed Oct 10 16:13:05 2018 +1100 powerpc: Move core kernel logic into arch/powerpc/Kbuild This is a nice cleanup, arch/powerpc/Makefile is long and messy so moving this out helps a little. It also allows us to do: $ make arch/powerpc Which can be helpful if you just want to compile test some changes to arch code and not link everything. Finally it also gives us a single place to do subdir-cc-flags assignments which affect the whole of arch/powerpc, which we will do in a future patch. Signed-off-by: Michael Ellerman commit fc0c8b36d379a046525eacb9c3323ca635283757 Author: Benjamin Herrenschmidt Date: Mon Oct 15 11:18:49 2018 +1100 macintosh/windfarm_smu_sat: Fix debug output There's some antiquated debug output that's trying to do a hand-made hexdump and turning into horrible 1-byte-per-line output these days. Use print_hex_dump() instead Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Michael Ellerman commit bd03fd84a53ac9ddaeb0a0fc4c4c9836e12f3ab9 Author: Christophe Leroy Date: Mon Oct 15 07:38:10 2018 +0000 powerpc/traps: remove redundant in_interrupt panic in die() do_exit() already includes a test to panic() is in_interrupt() This patch removes powerpc one which is redundant. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit f1f208e54d08ccf00121c700a9bb1fe3e55b3a51 Author: Benjamin Herrenschmidt Date: Mon Oct 15 13:50:00 2018 +1100 powerpc/prom_init: Generate "phandle" instead of "linux, phandle" When creating the boot-time FDT from an actual Open Firmware live tree, let's generate "phandle" properties for the phandles instead of the old deprecated "linux,phandle". Signed-off-by: Benjamin Herrenschmidt [mpe: Unsplit warning printf()] Signed-off-by: Michael Ellerman commit 2c51d97ee88da897db8405f659d1735ffe86ad7c Author: Benjamin Herrenschmidt Date: Mon Oct 15 13:49:59 2018 +1100 powerpc: Check prom_init for disallowed sections prom_init.c must not modify the kernel image outside of the .bss.prominit section. Thus make sure that prom_init.o doesn't have anything in any of these: .data .bss .init.data Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Michael Ellerman commit 5f69e38885c3483a1838dd946aaf0166b727ecbd Author: Benjamin Herrenschmidt Date: Mon Oct 15 13:49:58 2018 +1100 powerpc/prom_init: Move __prombss to it's own section and store it in .bss This makes __prombss its own section, and for now store it in .bss. This will give us the ability later to store it elsewhere and/or free it after boot (it's about 8KB). Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Michael Ellerman commit 8ca2d5151e7f5cbef42eda780eac56acc0eab47a Author: Benjamin Herrenschmidt Date: Mon Oct 15 13:49:57 2018 +1100 powerpc/prom_init: Move a few remaining statics to appropriate sections Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Michael Ellerman commit d00e34b92cd7d8f1c10c2f0a8c10368bfca1a5dc Author: Benjamin Herrenschmidt Date: Mon Oct 15 13:49:56 2018 +1100 powerpc/prom_init: Move const structures to __initconst As they are no longer used past the end of prom_init Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Michael Ellerman commit a614f52e75bd69b513707b4adc672149c4903995 Author: Benjamin Herrenschmidt Date: Mon Oct 15 13:49:55 2018 +1100 powerpc/prom_init: Move ibm_arch_vec to __prombss Make the existing initialized definition constant and copy it to a __prombss copy Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Michael Ellerman commit c886087caee759790db47f345f8382d653015de3 Author: Benjamin Herrenschmidt Date: Mon Oct 15 13:49:54 2018 +1100 powerpc/prom_init: Move prom_radix_disable to __prombss Initialize it dynamically instead of statically Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Michael Ellerman commit 11fdb309341ca1ba2e3d03fd1c9c0c6aedaea0b6 Author: Benjamin Herrenschmidt Date: Mon Oct 15 13:49:53 2018 +1100 powerpc/prom_init: Remove support for OPAL v2 We removed support for running under any OPAL version earlier than v3 in 2015 (they never saw the light of day anyway), but we kept some leftovers of this support in prom_init.c, so let's take it out. Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Michael Ellerman commit e63334e556d9286fc30bec1050360824bcd2d990 Author: Benjamin Herrenschmidt Date: Mon Oct 15 13:49:52 2018 +1100 powerpc/prom_init: Replace __initdata with __prombss when applicable This replaces all occurrences of __initdata for uninitialized data with a new __prombss Currently __promdata is defined to be __initdata but we'll eventually change that. Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Michael Ellerman commit b5beae5e224f1c72c4482b0ab36fc3d89481a6b2 Author: Oliver O'Halloran Date: Mon Oct 15 10:18:28 2018 +1100 powerpc/pseries: Add driver for PAPR SCM regions Adds a driver that implements support for enabling and accessing PAPR SCM regions. Unfortunately due to how the PAPR interface works we can't use the existing of_pmem driver (yet) because: a) The guest is required to use the H_SCM_BIND_MEM h-call to add add the SCM region to it's physical address space, and b) There is currently no mechanism for relating a bare of_pmem region to the backing DIMM (or not-a-DIMM for our case). Both of these are easily handled by rolling the functionality into a seperate driver so here we are... Acked-by: Dan Williams Signed-off-by: Oliver O'Halloran Signed-off-by: Michael Ellerman commit 4c5d87db497832c493ed296157bd1749dddc69f1 Author: Oliver O'Halloran Date: Mon Oct 15 10:18:27 2018 +1100 powerpc/pseries: PAPR persistent memory support This patch implements support for discovering storage class memory devices at boot and for handling hotplug of new regions via RTAS hotplug events. Signed-off-by: Oliver O'Halloran [mpe: Fix CONFIG_MEMORY_HOTPLUG=n build] Signed-off-by: Michael Ellerman commit 422123ccb9a13dcea2e008194ae6c262fbb64604 Author: Christophe Leroy Date: Mon Oct 15 07:20:45 2018 +0000 powerpc/traps: fix machine check handlers to use pr_cont() When printing the machine check cause, the cause appears on the following line due to bad use of printk without \n: [ 33.663993] Machine check in kernel mode. [ 33.664011] Caused by (from SRR1=9032): [ 33.664036] Data access error at address c90c8000 This patch fixes it by using pr_cont() for the second part: [ 133.258131] Machine check in kernel mode. [ 133.258146] Caused by (from SRR1=9032): Data access error at address c90c8000 Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit bde1a1335c5031758d3917d83dd5b85b761bbebd Author: Christophe Leroy Date: Wed Oct 17 13:03:22 2018 +0000 powerpc/book3e: redefine pte_mkprivileged() and pte_mkuser() Book3e defines both _PAGE_USER and _PAGE_PRIVILEGED, so the nohash default pte_mkprivileged() and pte_mkuser() are not usable. This patch redefines them for book3e. In theorie, only pte_mkprivileged() needs to be redefined because _PAGE_USER includes _PAGE_PRIVILEGED, but it is less confusing to redefine both. Fixes: a0da4bc166f2 ("powerpc/mm: Allow platforms to redefine some helpers") Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit b9fb4480a3af85552d88561a2fea9c4d5f54c917 Author: Aneesh Kumar K.V Date: Wed Oct 17 15:09:21 2018 +0530 powerpc/mm: Make pte_pgprot return all pte bits Other archs do the same and instead of adding required pte bits (which got masked out) in __ioremap_at(), make sure we filter only pfn bits out. Fixes: 26973fa5ac0e ("powerpc/mm: use pte helpers in generic code") Reviewed-by: Christophe Leroy Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman commit eb7ebfa3c1989aa8e59d5e68ab3cddd7df1bfb27 Author: Philipp Klocke Date: Thu Oct 18 12:33:02 2018 +0200 ALSA: i2c/cs8427: Fix int to char conversion Compiling with clang yields the following warning: sound/i2c/cs8427.c:140:31: warning: implicit conversion from 'int' to 'char' changes value from 160 to -96 [-Wconstant-conversion] data[0] = CS8427_REG_AUTOINC | CS8427_REG_CORU_DATABUF; ~ ~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~ Because CS8427_REG_AUTOINC is defined as 128, it is too big for a char field. So change data from char to unsigned char, that it can hold the value. This patch does not change the generated code. Signed-off-by: Philipp Klocke Signed-off-by: Takashi Iwai commit 89303c7ea770b6010943ef4ed73eb92bdc5a7ec8 Merge: ef1a2a62cc48 17c42e34997a Author: Greg Kroah-Hartman Date: Thu Oct 18 14:59:04 2018 +0200 Merge tag 'usb-serial-4.20-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-next Johan writes: USB-serial updates for v4.20-rc1 Here are the USB-serial updates for 4.20-rc1, including: - support for CBUS GPIO on FTDI devices (FTX and FT232R) - fix of a long-standing transfer-length bug Included are also various clean ups. All have been in linux-next with no reported issues. Signed-off-by: Johan Hovold * tag 'usb-serial-4.20-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: cypress_m8: remove set but not used variable 'iflag' USB: serial: cypress_m8: fix interrupt-out transfer length USB: serial: ftdi_sio: add support for FT232R CBUS gpios USB: serial: ftdi_sio: fix gpio name collisions USB: serial: ftdi_sio: implement GPIO support for FT-X devices USB: serial: cypress_m8: fix spelling mistake "retreiving" -> "retrieving" commit 0a1875ad29ef6436da3c184494b509697c8e0cf7 Merge: 1f825f74c113 d030fd0ec5c7 757c968c4423 Author: Rafael J. Wysocki Date: Thu Oct 18 12:37:51 2018 +0200 Merge branches 'acpi-property' and 'acpi-sbs' * acpi-property: ACPI / property: Switch to bitmap_zalloc() * acpi-sbs: ACPI / SBS: Fix rare oops when removing modules ACPI / SBS: Fix GPE storm on recent MacBookPro's commit 1f825f74c1132cea03a9edf02475ffb7715731dc Merge: bd371e088bd3 48402cee6889 d0381bf4f80c 78cd96f0504b afd0b1fb2226 3230b2b3c1ab Author: Rafael J. Wysocki Date: Thu Oct 18 12:37:27 2018 +0200 Merge branches 'acpi-soc', 'acpi-processor', 'acpi-pmic', 'acpi-cppc' and 'acpi-tad' * acpi-soc: ACPI / LPSS: Resume BYT/CHT I2C controllers from resume_noirq ACPI / LPSS: Add a device link from the GPU to the BYT I2C5 controller ACPI / LPSS: Add a device link from the GPU to the CHT I2C7 controller ACPI / LPSS: Make acpi_lpss_find_device() also find PCI devices ACPI / LPSS: Make hid_uid_match helper accept a NULL uid argument ACPI / LPSS: Make hid_uid_match helper take an acpi_device as first argument ACPI / LPSS: Exclude I2C busses shared with PUNIT from pmc_atom_d3_mask ACPI / LPSS: Add alternative ACPI HIDs for Cherry Trail DMA controllers * acpi-processor: ACPI / processor: Fix the return value of acpi_processor_ids_walk() * acpi-pmic: ACPI / PMIC: Convert drivers to use SPDX identifier ACPI / PMIC: Sort headers alphabetically * acpi-cppc: mailbox: PCC: handle parse error * acpi-tad: ACPI: TAD: Add low-level support for real time capability commit bd371e088bd39d31cf9fa8cb91858a87df404e7f Merge: 3c88a889b4ec d737f333b211 83b2348e2755 719cf71cada1 59bbff3775c0 56f57c07fd08 Author: Rafael J. Wysocki Date: Thu Oct 18 12:37:11 2018 +0200 Merge branches 'acpi-init', 'acpi-osl', 'acpi-bus', 'acpi-tables' and 'acpi-misc' * acpi-init: ACPI: probe ECDT before loading AML tables regardless of module-level code flag * acpi-osl: ACPI / OSL: Use 'jiffies' as the time bassis for acpi_os_get_timer() * acpi-bus: ACPI / glue: Split dev_is_platform() out of module for wide use * acpi-tables: ACPI/PPTT: Handle architecturally unknown cache types drivers: base: cacheinfo: Do not populate sysfs for unknown cache types * acpi-misc: ACPI: remove redundant 'default n' from Kconfig ACPI: custom_method: remove meaningless null check before debugfs_remove() commit cc19b05e3883efbbfd525747a86d0567b12c4d12 Merge: 5d113aa679b8 8fa387494928 9a69e3ac41a5 Author: Rafael J. Wysocki Date: Thu Oct 18 12:28:12 2018 +0200 Merge branches 'pm-devfreq' and 'pm-tools' * pm-devfreq: PM / devfreq: remove redundant null pointer check before kfree PM / devfreq: stopping the governor before device_unregister() PM / devfreq: Convert to using %pOFn instead of device_node.name PM / devfreq: Make update_devfreq() public PM / devfreq: Don't adjust to user limits in governors PM / devfreq: Fix handling of min/max_freq == 0 PM / devfreq: Drop custom MIN/MAX macros PM / devfreq: Fix devfreq_add_device() when drivers are built as modules. * pm-tools: PM / tools: sleepgraph and bootgraph: upgrade to v5.2 PM / tools: sleepgraph: first batch of v5.2 changes cpupower: Fix coredump on VMWare cpupower: Fix AMD Family 0x17 msr_pstate size cpupower: remove stringop-truncation waring commit 5d113aa679b855e03629cc79c7b7a5faf2ce2b89 Merge: 3f858ae02c19 c2dc121c6499 17ed15183c24 Author: Rafael J. Wysocki Date: Thu Oct 18 12:27:51 2018 +0200 Merge branches 'pm-opp' and 'powercap' * pm-opp: PM / OPP: _of_add_opp_table_v2(): increment count only if OPP is added cpufreq: dt: Try freeing static OPPs only if we have added them OPP: Return error on error from dev_pm_opp_get_opp_count() OPP: Improve error handling in dev_pm_opp_of_cpumask_add_table() OPP: Pass OPP table to _of_add_opp_table_v{1|2}() OPP: Prevent creating multiple OPP tables for devices sharing OPP nodes OPP: Use a single mechanism to free the OPP table OPP: Don't remove dynamic OPPs from _dev_pm_opp_remove_table() cpufreq: mvebu: Remove OPPs using dev_pm_opp_remove() OPP: Create separate kref for static OPPs list OPP: Don't take OPP table's kref for static OPPs OPP: Parse OPP table's DT properties from _of_init_opp_table() OPP: Pass index to _of_init_opp_table() OPP: Protect dev_list with opp_table lock OPP: Don't try to remove all OPP tables on failure OPP: Free OPP table properly on performance state irregularities * powercap: powercap: RAPL: Get rid of custom RAPL_CPU() macro commit 3f858ae02c196c1f97b88f56a28ff0263ac909f8 Merge: d1551f7a5aed 1cdda9486f51 1fca4ba0b14d Author: Rafael J. Wysocki Date: Thu Oct 18 12:27:30 2018 +0200 Merge branches 'acpi-pm' and 'pm-sleep' * acpi-pm: ACPI / PM: LPIT: Register sysfs attributes based on FADT * pm-sleep: x86-32, hibernate: Adjust in_suspend after resumed on 32bit system x86-32, hibernate: Set up temporary text mapping for 32bit system x86-32, hibernate: Switch to relocated restore code during resume on 32bit system x86-32, hibernate: Switch to original page table after resumed x86-32, hibernate: Use the page size macro instead of constant value x86-32, hibernate: Use temp_pgt as the temporary page table x86, hibernate: Rename temp_level4_pgt to temp_pgt x86-32, hibernate: Enable CONFIG_ARCH_HIBERNATION_HEADER on 32bit system x86, hibernate: Extract the common code of 64/32 bit system x86-32/asm/power: Create stack frames in hibernate_asm_32.S PM / hibernate: Check the success of generating md5 digest before hibernation x86, hibernate: Fix nosave_regions setup for hibernation PM / sleep: Show freezing tasks that caused a suspend abort PM / hibernate: Documentation: fix image_size default value commit d1551f7a5aed809bb1e912da9faf36927e739ca0 Merge: 41fd838cda4c a3ade38d5a8b Author: Rafael J. Wysocki Date: Thu Oct 18 12:26:11 2018 +0200 Merge branch 'pm-cpufreq' * pm-cpufreq: cpufreq: tegra186: don't pass GFP_DMA32 to dma_alloc_coherent() cpufreq: conservative: Take limits changes into account properly Documentation: intel_pstate: Add base_frequency information cpufreq: intel_pstate: Add base_frequency attribute ACPI / CPPC: Add support for guaranteed performance cpufreq: imx6q: read OCOTP through nvmem for imx6ul/imx6ull cpufreq: dt-platdev: allow RK3399 to have separate tunables per cluster cpufreq / CPPC: Mark acpi_ids as used cpufreq: dt: Add support for r8a7744 cpufreq: Convert to using %pOFn instead of device_node.name cpufreq: remove unnecessary unlikely() commit 41fd838cda4ca3e2c87820efc18e04c88fe4b12d Merge: e5089c2c73a1 f1c8e410cdac Author: Rafael J. Wysocki Date: Thu Oct 18 12:26:00 2018 +0200 Merge branch 'pm-cpuidle' * pm-cpuidle: cpuidle: menu: Avoid computations when result will be discarded cpuidle: menu: Drop redundant comparison cpuidle: menu: Simplify checks related to the polling state cpuidle: poll_state: Revise loop termination condition cpuidle: menu: Move the latency_req == 0 special case check cpuidle: menu: Avoid computations for very close timers cpuidle: menu: Do not update last_state_idx in menu_select() cpuidle: menu: Get rid of first_idx from menu_select() cpuidle: menu: Compute first_idx when latency_req is known cpuidle: menu: Fix wakeup statistics updates for polling state cpuidle: menu: Replace data->predicted_us with local variable cpuidle: enter_state: Don't needlessly calculate diff time cpuidle: Remove unnecessary wrapper cpuidle_get_last_residency() intel_idle: Get rid of custom ICPU() macro commit e5089c2c73a157997eb6ecca982adea9d0673075 Author: Ulf Hansson Date: Wed Oct 3 16:38:16 2018 +0200 PM / Domains: Document flags for genpd The current documented description of the GENPD_FLAG_* flags, are too simplified, so let's extend them. Signed-off-by: Ulf Hansson Signed-off-by: Rafael J. Wysocki commit 2c9b7f8772033cc8bafbd4eefe2ca605bf3eb094 Author: Ulf Hansson Date: Wed Oct 3 16:38:15 2018 +0200 PM / Domains: Deal with multiple states but no governor in genpd A caller of pm_genpd_init() that provides some states for the genpd via the ->states pointer in the struct generic_pm_domain, should also provide a governor. This because it's the job of the governor to pick a state that satisfies the constraints. Therefore, let's print a warning to inform the user about such bogus configuration and avoid to bail out, by instead picking the shallowest state before genpd invokes the ->power_off() callback. Signed-off-by: Ulf Hansson Reviewed-by: Lina Iyer Signed-off-by: Rafael J. Wysocki commit 2c361684803e0129007806b1ce42cbf9c52f8cd0 Author: Ulf Hansson Date: Wed Oct 3 16:38:14 2018 +0200 PM / Domains: Don't treat zero found compatible idle states as an error Instead of returning -EINVAL from of_genpd_parse_idle_states() in case none compatible states was found, let's return 0 to indicate success. Assign also the out-parameter *states to NULL and *n to 0, to indicate to the caller that zero states have been found/allocated. This enables the caller of of_genpd_parse_idle_states() to easier act on the returned error code. Signed-off-by: Ulf Hansson Reviewed-by: Lina Iyer Signed-off-by: Rafael J. Wysocki commit 3c88a889b4ec8d1ba36cc2d317ed7563677d1d46 Merge: 589edb56b424 08930d56c76a Author: Rafael J. Wysocki Date: Thu Oct 18 12:20:59 2018 +0200 Merge branch 'acpica' * acpica: ACPICA: Remove acpi_gbl_group_module_level_code and only use acpi_gbl_execute_tables_as_methods instead ACPICA: AML Parser: fix parse loop to correctly skip erroneous extended opcodes ACPICA: AML interpreter: add region addresses in global list during initialization ACPICA: Update version to 20181003 ACPICA: Never run _REG on system_memory and system_IO ACPICA: Split large interpreter file ACPICA: Update for field unit access ACPICA: Rename some of the Field Attribute defines ACPICA: Update for generic_serial_bus and attrib_raw_process_bytes protocol commit 58bf437ff64eac8aca606e42d7e4623e40b61fa1 Author: Dongjiu Geng Date: Sat Oct 13 00:12:49 2018 +0800 arm/arm64: KVM: Enable 32 bits kvm vcpu events support The commit 539aee0edb9f ("KVM: arm64: Share the parts of get/set events useful to 32bit") shares the get/set events helper for arm64 and arm32, but forgot to share the cap extension code. User space will check whether KVM supports vcpu events by checking the KVM_CAP_VCPU_EVENTS extension Acked-by: James Morse Reviewed-by : Suzuki K Poulose Signed-off-by: Dongjiu Geng Signed-off-by: Marc Zyngier commit 375bdd3b5d4f7cf146f0df1488b4671b141dd799 Author: Dongjiu Geng Date: Sat Oct 13 00:12:48 2018 +0800 arm/arm64: KVM: Rename function kvm_arch_dev_ioctl_check_extension() Rename kvm_arch_dev_ioctl_check_extension() to kvm_arch_vm_ioctl_check_extension(), because it does not have any relationship with device. Renaming this function can make code readable. Cc: James Morse Reviewed-by: Suzuki K Poulose Signed-off-by: Dongjiu Geng Signed-off-by: Marc Zyngier commit f90afe7955141d122883b27e56e27b686033db22 Author: Takashi Iwai Date: Thu Sep 20 16:42:09 2018 +0200 ALSA: doc: Brush up the old writing-an-alsa-driver Slightly brushing up and throw the old dust away from my ancient writing-an-alsa-driver document. The contents aren't changed so much but the obsoleted parts are dropped. Also, remove the date and the version number. It's useless. Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai commit c614ca3f7476934de54dd731e09d094ad822696c Author: Balakrishna Godavarthi Date: Tue Oct 16 19:51:35 2018 +0530 Bluetooth: hci_qca: Add support for controller debug logs. This patch will prevent error messages splashing on console. [ 78.426697] Bluetooth: hci_core.c:hci_acldata_packet() hci0: ACL packet for unknown connection handle 3804 [ 78.436682] Bluetooth: hci_core.c:hci_acldata_packet() hci0: ACL packet for unknown connection handle 3804 [ 78.446639] Bluetooth: hci_core.c:hci_acldata_packet() hci0: ACL packet for unknown connection handle 3804 [ 78.456596] Bluetooth: hci_core.c:hci_acldata_packet() hci0: ACL packet for unknown connection handle 3804 QCA wcn3990 will send the debug logs in the form of ACL packets. While decoding packet in qca_recv(), marking the received debug log packet as diagnostic packet. Signed-off-by: Harish Bandi Signed-off-by: Balakrishna Godavarthi Signed-off-by: Marcel Holtmann commit 835fe6d75d14c1513910ed7f5665127fee12acc8 Author: Anusha Srivatsa Date: Thu Oct 4 15:36:13 2018 -0700 firmware/dmc/icl: Add missing MODULE_FIRMWARE() for Icelake. Add missing MODULE_FIRMWARE while loading DMC ICL. v2: Add Fixes tag. (Rodrigo) v3: Rebase by Rodrigo after commit 7fe78985cd08 ("drm/i915/csr: restructure CSR firmware definition macros") v4: Rodrigo fixing his own mess on commit mentioning on v3 comment above. Fixes: 4445930f1c4a ("firmware/dmc/icl: load v1.07 on icelake.") Cc: Rodrigo Vivi Cc: Paulo Zanoni Cc: Jani Nikula Signed-off-by: Anusha Srivatsa Reviewed-by: Rodrigo Vivi (v2) Signed-off-by: Rodrigo Vivi Tested-by: Paulo Zanoni Link: https://patchwork.freedesktop.org/patch/msgid/20181004223613.19938-1-rodrigo.vivi@intel.com (cherry picked from commit 00e5d8b1eb47378924f3de3435450650f426b02a) Signed-off-by: Joonas Lahtinen commit f1c8e410cdac5df42a7806e49efde2859a10fecd Author: Rafael J. Wysocki Date: Mon Oct 15 13:53:25 2018 +0200 cpuidle: menu: Avoid computations when result will be discarded If the minimum interval taken into account in the average computation loop in get_typical_interval() is less than the expected idle duration determined so far, the resultant average cannot be greater than that value as well and the entire return result of the function is going to be discarded anyway going forward. In that case, it is a waste of time to carry out the remaining computations in get_typical_interval(), so avoid that by returning early if the minimum interval is not below the expected idle duration. No intentional changes of behavior. Signed-off-by: Rafael J. Wysocki commit 12b65eadf0bd41cf0dbf460f13bcd310a81afe2b Author: Rafael J. Wysocki Date: Mon Oct 15 13:51:45 2018 +0200 cpuidle: menu: Drop redundant comparison Since the correction factor cannot be greater than RESOLUTION * DECAY, the result of the predicted_us computation in menu_select() cannot be greater than data->next_timer_us, so it is not necessary to compare the "typical interval" value coming from get_typical_interval() with data->next_timer_us separately. It is sufficient to copmare predicted_us with the return value of get_typical_interval() directly, so do that and drop the now redundant expected_interval variable. No intentional changes of behavior. Signed-off-by: Rafael J. Wysocki commit 3045c0d05e728134aefb8adbbc56a4d876a0bdce Author: Chaitanya Kulkarni Date: Wed Oct 17 11:34:15 2018 -0700 nvme-pci: remove duplicate check This is a cleanup patch doesn't change any functionality. It removes the duplicate call to the blk_integrity_rq() in the nvme_map_data(). Signed-off-by: Chaitanya Kulkarni Reviewed-by: Keith Busch Signed-off-by: Christoph Hellwig commit b4ec5f39e4a0bc9844634faa88dd08ca94dca39d Author: Rodrigo Vivi Date: Wed Oct 17 14:56:52 2018 -0700 drm/i915/icl: Fix signal_levels Since when it was introduced we forgot to add this case so ICL was using a wrong signal_levels as reference. Fixes: fb5c8e9d4350 ("drm/i915/icl: Implement voltage swing programming sequence for Combo PHY DDI") Cc: José Roberto de Souza Cc: Manasi Navare Signed-off-by: Rodrigo Vivi Reviewed-by: Manasi Navare Link: https://patchwork.freedesktop.org/patch/msgid/20181017215652.26841-1-rodrigo.vivi@intel.com (cherry picked from commit 61cdfb9e194d2a327eef301e8fc80b63e3e1dc7a) Signed-off-by: Joonas Lahtinen commit 1411a26053f492b7cef95f09898624544e4701d4 Author: Owen Lin Date: Thu Oct 18 04:37:57 2018 +0000 Bluetooth: btusb: Add support for 0cf3:535b QCA_ROME device T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=02 Dev#= 3 Spd=12 MxCh= 0 D: Ver= 2.01 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0cf3 ProdID=535b Rev= 0.01 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms Signed-off-by: Owen Lin Signed-off-by: Marcel Holtmann commit 589edb56b424876cbbf61547b987a1f57d7ea99d Author: Hans de Goede Date: Wed Oct 17 10:59:28 2018 +0200 ACPI / scan: Create platform device for INT33FE ACPI nodes Bay and Cherry Trail devices with a Dollar Cove or Whiskey Cove PMIC have an ACPI node with a HID of INT33FE which is a "virtual" battery device implementing a standard ACPI battery interface which depends upon a proprietary, undocument OpRegion called BMOP. Since we do have docs for the actual fuel-gauges used on these boards we instead use native fuel-gauge drivers talking directly to the fuel-gauge ICs on boards which rely on this INT33FE device for their battery monitoring. On boards with a Dollar Cove PMIC the INT33FE device's resources (_CRS) describe a non-existing I2C client at address 0x6b with a bus-speed of 100KHz. This is a problem on some boards since there are actual devices on that same bus which need a speed of 400KHz to function properly. This commit adds the INT33FE HID to the list of devices with I2C resources which should be enumerated as a platform-device rather then letting the i2c-core instantiate an i2c-client matching the first I2C resource, so that its bus-speed will not influence the max speed of the I2C bus. This fixes e.g. the touchscreen not working on the Teclast X98 II Plus. The INT33FE device on boards with a Whiskey Cove PMIC is somewhat special. Its first I2C resource is for a secondary I2C address of the PMIC itself, which is already described in an ACPI device with an INT34D3 HID. But it has 3 more I2C resources describing 3 other chips for which we do need to instantiate I2C clients and which need device-connections added between them for things to work properly. This special case is handled by the drivers/platform/x86/intel_cht_int33fe.c code. Before this commit that code was binding to the i2c-client instantiated for the secondary I2C address of the PMIC, since we now instantiate a platform device for the INT33FE device instead, this commit also changes the intel_cht_int33fe driver from an i2c driver to a platform driver. This also brings the intel_cht_int33fe drv inline with how we instantiate multiple i2c clients from a single ACPI device in other cases, as done by the drivers/platform/x86/i2c-multi-instantiate.c code. Reported-and-tested-by: Alexander Meiler Signed-off-by: Hans de Goede Acked-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki commit 83db37385306072eca403ed80c0a8cf7b0d39e05 Author: Mahesh Kumar Date: Mon Oct 15 19:37:52 2018 -0700 drm/i915/icl: Fix DDI/TC port clk_off bits DDI/TC clock-off bits are not equally distanced. TC1-3 bits are from offset 12 & TC4 is at offset 21. Create a function to choose correct clk-off bit. v2: Add fixes tag (Lucas) Fixes: c27e917e2bda ("drm/i915/icl: add basic support for the ICL clocks") Signed-off-by: Mahesh Kumar Signed-off-by: Vandita Kulkarni Reviewed-by: Lucas De Marchi Signed-off-by: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/20181016023752.9285-1-lucas.demarchi@intel.com (cherry picked from commit bb1c7edc6d4d5cc6917814d858d47b22d2e93cde) Signed-off-by: Joonas Lahtinen commit a9b84b4492774668237b19aa65536e934df51567 Author: Mahesh Kumar Date: Thu Oct 4 14:20:43 2018 +0530 drm/i915/icl: create function to identify combophy port This patch creates a function/wrapper to check if port is combophy port instead of explicitly comparing ports. Changes since V1: - keep all intel_port_is_* helper together (Lucas) Signed-off-by: Mahesh Kumar Cc: Madhav Chauhan Cc: Manasi Navare Reviewed-by: Rodrigo Vivi Reviewed-by: Lucas De Marchi Signed-off-by: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/20181004085043.10154-1-mahesh1.kumar@intel.com (cherry picked from commit 176597a12d61709727d1639836e5d68a6e7c437b) Signed-off-by: Joonas Lahtinen commit 83b2348e2755db48fa8f40fdb791f366fabc0ba0 Author: Bart Van Assche Date: Wed Oct 17 13:24:56 2018 -0700 ACPI / OSL: Use 'jiffies' as the time bassis for acpi_os_get_timer() Since acpi_os_get_timer() may be called after the timer subsystem has been suspended, use the jiffies counter instead of ktime_get(). This patch avoids that the following warning is reported during hibernation: WARNING: CPU: 0 PID: 612 at kernel/time/timekeeping.c:751 ktime_get+0x116/0x120 RIP: 0010:ktime_get+0x116/0x120 Call Trace: acpi_os_get_timer+0xe/0x30 acpi_ds_exec_begin_control_op+0x175/0x1de acpi_ds_exec_begin_op+0x2c7/0x39a acpi_ps_create_op+0x573/0x5e4 acpi_ps_parse_loop+0x349/0x1220 acpi_ps_parse_aml+0x25b/0x6da acpi_ps_execute_method+0x327/0x41b acpi_ns_evaluate+0x4e9/0x6f5 acpi_ut_evaluate_object+0xd9/0x2f2 acpi_rs_get_method_data+0x8f/0x114 acpi_walk_resources+0x122/0x1b6 acpi_pci_link_get_current.isra.2+0x157/0x280 acpi_pci_link_set+0x32f/0x4a0 irqrouter_resume+0x58/0x80 syscore_resume+0x84/0x380 hibernation_snapshot+0x20c/0x4f0 hibernate+0x22d/0x3a6 state_store+0x99/0xa0 kobj_attr_store+0x37/0x50 sysfs_kf_write+0x87/0xa0 kernfs_fop_write+0x1a5/0x240 __vfs_write+0xd2/0x410 vfs_write+0x101/0x250 ksys_write+0xab/0x120 __x64_sys_write+0x43/0x50 do_syscall_64+0x71/0x220 entry_SYSCALL_64_after_hwframe+0x49/0xbe Fixes: 164a08cee135 (ACPICA: Dispatcher: Introduce timeout mechanism for infinite loop detection) Reported-by: Fengguang Wu References: https://lists.01.org/pipermail/lkp/2018-April/008406.html Signed-off-by: Bart Van Assche Cc: 4.16+ # 4.16+ Signed-off-by: Rafael J. Wysocki commit d737f333b211361b6e239fc753b84c3be2634aaa Author: Erik Schmauss Date: Wed Oct 17 15:41:21 2018 -0700 ACPI: probe ECDT before loading AML tables regardless of module-level code flag It was discovered that AML tables were loaded before or after the ECDT depending on acpi_gbl_execute_tables_as_methods. According to the ACPI spec, the ECDT should be loaded before the namespace is populated by loading AML tables (DSDT and SSDT). Since the ECDT should be loaded early in the boot process, this change moves the ECDT probing to acpi_early_init. Signed-off-by: Erik Schmauss Signed-off-by: Rafael J. Wysocki commit 08930d56c76a69716ba56eb111379a559a9b9f42 Author: Erik Schmauss Date: Wed Oct 17 15:41:20 2018 -0700 ACPICA: Remove acpi_gbl_group_module_level_code and only use acpi_gbl_execute_tables_as_methods instead acpi_gbl_group_module_level_code and acpi_gbl_execute_tables_as_methods were used to enable different table load behavior. The different table load behaviors are as follows: A.) acpi_gbl_group_module_level_code enabled the legacy approach where ASL if statements are executed after the namespace object has been loaded. B.) acpi_gbl_execute_tables_as_methods is currently used to enable the table load to be a method invocation. This meaning that ASL If statements are executed in-line rather than deferred until after the ACPI namespace has been populated. This is the correct behavior and option A will be removed in the future. We do not support a table load behavior where these variables are assigned the same value. In otherwords, we only support option A or B and do not need acpi_gbl_group_module_level_code to enable A. From now on, acpi_gbl_execute_tables_as_methods == 0 enables option A and acpi_gbl_execute_tables_as_methods == 1 enables option B. Note: option A is expected to be removed in the future and option B will become the only supported table load behavior. Signed-off-by: Erik Schmauss Signed-off-by: Rafael J. Wysocki commit c64baa3a6fa207d112706bc5e7fd645cd8a8663f Author: Erik Schmauss Date: Wed Oct 17 14:20:51 2018 -0700 ACPICA: AML Parser: fix parse loop to correctly skip erroneous extended opcodes AML opcodes come in two lengths: 1-byte opcodes and 2-byte, extended opcodes. If an error occurs due to illegal opcodes during table load, the AML parser needs to continue loading the table. In order to do this, it needs to skip parsing of the offending opcode and operands associated with that opcode. This change fixes the AML parse loop to correctly skip parsing of incorrect extended opcodes. Previously, only the short opcodes were skipped correctly. Signed-off-by: Erik Schmauss Cc: All applicable Signed-off-by: Rafael J. Wysocki commit 4abb951b73ff0a8a979113ef185651aa3c8da19b Author: Erik Schmauss Date: Wed Oct 17 14:09:35 2018 -0700 ACPICA: AML interpreter: add region addresses in global list during initialization The table load process omitted adding the operation region address range to the global list. This omission is problematic because the OS queries the global list to check for address range conflicts before deciding which drivers to load. This commit may result in warning messages that look like the following: [ 7.871761] ACPI Warning: system_IO range 0x00000428-0x0000042F conflicts with op_region 0x00000400-0x0000047F (\PMIO) (20180531/utaddress-213) [ 7.871769] ACPI: If an ACPI driver is available for this device, you should use it instead of the native driver However, these messages do not signify regressions. It is a result of properly adding address ranges within the global address list. Link: https://bugzilla.kernel.org/show_bug.cgi?id=200011 Tested-by: Jean-Marc Lenoir Signed-off-by: Erik Schmauss Cc: All applicable Signed-off-by: Rafael J. Wysocki commit 3230b2b3c1ab5a0d3f99d5850bfdc4bf48d11cdd Author: Rafael J. Wysocki Date: Mon Oct 15 13:56:02 2018 +0200 ACPI: TAD: Add low-level support for real time capability Add low-level support for the (optional) real time capability of the ACPI Time and Alarm Device (TAD) to the ACPI TAD driver. This allows the real time to be acquired or set via sysfs with the help of the _GRT and _SRT methods of the TAD, respectively. Signed-off-by: Rafael J. Wysocki Tested-by: Mika Westerberg commit c2712b858187f5bcd7b042fe4daa3ba3a12635c0 Author: Steven Rostedt (VMware) Date: Wed Oct 17 16:59:51 2018 -0400 kprobes, x86/ptrace.h: Make regs_get_kernel_stack_nth() not fault on bad stack Andy had some concerns about using regs_get_kernel_stack_nth() in a new function regs_get_kernel_argument() as if there's any error in the stack code, it could cause a bad memory access. To be on the safe side, call probe_kernel_read() on the stack address to be extra careful in accessing the memory. A helper function, regs_get_kernel_stack_nth_addr(), was added to just return the stack address (or NULL if not on the stack), that will be used to find the address (and could be used by other functions) and read the address with kernel_probe_read(). Requested-by: Andy Lutomirski Signed-off-by: Steven Rostedt (VMware) Reviewed-by: Joel Fernandes (Google) Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Josh Poimboeuf Cc: Linus Torvalds Cc: Masami Hiramatsu Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/20181017165951.09119177@gandalf.local.home Signed-off-by: Ingo Molnar commit 96987eea537d6ccd98704a71958f9ba02da80843 Author: Christoph Hellwig Date: Thu Oct 18 17:21:55 2018 +1100 xfs: cancel COW blocks before swapext We need to make sure we have no outstanding COW blocks before we swap extents, as there is nothing preventing us from having preallocated COW delalloc on either inode that swapext is called on. That case can easily be reproduced by running generic/324 in always_cow mode: [ 620.760572] XFS: Assertion failed: tip->i_delayed_blks == 0, file: fs/xfs/xfs_bmap_util.c, line: 1669 [ 620.761608] ------------[ cut here ]------------ [ 620.762171] kernel BUG at fs/xfs/xfs_message.c:102! [ 620.762732] invalid opcode: 0000 [#1] SMP PTI [ 620.763272] CPU: 0 PID: 24153 Comm: xfs_fsr Tainted: G W 4.19.0-rc1+ #4182 [ 620.764203] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.1-1 04/01/2014 [ 620.765202] RIP: 0010:assfail+0x20/0x28 [ 620.765646] Code: 31 ff e8 83 fc ff ff 0f 0b c3 48 89 f1 41 89 d0 48 c7 c6 48 ca 8d 82 48 89 fa 38 [ 620.767758] RSP: 0018:ffffc9000898bc10 EFLAGS: 00010202 [ 620.768359] RAX: 0000000000000000 RBX: ffff88012f14ba40 RCX: 0000000000000000 [ 620.769174] RDX: 00000000ffffffc0 RSI: 000000000000000a RDI: ffffffff828560d9 [ 620.769982] RBP: ffff88012f14b300 R08: 0000000000000000 R09: 0000000000000000 [ 620.770788] R10: 000000000000000a R11: f000000000000000 R12: ffffc9000898bc98 [ 620.771638] R13: ffffc9000898bc9c R14: ffff880130b5e2b8 R15: ffff88012a1fa2a8 [ 620.772504] FS: 00007fdc36e0fbc0(0000) GS:ffff88013ba00000(0000) knlGS:0000000000000000 [ 620.773475] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 620.774168] CR2: 00007fdc3604d000 CR3: 0000000132afc000 CR4: 00000000000006f0 [ 620.774978] Call Trace: [ 620.775274] xfs_swap_extent_forks+0x2a0/0x2e0 [ 620.775792] xfs_swap_extents+0x38b/0xab0 [ 620.776256] xfs_ioc_swapext+0x121/0x140 [ 620.776709] xfs_file_ioctl+0x328/0xc90 [ 620.777154] ? rcu_read_lock_sched_held+0x50/0x60 [ 620.777694] ? xfs_iunlock+0x233/0x260 [ 620.778127] ? xfs_setattr_nonsize+0x3be/0x6a0 [ 620.778647] do_vfs_ioctl+0x9d/0x680 [ 620.779071] ? ksys_fchown+0x47/0x80 [ 620.779552] ksys_ioctl+0x35/0x70 [ 620.780040] __x64_sys_ioctl+0x11/0x20 [ 620.780530] do_syscall_64+0x4b/0x190 [ 620.780927] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 620.781467] RIP: 0033:0x7fdc364d0f07 [ 620.781900] Code: b3 66 90 48 8b 05 81 5f 2c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 28 [ 620.784044] RSP: 002b:00007ffe2a766038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 620.784896] RAX: ffffffffffffffda RBX: 0000000000000025 RCX: 00007fdc364d0f07 [ 620.785667] RDX: 0000560296ca2fc0 RSI: 00000000c0c0586d RDI: 0000000000000005 [ 620.786398] RBP: 0000000000000025 R08: 0000000000001200 R09: 0000000000000000 [ 620.787283] R10: 0000000000000432 R11: 0000000000000246 R12: 0000000000000005 [ 620.788051] R13: 0000000000000000 R14: 0000000000001000 R15: 0000000000000006 [ 620.788927] Modules linked in: [ 620.789340] ---[ end trace 9503b7417ffdbdb0 ]--- [ 620.790065] RIP: 0010:assfail+0x20/0x28 [ 620.790642] Code: 31 ff e8 83 fc ff ff 0f 0b c3 48 89 f1 41 89 d0 48 c7 c6 48 ca 8d 82 48 89 fa 38 [ 620.793038] RSP: 0018:ffffc9000898bc10 EFLAGS: 00010202 [ 620.793609] RAX: 0000000000000000 RBX: ffff88012f14ba40 RCX: 0000000000000000 [ 620.794317] RDX: 00000000ffffffc0 RSI: 000000000000000a RDI: ffffffff828560d9 [ 620.795025] RBP: ffff88012f14b300 R08: 0000000000000000 R09: 0000000000000000 [ 620.795778] R10: 000000000000000a R11: f000000000000000 R12: ffffc9000898bc98 [ 620.796675] R13: ffffc9000898bc9c R14: ffff880130b5e2b8 R15: ffff88012a1fa2a8 [ 620.797782] FS: 00007fdc36e0fbc0(0000) GS:ffff88013ba00000(0000) knlGS:0000000000000000 [ 620.798908] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 620.799594] CR2: 00007fdc3604d000 CR3: 0000000132afc000 CR4: 00000000000006f0 [ 620.800424] Kernel panic - not syncing: Fatal exception [ 620.801191] Kernel Offset: disabled [ 620.801597] ---[ end Kernel panic - not syncing: Fatal exception ]--- Signed-off-by: Christoph Hellwig Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit efc3289cf8d39c34502a7cc9695ca2fa125aad0c Author: Brian Foster Date: Thu Oct 18 17:21:49 2018 +1100 xfs: clear ail delwri queued bufs on unmount of shutdown fs In the typical unmount case, the AIL is forced out by the unmount sequence before the xfsaild task is stopped. Since AIL items are removed on writeback completion, this means that the AIL ->ail_buf_list delwri queue has been drained. This is not always true in the shutdown case, however. It's possible for buffers to sit on a delwri queue for a period of time across submission attempts if said items are locked or have been relogged and pinned since first added to the queue. If the attempt to log such an item results in a log I/O error, the error processing can shutdown the fs, remove the item from the AIL, stale the buffer (dropping the LRU reference) and clear its delwri queue state. The latter bit means the buffer will be released from a delwri queue on the next submission attempt, but this might never occur if the filesystem has shutdown and the AIL is empty. This means that such buffers are held indefinitely by the AIL delwri queue across destruction of the AIL. Aside from being a memory leak, these buffers can also hold references to in-core perag structures. The latter problem manifests as a generic/475 failure, reproducing the following asserts at unmount time: XFS: Assertion failed: atomic_read(&pag->pag_ref) == 0, file: fs/xfs/xfs_mount.c, line: 151 XFS: Assertion failed: atomic_read(&pag->pag_ref) == 0, file: fs/xfs/xfs_mount.c, line: 132 To prevent this problem, clear the AIL delwri queue as a final step before xfsaild() exit. The !empty state should never occur in the normal case, so add an assert to catch unexpected problems going forward. [dgc: add comment explaining need for xfs_buf_delwri_cancel() after calling xfs_buf_delwri_submit_nowait().] Signed-off-by: Brian Foster Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 26ca39015ef210d728df53d66c1ae85e8b48b2f3 Author: Carlos Maiolino Date: Thu Oct 18 17:21:39 2018 +1100 xfs: use offsetof() in place of offset macros for __xfsstats Most offset macro mess is used in xfs_stats_format() only, and we can simply get the right offsets using offsetof(), instead of several macros to mark the offsets inside __xfsstats structure. Replace all XFSSTAT_END_* macros by a single helper macro to get the right offset into __xfsstats, and use this helper in xfs_stats_format() directly. The quota stats code, still looks a bit cleaner when using XFSSTAT_* macros, so, this patch also defines XFSSTAT_START_XQMSTAT and XFSSTAT_END_XQMSTAT locally to that code. This also should prevent offset mistakes when updates are done into __xfsstats. Signed-off-by: Carlos Maiolino Reviewed-by: Darrick J. Wong Signed-off-by: Dave Chinner commit 41657e5507b13e963be906d5d874f4f02374fd5c Author: Carlos Maiolino Date: Thu Oct 18 17:21:34 2018 +1100 xfs: Fix xqmstats offsets in /proc/fs/xfs/xqmstat The addition of FIBT, RMAP and REFCOUNT changed the offsets into __xfssats structure. This caused xqmstat_proc_show() to display garbage data via /proc/fs/xfs/xqmstat, once it relies on the offsets marked via macros. Fix it. Fixes: 00f4e4f9 xfs: add rmap btree stats infrastructure Fixes: aafc3c24 xfs: support the XFS_BTNUM_FINOBT free inode btree type Fixes: 46eeb521 xfs: introduce refcount btree definitions Signed-off-by: Carlos Maiolino Reviewed-by: Eric Sandeen Signed-off-by: Dave Chinner commit 37fd1678245f7a5898c1b05128bc481fb403c290 Author: Dave Chinner Date: Thu Oct 18 17:21:29 2018 +1100 xfs: fix use-after-free race in xfs_buf_rele When looking at a 4.18 based KASAN use after free report, I noticed that racing xfs_buf_rele() may race on dropping the last reference to the buffer and taking the buffer lock. This was the symptom displayed by the KASAN report, but the actual issue that was reported had already been fixed in 4.19-rc1 by commit e339dd8d8b04 ("xfs: use sync buffer I/O for sync delwri queue submission"). Despite this, I think there is still an issue with xfs_buf_rele() in this code: release = atomic_dec_and_lock(&bp->b_hold, &pag->pag_buf_lock); spin_lock(&bp->b_lock); if (!release) { ..... If two threads race on the b_lock after both dropping a reference and one getting dropping the last reference so release = true, we end up with: CPU 0 CPU 1 atomic_dec_and_lock() atomic_dec_and_lock() spin_lock(&bp->b_lock) spin_lock(&bp->b_lock) b_lru_ref = 0> freebuf = true spin_unlock(&bp->b_lock) xfs_buf_free(bp) spin_unlock(&bp->b_lock) IOWs, we can't safely take bp->b_lock after dropping the hold reference because the buffer may go away at any time after we drop that reference. However, this can be fixed simply by taking the bp->b_lock before we drop the reference. It is safe to nest the pag_buf_lock inside bp->b_lock as the pag_buf_lock is only used to serialise against lookup in xfs_buf_find() and no other locks are held over or under the pag_buf_lock there. Make this clear by documenting the buffer lock orders at the top of the file. Signed-off-by: Dave Chinner Reviewed-by: Brian Foster Reviewed-by: Carlos Maiolino commit 068f985a9e5ec70fde58d8f679994fdbbd093a36 Author: Allison Henderson Date: Thu Oct 18 17:21:23 2018 +1100 xfs: Add attibute remove and helper functions This patch adds xfs_attr_remove_args. These sub-routines remove the attributes specified in @args. We will use this later for setting parent pointers as a deferred attribute operation. Signed-off-by: Allison Henderson Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 2f3cd8091963810d85e6a5dd6ed1247e10e9e6f2 Author: Allison Henderson Date: Thu Oct 18 17:21:16 2018 +1100 xfs: Add attibute set and helper functions This patch adds xfs_attr_set_args and xfs_bmap_set_attrforkoff. These sub-routines set the attributes specified in @args. We will use this later for setting parent pointers as a deferred attribute operation. [dgc: remove attr fork init code from xfs_attr_set_args().] [dgc: xfs_attr_try_sf_addname() NULLs args.trans after commit.] [dgc: correct sf add error handling.] Signed-off-by: Allison Henderson Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 4c74a56b9de76bb6b581274b76b52535ad77c2a7 Author: Allison Henderson Date: Thu Oct 18 17:20:50 2018 +1100 xfs: Add helper function xfs_attr_try_sf_addname This patch adds a subroutine xfs_attr_try_sf_addname used by xfs_attr_set. This subrotine will attempt to add the attribute name specified in args in shortform, as well and perform error handling previously done in xfs_attr_set. This patch helps to pre-simplify xfs_attr_set for reviewing purposes and reduce indentation. New function will be added in the next patch. [dgc: moved commit to helper function, too.] Signed-off-by: Allison Henderson Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit e2421f0b5ff3ce279573036f5cfcb0ce28b422a9 Author: Allison Henderson Date: Thu Oct 18 17:20:45 2018 +1100 xfs: Move fs/xfs/xfs_attr.h to fs/xfs/libxfs/xfs_attr.h This patch moves fs/xfs/xfs_attr.h to fs/xfs/libxfs/xfs_attr.h since xfs_attr.c is in libxfs. We will need these later in xfsprogs. Signed-off-by: Allison Henderson Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner commit 56668a5cc420818b8e9c2197281d068552f80e46 Author: Dave Chinner Date: Thu Oct 18 17:20:39 2018 +1100 xfs: issue log message on user force shutdown The kernel only issues a log message that it's been shut down when the filesystem triggers a shutdown itself. Hence there is no trace in the log when a shutdown is triggered manually from userspace. This can make it hard to see sequence of events in the log when things go wrong, so make sure we always log a message when a shutdown is run. While there, clean up the logic flow so we don't have to continually check if the shutdown trigger was user initiated before logging shutdown messages. Signed-off-by: Dave Chinner Reviewed-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Dave Chinner commit 38b6238eb6b4f4b7fe5442670156c81b21516bee Author: Darrick J. Wong Date: Thu Oct 18 17:20:35 2018 +1100 xfs: fix buffer state management in xrep_findroot_block We don't handle buffer state properly in online repair's findroot routine. If a buffer already has b_ops set, we don't ever want to touch that, and we don't want to call the read verifiers on a buffer that could be dirty (CRCs are only recomputed during log checkpoints). Therefore, be more careful about what we do with a buffer -- if someone else already attached ops that are not the ones for this btree type, just ignore the buffer. We only attach our btree type's buf ops if it matches the magic/uuid and structure checks. We also modify xfs_buf_read_map to allow callers to set buffer ops on a DONE buffer with NULL ops so that repair doesn't leave behind buffers which won't have buffers attached to them. Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster Signed-off-by: Dave Chinner commit 1aff5696f3e03099a4a3e9a0d965ef9b345265a6 Author: Darrick J. Wong Date: Thu Oct 18 17:20:30 2018 +1100 xfs: always assign buffer verifiers when one is provided If a caller supplies buffer ops when trying to read a buffer and the buffer doesn't already have buf ops assigned, ensure that the ops are assigned to the buffer and the verifier is run on that buffer. Note that current XFS code is careful to assign buffer ops after a xfs_{trans_,}buf_read call in which ops were not supplied. However, we should apply ops defensively in case there is ever a coding mistake; and an upcoming repair patch will need to be able to read a buffer without assigning buf ops. Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster Reviewed-by: Christoph Hellwig Signed-off-by: Dave Chinner commit 1002ff45eff5cb70b0f2da28df488c789af2aeab Author: Darrick J. Wong Date: Thu Oct 18 17:20:26 2018 +1100 xfs: xrep_findroot_block should reject root blocks with siblings In xrep_findroot_block, if we find a candidate root block with sibling pointers or sibling blocks on the same tree level, we should not return that block as a tree root because root blocks cannot have siblings. Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster Signed-off-by: Dave Chinner commit dddde68b8f06dd83486124b8d245e7bfb15c185d Author: Adam Borowski Date: Thu Oct 18 17:20:19 2018 +1100 xfs: add a define for statfs magic to uapi Needed by userspace programs that call fstatfs(). It'd be natural to publish XFS_SB_MAGIC in uapi, but while these two have identical values, they have different semantic meaning: one is an enum cookie meant for statfs, the other a signature of the on-disk format. Signed-off-by: Adam Borowski Reviewed-by: Darrick J. Wong Signed-off-by: Dave Chinner commit 4831822ff12e9f2bc084da892045551fdf3d112c Author: Christoph Hellwig Date: Thu Oct 18 17:20:11 2018 +1100 xfs: print dangling delalloc extents Instead of just asserting that we have no delalloc space dangling in an inode that gets freed print the actual offenders for debug mode. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Reviewed-by: Brian Foster Signed-off-by: Dave Chinner commit 032dc923b2baef87db6c812f6e8bebcb7638cab8 Author: Christoph Hellwig Date: Thu Oct 18 17:19:58 2018 +1100 xfs: fix fork selection in xfs_find_trim_cow_extent We should want to write directly into the data fork for blocks that don't have an extent in the COW fork covering them yet. Signed-off-by: Christoph Hellwig Reviewed-by: Brian Foster Signed-off-by: Dave Chinner commit d392bc81bb7c26ea6225d088ead344ed6486b495 Author: Christoph Hellwig Date: Thu Oct 18 17:19:48 2018 +1100 xfs: remove the unused trimmed argument from xfs_reflink_trim_around_shared Signed-off-by: Christoph Hellwig Reviewed-by: Brian Foster Signed-off-by: Dave Chinner commit fc439464e3ee299d8a3d502d7d24d4d6a5686879 Author: Christoph Hellwig Date: Thu Oct 18 17:19:37 2018 +1100 xfs: remove the unused shared argument to xfs_reflink_reserve_cow Signed-off-by: Christoph Hellwig Reviewed-by: Brian Foster Signed-off-by: Dave Chinner commit 0365c5d6c3d4bcf17a1aa38719e48351932c62b6 Author: Christoph Hellwig Date: Thu Oct 18 17:19:26 2018 +1100 xfs: handle zeroing in xfs_file_iomap_begin_delay We only need to allocate blocks for zeroing for reflink inodes, and for we currently have a special case for reflink files in the otherwise direct I/O path that I'd like to get rid of. Signed-off-by: Christoph Hellwig Reviewed-by: Brian Foster Signed-off-by: Dave Chinner commit daa79baefc47293c753fed191d722f7ef605a303 Author: Christoph Hellwig Date: Thu Oct 18 17:18:58 2018 +1100 xfs: remove suport for filesystems without unwritten extent flag The option to enable unwritten extents was made default in 2003, removed from mkfs in 2007, and cannot be disabled in v5. We also rely on it for a lot of common functionality, so filesystems without it will run a completely untested and buggy code path. Enabling the support also is a simple bit flip using xfs_db, so legacy file systems can still be brought forward. Signed-off-by: Christoph Hellwig Reviewed-by: Brian Foster Signed-off-by: Dave Chinner commit 97e5a6e6dc44b9ea660f85de084f6e38cb5cf39c Author: Christoph Hellwig Date: Thu Oct 18 17:17:50 2018 +1100 xfs: remove XFS_IO_INVALID The invalid state isn't any different from a hole, so merge the two states. Use the more descriptive hole name, but keep it as the first value of the enum to catch uninitialized fields. Signed-off-by: Christoph Hellwig Reviewed-by: Brian Foster Signed-off-by: Dave Chinner commit 3642b29a63674020401e41185ed5b0e3c056ab4a Author: Chengguang Xu Date: Wed Jun 13 12:05:14 2018 +0800 fs/exofs: only use true/false for asignment of bool type variable Signed-off-by: Chengguang Xu Signed-off-by: Al Viro commit 515f1867addaba49c1c6ac73abfaffbc192c1db4 Author: Chengguang Xu Date: Wed Jun 13 12:05:13 2018 +0800 fs/exofs: fix potential memory leak in mount option parsing There are some cases can cause memory leak when parsing option 'osdname'. Signed-off-by: Chengguang Xu Signed-off-by: Al Viro commit 55338ac2a9839557516b00661e6a05daf996fda0 Author: nixiaoming Date: Sun Jul 22 16:37:08 2018 +0800 Delete invalid assignment statements in do_sendfile Assigning value -EINVAL to "retval" here, but that stored value is overwritten before it can be used. retval = -EINVAL; .... retval = rw_verify_area(WRITE, out.file, &out_pos, count); value_overwrite: Overwriting previous write to "retval" with value from rw_verify_area delete invalid assignment statements Signed-off-by: n00202754 Signed-off-by: Al Viro commit 82385b0d2d2504aee51aa3fb40ebfb03603f64c3 Author: Gustavo A. R. Silva Date: Wed Oct 17 15:01:37 2018 +0200 net: skbuff.h: Mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Acked-by: Kees Cook Signed-off-by: Gustavo A. R. Silva Signed-off-by: David S. Miller commit 9fd255928d7ffb56d8466fab3331d0b2f40aa8c7 Author: Arthur Kiyanovski Date: Wed Oct 17 15:33:23 2018 +0300 net: ena: enable Low Latency Queues Use the new API to enable usage of LLQ. Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller commit 8c590f9776386b8f697fd0b7ed6142ae6e3de79e Author: Netanel Belgazal Date: Wed Oct 17 10:04:21 2018 +0000 net: ena: Fix Kconfig dependency on X86 The Kconfig limitation of X86 is to too wide. The ENA driver only requires a little endian dependency. Change the dependency to be on little endian CPU. Signed-off-by: Netanel Belgazal Signed-off-by: David S. Miller commit a58598a49788f562a462c962abec98c8998089cc Merge: cb10c7c0dfd9 cf33e25c0dcf Author: David S. Miller Date: Wed Oct 17 22:22:54 2018 -0700 Merge branch 'tcp_bbr-TCP-BBR-changes-for-EDT-pacing-model' Neal Cardwell says: ==================== tcp_bbr: TCP BBR changes for EDT pacing model Two small patches for TCP BBR to follow up with Eric's recent work to change the TCP and fq pacing machinery to an "earliest departure time" (EDT) model: - The first patch adjusts the TCP BBR logic to work with the new "earliest departure time" (EDT) pacing model. - The second patch adjusts the TCP BBR logic to centralize the setting of gain values, to simplify the code and prepare for future changes. ==================== Signed-off-by: David S. Miller commit cf33e25c0dcfed4ef1b1735d2bf966d56936097b Author: Neal Cardwell Date: Tue Oct 16 20:16:45 2018 -0400 tcp_bbr: centralize code to set gains Centralize the code that sets gains used for computing cwnd and pacing rate. This simplifies the code and makes it easier to change the state machine or (in the future) dynamically change the gain values and ensure that the correct gain values are always used. Signed-off-by: Neal Cardwell Signed-off-by: Yuchung Cheng Signed-off-by: Soheil Hassas Yeganeh Signed-off-by: Priyaranjan Jha Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit a87c83d5ee25cf7208279819642ae7bd218e3782 Author: Neal Cardwell Date: Tue Oct 16 20:16:44 2018 -0400 tcp_bbr: adjust TCP BBR for departure time pacing Adjust TCP BBR for the new departure time pacing model in the recent commit ab408b6dc7449 ("tcp: switch tcp and sch_fq to new earliest departure time model"). With TSQ and pacing at lower layers, there are often several skbs queued in the pacing layer, and thus there is less data "in the network" than "in flight". With departure time pacing at lower layers (e.g. fq or potential future NICs), the data in the pacing layer now has a pre-scheduled ("baked-in") departure time that cannot be changed, even if the congestion control algorithm decides to use a new pacing rate. This means that there can be a non-trivial lag between when BBR makes a pacing rate change and when the inter-skb pacing delays change. After a pacing rate change, the number of packets in the network can gradually evolve to be higher or lower, depending on whether the sending rate is higher or lower than the delivery rate. Thus ignoring this lag can cause significant overshoot, with the flow ending up with too many or too few packets in the network. This commit changes BBR to adapt its pacing rate based on the amount of data in the network that it estimates has already been "baked in" by previous departure time decisions. We estimate the number of our packets that will be in the network at the earliest departure time (EDT) for the next skb scheduled as: in_network_at_edt = inflight_at_edt - (EDT - now) * bw If we're increasing the amount of data in the network ("in_network"), then we want to know if the transmit of the EDT skb will push in_network above the target, so our answer includes bbr_tso_segs_goal() from the skb departing at EDT. If we're decreasing in_network, then we want to know if in_network will sink too low just before the EDT transmit, so our answer does not include the segments from the skb departing at EDT. Why do we treat pacing_gain > 1.0 case and pacing_gain < 1.0 case differently? The in_network curve is a step function: in_network goes up on transmits, and down on ACKs. To accurately predict when in_network will go beyond our target value, this will happen on different events, depending on whether we're concerned about in_network potentially going too high or too low: o if pushing in_network up (pacing_gain > 1.0), then in_network goes above target upon a transmit event o if pushing in_network down (pacing_gain < 1.0), then in_network goes below target upon an ACK event This commit changes the BBR state machine to use this estimated "packets in network" value to make its decisions. Signed-off-by: Neal Cardwell Signed-off-by: Yuchung Cheng Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit d65b1f20292425b798ec74e313a7ad3f11b8af0d Author: Yue Haibing Date: Thu Sep 6 01:54:07 2018 +0000 iomap: remove duplicated include from iomap.c Remove duplicated include. Signed-off-by: Yue Haibing Signed-off-by: Al Viro commit cb10c7c0dfd9e6fd3d69ced98b05cbd198c48cf6 Author: Vijay Khemka Date: Tue Oct 16 12:13:19 2018 -0700 net/ncsi: Add NCSI Broadcom OEM command This patch adds OEM Broadcom commands and response handling. It also defines OEM Get MAC Address handler to get and configure the device. ncsi_oem_gma_handler_bcm: This handler send NCSI broadcom command for getting mac address. ncsi_rsp_handler_oem_bcm: This handles response received for all broadcom OEM commands. ncsi_rsp_handler_oem_bcm_gma: This handles get mac address response and set it to device. Signed-off-by: Vijay Khemka Reviewed-by: Samuel Mendoza-Jonas Signed-off-by: David S. Miller commit 1010c17ec5b496b54785dfb96f739d0f880484b3 Merge: 33c4368ee258 47d20212aa1c Author: David S. Miller Date: Wed Oct 17 22:08:56 2018 -0700 Merge branch 'mscc-fixes' Gustavo A. R. Silva says: ==================== fix signedness bug and memory leak in mscc driver This patchset aims to fix a signedness bug in function vsc85xx_downshift_get() and a memory leak in function vsc8574_config_pre_init(). Changes in v3: - Add Quentin's Reviewed-by to commit log in patch 2/2. - Post the series to netdev. Changes in v2: - Add Quentin's Reviewed-by to commit log in patch 1/2. - Jump to out label so all functions in the driver exit with the PHY set to access the standard page. Thanks to Quentin Schulz for pointing this out. ==================== Signed-off-by: David S. Miller commit 47d20212aa1c64f52aba0c5409d03c22bf25cd66 Author: Gustavo A. R. Silva Date: Tue Oct 16 19:37:35 2018 +0200 net: phy: mscc: fix memory leak in vsc8574_config_pre_init In case memory resources for *fw* were successfully allocated, release them before return. Addresses-Coverity-ID: 1473968 ("Resource leak") Fixes: 00d70d8e0e78 ("net: phy: mscc: add support for VSC8574 PHY") Reviewed-by: Quentin Schulz Signed-off-by: Gustavo A. R. Silva Signed-off-by: David S. Miller commit e519869af368fe1da218b43bdb3a553d66f4fcd0 Author: Gustavo A. R. Silva Date: Tue Oct 16 19:35:11 2018 +0200 net: phy: mscc: fix signedness bug in vsc85xx_downshift_get Currently, the error handling for the call to function phy_read_paged() doesn't work because *reg_val* is of type u16 (16 bits, unsigned), which makes it impossible for it to hold a value less than 0. Fix this by changing the type of variable *reg_val* to int. Addresses-Coverity-ID: 1473970 ("Unsigned compared against 0") Fixes: 6a0bfbbe20b0 ("net: phy: mscc: migrate to phy_select/restore_page functions") Reviewed-by: Quentin Schulz Signed-off-by: Gustavo A. R. Silva Signed-off-by: David S. Miller commit 33c4368ee2589c165aebd8d388cbd91e9adb9688 Author: Kyeongdon Kim Date: Tue Oct 16 14:57:26 2018 +0900 net: fix warning in af_unix This fixes the "'hash' may be used uninitialized in this function" net/unix/af_unix.c:1041:20: warning: 'hash' may be used uninitialized in this function [-Wmaybe-uninitialized] addr->hash = hash ^ sk->sk_type; Signed-off-by: Kyeongdon Kim Signed-off-by: David S. Miller commit 26422340da467538cd65eaa9c65538039ee99c8c Author: Marek Behún Date: Sat Oct 13 14:40:31 2018 +0200 net: dsa: mv88e6xxx: Fix 88E6141/6341 2500mbps SERDES speed This is a fix for the port_set_speed method for the Topaz family. Currently the same method is used as for the Peridot family, but this is wrong for the SERDES port. On Topaz, the SERDES port is port 5, not 9 and 10 as in Peridot. Moreover setting alt_bit on Topaz only makes sense for port 0 (for (differentiating 100mbps vs 200mbps). The SERDES port does not support more than 2500mbps, so alt_bit does not make any difference. Signed-off-by: Marek Behún Signed-off-by: David S. Miller commit b55cbc8d9b44aaee94f19e995a5f241d453763ee Author: Nicolas Dichtel Date: Wed Oct 17 16:24:48 2018 +0200 bpf: fix doc of bpf_skb_adjust_room() in uapi len_diff is signed. Fixes: fa15601ab31e ("bpf: add documentation for eBPF helpers (33-41)") CC: Quentin Monnet Signed-off-by: Nicolas Dichtel Reviewed-by: Quentin Monnet Signed-off-by: Alexei Starovoitov commit e943d94e4b7c54ee7b51852d91f9699e041bffd7 Merge: 53e50a6ec24d 557dd485eaeb Author: David S. Miller Date: Wed Oct 17 21:33:43 2018 -0700 Merge branch 'octeontx2-af-NPA-and-NIX-blocks-initialization' Sunil Goutham says: ==================== octeontx2-af: NPA and NIX blocks initialization This patchset is a continuation to earlier submitted patch series to add a new driver for Marvell's OcteonTX2 SOC's Resource virtualization unit (RVU) admin function driver. octeontx2-af: Add RVU Admin Function driver https://www.spinics.net/lists/netdev/msg528272.html This patch series adds logic for the following. - Modified register polling loop to use time_before(jiffies, timeout), as suggested by Arnd Bergmann. - Support to forward interface link status notifications sent by firmware to registered PFs mapped to a CGX::LMAC. - Support to set CGX LMAC in loopback mode, retrieve stats, configure DMAC filters at CGX level etc. - Network pool allocator (NPA) functional block initialization, admin queue support, NPALF aura/pool contexts memory allocation, init and deinit. - Network interface controller (NIX) functional block basic init, admin queue support, NIXLF RQ/CQ/SQ HW contexts memory allocation, init and deinit. ==================== Signed-off-by: David S. Miller commit 557dd485eaebdc8a447ce1d5c8916ada739f66b4 Author: Geetha sowjanya Date: Tue Oct 16 16:57:20 2018 +0530 octeontx2-af: Support for disabling NIX RQ/SQ/CQ contexts This patch adds support for a RVU PF/VF to disable all RQ/SQ/CQ contexts of a NIX LF via mbox. This will be used by PF/VF drivers upon teardown or while freeing up HW resources. A HW context which is not INIT'ed cannot be modified and a RVU PF/VF driver may or may not INIT all the RQ/SQ/CQ contexts. So a bitmap is introduced to keep track of enabled NIX RQ/SQ/CQ contexts, so that only enabled hw contexts are disabled upon LF teardown. Signed-off-by: Geetha sowjanya Signed-off-by: Stanislaw Kardach Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit ffb0abd7e9cb22714d86ad8a60babd7b05ebdc06 Author: Sunil Goutham Date: Tue Oct 16 16:57:19 2018 +0530 octeontx2-af: NIX AQ instruction enqueue support Add support for a RVU PF/VF to submit instructions to NIX AQ via mbox. Instructions can be to init/write/read RQ/SQ/CQ/RSS contexts. In case of read, context will be returned as part of response to the mbox msg received. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 709a4f0c254c06289283593b92b233451656bac3 Author: Sunil Goutham Date: Tue Oct 16 16:57:18 2018 +0530 octeontx2-af: Alloc bitmaps for NIX Tx scheduler queues Allocate bitmaps and memory for PFVF mapping info for maintaining NIX transmit scheduler queues maintenance. PF/VF drivers will request for alloc, free e.t.c of Tx schedulers via mailbox. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 59360e9809daecb59c3c42ee10918155bfded615 Author: Sunil Goutham Date: Tue Oct 16 16:57:17 2018 +0530 octeontx2-af: NIX LSO config for TSOv4/v6 offload Config LSO formats for TSOv4 and TSOv6 offloads. These formats tell HW which fields in the TCP packet's headers have to be updated while performing segmentation offload. Also report PF/VF drivers the LSO format indices as part of response to NIX_LF_ALLOC mbox msg. These indices are used in SQE extension headers while framing SQE for pkt transmission with TSO offload. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit cb30711a6c7aa4956f3fea8bfe2d6adeac4f55c0 Author: Sunil Goutham Date: Tue Oct 16 16:57:16 2018 +0530 octeontx2-af: NIX block LF initialization Upon receiving NIX_LF_ALLOC mbox message allocate memory for NIXLF's CQ, SQ, RQ, CINT, QINT and RSS HW contexts and configure respective base iova HW. Enable caching of contexts into NIX NDC. Return SQ buffer (SQB) size, this PF/VF MAC address etc info e.t.c to the mbox msg sender. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit aba53d5dbceabd36786a2a2f63ebbfe40cc343ad Author: Sunil Goutham Date: Tue Oct 16 16:57:15 2018 +0530 octeontx2-af: NIX block admin queue init Initialize NIX admin queue (AQ) i.e alloc memory for AQ instructions and for the results. All NIX LFs will submit instructions to AQ to init/write/read RQ/SQ/CQ/RSS contexts and in case of read, get context from result memory. Also before configuring/using NIX block calibrate X2P bus and check if NIX interfaces like CGX and LBK are in active and working state. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 57856dde119590462315ddb5b4bf5fd2d981cb36 Author: Geetha sowjanya Date: Tue Oct 16 16:57:14 2018 +0530 octeontx2-af: Support for disabling NPA Aura/Pool contexts This patch adds support for a RVU PF/VF to disable all Aura/Pool contexts of a NPA LF via mbox. This will be used by PF/VF drivers upon teardown or while freeing up HW resources. A HW context which is not INIT'ed cannot be modified and a RVU PF/VF driver may or may not INIT all the Aura/Pool contexts. So a bitmap is introduced to keep track of enabled NPA Aura/Pool contexts, so that only enabled hw contexts are disabled upon LF teardown. Signed-off-by: Geetha sowjanya Signed-off-by: Stanislaw Kardach Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 4a3581cd5995d86721b3a38e1e2799b2137b4d77 Author: Sunil Goutham Date: Tue Oct 16 16:57:13 2018 +0530 octeontx2-af: NPA AQ instruction enqueue support Add support for a RVU PF/VF to submit instructions to NPA AQ via mbox. Instructions can be to init/write/read Aura/Pool/Qint contexts. In case of read, context will be returned as part of response to the mbox msg received. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 3fa4c3232ac9da57f1ad10ddc971f521e62edc69 Author: Sunil Goutham Date: Tue Oct 16 16:57:12 2018 +0530 octeontx2-af: NPA block LF initialization Upon receiving NPA_LF_ALLOC mbox message allocate memory for NPALF's aura, pool and qint contexts and configure the same to HW. Enable caching of contexts into NPA NDC. Return pool related info like stack size, num pointers per stack page e.t.c to the mbox msg sender. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 7a37245ef23f75223263930e086aa0a8678e161f Author: Sunil Goutham Date: Tue Oct 16 16:57:11 2018 +0530 octeontx2-af: NPA block admin queue init Initialize NPA admin queue (AQ) i.e alloc memory for AQ instructions and for the results. All NPA LFs will submit instructions to AQ to init/write/read Aura/Pool contexts and in case of read, get context from result memory. Added some common APIs for allocating memory for a queue and get IOVA in return, these APIs will be used by NIX AQ and for other purposes. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 23999b30ae67a1baef78ed5b2c3edb6928fcb225 Author: Geetha sowjanya Date: Tue Oct 16 16:57:10 2018 +0530 octeontx2-af: Enable or disable CGX internal loopback Add support to enable or disable internal loopback mode in CGX. New mbox IDs CGX_INTLBK_ENABLE/DISABLE added for this. Signed-off-by: Geetha sowjanya Signed-off-by: Linu Cherian Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 61071a871ea6eb2125ece91c1a0dbb124a318c8a Author: Linu Cherian Date: Tue Oct 16 16:57:09 2018 +0530 octeontx2-af: Forward CGX link notifications to PFs Upon receiving notification from firmware the CGX event handler in the AF driver gets the current link info such as status, speed, duplex etc from CGX driver and sends it across to PFs who have registered to receive such notifications. To support above - Mbox messaging support for sending msgs from AF to PF has been added. - Added mbox msgs so that PFs can register/unregister for link events. - Link notifications are sent to PF under two scenarioss. 1. When a asynchronous link change notification is received from firmware with notification flag turned on for that PF. 2. Upon notification turn on request, the current link status is send to the PF. Also added a new mailbox msg using which RVU PF/VF can retrieve their mapped CGX LMAC's current link info. Link info includes status, speed, duplex and lmac type. Signed-off-by: Linu Cherian Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 96be2e0da85eb1c26e8d1d38ed4855a9c4eba167 Author: Vidhya Raman Date: Tue Oct 16 16:57:08 2018 +0530 octeontx2-af: Support for MAC address filters in CGX This patch adds support for setting MAC address filters in CGX for PF interfaces. Also PF interfaces can be put in promiscuous mode. Dataplane PFs access this functionality using mailbox messages to the AF driver. Signed-off-by: Vidhya Raman Signed-off-by: Stanislaw Kardach Signed-off-by: David S. Miller commit 66208910e57afda24ef37be64d413d354f9b523f Author: Christina Jacob Date: Tue Oct 16 16:57:07 2018 +0530 octeontx2-af: Support to retrieve CGX LMAC stats This patch adds support for a RVU PF/VF driver to retrieve it's mapped CGX LMAC Rx and Tx stats from AF via mbox. New mailbox msg is added is added. Signed-off-by: Christina Jacob Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 1435f66a28b44ac6b82f8601ee217d2eb55df4f2 Author: Sunil Goutham Date: Tue Oct 16 16:57:06 2018 +0530 octeontx2-af: CGX Rx/Tx enable/disable mbox handlers Added new mailbox msgs for RVU PF/VFs to request AF to enable/disable their mapped CGX::LMAC Rx & Tx. Signed-off-by: Sunil Goutham Signed-off-by: Linu Cherian Signed-off-by: David S. Miller commit 6ca3ee2f7d3a4b6063c14f5ebd1c6076035310ef Author: Sunil Goutham Date: Tue Oct 16 16:57:05 2018 +0530 octeontx2-af: Improve register polling loop Instead of looping on a integer timeout, use time_before(jiffies), so that maximum poll time is capped. Signed-off-by: Sunil Goutham Suggested-by: Arnd Bergmann Signed-off-by: David S. Miller commit 4d5b4ac1eae471bcd0fa381ab4099cc33e94e15d Author: Jens Axboe Date: Tue Oct 16 08:37:23 2018 -0600 scsi: fnic: replace gross legacy tag hack with blk-mq hack Would be nice to fix up the SCSI midlayer instead, but this will do for now. Cc: Christoph Hellwig Cc: Satish Kharat Cc: linux-scsi@vger.kernel.org Signed-off-by: Jens Axboe Signed-off-by: Martin K. Petersen commit c13bbf4a78aafed144de0250a3c71265672c9bda Merge: 28b32b9f61fe 8e16695b4eb8 Author: Dave Airlie Date: Thu Oct 18 12:05:08 2018 +1000 Merge branch 'drm-next-4.20' of git://people.freedesktop.org/~agd5f/linux into drm-next Fixes for 4.20. Highlights: - VCN DPG fixes for Picasso - Add support for the latest vega20 vbios - Scheduler timeout fix - License fixes for radeon and amdgpu - Misc other fixes Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20181017215427.2804-1-alexander.deucher@amd.com commit 28b32b9f61fe73e7625ed30c35afd6d8a0ed2b6e Merge: ca4b869240d5 0e8afefd5da4 Author: Dave Airlie Date: Thu Oct 18 12:04:41 2018 +1000 Merge tag 'drm-misc-next-fixes-2018-10-17' of git://anongit.freedesktop.org/drm/drm-misc into drm-next - Add quirk to fix orientation of Acer One 10 (S1003) panel (Hans) Cc: Hans de Goede Signed-off-by: Dave Airlie From: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20181017200741.GA240649@art_vandelay commit 6c714d44259494b4d593dd88d2b5a43ff1730680 Author: Christoph Hellwig Date: Thu Oct 11 10:17:35 2018 +0200 scsi: mesh: switch to generic DMA API Switch from the legacy PCI DMA API to the generic DMA API. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit 32e76961dd63ebb2882f8a478889cc7f42fbfb4c Author: Christoph Hellwig Date: Thu Oct 11 10:15:35 2018 +0200 scsi: ips: switch to generic DMA API Switch from the legacy PCI DMA API to the generic DMA API. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit 6917a9cc28181b37d142f1c5813a6888f41572e7 Author: Christoph Hellwig Date: Thu Oct 11 09:47:59 2018 +0200 scsi: smartpqi: fully convert to the generic DMA API The driver is currently using an odd mix of legacy PCI DMA API and generic DMA API calls, switch it over to the generic API entirely. Signed-off-by: Christoph Hellwig Tested-by: Don Brace Acked-by: Don Brace Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit 9b7ca6c24cb4bef2a704f34b4e11c471360d02a0 Author: Christoph Hellwig Date: Wed Oct 10 20:22:40 2018 +0200 scsi: vmw_pscsi: switch to generic DMA API Switch from the legacy PCI DMA API to the generic DMA API. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit cecfed31fda849767799e5521064796a21c5164c Author: Christoph Hellwig Date: Wed Oct 10 20:16:41 2018 +0200 scsi: snic: switch to generic DMA API Switch from the legacy PCI DMA API to the generic DMA API. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit ec44a6762fc57c82acdf2c12ec9b542d9f308300 Author: Christoph Hellwig Date: Thu Oct 11 09:56:58 2018 +0200 scsi: qla4xxx: fully convert to the generic DMA API The driver is currently using an odd mix of legacy PCI DMA API and generic DMA API calls, switch it over to the generic API entirely. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit e7d0bb774699be4542ec09e903a9cce38cea33d4 Author: Christoph Hellwig Date: Thu Oct 11 09:42:07 2018 +0200 scsi: qla2xxx: fully convert to the generic DMA API The driver is currently using an odd mix of legacy PCI DMA API and generic DMA API calls, switch it over to the generic API entirely. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit 60ea4fb138a66f8e08bc165225b89dfb942d0790 Author: Christoph Hellwig Date: Wed Oct 10 20:09:04 2018 +0200 scsi: qla1280: switch to generic DMA API Switch from the legacy PCI DMA API to the generic DMA API. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit 7ae7ce0bbefff16d24d932f650b9bd9e8c08c0da Author: Christoph Hellwig Date: Wed Oct 10 20:06:13 2018 +0200 scsi: qedi: fully convert to the generic DMA API The driver is currently using an odd mix of legacy PCI DMA API and generic DMA API calls, switch it over to the generic API entirely. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Acked-by: Manish Rangankar Signed-off-by: Martin K. Petersen commit 332d84f7f6378d6f595449f02c3552c22a77bd86 Author: Christoph Hellwig Date: Wed Oct 10 20:04:15 2018 +0200 scsi: qedf: fully convert to the generic DMA API The driver is currently using an odd mix of legacy PCI DMA API and generic DMA API calls, switch it over to the generic API entirely. Signed-off-by: Christoph Hellwig Acked-by: Chad Dupuis Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit f73bdebdf020a31ad43ce4de590ec7a09e383abd Author: Christoph Hellwig Date: Wed Oct 10 19:59:50 2018 +0200 scsi: pm8001: switch to generic DMA API Switch from the legacy PCI DMA API to the generic DMA API. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Reviewed-by: Jack Wang Signed-off-by: Martin K. Petersen commit 03676e1d31fa0e156df0caecbacf20b488f7bd3a Author: Christoph Hellwig Date: Wed Oct 10 19:55:59 2018 +0200 scsi: nsp32: switch to generic DMA API Switch from the legacy PCI DMA API to the generic DMA API. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit 4179a0619ad2f60eda275b6bd55f24c980e4efae Author: Christoph Hellwig Date: Thu Oct 11 09:54:21 2018 +0200 scsi: mvsas: fully convert to the generic DMA API The driver is currently using an odd mix of legacy PCI DMA API and generic DMA API calls, switch it over to the generic API entirely. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit ab8e7f4bdfeac57074c8a8a9ca12bcd101fdf1ca Author: Christoph Hellwig Date: Wed Oct 10 19:53:14 2018 +0200 scsi: mvumi: switch to generic DMA API Switch from the legacy PCI DMA API to the generic DMA API. Also reuse an existing helper (after fixing the error return) to set the DMA mask instead of having three copies of the code. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit 1c2048bdc3f4ff3337613c27519cf608916e95a9 Author: Christoph Hellwig Date: Thu Oct 11 09:35:25 2018 +0200 scsi: mpt3sas: switch to generic DMA API Switch from the legacy PCI DMA API to the generic DMA API. Also simplify setting the DMA mask a bit. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit 60ee6529511601e9a8660627e7ef9f8c8edaef0c Author: Christoph Hellwig Date: Wed Oct 10 19:31:25 2018 +0200 scsi: megaraid_sas: switch to generic DMA API Switch from the legacy PCI DMA API to the generic DMA API. Signed-off-by: Christoph Hellwig Acked-by: Sumit Saxena Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit 66e3a2418b025871aee14ccf366a9841e0ae7ee0 Author: Christoph Hellwig Date: Thu Oct 11 09:34:24 2018 +0200 scsi: megaraid_mbox: switch to generic DMA API Switch from the legacy PCI DMA API to the generic DMA API. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit 8bc8f47ea3964ef141e91ffff912538a66a55d5f Author: Christoph Hellwig Date: Wed Oct 10 18:56:15 2018 +0200 scsi: hpsa: switch to generic DMA API Switch from the legacy PCI DMA API to the generic DMA API. Signed-off-by: Christoph Hellwig Tested-by: Don Brace Acked-by: Don Brace Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit 7f9b0f774fdf26a5d76363d889ba587e242a497b Author: Christoph Hellwig Date: Wed Oct 10 18:40:56 2018 +0200 scsi: fnic: switch to generic DMA API Switch from the legacy PCI DMA API to the generic DMA API. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit c22b332d811b90448e090c7fb487448afb039fcc Author: Christoph Hellwig Date: Wed Oct 10 18:34:51 2018 +0200 scsi: csiostor: switch to generic DMA API Switch from the legacy PCI DMA API to the generic DMA API. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit 26a4c991af99f1f6632c0cf253a332a29edd2681 Author: Christoph Hellwig Date: Wed Oct 10 18:22:24 2018 +0200 scsi: be2iscsi: switch to generic DMA API Switch from the legacy PCI DMA API to the generic DMA API. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit 48ecddb41b741d4e530d88903757d26058fce2a5 Author: Christoph Hellwig Date: Wed Oct 10 18:14:14 2018 +0200 scsi: atp870u: switch to generic DMA API Switch from the legacy PCI DMA API to the generic DMA API. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit 4d431b182e67da090f6bbe092281f49cab1a55f2 Author: Christoph Hellwig Date: Wed Oct 10 18:09:42 2018 +0200 scsi: a100u2w: switch to generic DMA API Switch from the legacy PCI DMA API to the generic DMA API. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit 17a361b20a0f908ca3952778b063994435164fe8 Author: Christoph Hellwig Date: Wed Oct 10 18:03:24 2018 +0200 scsi: BusLogic: switch to generic DMA API Switch from the legacy PCI DMA API to the generic DMA API. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit b1fa122930c4ceeb265f02202c8f42a53a188a88 Author: Christoph Hellwig Date: Wed Oct 10 18:06:50 2018 +0200 scsi: 3w-sas: fully convert to the generic DMA API The driver is currently using an odd mix of legacy PCI DMA API and generic DMA API calls, switch it over to the generic API entirely. Signed-off-by: Christoph Hellwig Acked-by: Adam Radford Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit bd6cf46b046fd4bbfec128617600e85c431d2853 Author: Christoph Hellwig Date: Wed Oct 10 17:58:50 2018 +0200 scsi: 3w-xxx: fully convert to the generic DMA API The driver is currently using an odd mix of legacy PCI DMA API and generic DMA API calls, switch it over to the generic API entirely. Signed-off-by: Christoph Hellwig Acked-by: Adam Radford Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit b000bced57395e4f2f6a48d7b4b9cb2b2517bdfc Author: Christoph Hellwig Date: Wed Oct 10 17:53:41 2018 +0200 scsi: 3w-9xxx: fully convert to the generic DMA API The driver is currently using an odd mix of legacy PCI DMA API and generic DMA API calls, switch it over to the generic API entirely. Signed-off-by: Christoph Hellwig Acked-by: Adam Radford Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit 3a21986f1a5974d3d4d1489840188e2349ec7911 Author: Christoph Hellwig Date: Thu Oct 11 10:02:55 2018 +0200 scsi: aic94xx: fully convert to the generic DMA API The driver is currently using an odd mix of legacy PCI DMA API and generic DMA API calls, switch it over to the generic API entirely. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit 8c6f803fd66e28dfe01f51d1c0b5b9188980ba58 Author: Finn Thain Date: Tue Oct 16 16:31:25 2018 +1100 scsi: esp_scsi: Optimize PIO loops Avoid function calls in the inner PIO loops. On a Centris 660av this improves throughput for sequential read transfers by about 40% and sequential write by about 10%. Unfortunately it is not possible to have methods like .esp_write8 placed inline so this is always going to be slow, even with LTO. Tested-by: Stan Johnson Signed-off-by: Finn Thain Tested-by: Michael Schmitz Signed-off-by: Martin K. Petersen commit 53dce332db507a2bd9797adc938fa293d1f1acc6 Author: Finn Thain Date: Tue Oct 16 16:31:25 2018 +1100 scsi: esp_scsi: De-duplicate PIO routines As a temporary measure, the code to implement PIO transfers was duplicated in zorro_esp and mac_esp. Now that it has stabilized move the common code into the core driver but don't build it unless needed. This replaces the inline assembler with more portable writesb() calls. Optimizing the m68k writesb() implementation is a separate patch. [mkp: applied by hand] Signed-off-by: Finn Thain Tested-by: Stan Johnson Tested-by: Michael Schmitz Signed-off-by: Martin K. Petersen commit 8bca2143335116af838305440d94539367382555 Author: Finn Thain Date: Tue Oct 16 16:31:25 2018 +1100 scsi: esp_scsi: Eliminate ESP_FLAG_DOING_SLOWCMD The concept of a 'slow command' as it appears in esp_scsi is confusing because it could refer to an ESP command or a SCSI command. It turns out that it refers to a particular ESP select command which the driver also tracks as 'ESP_SELECT_MSGOUT'. For readability, it is better to use the terminology from the datasheets. The global ESP_FLAG_DOING_SLOWCMD flag is redundant anyway, as it can be inferred from esp->select_state. Remove the ESP_FLAG_DOING_SLOWCMD cruft and just use a boolean local variable. Tested-by: Stan Johnson Signed-off-by: Finn Thain Tested-by: Michael Schmitz Signed-off-by: Martin K. Petersen commit 87c58ef5a57f46b1d78117317a7d8806ad16f404 Author: Finn Thain Date: Tue Oct 16 16:31:25 2018 +1100 scsi: esp_scsi: Grant disconnect privilege for untagged commands A SCSI device is not granted disconnect privilege by an esp_scsi host unless that device has its simple_tags flag set. However, a device may support disconnect/reselect and not support command queueing. Allow such devices to disconnect and thereby improve bus utilization. Drop the redundant 'lp' check. The mid-layer invokes .slave_alloc and .slave_destroy in such a way that we may rely on scmd->device->hostdata for as long as scmd belongs to the low-level driver. Tested-by: Stan Johnson Signed-off-by: Finn Thain Tested-by: Michael Schmitz Signed-off-by: Martin K. Petersen commit fd47d919d0c336e7c22862b51ee94927ffea227a Author: Finn Thain Date: Tue Oct 16 16:31:25 2018 +1100 scsi: esp_scsi: Track residual for PIO transfers If a target disconnects during a PIO data transfer the command may fail when the target reconnects: scsi host1: DMA length is zero! scsi host1: cur adr[04380000] len[00000000] The scsi bus is then reset. This happens because the residual reached zero before the transfer was completed. The usual residual calculation relies on the Transfer Count registers. That works for DMA transfers but not for PIO transfers. Fix the problem by storing the PIO transfer residual and using that to correctly calculate bytes_sent. Fixes: 6fe07aaffbf0 ("[SCSI] m68k: new mac_esp scsi driver") Tested-by: Stan Johnson Signed-off-by: Finn Thain Tested-by: Michael Schmitz Signed-off-by: Martin K. Petersen commit b7ded0e8b0d11b6df1c4e5aa23a26e6629c21985 Author: Finn Thain Date: Tue Oct 16 16:31:25 2018 +1100 scsi: zorro_esp: Limit DMA transfers to 65535 bytes The core driver, esp_scsi, does not use the ESP_CONFIG2_FENAB bit, so the chip's Transfer Counter register is only 16 bits wide (not 24). A larger transfer cannot work and will theoretically result in a failed command and a "DMA length is zero" error. Fixes: 3109e5ae0311 ("scsi: zorro_esp: New driver for Amiga Zorro NCR53C9x boards") Signed-off-by: Finn Thain Cc: Michael Schmitz Tested-by: Michael Schmitz Reviewed-by: Michael Schmitz Signed-off-by: Martin K. Petersen commit dfda5e21c93a3441e8a54a38000cff95f9515d34 Author: Christoph Hellwig Date: Thu Oct 11 16:17:16 2018 +0200 scsi: dc395x: use generic DMA API Convert the driver from the legacy pci_* DMA API to the generic DMA API. Signed-off-by: Christoph Hellwig Signed-off-by: Martin K. Petersen commit 6c404a68bf83b4135a8a9aa1c388ebdf98e8ba7f Author: Christoph Hellwig Date: Thu Oct 11 16:17:15 2018 +0200 scsi: dc395x: fix DMA API usage in sg_update_list We need to transfer device ownership to the CPU before we can manipulate the mapped data. Signed-off-by: Christoph Hellwig Signed-off-by: Martin K. Petersen commit 3a5bd7021184dec2946f2a4d7a8943f8a5713e52 Author: Christoph Hellwig Date: Thu Oct 11 16:17:14 2018 +0200 scsi: dc395x: fix dma API usage in srb_done We can't just transfer ownership to the CPU and then unmap, as this will break with swiotlb. Instead unmap the command and sense buffer a little earlier in the I/O completion handler and get rid of the pci_dma_sync_sg_for_cpu call entirely. Signed-off-by: Christoph Hellwig Signed-off-by: Martin K. Petersen commit cd29660dc8675ec235db23e38435fad833158e1c Author: Christoph Hellwig Date: Thu Oct 11 16:17:13 2018 +0200 scsi: dc395x: simplify list handling Remove the list wrappers, including the pointless list iteration before deletion. Signed-off-by: Christoph Hellwig Signed-off-by: Martin K. Petersen commit d9a515867bdba59ebf196a6ade10faae8e8be36a Author: Imre Deak Date: Tue Oct 16 19:00:11 2018 +0300 drm/i915/gen9+: Fix initial readout for Y tiled framebuffers If BIOS configured a Y tiled FB we failed to set up the backing object tiling accordingly, leading to a lack of GT fence installed and a garbled console. The problem was bisected to commit 011f22eb545a ("drm/i915: Do NOT skip the first 4k of stolen memory for pre-allocated buffers v2") but it just revealed a pre-existing issue. Kudos to Ville who suspected a missing fence looking at the corruption on the screen. Cc: Ville Syrjälä Cc: Mika Westerberg Cc: Hans de Goede Cc: Cc: Reported-by: Mika Westerberg Reported-by: Tested-by: Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108264 Fixes: bc8d7dffacb1 ("drm/i915/skl: Provide a Skylake version of get_plane_config()") Signed-off-by: Imre Deak Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20181016160011.28347-1-imre.deak@intel.com (cherry picked from commit 914a4fd8cd28016038ce749a818a836124a8d270) Signed-off-by: Rodrigo Vivi commit ab0d6a141843e0b4b2709dfd37b53468b5452c3a Author: Chris Wilson Date: Fri Oct 12 15:02:28 2018 +0100 drm/i915: Large page offsets for pread/pwrite Handle integer overflow when computing the sub-page length for shmem backed pread/pwrite. Reported-by: Tvrtko Ursulin Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: stable@vger.kernel.org Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20181012140228.29783-1-chris@chris-wilson.co.uk (cherry picked from commit a5e856a5348f6cd50889d125c40bbeec7328e466) Signed-off-by: Rodrigo Vivi commit e3118a038dfd1d6d902ea966e0ce3ce4e91e503b Author: Chris Wilson Date: Thu Oct 11 11:37:48 2018 +0100 drm/i915/selftests: Disable shrinker across mmap-exhaustion For mmap-exhaustion, we deliberately put the system under a large amount of pressure to ensure that we are able to reap mmap-offsets from dead objects. If background activity does that reaping for us, that defeats the purpose of the test and in some cases will fail our sanity checks (because of the fake activity we use to prevent the idle worker). Fixes: 932cac10c8fb ("drm/i915/selftests: Prevent background reaping of acti ve objects") Signed-off-by: Chris Wilson Cc: Mika Kuoppala Cc: Matthew Auld Reviewed-by: Mika Kuoppala Link: https://patchwork.freedesktop.org/patch/msgid/20181011103748.18387-1-chris@chris-wilson.co.uk (cherry picked from commit 0b4bf7ca9be824dde6ff63dd2ceba2d1367f8a58) Signed-off-by: Rodrigo Vivi commit 041444458835d7fb2c9f042598bfe16bf375b15d Author: Manasi Navare Date: Tue Oct 9 14:28:04 2018 -0700 drm/i915/dp: Link train Fallback on eDP only if fallback link BW can fit panel's native mode This patch fixes the original commit c0cfb10d9e1de49 ("drm/i915/edp: Do not do link training fallback or prune modes on EDP") that causes a blank screen in case of certain eDP panels (Eg: seen on Dell XPS13 9350) where first link training fails and a retraining is required by falling back to lower link rate/lane count. In case of some panels they advertise higher link rate/lane count than whats required for supporting the panel's native mode. But we always link train at highest link rate/lane count for eDP and if that fails we can still fallback to lower link rate/lane count as long as the fallback link BW still fits the native mode to avoid pruning the panel's native mode yet retraining at fallback values to recover from a blank screen. v3: * Add const for fixed_mode (Ville) v2: * Send uevent if link failure on eDP unconditionally Fixes: c0cfb10d9e1d ("drm/i915/edp: Do not do link training fallback or prune modes on EDP") Cc: Clinton Taylor Cc: Jani Nikula Cc: Ville Syrjala Cc: Daniel Vetter Cc: Lucas De Marchi Cc: # v4.17+ Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107489 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105338 Signed-off-by: Manasi Navare Tested-by: Alexander Wilson Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20181009212804.702-1-manasi.d.navare@intel.com (cherry picked from commit 1e712535c51ab025ebc776d4405683d81521996d) Signed-off-by: Rodrigo Vivi commit 4bbf0d4749e707b6b262d576a9a9ef5c63b52dd4 Author: Lyude Paul Date: Mon Oct 8 19:24:34 2018 -0400 drm/i915: Fix intel_dp_mst_best_encoder() Currently, i915 appears to rely on blocking modesets on no-longer-present MSTB ports by simply returning NULL for ->best_encoder(), which in turn causes any new atomic commits that don't disable the CRTC to fail. This is wrong however, since we still want to allow userspace to disable CRTCs on no-longer-present MSTB ports by changing the DPMS state to off and this still requires that we retrieve an encoder. So, fix this by always returning a valid encoder regardless of the state of the MST port. Changes since v1: - Remove mst atomic helper, since this got replaced with a much simpler solution Signed-off-by: Lyude Paul Reviewed-by: Daniel Vetter Cc: stable@vger.kernel.org Link: https://patchwork.freedesktop.org/patch/msgid/20181008232437.5571-6-lyude@redhat.com (cherry picked from commit a9f9ca33d1fe9325f414914be526c0fc4ba5281c) Signed-off-by: Rodrigo Vivi commit c02ba4ef16eefe663fdefcccaa57fad32d5481bf Author: Lyude Paul Date: Mon Oct 8 19:24:33 2018 -0400 drm/i915: Skip vcpi allocation for MSTB ports that are gone Since we need to be able to allow DPMS on->off prop changes after an MST port has disappeared from the system, we need to be able to make sure we can compute a config for the resulting atomic commit. Currently this is impossible when the port has disappeared, since the VCPI slot searching we try to do in intel_dp_mst_compute_config() will fail with -EINVAL. Since the only commits we want to allow on no-longer-present MST ports are ones that shut off display hardware, we already know that no VCPI allocations are needed. So, hardcode the VCPI slot count to 0 when intel_dp_mst_compute_config() is called on an MST port that's gone. Changes since V4: - Don't use mst_port_gone at all, just check whether or not the drm connector is registered - Daniel Vetter Signed-off-by: Lyude Paul Reviewed-by: Daniel Vetter Cc: stable@vger.kernel.org Link: https://patchwork.freedesktop.org/patch/msgid/20181008232437.5571-5-lyude@redhat.com (cherry picked from commit f67207d78ceaf98b7531bc22df6f21328559c8d4) Signed-off-by: Rodrigo Vivi commit 80c188695a77eddaa6e8885510ff4ef59fd478c3 Author: Lyude Paul Date: Mon Oct 8 19:24:32 2018 -0400 drm/i915: Don't unset intel_connector->mst_port Currently we set intel_connector->mst_port to NULL to signify that the MST port has been removed from the system so that we can prevent further action on the port such as connector probes, mode probing, etc. However, we're going to need access to intel_connector->mst_port in order to fixup ->best_encoder() so that it can always return the correct encoder for an MST port to prevent legacy DPMS prop changes from failing. This should be safe, so instead keep intel_connector->mst_port always set and instead just check the status of drm_connector->regustered to signify whether or not the connector has disappeared from the system. Changes since v2: - Add a comment to mst_port_gone (Jani Nikula) - Change mst_port_gone to a u8 instead of a bool, per the kernel bot. Apparently bool is discouraged in structs these days Changes since v4: - Don't use mst_port_gone at all! Just check if the connector is registered or not - Daniel Vetter Signed-off-by: Lyude Paul Reviewed-by: Daniel Vetter Cc: stable@vger.kernel.org Link: https://patchwork.freedesktop.org/patch/msgid/20181008232437.5571-4-lyude@redhat.com (cherry picked from commit 6ed5bb1fbad34382c8cfe9a9bf737e9a43053df5) Signed-off-by: Rodrigo Vivi commit 708ea872601e56ef9ea8398c5a11938482bcbb4d Author: Chris Wilson Date: Thu Oct 4 09:21:19 2018 +0100 drm/i915: Only reset seqno if actually idle Before we can reset the seqno, we have to be sure the engines are idle. In debugfs/i915_drop_caches_set, we do wait_for_idle but allow ourselves to be interrupted. We should only proceed to reset the seqno then if we were not interrupted, and so also avoid overwriting the error status. References: https://bugs.freedesktop.org/show_bug.cgi?id=108133 Fixes: 6b048706f407 ("drm/i915: Forcibly flush unwanted requests in drop-caches") Signed-off-by: Chris Wilson Cc: Joonas Lahtinen Reviewed-by: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20181004082119.24970-1-chris@chris-wilson.co.uk (cherry picked from commit 88a83f3c2d7a87ce7c9c4171dec8e2fb48070288) Signed-off-by: Rodrigo Vivi commit 9b27390139dbe0dc10d1899545248862fe826b61 Author: Ville Syrjälä Date: Wed Oct 3 17:50:17 2018 +0300 drm/i915: Use the correct crtc when sanitizing plane mapping When we decide that a plane is attached to the wrong pipe we try to turn off said plane. However we are passing around the crtc we think that the plane is supposed to be using rather than the crtc it is currently using. That doesn't work all that well because we may have to do vblank waits etc. and the other pipe might not even be enabled here. So let's pass the plane's current crtc to intel_plane_disable_noatomic() so that it can its job correctly. To do that semi-cleanly we also have to change the plane readout to record the plane's visibility into the bitmasks of the crtc where the plane is currently enabled rather than to the crtc we want to use for the plane. One caveat here is that our active_planes bitmask will get confused if both planes are enabled on the same pipe. Fortunately we can use plane_mask to reconstruct active_planes sufficiently since plane_mask still has the same meaning (is the plane visible?) during readout. We also have to do the same during the initial plane readout as the second plane could clear the active_planes bit the first plane had already set. v2: Rely on fixup_active_planes() to populate active_planes fully (Daniel) Add Daniel's proposed comment to better document why we do this Drop the redundant intel_set_plane_visible() call Cc: stable@vger.kernel.org # fcba862e8428 drm/i915: Have plane->get_hw_state() return the current pipe Cc: stable@vger.kernel.org Cc: Dennis Cc: Daniel Vetter Tested-by: Dennis Tested-by: Peter Nowee Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105637 Fixes: b1e01595a66d ("drm/i915: Redo plane sanitation during readout") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20181003145017.4527-1-ville.syrjala@linux.intel.com Reviewed-by: Daniel Vetter (cherry picked from commit 62358aa4ee86481ce044bef04859820e1bc7c1d9) Signed-off-by: Rodrigo Vivi commit 7cada4d0b7a0fb813dbc9777fec092e9ed0546e9 Author: Ville Syrjälä Date: Wed Oct 3 17:49:51 2018 +0300 drm/i915: Restore vblank interrupts earlier Plane sanitation needs vblank interrupts (on account of CxSR disable). So let's restore vblank interrupts earlier. v2: Make it actually build v3: Add comment to explain why we need this (Daniel) Cc: stable@vger.kernel.org Cc: Dennis Tested-by: Dennis Tested-by: Peter Nowee Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105637 Fixes: b1e01595a66d ("drm/i915: Redo plane sanitation during readout") Signed-off-by: Ville Syrjälä Reviewed-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20181003144951.4397-1-ville.syrjala@linux.intel.com (cherry picked from commit 68bc30deac625b8be8d3950b30dc93d09a3645f5) Signed-off-by: Rodrigo Vivi commit 3f6d5ba173da9a41c799146a3ad999da2158716a Author: Ville Syrjälä Date: Tue Sep 18 17:02:43 2018 +0300 drm/i915: Check fb stride against plane max stride commit 4e0b83a567e2 ("drm/i915: Extract per-platform plane->check() functions") removed the plane max stride check for sprite planes. I was going to add it back when introducing GTT remapping for the display, but after further thought it seems better to re-introduce it separately. So let's add the max stride check back. And let's do it in a nicer form than what we had before and do it for all plane types (easy now that we have the ->max_stride() plane vfunc). Only sprite planes really need this for now since primary planes are capable of scanning out the current max fb size we allow, and cursors have more stringent stride checks elsewhere. Cc: José Roberto de Souza Fixes: 4e0b83a567e2 ("drm/i915: Extract per-platform plane->check() functions") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20180918140243.12207-1-ville.syrjala@linux.intel.com Reviewed-by: Dhinakaran Pandiyan (cherry picked from commit fc3fed5d297b51f9e2c7d4f969c95c0d6e50ca57) Signed-off-by: Rodrigo Vivi commit 85c95f208f481ab3c34c4622f508272cd4803afd Author: Mark Fasheh Date: Mon Sep 10 16:21:18 2018 -0700 vfs: dedupe should return EPERM if permission is not granted Right now we return EINVAL if a process does not have permission to dedupe a file. This was an oversight on my part. EPERM gives a true description of the nature of our error, and EINVAL is already used for the case that the filesystem does not support dedupe. Signed-off-by: Mark Fasheh Reviewed-by: Darrick J. Wong Acked-by: David Sterba Signed-off-by: Al Viro commit 5de4480ae7f8f1969065aa88be98111e36075bb0 Author: Mark Fasheh Date: Mon Sep 10 16:21:17 2018 -0700 vfs: allow dedupe of user owned read-only files The permission check in vfs_dedupe_file_range_one() is too coarse - We only allow dedupe of the destination file if the user is root, or they have the file open for write. This effectively limits a non-root user from deduping their own read-only files. In addition, the write file descriptor that the user is forced to hold open can prevent execution of files. As file data during a dedupe does not change, the behavior is unexpected and this has caused a number of issue reports. For an example, see: https://github.com/markfasheh/duperemove/issues/129 So change the check so we allow dedupe on the target if: - the root or admin is asking for it - the process has write access - the owner of the file is asking for the dedupe - the process could get write access That way users can open read-only and still get dedupe. Signed-off-by: Mark Fasheh Signed-off-by: Al Viro commit 77266186397c6c782a3f670d32808a9671806ec5 Author: Hannes Reinecke Date: Wed Oct 17 17:25:12 2018 +0200 scsi: myrs: Add Mylex RAID controller (SCSI interface) This patch adds support for the Mylex DAC960 RAID controller, supporting the newer, SCSI-based interface. The driver is a re-implementation of the original DAC960 driver. Signed-off-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen commit 081ff398c56cc1052091e299aae6f7f7de680853 Author: Hannes Reinecke Date: Wed Oct 17 17:25:11 2018 +0200 scsi: myrb: Add Mylex RAID controller (block interface) This patch adds support for the Mylex DAC960 RAID controller, supporting the older, block-based interface only. The driver is a re-implementation of the original DAC960 driver. Signed-off-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen commit e6760cc43e689ea29dce046c9fa1b10982e6b2b5 Author: YueHaibing Date: Wed Oct 17 20:34:32 2018 +0800 scsi: advansys: remove unused variable 'srb_tag' in adv_isr_callback drivers/scsi/advansys.c: In function 'adv_isr_callback': drivers/scsi/advansys.c:5952:6: warning: variable 'srb_tag' set but not used [-Wunused-but-set-variable] It never used since introduction in commit 9c17c62aedb0 ("advansys: use shared host tag map for command lookup") Signed-off-by: YueHaibing Signed-off-by: Martin K. Petersen commit 37208bee6a75574f66b28ae6bb536d9f9b6f22bf Author: Laurence Oberman Date: Tue Oct 16 16:39:16 2018 -0400 scsi: core: Remove scsi_block_when_processing_errors: message This message floods the log when enabling mask 0x7 for /proc/sys/dev/scsi/logging_level: xxxxxxxx kernel: scsi_block_when_processing_errors: rtn: 1 It's not needed and makes tracing just scsi_eh* messages way too verbose so get rid of it. [mkp: mangled patch, applied by hand] Signed-off-by: Laurence Oberman Reviewed-by: Hannes Reinecke Reviewed-by: Chad Dupuis Reviewed-by: Ewan D. Milne Signed-off-by: Martin K. Petersen commit a1ad38a61e34a67bce75c01702d056f051feaf04 Author: Bryant G. Ly Date: Tue Oct 16 17:34:26 2018 +0000 scsi: ibmvscsi_tgt: Remove target_wait_for_sess_cmd() There is currently a bug with the driver where there is never a call to target_sess_cmd_list_set_waiting(), it only called target_wait_for_sess_cmd(), which basically means that the sess_wait_list would always be empty. Thus, list_empty(&sess->sess_wait_list) = true, (eg: no se_cmd I/O is quiesced, because no se_cmd in sess_wait_list), since commit 712db3eb2c35 ("scsi: ibmvscsis: Properly deregister target sessions") in 4.9.y code. ibmvscsi_tgt does not remove the I_T Nexus when a VM is active so we can fix this issue by removing the call to target_wait_for_sess_cmd() altogether. Signed-off-by: Bryant G. Ly Reviewed-by: Mike Christie Signed-off-by: Martin K. Petersen commit f4bb7704699beee9edfbee875daa9089c86cf724 Author: Evan Green Date: Fri Oct 5 10:27:32 2018 -0700 scsi: ufs: Schedule clk gating work on correct queue With commit 10e5e37581fc ("scsi: ufs: Add clock ungating to a separate workqueue"), clock gating work was moved to a separate work queue with WQ_MEM_RECLAIM set, since clock gating could occur from a memory reclaim context. Unfortunately, clk_gating.gate_work was left queued via schedule_delayed_work, which is a system workqueue that does not have WQ_MEM_RECLAIM set. Because ufshcd_ungate_work attempts to cancel gate_work, the following warning appears: [ 14.174170] workqueue: WQ_MEM_RECLAIM ufs_clk_gating_0:ufshcd_ungate_work is flushing !WQ_MEM_RECLAIM events:ufshcd_gate_work [ 14.174179] WARNING: CPU: 4 PID: 173 at kernel/workqueue.c:2440 check_flush_dependency+0x110/0x118 [ 14.205725] CPU: 4 PID: 173 Comm: kworker/u16:3 Not tainted 4.14.68 #1 [ 14.212437] Hardware name: Google Cheza (rev1) (DT) [ 14.217459] Workqueue: ufs_clk_gating_0 ufshcd_ungate_work [ 14.223107] task: ffffffc0f6a40080 task.stack: ffffff800a490000 [ 14.229195] PC is at check_flush_dependency+0x110/0x118 [ 14.234569] LR is at check_flush_dependency+0x110/0x118 [ 14.239944] pc : [] lr : [] pstate: 60c001c9 [ 14.333050] Call trace: [ 14.427767] [] check_flush_dependency+0x110/0x118 [ 14.434219] [] start_flush_work+0xac/0x1fc [ 14.440046] [] flush_work+0x40/0x94 [ 14.445246] [] __cancel_work_timer+0x11c/0x1b8 [ 14.451433] [] cancel_delayed_work_sync+0x20/0x30 [ 14.457886] [] ufshcd_ungate_work+0x24/0xd0 [ 14.463800] [] process_one_work+0x32c/0x690 [ 14.469713] [] worker_thread+0x218/0x338 [ 14.475361] [] kthread+0x120/0x130 [ 14.480470] [] ret_from_fork+0x10/0x18 The simple solution is to put the gate_work on the same WQ_MEM_RECLAIM work queue as the ungate_work. Fixes: 10e5e37581fc ("scsi: ufs: Add clock ungating to a separate workqueue") Signed-off-by: Evan Green Reviewed-by: Douglas Anderson Reviewed-by: Stephen Boyd Signed-off-by: Martin K. Petersen commit 53e50a6ec24d83e9d79e6a95a33b7adcd610f772 Merge: aadd4355918f 1231e04f5bba Author: David S. Miller Date: Wed Oct 17 17:45:08 2018 -0700 Merge branch 'mlxsw-Add-VxLAN-support' Ido Schimmel says: ==================== mlxsw: Add VxLAN support This patchset adds support for VxLAN offload in the mlxsw driver. With regards to the forwarding plane, VxLAN support is composed from two main parts: Encapsulation and decapsulation. In the device, NVE encapsulation (and VxLAN in particular) takes place in the bridge. A packet can be encapsulated using VxLAN either because it hit an FDB entry that forwards it to the router with the IP of the remote VTEP or because it was flooded, in which case it is sent to a list of remote VTEPs (in addition to local ports). In either case, the VNI is derived from the filtering identifier (FID) the packet was classified to at ingress and the underlay source IP is taken from a device global configuration. VxLAN decapsulation takes place in the underlay router, where packets that hit a local route that corresponds to the source IP of the local VTEP are decapsulated and injected to the bridge. The packets are classified to a FID based on the VNI they came with. The first six patches export the required APIs in the VxLAN and mlxsw drivers in order to allow for the introduction of the NVE core in the next two patches. The NVE core is designed to support a variety of NVE encapsulations (e.g., VxLAN, NVGRE) and different ASICs, but currently only VxLAN and Spectrum are supported. Spectrum-2 support will be added in the future. The last 10 patches add support for VxLAN decapsulation and encapsulation and include the addition of the required switchdev APIs in the VxLAN driver. These APIs allow capable drivers to get a notification about the addition / deletion of FDB entries to / from the VxLAN's FDB. Subsequent patchset will add selftests (generic and mlxsw-specific), data plane learning, FDB extack and vetoing and support for VLAN-aware bridges (one VNI per VxLAN device model). v2: * Implement netif_is_vxlan() using rtnl_link_ops->kind (Jakub & Stephen) ==================== Signed-off-by: David S. Miller commit 1231e04f5bba47f87d0b690a2d58c771a59f93aa Author: Ido Schimmel Date: Wed Oct 17 08:53:32 2018 +0000 mlxsw: spectrum_switchdev: Add support for VxLAN encapsulation In the device, VxLAN encapsulation takes place in the FDB table where certain {MAC, FID} entries are programmed with an underlay unicast IP. MAC addresses that are not programmed in the FDB are flooded to the relevant local ports and also to a list of underlay unicast IPs that are programmed using the all zeros MAC address in the VxLAN driver. One difference between the hardware and software data paths is the fact that in the software data path there are two FDB lookups prior to the encapsulation of the packet. First in the bridge's FDB table using {MAC, VID} and another in the VxLAN's FDB table using {MAC, VNI}. Therefore, when a new VxLAN FDB entry is notified, it is only programmed to the device if there is a corresponding entry in the bridge's FDB table. Similarly, when a new bridge FDB entry pointing to the VxLAN device is notified, it is only programmed to the device if there is a corresponding entry in the VxLAN's FDB table. Note that the above scheme will result in a discrepancy between both data paths if only one FDB table is populated in the software data path. For example, if only the bridge's FDB is populated with an entry pointing to a VxLAN device, then a packet hitting the entry will only be flooded by the kernel to remote VTEPs whereas the device will also flood the packets to other local ports member in the VLAN. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller commit 1c30d1836aebdfa2b0a18952f0a906dcf49c66fc Author: Ido Schimmel Date: Wed Oct 17 08:53:31 2018 +0000 mlxsw: spectrum: Enable VxLAN enslavement to bridges Enslavement of VxLAN devices to offloaded bridges was never forbidden by mlxsw, but this patch makes sure the required configuration is performed in order to allow VxLAN encapsulation and decapsulation to take place in the device. The patch handles both the case where a VxLAN device is enslaved to an already offloaded bridge and the case where the first mlxsw port is enslaved to a bridge that already has VxLAN device configured. Invalid configurations are sanitized and an error string is returned via extack. Since encapsulation and decapsulation do not occur when the VxLAN device is down, the driver makes sure to enable / disable these functionalities based on NETDEV_PRE_UP and NETDEV_DOWN events. Note that NETDEV_PRE_UP is used in favor of NETDEV_UP, as the former allows to veto the operation, if necessary. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller commit e9ba0fbc7dd23a74e77960c98c988f59a1ff75aa Author: Ido Schimmel Date: Wed Oct 17 08:53:29 2018 +0000 bridge: switchdev: Allow clearing FDB entry offload indication Currently, an FDB entry only ceases being offloaded when it is deleted. This changes with VxLAN encapsulation. Devices capable of performing VxLAN encapsulation usually have only one FDB table, unlike the software data path which has two - one in the bridge driver and another in the VxLAN driver. Therefore, bridge FDB entries pointing to a VxLAN device are only offloaded if there is a corresponding entry in the VxLAN FDB. Allow clearing the offload indication in case the corresponding entry was deleted from the VxLAN FDB. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller commit 045a5a99141d96e6254664783e8afb4e298ae2c9 Author: Petr Machata Date: Wed Oct 17 08:53:27 2018 +0000 vxlan: Notify for each remote of a removed FDB entry When notifications are sent about FDB activity, and an FDB entry with several remotes is removed, the notification is sent only for the first destination. That makes it impossible to distinguish between the case where only this first remote is removed, and the one where the FDB entry is removed as a whole. Therefore send one notification for each remote of a removed FDB entry. Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 0efe11733356273d734cc2c5ab2dc6f5865cbeb6 Author: Petr Machata Date: Wed Oct 17 08:53:26 2018 +0000 vxlan: Support marking RDSTs as offloaded Offloaded bridge FDB entries are marked with NTF_OFFLOADED. Implement a similar mechanism for VXLAN, where a given remote destination can be marked as offloaded. To that end, introduce a new event, SWITCHDEV_VXLAN_FDB_OFFLOADED, through which the marking is communicated to the vxlan driver. To identify which RDST should be marked as offloaded, an switchdev_notifier_vxlan_fdb_info is passed to the listeners. The "offloaded" flag in that object determines whether the offloaded mark should be set or cleared. When sending offloaded FDB entries over netlink, mark them with NTF_OFFLOADED. Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 1941f1d6453a527ae8df59891da0319646608444 Author: Petr Machata Date: Wed Oct 17 08:53:24 2018 +0000 vxlan: Add vxlan_fdb_find_uc() for FDB querying A switchdev-capable driver that is aware of VXLAN may need to query VXLAN FDB. In the particular case of mlxsw, this functionality is limited to querying UC FDBs. Those being easier to deal with than the general case of RDST chain traversal, introduce an interface to query specifically UC FDBs: vxlan_fdb_find_uc(). Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 9a99735317866e821c75f957fc85c63d049d330c Author: Petr Machata Date: Wed Oct 17 08:53:22 2018 +0000 vxlan: Add switchdev notifications When offloading VXLAN devices, drivers need to know about events in VXLAN FDB database. Since VXLAN models a bridge, it is natural to distribute the VXLAN FDB notifications using the pre-existing switchdev notification mechanism. To that end, introduce two new notification types: SWITCHDEV_VXLAN_FDB_ADD_TO_DEVICE and SWITCHDEV_VXLAN_FDB_DEL_TO_DEVICE. Introduce a new function, vxlan_fdb_switchdev_call_notifiers() to send the new notifier types, and a struct switchdev_notifier_vxlan_fdb_info to communicate the details of the FDB entry under consideration. Invoke the new function from vxlan_fdb_notify(). Signed-off-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller commit 5ff4ff4fe8c4e7d0de1d837e489056f0c470667b Author: Ido Schimmel Date: Wed Oct 17 08:53:20 2018 +0000 net: Add netif_is_vxlan() Add the ability to determine whether a netdev is a VxLAN netdev by calling the above mentioned function that checks the netdev's rtnl_link_ops. This will allow modules to identify netdev events involving a VxLAN netdev and act accordingly. For example, drivers capable of VxLAN offload will need to configure the underlying device when a VxLAN netdev is being enslaved to an offloaded bridge. Convert nfp to use the newly introduced helper. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit 4cf178d7b9dc3c821ccc16b7acf9937b95a2b837 Author: Ido Schimmel Date: Wed Oct 17 08:53:19 2018 +0000 mlxsw: spectrum_router: Configure matching local routes for NVE decap When a local route that matches the source IP of an offloaded NVE tunnel is notified, the driver needs to program it to perform NVE decapsulation instead of merely trapping packets to the CPU. This patch complements "mlxsw: spectrum_router: Enable local routes promotion to perform NVE decap" where existing local routes were promoted to perform NVE decapsulation. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller commit 498790befb5f68213d418c2f064ca21168fdc8da Author: Ido Schimmel Date: Wed Oct 17 08:53:17 2018 +0000 mlxsw: spectrum_fid: Clear NVE configuration when destroying 802.1D FIDs 802.1D FIDs are used to represent VLAN-unaware bridges and currently this is the only type of FID that supports NVE configuration. Since the NVE tunnel device does not take a reference on the FID, it is possible for the FID to be destroyed when it still has NVE configuration. Therefore, when destroying the FID make sure to disable its NVE configuration. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller commit 369529115475e3c3eb520a8ace83c983535aef54 Author: Ido Schimmel Date: Wed Oct 17 08:53:16 2018 +0000 mlxsw: spectrum_nve: Implement VxLAN operations The common NVE core expects each encapsulation type to implement a certain set of operations that are specific to this type and the currently used ASIC. These operations include things such as the ability to determine whether a certain NVE configuration can be offloaded and ASIC-specific initialization for this type. Implement these operations for VxLAN on the Spectrum ASIC. Spectrum-2 support will be added by a future patchset. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller commit 6e6030bd5412182e064139821ffb09c373e46829 Author: Ido Schimmel Date: Wed Oct 17 08:53:14 2018 +0000 mlxsw: spectrum_nve: Implement common NVE core The Spectrum ASIC supports different types of NVE encapsulations (e.g., VxLAN, NVGRE) with more types to be supported by future ASICs. Despite being different, all these encapsulations share some common functionality such as the enablement of NVE encapsulation on a given filtering identifier (FID) and the addition of remote VTEPs to the linked-list of VTEPs that traffic should be flooded to. Implement this common core and allow different ASICs to register different operations for different encapsulation types. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller commit 28e450333d4d1328710e258d38793c61658d4c95 Author: Ido Schimmel Date: Wed Oct 17 08:53:12 2018 +0000 inet: Refactor INET_ECN_decapsulate() Drivers that support tunnel decapsulation (IPinIP or NVE) need to configure the underlying device to conform to the behavior outlined in RFC 6040 with respect to the ECN bits. This behavior is implemented by INET_ECN_decapsulate() which requires an skb to be passed where the ECN CE bit can be potentially set. Since these drivers do not need to mark an skb, but only configure the device to do so, factor out the business logic to __INET_ECN_decapsulate() and potentially perform the marking in INET_ECN_decapsulate(). This allows drivers to invoke __INET_ECN_decapsulate() and configure the device. Signed-off-by: Ido Schimmel Suggested-by: Petr Machata Reviewed-by: Petr Machata Signed-off-by: David S. Miller commit cca45e054ce55c06046a37bf4d3fd7c17edd57da Author: Ido Schimmel Date: Wed Oct 17 08:53:10 2018 +0000 vxlan: Export address checking functions Drivers that support VxLAN offload need to be able to sanitize the configuration of the VxLAN device and accept / reject its offload. For example, mlxsw requires that the local IP of the VxLAN device be set and that packets be flooded to unicast IP(s) and not to a multicast group. Expose the functions that perform such checks. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller commit 88782f75f93f62928c26d7e7e5c1649f85dd1469 Author: Ido Schimmel Date: Wed Oct 17 08:53:08 2018 +0000 mlxsw: spectrum_router: Allow querying VR ID based on table ID In the device, different VRFs (routing tables) are represented using different virtual routers (VRs) and thus the kernel's table IDs are mapped to VR IDs. Allow internal users of the IP router to query the VR ID based on a kernel table ID. This is needed - for example - when configuring the underlay VR where VxLAN encapsulated packets will undergo an L3 lookup. In this case, the kernel's table ID is derived from the VxLAN device's configuration. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller commit 0c69e0fcd3b1a5c73a3faaae2df76a3e0e74f122 Author: Ido Schimmel Date: Wed Oct 17 08:53:07 2018 +0000 mlxsw: spectrum_router: Enable local routes promotion to perform NVE decap When an NVE tunnel with an IP underlay (e.g., VxLAN) is configured the local route to the tunnel's source IP needs to be promoted to perform NVE decapsulation. Expose an API in the unicast IP router to promote / demote local routes. The case where a local route is configured after the creation of the NVE tunnel will be handled in a subsequent patch in the set. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller commit 564c6d727aca31735662b944311efda0d9465820 Author: Ido Schimmel Date: Wed Oct 17 08:53:05 2018 +0000 mlxsw: spectrum_fid: Add APIs to lookup FID without creating it Current APIs only allow looking for a FID and creating it in case it does not exist. With VxLAN, in case the bridge to which the VxLAN device was enslaved does not already have a corresponding FID, then it means that something went wrong that we need to be aware of. Add an API to look up a FID, but without creating it in order to catch above-mentioned situation. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller commit d3d19d4b8ca2efbcf4fc543ef5d2367999a89862 Author: Ido Schimmel Date: Wed Oct 17 08:53:03 2018 +0000 mlxsw: spectrum_fid: Allow setting and clearing NVE properties on FID In the device, the VNI and the list of remote VTEPs a packet should be flooded to is a property of the filtering identifier (FID). During encapsulation, the VNI is taken from the FID the packet was classified to. During decapsulation, the overlay packet is injected into a bridge and classified to a FID based on the VNI it came with. Allow NVE configuration for a FID. Currently, this is only supported with 802.1D FIDs which are used for VLAN-unaware bridges. However, NVE configuration is going to be supported with 802.1Q FIDs which is why the related fields are placed in the common FID struct. Since the device requires a 1:1 mapping between FID and VNI, the driver maintains a hashtable keyed by VNI and checks if the VNI is already associated with an existing FID. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller commit 711f76a328cbe5b49164bb14bcb593fa52102051 Author: Sebastian Andrzej Siewior Date: Wed Oct 17 19:05:53 2018 +0200 x86/mcelog: Remove one mce_helper definition Commit 5de97c9f6d85f ("x86/mce: Factor out and deprecate the /dev/mcelog driver") moved the old interface into one file including mce_helper definition as static and "extern". Remove one. Fixes: 5de97c9f6d85f ("x86/mce: Factor out and deprecate the /dev/mcelog driver") Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Borislav Petkov CC: "H. Peter Anvin" CC: Ingo Molnar CC: Thomas Gleixner CC: Tony Luck CC: linux-edac CC: x86-ml Link: http://lkml.kernel.org/r/20181017170554.18841-3-bigeasy@linutronix.de commit bf07aa730a04a375bc10d09df1e81357af1d4477 Author: Paul Blakey Date: Sun Sep 2 10:19:14 2018 +0300 net/mlx5e: Support offloading tc priorities and chains for eswitch flows Currently we fail when user specify a non-zero chain, this patch adds the support for it and tc priorities. To get to a new chain, use the tc goto action. Currently we support a fixed prio range 1-16, and chain range 0-3. Signed-off-by: Paul Blakey Reviewed-by: Or Gerlitz Signed-off-by: Saeed Mahameed commit 5dbe906ff1d5040013d30df1e8c769d28af7e0f9 Author: Paul Blakey Date: Wed Aug 1 11:09:10 2018 +0300 net/mlx5e: Use a slow path rule instead if vxlan neighbour isn't available When adding a vxlan tc rule, and a neighbour isn't available, we don't insert any rule to hardware. Once we enable offloading flows with multiple priorities, a packet that should have matched this rule will continue in hardware pipeline and might match a wrong one. This is unlike in tc software path where it will be matched and forwarded to the vxlan device (which will cause a ARP lookup eventually) and stop processing further tc filters. To address that, when when a neighbour isn't available (EAGAIN from attach_encap), or gets deleted, change the original action to be a forward to slow path instead. Neighbour update will restore the original action once the neighbour becomes available. This will be done atomically so at any given time we will have a the correct match. Signed-off-by: Paul Blakey Reviewed-by: Or Gerlitz Signed-off-by: Saeed Mahameed commit c92a0b9457a4e44e1e7f53785490a5482eedfe2d Author: Paul Blakey Date: Tue Sep 4 20:32:07 2018 +0300 net/mlx5: E-Switch, Enable setting goto slow path chain action A pre-step for the tc offloads code to use this when a neigh is not available for encap rules. Signed-off-by: Paul Blakey Reviewed-by: Or Gerlitz Signed-off-by: Saeed Mahameed commit 6d2a3ed011e84287c634ec2b6e4a856ce95fd729 Author: Or Gerlitz Date: Tue Sep 4 19:12:10 2018 +0300 net/mlx5e: Avoid duplicated code for tc offloads add/del fdb rule The code for adding/deleting fdb flow is repeated when user-space does flow add/del and when we add/del from the neigh update path - unify them to avoid the duplication. Signed-off-by: Or Gerlitz Signed-off-by: Paul Blakey Signed-off-by: Saeed Mahameed commit 42f7ad6760077e125eb7849c5499b7b77a54c2f3 Author: Paul Blakey Date: Sun Sep 2 09:23:24 2018 +0300 net/mlx5e: For TC offloads, always add new flow instead of appending the actions When replacing a tc flower rule, flower first requests to add the new rule (new action), then deletes the old one. But currently when asked to add a new tc flower flow, we append the actions (and counters to it). This can result in a fte with two flow counters or conflicting actions (drop and encap action) which firmware complains/errs about and isn't achieving what the user aimed for. Instead, insert the flow using the new no-append flag which will add a new HW rule, the old flow and rule will be deleted later by flower Signed-off-by: Paul Blakey Reviewed-by: Or Gerlitz Signed-off-by: Saeed Mahameed commit d5634fee245f9e92787e3a34ef621fc12b2cbf16 Author: Paul Blakey Date: Thu Sep 20 12:17:48 2018 +0200 net/mlx5: Add a no-append flow insertion mode If no-append flag is set, we will add a new FTE, instead of appending the actions of the inserted rule when the same match already exists. While here, move the has_flow_tag boolean indicator to be a flag too. This patch doesn't change any functionality. Signed-off-by: Paul Blakey Reviewed-by: Or Gerlitz Reviewed-by: Mark Bloch Signed-off-by: Saeed Mahameed commit e52c2802400831389c773bc5bb119ab4b96fde3b Author: Paul Blakey Date: Tue Jul 3 12:14:30 2018 +0300 net/mlx5: E-Switch, Add chains and priorities A chain is a group of priorities, so use the fdb parallel sub namespaces to implement chains, and a flow table for each priority in them. Because these namespaces are parallel and in series to the slow path fdb, the chains aren't connected to one another (but to the slow path), and one must use a explicit goto action to reach a different chain. Flow tables for the priorities will be created on demand and destroyed once not used. The Firmware has four pools of tables for sizes S/XS/M/L (4k, 64k, 1m, 4m). We maintain ghost copies of the pools occupancy. When a new table is to be created, we scan the pools from large to small and find the 1st table size which can be now created. When a table is destroyed, we update the relevant pool. Multi chain/prio isn't enabled yet by this patch, for now all flows will use the default chain 0, and prio 1. Signed-off-by: Paul Blakey Reviewed-by: Or Gerlitz Signed-off-by: Saeed Mahameed commit 482650069a2b84c9c87ea85b56d7b310c6005c6f Author: Or Gerlitz Date: Thu Sep 20 17:09:57 2018 +0200 net/mlx5: E-Switch, Have explicit API to delete fwd rules Be symmetric with the e-switch API to add rules which has a specific function to add fwd rules which are used as part of vport mirroring. This patch doesn't change any functionality. Signed-off-by: Or Gerlitz Reviewed-by: Paul Blakey Signed-off-by: Saeed Mahameed commit 328edb499f99126946845ece477c9c1afe8631af Author: Paul Blakey Date: Tue Jul 3 11:13:00 2018 +0300 net/mlx5: Split FDB fast path prio to multiple namespaces Towards supporting multi-chains and priorities, split the FDB fast path to multiple namespaces (sub namespaces), each with multiple priorities. This patch adds a new flow steering type, FS_TYPE_PRIO_CHAINS, which is like current FS_TYPE_PRIO, but may contain only namespaces, and those will be in parallel to one another in terms of managing of the flow tables connections inside them. Meaning, while searching for the next or previous flow table to connect for a new table inside such namespace we skip the parallel namespaces in the same level under the FS_TYPE_PRIO_CHAINS prio we originated from. We use this new type for splitting the fast path prio into multiple parallel namespaces, each containing normal prios. The prios inside them (and their tables) will be connected to one another, but not from one parallel namespace to another, instead the last prio in each namespace will be connected to the next prio in the containing FDB namespace, which is the slow path prio. Signed-off-by: Paul Blakey Acked-by: Or Gerlitz Signed-off-by: Saeed Mahameed commit b9aa0ba17af5afa13605eb6ea91f1974da97a2e2 Author: Paul Blakey Date: Thu May 31 11:50:23 2018 +0300 net/mlx5: Add cap bits for multi fdb encap If set, the firmware supports creating of flow tables with encap enabled while VFs are configured, if we already created one (restriction still applies on the first creation). Signed-off-by: Paul Blakey Reviewed-by: Or Gerlitz Signed-off-by: Saeed Mahameed commit a88780a9499a3bc845f4c8c020a006cd4c973070 Author: Roi Dayan Date: Tue May 15 12:08:12 2018 +0300 net/mlx5e: Split TC add rule path for nic vs e-switch Move to have clear separation on the code path to add nic vs e-switch flows. While here we break the code that deals with adding offloaded TC tool to few smaller stages, each on helper function. Besides getting us simpler and readable code, these are pre-steps for being able to have two HW flows serving one SW TC flow for some e-switch use cases. Signed-off-by: Roi Dayan Reviewed-by: Or Gerlitz Signed-off-by: Saeed Mahameed commit c83954abb221718e961802136078ba04d563cf3a Author: Rabie Loulou Date: Sun Oct 15 15:48:41 2017 +0300 net/mlx5e: Change return type of tc add flow functions Refactor the flow add utility functions to return err code instead of rule pointers. This will allow for simpler logic when one tc rule is duplicated to two HW rules in downstream patches. Signed-off-by: Rabie Loulou Signed-off-by: Shahar Klein Reviewed-by: Roi Dayan Reviewed-by: Or Gerlitz Signed-off-by: Saeed Mahameed commit 171c7625bef999848ee6032c6dde96e7330c4d15 Author: Mark Bloch Date: Wed Oct 3 00:03:35 2018 +0000 net/mlx5: Use flow counter IDs and not the wrapping cache object Currently, when a flow rule is created using the FS core layer, the caller has to pass the entire flow counter object and not just the counter HW handle (ID). This requires both the FS core and the caller to have knowledge about the inner implementation of the FS layer flow counters cache and limits the possible users. Move to use the counter ID across the place when dealing with flows. Doing this decoupling, now can we privatize the inner implementation of the flow counters. Signed-off-by: Mark Bloch Reviewed-by: Or Gerlitz Signed-off-by: Saeed Mahameed commit b8aee82250b7d90a32b11ba208656f52dbaca342 Author: Mark Bloch Date: Tue Oct 2 22:57:24 2018 +0000 net/mlx5: E-Switch, Get counters for offloaded flows from callers There's no real reason for the e-switch logic to manage the creation of counters for offloaded flows. The API already has the directive for the caller to denote they want to attach a counter to the created flow. As such, we go and move the management of flow counters to the mlx5e tc offload logic. This also lets us remove an inelegant interface where the FS layer had to provide a way to retrieve a counter from a flow rule. Signed-off-by: Mark Bloch Reviewed-by: Or Gerlitz Signed-off-by: Saeed Mahameed commit 186daf0c20507072e72a3c74db4ac50a5b6dae07 Merge: aadd4355918f 94a04d1d3d36 Author: Saeed Mahameed Date: Wed Oct 17 14:13:36 2018 -0700 Merge branch 'mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux into net-next mlx5 updates for both net-next and rdma-next * 'mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux: (21 commits) net/mlx5: Expose DC scatter to CQE capability bit net/mlx5: Update mlx5_ifc with DEVX UID bits net/mlx5: Set uid as part of DCT commands net/mlx5: Set uid as part of SRQ commands net/mlx5: Set uid as part of SQ commands net/mlx5: Set uid as part of RQ commands net/mlx5: Set uid as part of QP commands net/mlx5: Set uid as part of CQ commands net/mlx5: Rename incorrect naming in IFC file net/mlx5: Export packet reformat alloc/dealloc functions net/mlx5: Pass a namespace for packet reformat ID allocation net/mlx5: Expose new packet reformat capabilities {net, RDMA}/mlx5: Rename encap to reformat packet net/mlx5: Move header encap type to IFC header file net/mlx5: Break encap/decap into two separated flow table creation flags net/mlx5: Add support for more namespaces when allocating modify header net/mlx5: Export modify header alloc/dealloc functions net/mlx5: Add proper NIC TX steering flow tables support net/mlx5: Cleanup flow namespace getter switch logic net/mlx5: Add memic command opcode to command checker ... Signed-off-by: Saeed Mahameed commit 8e16695b4eb819881774b8c06eb164dc1fb74275 Author: James Zhu Date: Tue Oct 16 10:06:00 2018 -0400 drm/amdgpu/vcn:Fix uninitialized symbol error ret_code should be initialized with 0. The check of read/write ptr should be activate when UVD_POWER_STATUS_TILES is off. Signed-off-by: James Zhu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 594861215c834e4b59a30d4b794f6372717bc197 Author: Dan Williams Date: Mon Oct 15 12:57:31 2018 -0700 acpi, nfit: Further restrict userspace ARS start requests In addition to not allowing ARS start while the background thread is actively running, prevent ARS start while any scrub request is pending. This aligns the window for ARS start submission with the status of ARS reported via sysfs. Previously userspace could sneak its own ARS start requests in while sysfs reported -EBUSY. Reviewed-by: Dave Jiang Signed-off-by: Dan Williams commit 208983f099d975b5da27907245b4c4ea5146210e Author: Sasha Neftin Date: Thu Oct 11 10:17:36 2018 +0300 igc: Add watchdog Code completion, remove obsolete code Add watchdog methods Signed-off-by: Sasha Neftin Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher commit d3abaf43bab8d5b0a3c6b982100d9e2be96de4ad Author: Dan Williams Date: Sat Oct 13 20:32:17 2018 -0700 acpi, nfit: Fix Address Range Scrub completion tracking The Address Range Scrub implementation tried to skip running scrubs against ranges that were already scrubbed by the BIOS. Unfortunately that support also resulted in early scrub completions as evidenced by this debug output from nfit_test: nd_region region9: ARS: range 1 short complete nd_region region3: ARS: range 1 short complete nd_region region4: ARS: range 2 ARS start (0) nd_region region4: ARS: range 2 short complete ...i.e. completions without any indications that the scrub was started. This state of affairs was hard to see in the code due to the proliferation of state bits and mistakenly trying to track done state per-range when the completion is a global property of the bus. So, kill the four ARS state bits (ARS_REQ, ARS_REQ_REDO, ARS_DONE, and ARS_SHORT), and replace them with just 2 request flags ARS_REQ_SHORT and ARS_REQ_LONG. The implementation will still complete and reap the results of BIOS initiated ARS, but it will not attempt to use that information to affect the completion status of scrubbing the ranges from a Linux perspective. Instead, try to synchronously run a short ARS per range at init time and schedule a long scrub in the background. If ARS is busy with an ARS request, schedule both a short and a long scrub for when ARS returns to idle. This logic also satisfies the intent of what ARS_REQ_REDO was trying to achieve. The new rule is that the REQ flag stays set until the next successful ars_start() for that range. With the new policy that the REQ flags are not cleared until the next start, the implementation no longer loses requests as can be seen from the following log: nd_region region3: ARS: range 1 ARS start short (0) nd_region region9: ARS: range 1 ARS start short (0) nd_region region3: ARS: range 1 complete nd_region region4: ARS: range 2 ARS start short (0) nd_region region9: ARS: range 1 complete nd_region region9: ARS: range 1 ARS start long (0) nd_region region4: ARS: range 2 complete nd_region region3: ARS: range 1 ARS start long (0) nd_region region9: ARS: range 1 complete nd_region region3: ARS: range 1 complete nd_region region4: ARS: range 2 ARS start long (0) nd_region region4: ARS: range 2 complete ...note that the nfit_test emulated driver provides 2 buses, that is why some of the range indices are duplicated. Notice that each range now successfully completes a short and long scrub. Cc: Fixes: 14c73f997a5e ("nfit, address-range-scrub: introduce nfit_spa->ars_state") Fixes: cc3d3458d46f ("acpi/nfit: queue issuing of ars when an uc error...") Reported-by: Jacek Zloch Reported-by: Krzysztof Rusocki Reviewed-by: Dave Jiang Signed-off-by: Dan Williams commit f366d322aea782cf786aa821d5accdc1609f9e10 Author: David Howells Date: Thu Sep 6 10:19:30 2018 +0100 UAPI: ndctl: Remove use of PAGE_SIZE The macro PAGE_SIZE isn't valid outside of the kernel, so it should not appear in UAPI headers. Furthermore, the actual machine page size could theoretically change from an application's point of view if it's running in a container that gets migrated to another machine (say 4K/ppc64 to 64K/ppc64). Fixes: f2ba5a5baecf ("libnvdimm, namespace: make min namespace size 4K") Signed-off-by: David Howells Signed-off-by: Dan Williams commit 4eb8080143a9d9fd513bacc65b2466c57983aaae Author: Sasha Neftin Date: Thu Oct 11 10:17:34 2018 +0300 igc: Add setup link functionality Add link establishment methods Add auto negotiation methods Add read MAC address method Signed-off-by: Sasha Neftin Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher commit 9607871f37dc3e717639694b8d0dc738f2a68efc Author: David Howells Date: Thu Sep 6 10:19:24 2018 +0100 UAPI: ndctl: Fix g++-unsupported initialisation in headers The following code in the linux/ndctl header file: static inline const char *nvdimm_bus_cmd_name(unsigned cmd) { static const char * const names[] = { [ND_CMD_ARS_CAP] = "ars_cap", [ND_CMD_ARS_START] = "ars_start", [ND_CMD_ARS_STATUS] = "ars_status", [ND_CMD_CLEAR_ERROR] = "clear_error", [ND_CMD_CALL] = "cmd_call", }; if (cmd < ARRAY_SIZE(names) && names[cmd]) return names[cmd]; return "unknown"; } is broken in a number of ways: (1) ARRAY_SIZE() is not generally defined. (2) g++ does not support "non-trivial" array initialisers fully yet. (3) Every file that calls this function will acquire a copy of names[]. The same goes for nvdimm_cmd_name(). Fix all three by converting to a switch statement where each case returns a string. That way if cmd is a constant, the compiler can trivially reduce it and, if not, the compiler can use a shared lookup table if it thinks that is more efficient. A better way would be to remove these functions and their arrays from the header entirely. Signed-off-by: David Howells Signed-off-by: Dan Williams commit 5586838fe9ced0980e210b39d635ff3842297448 Author: Sasha Neftin Date: Thu Oct 11 10:17:31 2018 +0300 igc: Add code for PHY support Add PHY's ID support Add support for initialization, acquire and release of PHY Enable register access Signed-off-by: Sasha Neftin Signed-off-by: Alexander Duyck Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher commit ab4056126813c889ee6c8fb24ca8f75b84c981ab Author: Sasha Neftin Date: Thu Oct 11 10:17:28 2018 +0300 igc: Add NVM support Add code for NVM support and get MAC address, complete probe method. Signed-off-by: Sasha Neftin Signed-off-by: Alexander Duyck Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher commit c0071c7aa5fe0a6aa4cfc8426af893307ccd276d Author: Sasha Neftin Date: Thu Oct 11 10:17:26 2018 +0300 igc: Add HW initialization code Add code for hardware initialization and reset Add code for semaphore handling Signed-off-by: Sasha Neftin Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher commit 0507ef8a0372b80c30555bbeec7215f2cf874ecd Author: Sasha Neftin Date: Thu Oct 11 10:17:22 2018 +0300 igc: Add transmit and receive fastpath and interrupt handlers This patch adds support for allocating, configuring, and freeing Tx/Rx ring resources. With these changes in place the descriptor queues are in a state where they are ready to transmit or receive if provided buffers. This also adds the transmit and receive fastpath and interrupt handlers. With this code in place the network device is now able to send and receive frames over the network interface using a single queue. Signed-off-by: Sasha Neftin Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher commit 13b5b7fd6a4a96dffe604f25e7b64cfbd9520924 Author: Sasha Neftin Date: Thu Oct 11 10:17:19 2018 +0300 igc: Add support for Tx/Rx rings This change adds the defines and structures necessary to support both Tx and Rx descriptor rings. Signed-off-by: Sasha Neftin Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher commit 3df25e4c1e66a69097bde99990fb095b26125c82 Author: Sasha Neftin Date: Thu Oct 11 10:17:16 2018 +0300 igc: Add interrupt support This patch set adds interrupt support for the igc interfaces. Signed-off-by: Sasha Neftin Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher commit 77612720a2362230af726baa4149c40ec7a7fb05 Author: Sricharan R Date: Tue Aug 14 17:42:31 2018 +0530 clk: qcom: Add safe switch hook for krait mux clocks When the Hfplls are reprogrammed during the rate change, the primary muxes which are sourced from the same hfpll for higher frequencies, needs to be switched to the 'safe secondary mux' as the parent for that small window. This is done by registering a clk notifier for the muxes and switching to the safe parent in the PRE_RATE_CHANGE notifier and back to the original parent in the POST_RATE_CHANGE notifier. Signed-off-by: Sricharan R Tested-by: Craig Tatlor Signed-off-by: Stephen Boyd commit bf4503ccf321811192cb07f9711556237c3cf668 Author: Stephen Boyd Date: Tue Aug 14 17:42:30 2018 +0530 dt-bindings: clock: Document qcom,krait-cc The Krait clock controller controls the krait CPU and the L2 clocks consisting a primary mux and secondary mux. Add document for that. Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd Signed-off-by: Sricharan R Tested-by: Craig Tatlor Signed-off-by: Stephen Boyd commit bb5c4a85051e5e0be39c775b6df85521f2ae807d Author: Stephen Boyd Date: Tue Aug 14 17:42:29 2018 +0530 clk: qcom: Add Krait clock controller driver The Krait CPU clocks are made up of a primary mux and secondary mux for each CPU and the L2, controlled via cp15 accessors. For Kraits within KPSSv1 each secondary mux accepts a different aux source, but on KPSSv2 each secondary mux accepts the same aux source. Cc: Signed-off-by: Stephen Boyd Signed-off-by: Sricharan R Tested-by: Craig Tatlor Signed-off-by: Stephen Boyd commit 40e5ddf4f84869815129551f4a8cfc2c223ebeae Author: Stephen Boyd Date: Tue Aug 14 17:42:28 2018 +0530 dt-bindings: arm: Document qcom,kpss-gcc The ACC and GCC regions present in KPSSv1 contain registers to control clocks and power to each Krait CPU and L2. Documenting the bindings here. Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd Signed-off-by: Sricharan R Tested-by: Craig Tatlor Signed-off-by: Stephen Boyd commit 3ddc3564d3c9f097986bd4ccbe34152413811335 Author: Stephen Boyd Date: Tue Aug 14 17:42:27 2018 +0530 clk: qcom: Add KPSS ACC/GCC driver The ACC and GCC regions present in KPSSv1 contain registers to control clocks and power to each Krait CPU and L2. For CPUfreq purposes probe these devices and expose a mux clock that chooses between PXO and PLL8. Cc: Signed-off-by: Stephen Boyd Signed-off-by: Sricharan R Tested-by: Craig Tatlor Signed-off-by: Stephen Boyd commit 4d7dc77babfef1d6cb8fd825e2f17dc3384c3272 Author: Stephen Boyd Date: Tue Aug 14 17:42:26 2018 +0530 clk: qcom: Add support for Krait clocks The Krait clocks are made up of a series of muxes and a divider that choose between a fixed rate clock and dedicated HFPLLs for each CPU. Instead of using mmio accesses to remux parents, the Krait implementation exposes the remux control via cp15 registers. Support these clocks. Signed-off-by: Stephen Boyd Signed-off-by: Sricharan R Tested-by: Craig Tatlor [sboyd@kernel.org: Move hidden config to top outside of the visible qcom config zone so that menuconfig looks nice] Signed-off-by: Stephen Boyd commit 1f79131bfd512f322c16b58dca581ce39beafab9 Author: Stephen Boyd Date: Tue Aug 14 17:42:25 2018 +0530 clk: qcom: Add IPQ806X's HFPLLs Describe the HFPLLs present on IPQ806X devices. Signed-off-by: Stephen Boyd Signed-off-by: Sricharan R Tested-by: Craig Tatlor Signed-off-by: Stephen Boyd commit 72ad7207954dd622a662ba884dc6c30a820123f2 Author: Stephen Boyd Date: Tue Aug 14 17:42:24 2018 +0530 clk: qcom: Add MSM8960/APQ8064's HFPLLs Describe the HFPLLs present on MSM8960 and APQ8064 devices. Acked-by: Rob Herring (bindings) Signed-off-by: Stephen Boyd Signed-off-by: Sricharan R Tested-by: Craig Tatlor Signed-off-by: Stephen Boyd commit 1f924faa8b1e4789ecc06ed0dd58ca3487c89012 Author: Stephen Boyd Date: Tue Aug 14 17:42:23 2018 +0530 dt-bindings: clock: Document qcom,hfpll Adds bindings document for qcom,hfpll instantiated within the Krait processor subsystem as separate register region. Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd Signed-off-by: Sricharan R Tested-by: Craig Tatlor Signed-off-by: Stephen Boyd commit cb546b797a0da4dbb1a0c76a2a357921887b6189 Author: Stephen Boyd Date: Tue Aug 14 17:42:22 2018 +0530 clk: qcom: Add HFPLL driver On some devices (MSM8974 for example), the HFPLLs are instantiated within the Krait processor subsystem as separate register regions. Add a driver for these PLLs so that we can provide HFPLL clocks for use by the system. Cc: Signed-off-by: Stephen Boyd Signed-off-by: Sricharan R Tested-by: Craig Tatlor Signed-off-by: Stephen Boyd commit b3f2f10693aadeacf83ab5be03810941a4b77612 Author: Stephen Boyd Date: Tue Aug 14 17:42:21 2018 +0530 clk: qcom: Add support for High-Frequency PLLs (HFPLLs) HFPLLs are the main frequency source for Krait CPU clocks. Add support for changing the rate of these PLLs. Signed-off-by: Stephen Boyd Signed-off-by: Sricharan R Tested-by: Craig Tatlor Signed-off-by: Stephen Boyd commit 36d68f64c411e09788687d5919886aadeb92adca Author: Stephen Boyd Date: Tue Aug 14 17:42:20 2018 +0530 ARM: Add Krait L2 register accessor functions Krait CPUs have a handful of L2 cache controller registers that live behind a cp15 based indirection register. First you program the indirection register (l2cpselr) to point the L2 'window' register (l2cpdr) at what you want to read/write. Then you read/write the 'window' register to do what you want. The l2cpselr register is not banked per-cpu so we must lock around accesses to it to prevent other CPUs from re-pointing l2cpdr underneath us. Cc: Mark Rutland Cc: Russell King Acked-by: Bjorn Andersson Signed-off-by: Stephen Boyd Signed-off-by: Sricharan R Tested-by: Craig Tatlor Signed-off-by: Stephen Boyd commit c9a11c23ceb65db7ecc5735e7428311d70e74ba9 Author: Sasha Neftin Date: Thu Oct 11 10:17:13 2018 +0300 igc: Add netdev Now that we have the ability to configure the basic settings on the device we can start allocating and configuring a netdev for the interface. Signed-off-by: Sasha Neftin Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher commit 146740f9abc4976e4f0af1aa302efee1c699d2e4 Author: Sasha Neftin Date: Thu Oct 11 10:17:10 2018 +0300 igc: Add support for PF This patch adds the basic defines and structures needed by the PF for operation. With this it is possible to bring up the interface, but without being able to configure any of the filters on the interface itself. Add skeleton for a function pointers. Signed-off-by: Sasha Neftin Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher commit d89f88419f999f03af2282789f2d2eea6468c00a Author: Sasha Neftin Date: Thu Oct 11 10:17:08 2018 +0300 igc: Add skeletal frame for Intel(R) 2.5G Ethernet Controller support This patch adds the beginning framework onto which I am going to add the igc driver which supports the Intel(R) I225-LM/I225-V 2.5G Ethernet Controller. Signed-off-by: Sasha Neftin Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher commit a27ee74d0d51697ce1664faefc5834fade4fef49 Author: Sergei Shtylyov Date: Tue Oct 16 22:22:05 2018 +0300 spi: sh-msiof: document R8A779{7|8}0 bindings Document the R-Car V3{M|H} (R8A779{7|8}0) SoCs in the Renesas MSIOF bindings. Signed-off-by: Sergei Shtylyov Reviewed-by: Simon Horman Signed-off-by: Mark Brown commit 2eaa6e233091f51d8a629e423ad0bc080ffcb5d6 Author: Kuninori Morimoto Date: Wed Oct 17 01:55:57 2018 +0000 ASoC: rsnd: tidyup SSICR::SWSP for TDM R-Car datasheet is indicating that WS output settings of SSICR::SWSP is inverted on TDM mode from non TDM mode settings. But, it is meaning that TDM should use 0 here. Without this patch, sound input/output 1ch will be 2ch, 2ch will be 3ch ..., be jumbled on I2S + TDM settings. This patch fixup it. This patch is tested on R-Car H3 ulcb-kf board, SSI3/4 TDM sound. Signed-off-by: Kuninori Morimoto Signed-off-by: Mark Brown commit 6817d7593f3e3c8a9c11e7a07cb5646c70371f0a Author: Kuninori Morimoto Date: Wed Oct 17 01:55:37 2018 +0000 ASoC: rsnd: enable TDM settings for SSI parent Some SSIs are sharing each pins (= WS/CLK pin for playback/capture). Then, SSI parent needs control WS/CLK setting for SSI slave. In such case, SSI parent needs TDM settings if SSI slave is working as TDM mode. But it is not cared in current driver. It can't capture TDM sound without this patch if SSIs were pin sharing. This patch is tested on R-Car H3 ulcb-kf board, SSI3/4 with TDM sound. Signed-off-by: Kuninori Morimoto Signed-off-by: Mark Brown commit 4e9e07c5675706983ed649cfb92521a4d8aa1d6d Author: Kuninori Morimoto Date: Wed Oct 17 01:54:33 2018 +0000 ASoC: pcm3168a: add hw constraint for capture channel LEFT_J / I2S only can use TDM. commit 594680ea4a394 ("ASoC: pcm3168a: add hw constraint for channel") commit 3809688980205 ("ASoC: pcm3168a: add HW constraint for non RIGHT_J") added channel constraint for it, but, it was only for playback. This patch adds constraint for capture. Signed-off-by: Kuninori Morimoto Signed-off-by: Mark Brown commit fce9ec954a8af7e04cbf5b9daa8bec9c1df5cfe6 Author: Daniel Mack Date: Wed Oct 17 13:37:03 2018 +0200 ASoC: sta32x: Add support for XTI clock The STA32x chips feature an XTI clock input that needs to be stable before the reset signal is released. Therefore, the chip driver needs to get a handle to the clock. Instead of relying on other parts of the system to enable the clock, let the codec driver grab a handle itself. In order to keep existing boards working, clock support is made optional. Signed-off-by: Daniel Mack Signed-off-by: Mark Brown commit 1e3cb6c321be2e5295dcaa94c2bf42a43a47a067 Author: David Lin Date: Fri Sep 28 11:10:04 2018 +0800 ASoC: nau8822: new codec driver Add driver for NAU88C22. Signed-off-by: David Lin Signed-off-by: Mark Brown commit a85227da2dcc291b762c8482a505bc7d0d2d4b07 Author: Marcel Ziswiler Date: Tue Oct 16 12:47:29 2018 +0200 ASoC: tegra_sgtl5000: fix device_node refcounting Similar to the following: commit 4321723648b0 ("ASoC: tegra_alc5632: fix device_node refcounting") commit 7c5dfd549617 ("ASoC: tegra: fix device_node refcounting") Signed-off-by: Marcel Ziswiler Acked-by: Jon Hunter Signed-off-by: Mark Brown commit 885882a493c5c53b70bb71c920dc8a3d3ee006c6 Author: Lubomir Rintel Date: Wed Oct 10 18:38:24 2018 +0200 dt-bindings: Add OLPC vendor prefix One Laptop Per Child is a non-profit that produced the XO series of eductional laptops for children. Signed-off-by: Lubomir Rintel Signed-off-by: Rob Herring commit 341ce3563e52d6adc69095f65d57d2c9b8c68a65 Author: Anson Huang Date: Fri Aug 31 15:53:17 2018 +0800 clk: imx6q: add mmdc0 ipg clock i.MX6Q has MMDC0 ipg clock in CCM CCGR, add it into clock tree for clock management. Signed-off-by: Anson Huang Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd commit 09d47620d0f839bc4bf3d3061aabee0c9539407a Author: Anson Huang Date: Fri Aug 31 15:53:16 2018 +0800 clk: imx6sl: add mmdc ipg clocks i.MX6SL has MMDC0 and MMDC1 ipg clock in CCM CCGR, add them into clock tree for clock management. Signed-off-by: Anson Huang Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd commit aac7ff2048a881975fceb41ae6545730dee310d2 Author: Anson Huang Date: Fri Aug 31 15:53:15 2018 +0800 clk: imx6sll: add mmdc1 ipg clock i.MX6SLL has MMDC1 ipg clock in CCM CCGR, add it into clock tree for clock management. Signed-off-by: Anson Huang Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd commit 891f30bf603ba49ac1cf1778fedef4e9d4ee3483 Author: Anson Huang Date: Fri Aug 31 15:53:14 2018 +0800 clk: imx6sx: add mmdc1 ipg clock i.MX6SX has MMDC1 ipg clock in CCM CCGR, add it into clock tree for clock management. Signed-off-by: Anson Huang Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd commit acc4f98d44bfc7cccfcb866e991db755f2062e6f Author: Anson Huang Date: Fri Aug 31 15:53:13 2018 +0800 clk: imx6ul: add mmdc1 ipg clock i.MX6UL has MMDC1 ipg clock in CCM CCGR, add it into clock tree for clock management. Signed-off-by: Anson Huang Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd commit f110176633d74bbac1f80ab9b9c6b83ea3e1cc23 Author: Dan Williams Date: Wed Oct 17 10:47:19 2018 -0700 tools/testing/nvdimm: Populate dirty shutdown data Allow the unit tests to verify the retrieval of the dirty shutdown count via smart commands, and allow the driver-load-time retrieval of the smart health payload to be simulated by nfit_test. Reviewed-by: Keith Busch Signed-off-by: Dan Williams commit 62061d357c7f40dad558414895a182e70391513f Author: Alexandre Belloni Date: Tue Oct 16 16:21:53 2018 +0200 clk: at91: move DT compatibility code to its own file Move all the DT backward compatibility code to its own file so it can be deleted later. Signed-off-by: Alexandre Belloni Signed-off-by: Stephen Boyd commit ecd0bf3377c809c98d69c8bc989344f085980bed Author: Alexandre Belloni Date: Tue Oct 16 16:21:52 2018 +0200 clk: at91: add at91sam9rl PMC driver Add a driver for the PMC clocks of the at91sam9rl SoC. Signed-off-by: Alexandre Belloni [sboyd@kernel.org: Make i signed to fix signedness bug] Signed-off-by: Stephen Boyd commit 1eabdc2f9dd8f1bca1b985fd2b1243be836b30ad Author: Alexandre Belloni Date: Tue Oct 16 16:21:51 2018 +0200 clk: at91: add at91sam9x5 PMCs driver Add a driver for the PMC clocks of the at91sam9x5 SoCs Signed-off-by: Alexandre Belloni [sboyd@kernel.org: Make i signed to fix signedness bug] Signed-off-by: Stephen Boyd commit c8923236a2894cc4b27010639e98e1a3086c0987 Author: Alexandre Belloni Date: Tue Oct 16 16:21:50 2018 +0200 clk: at91: add at91sam9260 PMC driver Add a driver for the PMC clocks of the at91sam9260, at91sam9261, at91am9263 and at91sam9g20 SoCs. Signed-off-by: Alexandre Belloni [sboyd@kernel.org: Make i signed to fix signedness bug] Signed-off-by: Stephen Boyd commit a2038077de9a9e35f14a72612e2885193d4490d4 Author: Alexandre Belloni Date: Tue Oct 16 16:21:49 2018 +0200 clk: at91: add sama5d2 PMC driver Add a driver for the PMC clocks of the sama5d2 Signed-off-by: Alexandre Belloni [sboyd@kernel.org: Make i signed to fix signedness bug] Signed-off-by: Stephen Boyd commit 084b696bb509d5943d94e282a4e349426ac85dc6 Author: Alexandre Belloni Date: Tue Oct 16 16:21:48 2018 +0200 clk: at91: add sama5d4 pmc driver Add a driver for the PMC clocks of the sama5d4 Signed-off-by: Alexandre Belloni [sboyd@kernel.org: Make i signed to fix signedness bug] Signed-off-by: Stephen Boyd commit d387ff5427be6b93e11986c6ab6d7a8e6031e976 Author: Alexandre Belloni Date: Tue Oct 16 16:21:47 2018 +0200 clk: at91: add new DT lookup function Add a new DT lookup function to lookup for PMC clocks. Note that the #ifndef AT91_PMC_MOSCS section will be removed once all the platforms are converted. Signed-off-by: Alexandre Belloni Acked-by: Rob Herring Signed-off-by: Stephen Boyd commit d425ad81eacda2df98f063c4ca93b0f5a4690206 Author: Alexandre Belloni Date: Tue Oct 16 16:21:46 2018 +0200 dt-bindings: clk: at91: Document new PMC binding Document the new PMC binding with only one PMC node for all the PMC clocks instead of one node per clock as this proved to be problematic. Reviewed-by: Rob Herring Signed-off-by: Alexandre Belloni Signed-off-by: Stephen Boyd commit b00cd8e41979267e067ad858b62b5e8b1b94c945 Author: Alexandre Belloni Date: Tue Oct 16 16:21:45 2018 +0200 clk: at91: add pmc_data struct and helpers Add a new strut to handle references to all the PMC clocks and implement allocation/free helpers. Signed-off-by: Alexandre Belloni Signed-off-by: Stephen Boyd commit b2e39dc0bb8107341f6f704472e79fd32d0cef25 Author: Alexandre Belloni Date: Tue Oct 16 16:21:44 2018 +0200 clk: at91: allow clock registration from C code Remove static keyword to allow functions to be used from other units. Also move some struct and function declarations to pmc.h Signed-off-by: Alexandre Belloni [sboyd@kernel.org: Include pmc.h] Signed-off-by: Stephen Boyd commit c1e4580a1d0ff510d56268c1fc7fcfeec366fe70 Author: Alexandre Belloni Date: Tue Oct 16 16:21:43 2018 +0200 clk: at91: generated: set audio_pll_allowed in at91_clk_register_generated() Set gck->audio_pll_allowed in at91_clk_register_generated. This makes it easier to do it from code that is not parsing device tree. Also, this fixes an issue where the resulting clk_hw can be dereferenced before being tested for error. Fixes: 1a1a36d72e3d ("clk: at91: clk-generated: make gclk determine audio_pll rate") Signed-off-by: Alexandre Belloni Signed-off-by: Stephen Boyd commit 08979ee55a9f2983265bc46b237576fc7986d56d Author: Alexandre Belloni Date: Tue Oct 16 16:21:42 2018 +0200 clk: at91: audio-pll: separate registration from DT parsing Separate registration out of of_sama5d2_clk_audio_pll*_setup to allow other code to use it. Signed-off-by: Alexandre Belloni [sboyd@kernel.org: Include pmc.h] Signed-off-by: Stephen Boyd commit 0ead11181fe0c9538b185e46a494df21dc7de23a Author: Dan Williams Date: Wed Sep 26 10:47:15 2018 -0700 acpi, nfit: Collect shutdown status Some NVDIMMs, in addition to providing an indication of whether the previous shutdown was clean, also provide a running count of lifetime dirty-shutdown events for the device. In anticipation of this functionality appearing on more devices arrange for the nfit driver to retrieve / cache this data at DIMM discovery time, and export it via sysfs. Reviewed-by: Keith Busch Signed-off-by: Dan Williams commit da5a3ce66b8bb51b0ea8a89f42aac153903f90fb Author: Mark Rutland Date: Wed Oct 17 17:42:10 2018 +0100 KVM: arm64: Fix caching of host MDCR_EL2 value At boot time, KVM stashes the host MDCR_EL2 value, but only does this when the kernel is not running in hyp mode (i.e. is non-VHE). In these cases, the stashed value of MDCR_EL2.HPMN happens to be zero, which can lead to CONSTRAINED UNPREDICTABLE behaviour. Since we use this value to derive the MDCR_EL2 value when switching to/from a guest, after a guest have been run, the performance counters do not behave as expected. This has been observed to result in accesses via PMXEVTYPER_EL0 and PMXEVCNTR_EL0 not affecting the relevant counters, resulting in events not being counted. In these cases, only the fixed-purpose cycle counter appears to work as expected. Fix this by always stashing the host MDCR_EL2 value, regardless of VHE. Cc: Christopher Dall Cc: James Morse Cc: Will Deacon Cc: stable@vger.kernel.org Fixes: 1e947bad0b63b351 ("arm64: KVM: Skip HYP setup when already running in HYP") Tested-by: Robin Murphy Signed-off-by: Mark Rutland Signed-off-by: Marc Zyngier commit 0a9df0df17a011fa4d17277a8c8dd662668c6426 Author: Lu Fengqi Date: Mon Oct 15 14:25:38 2018 +0800 btrfs: delayed-ref: extract find_first_ref_head from find_ref_head The find_ref_head shouldn't return the first entry even if no exact match is found. So move the hidden behavior to higher level. Besides, remove the useless local variables in the btrfs_select_ref_head. Reviewed-by: Nikolay Borisov Signed-off-by: Lu Fengqi [ reformat comment ] Signed-off-by: David Sterba commit c6925093d0b28329ad3a486f5b0345c2c192ae9a Author: Logan Gunthorpe Date: Thu Oct 4 15:27:47 2018 -0600 nvmet: Optionally use PCI P2P memory Create a configfs attribute in each nvme-fabrics namespace to enable P2P memory use. The attribute may be enabled (with a boolean) or a specific P2P device may be given (with the device's PCI name). When enabled, the namespace will ensure the underlying block device supports P2P and is compatible with any specified P2P device. If no device was specified it will ensure there is compatible P2P memory somewhere in the system. Enabling a namespace with P2P memory will fail with EINVAL (and an appropriate dmesg error) if any of these conditions are not met. Once a controller is set up on a specific port, the P2P device to use for each namespace will be found and stored in a radix tree by namespace ID. When memory is allocated for a request, the tree is used to look up the P2P device to allocate memory against. If no device is in the tree (because no appropriate device was found), or if allocation of P2P memory fails, fall back to using regular memory. Signed-off-by: Stephen Bates Signed-off-by: Steve Wise [hch: partial rewrite of the initial code] Signed-off-by: Christoph Hellwig Signed-off-by: Logan Gunthorpe Signed-off-by: Bjorn Helgaas commit 5b2322e48c978fd91d50873491b1c3b0a3b0266b Author: Logan Gunthorpe Date: Thu Oct 4 15:27:46 2018 -0600 nvmet: Introduce helper functions to allocate and free request SGLs Add helpers to allocate and free the SGL in a struct nvmet_req: int nvmet_req_alloc_sgl(struct nvmet_req *req) void nvmet_req_free_sgl(struct nvmet_req *req) This will be expanded in a future patch to implement peer-to-peer memory DMAs and should be common with all target drivers. The new helpers are used in nvmet-rdma. Seeing we use req.transfer_len as the length of the SGL it is set earlier and cleared on any error. It also seems to be unnecessary to accumulate the length as the map_sgl functions should only ever be called once per request. Signed-off-by: Logan Gunthorpe Signed-off-by: Bjorn Helgaas Reviewed-by: Christoph Hellwig Acked-by: Sagi Grimberg commit e0596ab2900dfa64c0538e4aef8eec3c6f0f38eb Author: Logan Gunthorpe Date: Thu Oct 4 15:27:44 2018 -0600 nvme-pci: Add support for P2P memory in requests For P2P requests, we must use the pci_p2pmem_map_sg() function instead of the dma_map_sg functions. With that, we can then indicate PCI_P2P support in the request queue. For this, we create an NVME_F_PCI_P2P flag which tells the core to set QUEUE_FLAG_PCI_P2P in the request queue. Signed-off-by: Logan Gunthorpe Signed-off-by: Bjorn Helgaas Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Reviewed-by: Keith Busch commit 0f238ff5cc92554fe8ddc6c3776386f31a4d38fa Author: Logan Gunthorpe Date: Thu Oct 4 15:27:43 2018 -0600 nvme-pci: Use PCI p2pmem subsystem to manage the CMB Register the CMB buffer as p2pmem and use the appropriate allocation functions to create and destroy the IO submission queues. If the CMB supports WDS and RDS, publish it for use as P2P memory by other devices. Kernels without CONFIG_PCI_P2PDMA will also no longer support NVMe CMB. However, seeing the main use-cases for the CMB is P2P operations, this seems like a reasonable dependency. We drop the __iomem safety on the buffer seeing that, by convention, it's safe to directly access memory mapped by memremap()/devm_memremap_pages(). Architectures where this is not safe will not be supported by memremap() and therefore will not support PCI P2P and have no support for CMB. Signed-off-by: Logan Gunthorpe Signed-off-by: Bjorn Helgaas Reviewed-by: Keith Busch Reviewed-by: Christoph Hellwig commit 50b7d22079f74571a0fa73420586a7ad1ffebe2f Author: Logan Gunthorpe Date: Thu Oct 4 15:27:42 2018 -0600 IB/core: Ensure we map P2P memory correctly in rdma_rw_ctx_[init|destroy]() In order to use PCI P2P memory the pci_p2pmem_map_sg() function must be called to map the correct PCI bus address. To do this, check the first page in the scatter list to see if it is P2P memory or not. At the moment, scatter lists that contain P2P memory must be homogeneous so if the first page is P2P the entire SGL should be P2P. Signed-off-by: Logan Gunthorpe Signed-off-by: Bjorn Helgaas Reviewed-by: Christoph Hellwig Reviewed-by: Sagi Grimberg commit 49d92c0dd64ae769c2d67fe27ac260ae31259ba6 Author: Logan Gunthorpe Date: Thu Oct 4 15:27:41 2018 -0600 block: Add PCI P2P flag for request queue Add QUEUE_FLAG_PCI_P2P, meaning a driver's request queue supports targeting P2P memory. This will be used by P2P providers and orchestrators (in subsequent patches) to ensure block devices can support P2P memory before submitting P2P-backed pages to submit_bio(). Signed-off-by: Logan Gunthorpe Signed-off-by: Bjorn Helgaas Reviewed-by: Christoph Hellwig Acked-by: Jens Axboe commit e4f7a9480337543efaae137536ed686d0cd48ff7 Author: Logan Gunthorpe Date: Thu Oct 4 15:27:40 2018 -0600 PCI/P2PDMA: Add P2P DMA driver writer's documentation Add a restructured text file describing how to write drivers with support for P2P DMA transactions. The document describes how to use the APIs that were added in the previous few commits. Also adds an index for the PCI documentation tree even though this is the only PCI document that has been converted to restructured text at this time. Signed-off-by: Logan Gunthorpe Signed-off-by: Bjorn Helgaas Cc: Jonathan Corbet commit fcc78f9c22474d60c65d522e50ea07006ec1b9fc Author: Logan Gunthorpe Date: Thu Oct 4 15:27:39 2018 -0600 docs-rst: Add a new directory for PCI documentation Add a new directory in the driver API guide for PCI-specific documentation. This is in preparation for adding a new PCI P2P DMA driver writers guide which will go in this directory. Signed-off-by: Logan Gunthorpe Signed-off-by: Bjorn Helgaas Cc: Jonathan Corbet Cc: Mauro Carvalho Chehab Cc: Greg Kroah-Hartman Cc: Vinod Koul Cc: Linus Walleij Cc: Logan Gunthorpe Cc: Thierry Reding Cc: Sanyog Kale Cc: Sagar Dharia commit 2d7bc010f450d803db9fed1a25da6144ff6140d3 Author: Logan Gunthorpe Date: Thu Oct 4 15:27:38 2018 -0600 PCI/P2PDMA: Introduce configfs/sysfs enable attribute helpers Users of the P2PDMA infrastructure will typically need a way for the user to tell the kernel to use P2P resources. Typically this will be a simple on/off boolean operation but sometimes it may be desirable for the user to specify the exact device to use for the P2P operation. Add new helpers for attributes which take a boolean or a PCI device. Any boolean as accepted by strtobool() turn P2P on or off (such as 'y', 'n', '1', '0', etc). Specifying a full PCI device name/BDF will select the specific device. Signed-off-by: Logan Gunthorpe Signed-off-by: Bjorn Helgaas Reviewed-by: Christoph Hellwig commit 977196b8c5b20b901acb0042579e30d7fa55790a Author: Logan Gunthorpe Date: Thu Oct 4 15:27:37 2018 -0600 PCI/P2PDMA: Add PCI p2pmem DMA mappings to adjust the bus offset The DMA address used when mapping PCI P2P memory must be the PCI bus address. Thus, introduce pci_p2pmem_map_sg() to map the correct addresses when using P2P memory. Memory mapped in this way does not need to be unmapped and thus if we provided pci_p2pmem_unmap_sg() it would be empty. This breaks the expected balance between map/unmap but was left out as an empty function doesn't really provide any benefit. In the future, if this call becomes necessary it can be added without much difficulty. For this, we assume that an SGL passed to these functions contain all P2P memory or no P2P memory. Signed-off-by: Logan Gunthorpe Signed-off-by: Bjorn Helgaas Reviewed-by: Christoph Hellwig commit cbb8ca69fcbb2c82f70abcbb75b6ea8579236210 Author: Logan Gunthorpe Date: Thu Oct 4 15:27:36 2018 -0600 PCI/P2PDMA: Add sysfs group to display p2pmem stats Add a sysfs group to display statistics about P2P memory that is registered in each PCI device. Attributes in the group display the total amount of P2P memory, the amount available and whether it is published or not. Signed-off-by: Logan Gunthorpe Signed-off-by: Bjorn Helgaas Reviewed-by: Christoph Hellwig commit 1e58e5e59148916fa43444a406335a990783fb78 Author: Paolo Bonzini Date: Wed Oct 17 00:55:22 2018 +0200 KVM: VMX: enable nested virtualization by default With live migration support and finally a good solution for exception event injection, nested VMX should be ready for having a stable userspace ABI. The results of syzkaller fuzzing are not perfect but not horrible either (and might be partially due to running on GCE, so that effectively we're testing three-level nesting on a fork of upstream KVM!). Enabling it by default seems like a nice way to conclude the 4.20 pull request. :) Unfortunately, enabling nested SVM in 2009 (commit 4b6e4dca701) was a bit premature. However, until live migration support is in place we can reasonably expect that it does not offer much in terms of ABI guarantees. Therefore we are still in time to break things and conform as much as possible to the interface used for VMX. Suggested-by: Jim Mattson Suggested-by: Liran Alon Reviewed-by: Liran Alon Celebrated-by: Liran Alon Celebrated-by: Wanpeng Li Celebrated-by: Wincy Van Signed-off-by: Paolo Bonzini commit 43ce76ce731ff7f9cff51124fee738018c18a864 Author: Uros Bizjak Date: Wed Oct 17 16:46:57 2018 +0200 KVM/x86: Use 32bit xor to clear registers in svm.c x86_64 zero-extends 32bit xor operation to a full 64bit register. Also add a comment and remove unnecessary instruction suffix in vmx.c Signed-off-by: Uros Bizjak Signed-off-by: Paolo Bonzini commit c4f55198c7c2b87909b166ffc2f6b68d9af6766c Author: Jim Mattson Date: Tue Oct 16 14:29:24 2018 -0700 kvm: x86: Introduce KVM_CAP_EXCEPTION_PAYLOAD This is a per-VM capability which can be enabled by userspace so that the faulting linear address will be included with the information about a pending #PF in L2, and the "new DR6 bits" will be included with the information about a pending #DB in L2. With this capability enabled, the L1 hypervisor can now intercept #PF before CR2 is modified. Under VMX, the L1 hypervisor can now intercept #DB before DR6 and DR7 are modified. When userspace has enabled KVM_CAP_EXCEPTION_PAYLOAD, it should generally provide an appropriate payload when injecting a #PF or #DB exception via KVM_SET_VCPU_EVENTS. However, to support restoring old checkpoints, this payload is not required. Note that bit 16 of the "new DR6 bits" is set to indicate that a debug exception (#DB) or a breakpoint exception (#BP) occurred inside an RTM region while advanced debugging of RTM transactional regions was enabled. This is the reverse of DR6.RTM, which is cleared in this scenario. This capability also enables exception.pending in struct kvm_vcpu_events, which allows userspace to distinguish between pending and injected exceptions. Reported-by: Jim Mattson Suggested-by: Paolo Bonzini Signed-off-by: Jim Mattson Signed-off-by: Paolo Bonzini commit f10c729ff965283d2086aa03d139dcf82da86a96 Author: Jim Mattson Date: Tue Oct 16 14:29:23 2018 -0700 kvm: vmx: Defer setting of DR6 until #DB delivery When exception payloads are enabled by userspace (which is not yet possible) and a #DB is raised in L2, defer the setting of DR6 until later. Under VMX, this allows the L1 hypervisor to intercept the fault before DR6 is modified. Under SVM, DR6 is modified before L1 can intercept the fault (as has always been the case with DR7). Note that the payload associated with a #DB exception includes only the "new DR6 bits." When the payload is delievered, DR6.B0-B3 will be cleared and DR6.RTM will be set prior to merging in the new DR6 bits. Also note that bit 16 in the "new DR6 bits" is set to indicate that a debug exception (#DB) or a breakpoint exception (#BP) occurred inside an RTM region while advanced debugging of RTM transactional regions was enabled. Though the reverse of DR6.RTM, this makes the #DB payload field compatible with both the pending debug exceptions field under VMX and the exit qualification for #DB exceptions under VMX. Reported-by: Jim Mattson Suggested-by: Paolo Bonzini Signed-off-by: Jim Mattson Signed-off-by: Paolo Bonzini commit da998b46d244767505e41d050dcac5e4d03ba96f Author: Jim Mattson Date: Tue Oct 16 14:29:22 2018 -0700 kvm: x86: Defer setting of CR2 until #PF delivery When exception payloads are enabled by userspace (which is not yet possible) and a #PF is raised in L2, defer the setting of CR2 until the #PF is delivered. This allows the L1 hypervisor to intercept the fault before CR2 is modified. For backwards compatibility, when exception payloads are not enabled by userspace, kvm_multiple_exception modifies CR2 when the #PF exception is raised. Reported-by: Jim Mattson Suggested-by: Paolo Bonzini Signed-off-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 91e86d225ef3da80d33a8fd7695316c31c0810c9 Author: Jim Mattson Date: Tue Oct 16 14:29:21 2018 -0700 kvm: x86: Add payload operands to kvm_multiple_exception kvm_multiple_exception now takes two additional operands: has_payload and payload, so that updates to CR2 (and DR6 under VMX) can be delayed until the exception is delivered. This is necessary to properly emulate VMX or SVM hardware behavior for nested virtualization. The new behavior is triggered by vcpu->kvm->arch.exception_payload_enabled, which will (later) be set by a new per-VM capability, KVM_CAP_EXCEPTION_PAYLOAD. Reported-by: Jim Mattson Suggested-by: Paolo Bonzini Signed-off-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 59073aaf6de0d2dacc2603cee6d1d6cd5592ac08 Author: Jim Mattson Date: Tue Oct 16 14:29:20 2018 -0700 kvm: x86: Add exception payload fields to kvm_vcpu_events The per-VM capability KVM_CAP_EXCEPTION_PAYLOAD (to be introduced in a later commit) adds the following fields to struct kvm_vcpu_events: exception_has_payload, exception_payload, and exception.pending. With this capability set, all of the details of vcpu->arch.exception, including the payload for a pending exception, are reported to userspace in response to KVM_GET_VCPU_EVENTS. With this capability clear, the original ABI is preserved, and the exception.injected field is set for either pending or injected exceptions. When userspace calls KVM_SET_VCPU_EVENTS with KVM_CAP_EXCEPTION_PAYLOAD clear, exception.injected is no longer translated to exception.pending. KVM_SET_VCPU_EVENTS can now only establish a pending exception when KVM_CAP_EXCEPTION_PAYLOAD is set. Reported-by: Jim Mattson Suggested-by: Paolo Bonzini Signed-off-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 61170a9373ee3cc8e86b033a34d71c16c13473c5 Author: Alexandre Belloni Date: Tue Oct 16 16:21:41 2018 +0200 clk: at91: h32mx: separate registration from DT parsing Separate registration out of of_sama5d4_clk_h32mx_setup to allow other code to use it. Signed-off-by: Alexandre Belloni Signed-off-by: Stephen Boyd commit 6d631027b807cf2721dd38de4711a2528a5e0008 Author: Alexandre Belloni Date: Tue Oct 16 16:21:40 2018 +0200 clk: at91: generated: SSCs don't have a gclk As the SSCs don't have gclk, don't check for their ID to allow them to set the audio pll rate. Signed-off-by: Alexandre Belloni Signed-off-by: Stephen Boyd commit 7fa75007b7d7421aea59ff2b12ab1bd65a5abfa6 Author: Alexandre Belloni Date: Tue Oct 16 16:21:39 2018 +0200 clk: at91: audio-pll: fix audio pmc type The allocation for the audio pmc is using the size of struct clk_audio_pad instead of struct clk_audio_pmc. This works fine because the former is larger than the latter but it is safer to be correct. Fixes: ("0865805d82d4 clk: at91: add audio pll clock drivers") Signed-off-by: Alexandre Belloni Signed-off-by: Stephen Boyd commit 4917fb90eec7c26dac1497ada3bd4a325f670fcc Author: Lubomir Rintel Date: Mon Sep 10 14:01:44 2018 +0200 clk: mmp2: fix the clock id for sdh2_clk and sdh3_clk A typo that makes it impossible to get the correct clocks for MMP2_CLK_SDH2 and MMP2_CLK_SDH3. Signed-off-by: Lubomir Rintel Fixes: 1ec770d92a62 ("clk: mmp: add mmp2 DT support for clock driver") Signed-off-by: Stephen Boyd commit a60109dc9a954ef9eddba6577e2d2e9e7952e487 Author: Yonatan Cohen Date: Wed Oct 10 09:25:16 2018 +0300 IB/mlx5: Add support for extended atomic operations Extended atomic operations cmp&swp and fetch&add is a Mellanox feature extending the standard atomic operation to use, varied operand sizes, as apposed to normal atomic operation that use an 8 byte operand only. Extended atomics allows masking the results and arguments. This patch configures QP to support extended atomic operation with the maximum size possible, as exposed by HCA capabilities. Signed-off-by: Yonatan Cohen Reviewed-by: Guy Levi Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford commit 5ce555578e0919237fa4bda92b4670e2dd176f85 Author: Filipe Manana Date: Fri Oct 12 10:03:55 2018 +0100 Btrfs: fix deadlock when writing out free space caches When writing out a block group free space cache we can end deadlocking with ourselves on an extent buffer lock resulting in a warning like the following: [245043.379979] WARNING: CPU: 4 PID: 2608 at fs/btrfs/locking.c:251 btrfs_tree_lock+0x1be/0x1d0 [btrfs] [245043.392792] CPU: 4 PID: 2608 Comm: btrfs-transacti Tainted: G W I 4.16.8 #1 [245043.395489] RIP: 0010:btrfs_tree_lock+0x1be/0x1d0 [btrfs] [245043.396791] RSP: 0018:ffffc9000424b840 EFLAGS: 00010246 [245043.398093] RAX: 0000000000000a30 RBX: ffff8807e20a3d20 RCX: 0000000000000001 [245043.399414] RDX: 0000000000000001 RSI: 0000000000000002 RDI: ffff8807e20a3d20 [245043.400732] RBP: 0000000000000001 R08: ffff88041f39a700 R09: ffff880000000000 [245043.402021] R10: 0000000000000040 R11: ffff8807e20a3d20 R12: ffff8807cb220630 [245043.403296] R13: 0000000000000001 R14: ffff8807cb220628 R15: ffff88041fbdf000 [245043.404780] FS: 0000000000000000(0000) GS:ffff88082fc80000(0000) knlGS:0000000000000000 [245043.406050] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [245043.407321] CR2: 00007fffdbdb9f10 CR3: 0000000001c09005 CR4: 00000000000206e0 [245043.408670] Call Trace: [245043.409977] btrfs_search_slot+0x761/0xa60 [btrfs] [245043.411278] btrfs_insert_empty_items+0x62/0xb0 [btrfs] [245043.412572] btrfs_insert_item+0x5b/0xc0 [btrfs] [245043.413922] btrfs_create_pending_block_groups+0xfb/0x1e0 [btrfs] [245043.415216] do_chunk_alloc+0x1e5/0x2a0 [btrfs] [245043.416487] find_free_extent+0xcd0/0xf60 [btrfs] [245043.417813] btrfs_reserve_extent+0x96/0x1e0 [btrfs] [245043.419105] btrfs_alloc_tree_block+0xfb/0x4a0 [btrfs] [245043.420378] __btrfs_cow_block+0x127/0x550 [btrfs] [245043.421652] btrfs_cow_block+0xee/0x190 [btrfs] [245043.422979] btrfs_search_slot+0x227/0xa60 [btrfs] [245043.424279] ? btrfs_update_inode_item+0x59/0x100 [btrfs] [245043.425538] ? iput+0x72/0x1e0 [245043.426798] write_one_cache_group.isra.49+0x20/0x90 [btrfs] [245043.428131] btrfs_start_dirty_block_groups+0x102/0x420 [btrfs] [245043.429419] btrfs_commit_transaction+0x11b/0x880 [btrfs] [245043.430712] ? start_transaction+0x8e/0x410 [btrfs] [245043.432006] transaction_kthread+0x184/0x1a0 [btrfs] [245043.433341] kthread+0xf0/0x130 [245043.434628] ? btrfs_cleanup_transaction+0x4e0/0x4e0 [btrfs] [245043.435928] ? kthread_create_worker_on_cpu+0x40/0x40 [245043.437236] ret_from_fork+0x1f/0x30 [245043.441054] ---[ end trace 15abaa2aaf36827f ]--- This is because at write_one_cache_group() when we are COWing a leaf from the extent tree we end up allocating a new block group (chunk) and, because we have hit a threshold on the number of bytes reserved for system chunks, we attempt to finalize the creation of new block groups from the current transaction, by calling btrfs_create_pending_block_groups(). However here we also need to modify the extent tree in order to insert a block group item, and if the location for this new block group item happens to be in the same leaf that we were COWing earlier, we deadlock since btrfs_search_slot() tries to write lock the extent buffer that we locked before at write_one_cache_group(). We have already hit similar cases in the past and commit d9a0540a79f8 ("Btrfs: fix deadlock when finalizing block group creation") fixed some of those cases by delaying the creation of pending block groups at the known specific spots that could lead to a deadlock. This change reworks that commit to be more generic so that we don't have to add similar logic to every possible path that can lead to a deadlock. This is done by making __btrfs_cow_block() disallowing the creation of new block groups (setting the transaction's can_flush_pending_bgs to false) before it attempts to allocate a new extent buffer for either the extent, chunk or device trees, since those are the trees that pending block creation modifies. Once the new extent buffer is allocated, it allows creation of pending block groups to happen again. This change depends on a recent patch from Josef which is not yet in Linus' tree, named "btrfs: make sure we create all new block groups" in order to avoid occasional warnings at btrfs_trans_release_chunk_metadata(). Fixes: d9a0540a79f8 ("Btrfs: fix deadlock when finalizing block group creation") CC: stable@vger.kernel.org # 4.4+ Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199753 Link: https://lore.kernel.org/linux-btrfs/CAJtFHUTHna09ST-_EEiyWmDH6gAqS6wa=zMNMBsifj8ABu99cw@mail.gmail.com/ Reported-by: E V Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 7ed586d0a8241e81d58c656c5b315f781fa6fc97 Author: Filipe Manana Date: Mon Oct 15 09:51:00 2018 +0100 Btrfs: fix assertion on fsync of regular file when using no-holes feature When using the NO_HOLES feature and logging a regular file, we were expecting that if we find an inline extent, that either its size in RAM (uncompressed and unenconded) matches the size of the file or if it does not, that it matches the sector size and it represents compressed data. This assertion does not cover a case where the length of the inline extent is smaller than the sector size and also smaller the file's size, such case is possible through fallocate. Example: $ mkfs.btrfs -f -O no-holes /dev/sdb $ mount /dev/sdb /mnt $ xfs_io -f -c "pwrite -S 0xb60 0 21" /mnt/foobar $ xfs_io -c "falloc 40 40" /mnt/foobar $ xfs_io -c "fsync" /mnt/foobar In the above example we trigger the assertion because the inline extent's length is 21 bytes while the file size is 80 bytes. The fallocate() call merely updated the file's size and did not touch the existing inline extent, as expected. So fix this by adjusting the assertion so that an inline extent length smaller than the file size is valid if the file size is smaller than the filesystem's sector size. A test case for fstests follows soon. Reported-by: Anatoly Trosinenko Fixes: a89ca6f24ffe ("Btrfs: fix fsync after truncate when no_holes feature is enabled") CC: stable@vger.kernel.org # 4.14+ Link: https://lore.kernel.org/linux-btrfs/CAE5jQCfRSBC7n4pUTFJcmHh109=gwyT9mFkCOL+NKfzswmR=_Q@mail.gmail.com/ Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 76d865b87c327b34c0e24f23e75828878022f899 Author: Parav Pandit Date: Wed Oct 17 13:21:08 2018 +0300 RDMA/core: Fix comment for hw stats init for port == 0 When add_port() is done for port == 0, it indicates that ports hardware counters initialization should be skipped. Reflect so in the comment. Signed-off-by: Parav Pandit Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford commit 548cb4fbe80d68b9d1b8b30aca179636e74bec36 Author: Parav Pandit Date: Wed Oct 17 13:20:20 2018 +0300 RDMA/core: Refactor ib_register_device() function ib_register_device() does several allocation and initialization steps. Split it into smaller more readable functions for easy review and maintenance. Signed-off-by: Parav Pandit Reviewed-by: Daniel Jurgens Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford commit 67fecaf8e9cc28812042f61194ac0e0a9737f897 Author: Parav Pandit Date: Wed Oct 17 13:19:27 2018 +0300 RDMA/core: Fix unwinding flow in case of error to register device If port pkey list initialization fails, free the port_immutable memory during cleanup path. Currently it is missed out. If cache setup fails, free the pkey list during cleanup path. Fixes: d291f1a65 ("IB/core: Enforce PKey security on QPs") Signed-off-by: Parav Pandit Reviewed-by: Daniel Jurgens Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford commit 56e027a604c80b1106786f8426e7cc5dbacb53b2 Author: Hannes Reinecke Date: Wed Oct 17 09:20:04 2018 +0200 ib_srp: Remove WARN_ON in srp_terminate_io() The WARN_ON() is pointless as the rport is placed in SDEV_TRANSPORT_OFFLINE at that time, so no new commands can be submitted via srp_queuecommand() Signed-off-by: Hannes Reinecke Reviewed-by: Jens Axboe Reviewed-by: Johannes Thumshirn Acked-by: Bart Van Assche Signed-off-by: Doug Ledford commit 3527a018c00e5dbada2f9d7ed5576437b6dd5cfb Author: Filipe Manana Date: Sat Oct 13 00:37:25 2018 +0100 Btrfs: fix null pointer dereference on compressed write path error At inode.c:compress_file_range(), under the "free_pages_out" label, we can end up dereferencing the "pages" pointer when it has a NULL value. This case happens when "start" has a value of 0 and we fail to allocate memory for the "pages" pointer. When that happens we jump to the "cont" label and then enter the "if (start == 0)" branch where we immediately call the cow_file_range_inline() function. If that function returns 0 (success creating an inline extent) or an error (like -ENOMEM for example) we jump to the "free_pages_out" label and then access "pages[i]" leading to a NULL pointer dereference, since "nr_pages" has a value greater than zero at that point. Fix this by setting "nr_pages" to 0 when we fail to allocate memory for the "pages" pointer. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=201119 Fixes: 771ed689d2cd ("Btrfs: Optimize compressed writeback and reads") CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Liu Bo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6956b956934f10c19eca2a1d44f50a3bee860531 Author: Hannes Reinecke Date: Wed Oct 17 17:25:13 2018 +0200 drivers/block: Remove DAC960 driver The DAC960 driver has been obsoleted by the myrb/myrs drivers, so it can be dropped. Signed-off-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 0d09e668b70ba687ed07976a33a09b19e9416488 Author: Anson Huang Date: Wed Oct 17 06:12:04 2018 +0000 clk: imx7d: remove CLK_IS_CRITICAL flag for arm_a7_root_clk i.MX7D uses virtual cpu clock of "arm" clock to be child clock of "arm_a7_root_clk" and it is with CLK_IS_CRITICAL flag set, so no need to add CLK_IS_CRITICAL flag for keeping "arm_a7_root_clk" use count correct, latest clock tree is as below in clk_summary: pll_arm_main 1 1 0 792000000 0 pll_arm_main_bypass 1 1 0 792000000 0 pll_arm_main_clk 1 1 0 792000000 0 arm_a7_src 1 1 0 792000000 0 arm_a7_cg 1 1 0 792000000 0 arm_a7_div 1 1 0 792000000 0 arm_a7_root_clk 1 1 0 792000000 0 arm 1 1 0 792000000 Signed-off-by: Anson Huang Signed-off-by: Stephen Boyd commit ec1893922df19ab69153e21ee4154a937e8a8eeb Author: Anson Huang Date: Wed Oct 17 06:11:59 2018 +0000 clk: imx: cpu clock should be always critical Add CLK_IS_CRITICAL flag for cpu clock type to make cpu clock use count correct, as cpu clock should be always critical. Signed-off-by: Anson Huang Signed-off-by: Stephen Boyd commit 6f4bc0ea682b59d7013cbc5ced2d4dd73067a33f Author: Yonatan Cohen Date: Tue Oct 9 12:05:15 2018 +0300 IB/mlx5: Allow scatter to CQE without global signaled WRs Requester scatter to CQE is restricted to QPs configured to signal all WRs. This patch adds ability to enable scatter to cqe (force enable) in the requester without sig_all, for users who do not want all WRs signaled but rather just the ones whose data found in the CQE. Signed-off-by: Yonatan Cohen Reviewed-by: Guy Levi Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford commit 2e43bb31b8df662f591a7e80270ca3acda44bb48 Author: Yonatan Cohen Date: Tue Oct 9 12:05:14 2018 +0300 IB/mlx5: Verify that driver supports user flags Flags sent down from user might not be supported by running driver. This might lead to unwanted bugs. To solve this, added macro to test for unsupported flags. Signed-off-by: Yonatan Cohen Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford commit 5d6ff1babe78034f0cf8e5f7bf312a257e5574cc Author: Yonatan Cohen Date: Tue Oct 9 12:05:13 2018 +0300 IB/mlx5: Support scatter to CQE for DC transport type Scatter to CQE is a HW offload that saves PCI writes by scattering the payload to the CQE. This patch extends already existing functionality to support DC transport type. Signed-off-by: Yonatan Cohen Reviewed-by: Guy Levi Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford commit 5a8336d99a81ae7492d41b5a13dc2717b0d39565 Merge: 508a523f6bc6 94a04d1d3d36 Author: Doug Ledford Date: Wed Oct 17 11:23:37 2018 -0400 Merge remote-tracking branch 'mlx5-next' into for-next Pick up changes to mlx5_ifc.h needed for direct Scatter to CQE support series to come next. Signed-off-by: Doug Ledford commit 3847dab77421867fbc77faacb2f377d44e729e1b Author: Helge Deller Date: Tue Oct 16 22:38:22 2018 +0200 parisc: Add alternative coding infrastructure This patch adds the necessary code to patch a running kernel at runtime to improve performance. The current implementation offers a few optimizations variants: - When running a SMP kernel on a single UP processor, unwanted assembler statements like locking functions are overwritten with NOPs. When multiple instructions shall be skipped, one branch instruction is used instead of multiple nop instructions. - In the UP case, some pdtlb and pitlb instructions are patched to become pdtlb,l and pitlb,l which only flushes the CPU-local tlb entries instead of broadcasting the flush to other CPUs in the system and thus may improve performance. - fic and fdc instructions are skipped if no I- or D-caches are installed. This should speed up qemu emulation and cacheless systems. - If no cache coherence is needed for IO operations, the relevant fdc and sync instructions in the sba and ccio drivers are replaced by nops. - On systems which share I- and D-TLBs and thus don't have a seperate instruction TLB, the pitlb instruction is replaced by a nop. Live-patching is done early in the boot process, just after having run the system inventory. No drivers are running and thus no external interrupts should arrive. So the hope is that no TLB exceptions will occur during the patching. If this turns out to be wrong we will probably need to do the patching in real-mode. Signed-off-by: Helge Deller commit 031337ace2d1c22a447da6390716fe92592cdd6e Author: Honghui Zhang Date: Mon Oct 15 16:08:59 2018 +0800 PCI: mediatek: Add loadable kernel module support Implement remove() callback function for the Mediatek PCIe controller driver to add loadable kernel module support. Save the PCIe's GIC IRQ at probe so that it can be retrieved to call dispose_irq() to tear down the IRQ upon module removal. Signed-off-by: Honghui Zhang [lorenzo.pieralisi@arm.com: updated commit log] Signed-off-by: Lorenzo Pieralisi Reviewed-by: Ryder Lee commit 97d2932fee4b0607bad4f71a8d2c0938f596b1c3 Author: Honghui Zhang Date: Mon Oct 15 16:08:58 2018 +0800 PCI: mediatek: Add system PM support for MT2712 and MT7622 In order to reduce the PCIe power consumption in system suspend, the PCI bus physical layer should be gated. On system resume, the PCIe link should be re-established and the related control register values should be restored. Define suspend_noirq & resume_noirq callback functions to implement PM system syspend hooks for the PCI host controller. Signed-off-by: Honghui Zhang [lorenzo.pieralisi@arm.com: updated commit log] Signed-off-by: Lorenzo Pieralisi Acked-by: Ryder Lee commit 3828d60fd2ef99f97a677c1f95af2ab3e65e2576 Author: Honghui Zhang Date: Mon Oct 15 16:08:56 2018 +0800 PCI: mediatek: Fixup MSI enablement logic by enabling MSI before clocks Commit 43e6409db64d ("PCI: mediatek: Add MSI support for MT2712 and MT7622") added MSI support but enabled MSI in the wrong place, at a step in the probe sequence where clocks were not still enabled. Fix this issue by calling mtk_pcie_enable_msi() in mtk_pcie_startup_port_v2() since clocks are enabled when mtk_pcie_startup_port_v2() is called. To avoid forward declaration of mtk_pcie_enable_msi(), move the mtk_pcie_startup_port_v2() function definition in the file. Fixes: 43e6409db64d ("PCI: mediatek: Add MSI support for MT2712 and MT7622") Signed-off-by: Honghui Zhang [lorenzo.pieralisi@arm.com: squashed commit and adapted log] Signed-off-by: Lorenzo Pieralisi Acked-by: Ryder Lee commit 57cb3152b360eabf30d498515dcf9049f3c7b9df Author: Honghui Zhang Date: Mon Oct 15 16:08:55 2018 +0800 PCI: mediatek: Convert to use pci_host_probe() Part of mtk_pcie_register_host() is an open-coded version of pci_host_probe(). So instead of duplicating this code, use pci_host_probe() directly and remove mtk_pcie_register_host(). Signed-off-by: Honghui Zhang [lorenzo.pieralisi@arm.com: commit log changes] Signed-off-by: Lorenzo Pieralisi Acked-by: Ryder Lee commit 88c0e230bb4a79680ee5f05ddba879d436f98f13 Author: Honghui Zhang Date: Mon Oct 15 16:08:54 2018 +0800 PCI: mediatek: Remove the redundant dev->pm_domain check There is no need to check whether device have a PM domain attached before calling the PM runtime methods. Remove it. Signed-off-by: Honghui Zhang [lorenzo.pieralisi@arm.com: commit log changes] Signed-off-by: Lorenzo Pieralisi Acked-by: Ryder Lee commit 665636b2940d0897c4130253467f5e8c42eea392 Author: Enric Balletbo i Serra Date: Tue Oct 16 15:41:44 2018 +0200 clk: rockchip: Fix static checker warning in rockchip_ddrclk_get_parent call Fixes the signedness bug returning '(-22)' on the return type by removing the sanity checker in rockchip_ddrclk_get_parent(). The function should return and unsigned value only and it's safe to remove the sanity checker as the core functions that call get_parent like clk_core_get_parent_by_index already ensures the validity of the clk index returned (index >= core->num_parents). Fixes: a4f182bf81f18 ("clk: rockchip: add new clock-type for the ddrclk") Cc: stable@vger.kernel.org Signed-off-by: Enric Balletbo i Serra Reviewed-by: Stephen Boyd Signed-off-by: Heiko Stuebner commit 0e8afefd5da4875ddea9aa4ad17a2540a2bf9736 Author: Hans de Goede Date: Fri Oct 12 12:16:10 2018 +0200 drm: panel-orientation-quirks: Add quirk for Acer One 10 (S1003) The Acer One 10 uses a clamshell design with a detachable keyboard. As such in normal operating mode, with the keyboard attach the device is in landscape mode (and the Acer logo at boot also shows in landscape mode). But the device uses a portrait screen rotated 90 degrees (sigh). This commit adds a quirk for this device so that we shown the fbcon the right way up and that we hint userspace to also show e.g. plymouth and gdm the right way up. Cc: stable@vger.kernel.org Acked-by: Daniel Vetter Signed-off-by: Hans de Goede Link: https://patchwork.freedesktop.org/patch/msgid/20181012101610.29100-1-hdegoede@redhat.com commit ec506e9246bf42795f1fa8a5cd00740e5686ba73 Author: Christoph Hellwig Date: Sat Oct 13 17:17:02 2018 +0200 spi: pic32-sqi: don't pass GFP_DMA32 to dma_alloc_coherent The DMA API does its own zone decisions based on the coherent_dma_mask. Signed-off-by: Christoph Hellwig Signed-off-by: Mark Brown commit 7e95aac96b554193760aaeb64e263da58127bf27 Author: Vasily Khoruzhick Date: Wed Oct 17 00:38:10 2018 -0700 ASoC: sunxi: allow the sun8i-codec driver to be built on ARM64 Allwinner A64 uses the same digital codec part as in A33, so we need to build this driver on ARM64 as well. Signed-off-by: Vasily Khoruzhick Acked-by: Maxime Ripard Signed-off-by: Mark Brown commit 42371f327df0b8e9d479b929c5cd301846dd0f70 Author: Vasily Khoruzhick Date: Wed Oct 17 00:38:09 2018 -0700 ASoC: sunxi: Add new driver for Allwinner A64 codec's analog path controls The internal codec on A64 is split into 2 parts. The analog path controls are routed through an embedded custom register bus accessed through the PRCM block. Add an ASoC component driver for it. This should be tied to the codec audio card as an auxiliary device. Signed-off-by: Vasily Khoruzhick Acked-by: Maxime Ripard Signed-off-by: Mark Brown commit af2c06c41970eb0110a03696fd7f8f07854719db Author: Vasily Khoruzhick Date: Wed Oct 17 00:38:08 2018 -0700 ASoC: dt-binding: Add bindings for Allwinner A64 codec's analog path controls The internal codec on Allwinner A64 is split into 2 parts. The analog path controls are routed through an embedded custom register bus accessed through the PRCM block just as on A23/A33/H3. Add a binding for this hardware. Signed-off-by: Vasily Khoruzhick Acked-by: Maxime Ripard Signed-off-by: Mark Brown commit 55b407f6468c481edc4a26b21c9f567ae57f01a4 Author: Vasily Khoruzhick Date: Wed Oct 17 00:38:07 2018 -0700 ASoC: sun8i-codec-analog: split regmap code into separate driver It will be reused by sun50i-codec-analog later. Signed-off-by: Vasily Khoruzhick Acked-by: Maxime Ripard Signed-off-by: Mark Brown commit 13c3bf174becfb8b55adcfeb6f01724dc99347f0 Author: Vasily Khoruzhick Date: Wed Oct 17 00:38:06 2018 -0700 ASoC: sun8i-codec: Don't hardcode BCLK / LRCK ratio BCLK / LRCK ratio should be sample size * channels, but it was hardcoded to 32 (0x1 is 32 as per A33 and A64 datasheets). Calculate it basing on sample size and number of channels. Signed-off-by: Vasily Khoruzhick Acked-by: Maxime Ripard Signed-off-by: Mark Brown commit 66ecce3325383c8304063e7d5a30f4374ef5a33e Author: Marcus Cooper Date: Wed Oct 17 00:38:05 2018 -0700 ASoC: sun4i-i2s: Add compatibility with A64 codec I2S The I2S block used for the audio codec in the A64 differs from other 3 I2S modules in A64 and isn't compatible with H3. But it is very similar to what is found in A10(sun4i). However, its TX FIFO is located at a different address. Signed-off-by: Marcus Cooper Signed-off-by: Vasily Khoruzhick Acked-by: Maxime Ripard Signed-off-by: Mark Brown commit 3b991038498bc5011b063d6a804503c577a79434 Author: Christoph Hellwig Date: Sat Oct 13 17:17:04 2018 +0200 ASoC: intel: don't pass GFP_DMA32 to dma_alloc_coherent The DMA API does its own zone decisions based on the coherent_dma_mask. Signed-off-by: Christoph Hellwig Reviewed-by: Takashi Iwai Signed-off-by: Mark Brown commit 508a523f6bc6cdfbf7031d66559d4ad24956b741 Author: Parav Pandit Date: Thu Oct 11 22:31:54 2018 +0300 RDMA/drivers: Use core provided API for registering device attributes Use rdma_set_device_sysfs_group() to register device attributes and simplify the driver. Signed-off-by: Parav Pandit Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 261de72f0169fd9e5bf7113ad9b52e8678f2fdf0 Author: Kishon Vijay Abraham I Date: Wed Oct 17 13:11:14 2018 +0530 PCI: keystone: Cleanup macros defined in pci-keystone.c No functional change. Cleanup macros defined in pci-keystone.c by removing unused macros, grouping the macros and aligning it properly. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Lorenzo Pieralisi commit c0b8558648c29a86c036de89fc3cc7909587aefd Author: Kishon Vijay Abraham I Date: Wed Oct 17 13:11:13 2018 +0530 PCI: keystone: Reorder header file in alphabetical order No functional change. Reorder header file in alphabetical order. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Lorenzo Pieralisi commit daaaa665ca01753da1b557323702f13c26f7c552 Author: Kishon Vijay Abraham I Date: Wed Oct 17 13:11:12 2018 +0530 PCI: keystone: Add debug error message for all errors commit 025dd3daeda77f61a280da87ae701 ("PCI: keystone: Add error IRQ handler") added dev_err() message only for ERR_AXI and ERR_FATAL. Add debug error message for ERR_SYS, ERR_NONFATAL, ERR_CORR and ERR_AER here. While at that avoid using ERR_IRQ_STATUS_RAW and use ERR_IRQ_STATUS instead. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Lorenzo Pieralisi commit 0523cdc6e775494900c878af5f7eb7e90bb03f20 Author: Kishon Vijay Abraham I Date: Wed Oct 17 13:11:11 2018 +0530 PCI: keystone: Use ERR_IRQ_STATUS instead of ERR_IRQ_STATUS_RAW to get interrupt status Use ERR_IRQ_STATUS instead of ERR_IRQ_STATUS_RAW to get interrupt status. ERR_IRQ_STATUS_RAW has the status of the interrupts before masking whereas ERR_IRQ_STATUS has the status of the interrupts after masking. Since all the interrupts are unmasked here, use ERR_IRQ_STATUS. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Lorenzo Pieralisi commit 23fe5bd4be90099e760fe0d00665ab1e465255b3 Author: Kishon Vijay Abraham I Date: Wed Oct 17 13:11:10 2018 +0530 PCI: keystone: Cleanup ks_pcie_link_up() ks_pcie_link_up() uses registers from the designware core to get the status of the link. Move the register defines to pcie-designware.h and cleanup ks_pcie_link_up(). Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Lorenzo Pieralisi commit f9127db9fbadd079c6b88974001cb036057c8afc Author: Kishon Vijay Abraham I Date: Wed Oct 17 13:11:09 2018 +0530 PCI: keystone: Cleanup set_dbi_mode() and get_dbi_mode() No functional change. Use BIT() macro for DBI_CS2 and cleanup set_dbi_mode() and get_dbi_mode(). Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Lorenzo Pieralisi commit e75043ad9792596916ed0e1910b44f34b181c3b7 Author: Kishon Vijay Abraham I Date: Wed Oct 17 13:11:08 2018 +0530 PCI: keystone: Cleanup outbound window configuration Outbound translation window is configured in order to access the PCIe card's MEM space. Cleanup outbound translation configuration here by using BIT() macros, adding a macro for window size and using lower_32_bits/upper_32_bits macros for configuring the 64 bit offset in the outbound translation region. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Lorenzo Pieralisi commit b4f1af8352fda6926831b52caff37709bc895d05 Author: Kishon Vijay Abraham I Date: Wed Oct 17 13:11:07 2018 +0530 PCI: keystone: Get number of outbound windows from DT Instead of having a fixed outbound window count, get the number of outbound windows from the device tree. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Lorenzo Pieralisi commit 44c747af2be7065d5a6417beacbab8f8a52b5556 Author: Kishon Vijay Abraham I Date: Wed Oct 17 13:11:06 2018 +0530 PCI: keystone: Cleanup configuration space access Cleanup configuration space access by removing ks_pcie_cfg_setup() which has an unncessary check of "if (bus == 0)" which will never be the case of *_other_conf() and adding macros for configuring the CFG_SETUP register required for accessing the configuration space of the device. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Lorenzo Pieralisi commit 8047eb55129ababe38dd2f1608c4fdc6d3e75aaf Author: Kishon Vijay Abraham I Date: Wed Oct 17 13:11:05 2018 +0530 PCI: keystone: Invoke runtime PM APIs to enable clock Invoke runtime PM APIs to enable clocks and remove explicit clock enabling using clk_prepare_enable(). Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Lorenzo Pieralisi commit 49229238ab47fa1852a89ee55d1e7fb251ee4eb0 Author: Kishon Vijay Abraham I Date: Wed Oct 17 13:11:04 2018 +0530 PCI: keystone: Cleanup PHY handling Cleanup PHY handling by using devm_phy_optional_get() to get PHYs if the PHYs are optional, creating a device link between the PHY device and the controller device and disable PHY on error cases here. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Lorenzo Pieralisi commit b51a625b784aa9cdac4a177560e19f0a0041ce19 Author: Kishon Vijay Abraham I Date: Wed Oct 17 13:11:03 2018 +0530 PCI: keystone: Use SYSCON APIs to get device ID from control module Control module registers should be read using syscon APIs. pci-keystone.c uses platform_get_resource() to get control module registers. Fix it here by using syscon APIs to get device id from control module. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Lorenzo Pieralisi commit 03d178386477cb58031b31efe2403071a01868fd Author: Kishon Vijay Abraham I Date: Wed Oct 17 13:11:02 2018 +0530 dt-bindings: PCI: keystone: Add bindings to get device control module Add bindings to get device control module which has the device id and vendor id to be configured in the keystone PCIe controller. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Lorenzo Pieralisi Reviewed-by: Rob Herring commit a1cabd2b42fd7710f75dda4ef504ded9ddae612c Author: Kishon Vijay Abraham I Date: Wed Oct 17 13:11:01 2018 +0530 PCI: keystone: Use uniform function naming convention No functional change. Some function names begin with ks_dw_pcie_* and some function names begin with ks_pcie_*. Modify it so that all function names begin with ks_pcie_*. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Lorenzo Pieralisi commit c81ab80136727e11ad76a601b179d4dc84b08120 Author: Kishon Vijay Abraham I Date: Wed Oct 17 13:11:00 2018 +0530 PCI: keystone: Remove redundant platform_set_drvdata() invocation No functional change. Remove redundant platform_set_drvdata() invocation in ks_pcie_probe(). Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Lorenzo Pieralisi commit b492aca35c982011500377797d2e85b36fffda22 Author: Kishon Vijay Abraham I Date: Wed Oct 17 13:10:59 2018 +0530 PCI: keystone: Merge pci-keystone-dw.c and pci-keystone.c No functional change. Having two different files for keystone PCI driver doesn't serve any purpose. Merge pci-keystone-dw.c and pci-keystone.c into a single pci-keystone.c file and remove pci-keystone.h. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Lorenzo Pieralisi commit 1f79f98f0575521df1a3921f30948b6cd8317ee4 Author: Kishon Vijay Abraham I Date: Wed Oct 17 13:10:58 2018 +0530 PCI: keystone: Remove unused argument from ks_dw_pcie_host_init() No functional change. Remove unused "msi_intc_np" argument from ks_dw_pcie_host_init(). Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Lorenzo Pieralisi commit 2433a182ad9c6b1febac75825cbf81f358fec474 Author: Kishon Vijay Abraham I Date: Wed Oct 17 13:10:57 2018 +0530 PCI: keystone: Do not initiate link training multiple times commit 886bc5ceb5cc3ad4b219502d72 ("PCI: designware: Add generic dw_pcie_wait_for_link()") while adding a generic dw_pcie_wait_for_link() performed a special handling (initiate link training multiple times) for keystone which is not required. This also resulted in unncessarily waiting for more time to establish the link even when no PCI device is connected. Remove it and make it look similar to other dwc based PCIe drivers. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Lorenzo Pieralisi commit 1e10f73e4cb033e73a3f47b0cc6080c0e3cf28f2 Author: Kishon Vijay Abraham I Date: Wed Oct 17 13:10:56 2018 +0530 PCI: keystone: Move dw_pcie_setup_rc() out of ks_pcie_establish_link() No functional change. Move dw_pcie_setup_rc() out of ks_pcie_establish_link() so that ks_pcie_establish_linki() can be used only to start the link. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Lorenzo Pieralisi commit 00a2c4094f8edb07ef03a307c2a5b211e9065165 Author: Kishon Vijay Abraham I Date: Wed Oct 17 13:10:55 2018 +0530 PCI: keystone: Use quirk to set MRRS for PCI host bridge Reuse the already existing quirk to set MRRS for PCI host bridge instead of explicitly setting MRRS in ks_pcie_host_init(). Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Lorenzo Pieralisi commit 148e340c0696369fadbbddc8f4bef801ed247d71 Author: Kishon Vijay Abraham I Date: Wed Oct 17 13:10:54 2018 +0530 PCI: keystone: Use quirk to limit MRRS for K2G PCI controller in K2G also has a limitation that memory read request size (MRRS) must not exceed 256 bytes. Use the quirk to limit MRRS (added for K2HK, K2L and K2E) for K2G as well. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Lorenzo Pieralisi commit a3ade38d5a8b101eed7b8ebfd427534404943b8a Author: Christoph Hellwig Date: Sat Oct 13 17:17:00 2018 +0200 cpufreq: tegra186: don't pass GFP_DMA32 to dma_alloc_coherent() The DMA API does its own zone decisions based on the coherent_dma_mask. Signed-off-by: Christoph Hellwig Signed-off-by: Rafael J. Wysocki commit d4122f5abef844112799d2056fdc7bbedbc913f3 Author: Parav Pandit Date: Thu Oct 11 22:31:53 2018 +0300 RDMA/core: Allow existing drivers to set one sysfs group per device Currently many rdma drivers are creating device attribute files using device_create_file() with device specific attributes. Device specific attributes should be exposed via well defined netlink device attributes in future. Introduce an API rdma_set_device_sysfs_group() for existing drivers to set a group for sysfs attributes for legacy. This API is only for exposing legacy attributes which existed for sometime now. New drivers should not be using this API and rather follow netlink path. Signed-off-by: Parav Pandit Reviewed-by: Daniel Jurgens Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit cb4bfda62afa25b4eee3d635d33fccdd9485dd7c Author: Keith Busch Date: Mon Oct 15 10:19:06 2018 -0600 nvme-pci: fix hot removal during error handling A removal waits for the reset_work to complete. If a surprise removal occurs around the same time as an error triggered controller reset, and reset work happened to dispatch a command to the removed controller, the command won't be recovered since the timeout work doesn't do anything during error recovery. We wouldn't want to wait for timeout handling anyway, so this patch fixes this by disabling the controller and killing admin queues prior to syncing with the reset_work. Signed-off-by: Keith Busch Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit 1216e9ef18b84f4fb5934792368fb01eb3540520 Author: Bart Van Assche Date: Wed Oct 10 08:08:20 2018 -0700 nvmet-fcloop: suppress a compiler warning Building with W=1 enables the compiler warning -Wimplicit-fallthrough=3. That option does not recognize the fall-through comment in the fcloop driver. Add a fall-through comment that is recognized for -Wimplicit-fallthrough=3. This patch avoids that the compiler reports the following warning when building with W=1: drivers/nvme/target/fcloop.c:647:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (op == NVMET_FCOP_READDATA) ^ Signed-off-by: Bart Van Assche Reviewed-by: James Smart Signed-off-by: Christoph Hellwig commit 202359c007f6b1d6247a062c0682d6d5bcd3e7d7 Author: Bart Van Assche Date: Wed Oct 10 08:08:19 2018 -0700 nvme-core: make implicit seed truncation explicit The nvme_user_io.slba field is 64 bits wide. That value is copied into the 32-bit bio_integrity_payload.bip_iter.bi_sector field. Make that truncation explicit to avoid that Coverity complains about implicit truncation. See also Coverity ID 1056486 on http://scan.coverity.com/projects/linux. Signed-off-by: Bart Van Assche Reviewed-by: Keith Busch Signed-off-by: Christoph Hellwig commit 1c4665272ca73335a662a0fb6a9604ec76983756 Author: Bart Van Assche Date: Mon Oct 8 14:28:47 2018 -0700 nvmet-fc: fix kernel-doc headers This patch avoids that the kernel-doc tool complains about two function headers when building with W=1. Signed-off-by: Bart Van Assche Reviewed-by: James Smart Signed-off-by: Christoph Hellwig commit 0d2bdf9f4134582bc7c4b82cb516cb27952127d0 Author: Bart Van Assche Date: Mon Oct 8 14:28:46 2018 -0700 nvme-fc: rework the request initialization code Instead of setting and then clearing the first_sgl pointer for AEN requests, leave that pointer zero. This patch does not change how requests are initialized but avoids that Coverity reports the following complaint for nvme_fc_init_aen_ops(): CID 1418400 (#1 of 1): Out-of-bounds access (OVERRUN) 4. overrun-buffer-val: Overrunning buffer pointed to by aen_op of 312 bytes by passing it to a function which accesses it at byte offset 312. Signed-off-by: Bart Van Assche Reviewed-by: James Smart Signed-off-by: Christoph Hellwig commit d3d0bc78be300098104d9fde9ca1330694a70f45 Author: Bart Van Assche Date: Mon Oct 8 14:28:45 2018 -0700 nvme-fc: introduce struct nvme_fcp_op_w_sgl This patch does not change any functionality but makes the intent of the code more clear. Signed-off-by: Bart Van Assche Reviewed-by: James Smart Signed-off-by: Christoph Hellwig commit 76c910c7cf6d2d325c24439855a606cf1d414d29 Author: Bart Van Assche Date: Mon Oct 8 14:28:44 2018 -0700 nvme-fc: fix kernel-doc headers This patch avoids that the kernel-doc tool complains about several multiple function headers when building with W=1. Signed-off-by: Bart Van Assche Reviewed-by: James Smart Signed-off-by: Christoph Hellwig commit 8eacd1bd21d6913ec27e6120e9a8733352e191d3 Author: Bart Van Assche Date: Mon Oct 8 14:28:52 2018 -0700 nvmet: avoid integer overflow in the discard code Although I'm not sure whether it is a good idea to support large discard commands, I think integer overflow for discard ranges larger than 4 GB should be avoided. This patch avoids that smatch reports the following: drivers/nvme/target/io-cmd-file.c:249:1 nvmet_file_execute_discard() warn: should '((range.nlb)) << req->ns->blksize_shift' be a 64 bit type? Fixes: d5eff33ee6f8 ("nvmet: add simple file backed ns support") Signed-off-by: Bart Van Assche Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 0d3ebdec9394c984f3aa59ea97541f2243952b55 Author: Bart Van Assche Date: Mon Oct 8 14:28:53 2018 -0700 nvmet-rdma: declare local symbols static This patch avoids that sparse complains about missing declarations. Signed-off-by: Bart Van Assche Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 5eadc9cce17100caef88e972abeeeca7ef6d8a92 Author: Bart Van Assche Date: Mon Oct 8 14:28:51 2018 -0700 nvmet: use strlcpy() instead of strcpy() Although the code modified by this patch looks fine to me, this patch avoids that Coverity reports the following complaint (ID 1364971 and ID 1364973): "You might overrun the 256-character fixed-size string id->subnqn". Signed-off-by: Bart Van Assche Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 40581d1a91a1527e1e15350e479156810a389a96 Author: Bart Van Assche Date: Mon Oct 8 14:28:43 2018 -0700 nvme-pci: fix nvme_suspend_queue() kernel-doc header This patch avoids that the kernel-doc tool complains about the nvme_suspend_queue() function header when building with W=1. Signed-off-by: Bart Van Assche Reviewed-by: Keith Busch Signed-off-by: Christoph Hellwig commit bb2a1d4e804aa41eef0003a192a674f844dbca23 Author: Bart Van Assche Date: Mon Oct 8 14:28:41 2018 -0700 nvme-core: rework a NQN copying operation Although it is easy to see that the code in nvme_init_subnqn() guarantees that the subsys->nqn string is '\0'-terminated, apparently Coverity is not smart enough to see this. Make it easier for Coverity to analyze this code by changing the strncpy() call into a strlcpy() call. This patch does not change the behavior of the code but fixes Coveritiy ID 1423720. Signed-off-by: Bart Van Assche Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig commit eb090c4c948ccc7a051451261cf1426edf83f3eb Author: Bart Van Assche Date: Mon Oct 8 14:28:39 2018 -0700 nvme-core: declare local symbols static This patch avoids that sparse complains about missing declarations. Signed-off-by: Bart Van Assche Reviewed-by: Chaitanya Kulkarni Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig commit 35da77d556c17980f9bd6892828a70d7a1a8a145 Author: Bart Van Assche Date: Mon Oct 8 14:28:54 2018 -0700 nvmet-rdma: check for timeout in nvme_rdma_wait_for_cm() Check whether queue->cm_error holds a value before reading it. This patch addresses Coverity ID 1373774: unchecked return value. Signed-off-by: Bart Van Assche Signed-off-by: Christoph Hellwig commit 43a6f8fb619730fe5989e2430669626b2b5e13a0 Author: Bart Van Assche Date: Mon Oct 8 14:28:49 2018 -0700 nvmet: use strcmp() instead of strncmp() for subsystem lookup strncmp() stops comparing when either the end of one of the first two arguments is reached or when 'n' characters have been compared, whichever comes first. That means that strncmp(s1, s2, n) is equivalent to strcmp(s1, s2) if n exceeds the length of s1 or the length of s2. Since that is the case in nvmet_find_get_subsys(), change strncmp() into strcmp(). This patch avoids that the following warning is reported by smatch: drivers/nvme/target/core.c:940:1 nvmet_find_get_subsys() error: strncmp() '"nqn.2014-08.org.nvmexpress.discovery"' too small (37 vs 223) Signed-off-by: Bart Van Assche Signed-off-by: Christoph Hellwig commit 48440ab6dc275a3144474e8c5f45fab854d6e20f Author: Chaitanya Kulkarni Date: Wed Aug 22 19:58:45 2018 -0700 nvmet: remove unreachable code Get rid of the unreachable code in the nvmet_parse_discovery_cmd(). Keep the error message identical to the admin-cmd.c and io-cmd*.c Signed-off-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 886fabf693263e8651c0c4ab84fc626ad6d3a6e7 Author: Keith Busch Date: Fri Oct 5 09:49:37 2018 -0600 nvme: update node paths after adding new path The nvme namespace paths were being updated only when the current path was not set or nonoptimized. If a new path comes online that is a better path for its NUMA node, the multipath selector may continue using the previously set path on a potentially further node. This patch re-runs the path assignment after successfully adding a new optimized path. Signed-off-by: Keith Busch Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit b3569d3a4b4fe93ee33eaa3c69ec3ed2cd3b276a Author: Bartlomiej Zolnierkiewicz Date: Tue Oct 16 15:42:16 2018 +0200 x86/kconfig: Remove redundant 'default n' lines from all x86 Kconfig's 'default n' is the default value for any bool or tristate Kconfig setting so there is no need to write it explicitly. Also, since commit: f467c5640c29 ("kconfig: only write '# CONFIG_FOO is not set' for visible symbols") ... the Kconfig behavior is the same regardless of 'default n' being present or not: ... One side effect of (and the main motivation for) this change is making the following two definitions behave exactly the same: config FOO bool config FOO bool default n With this change, neither of these will generate a '# CONFIG_FOO is not set' line (assuming FOO isn't selected/implied). That might make it clearer to people that a bare 'default n' is redundant. ... Signed-off-by: Bartlomiej Zolnierkiewicz Cc: Boris Ostrovsky Cc: Borislav Petkov Cc: Juergen Gross Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: xen-devel@lists.xenproject.org Link: http://lkml.kernel.org/r/20181016134217eucas1p2102984488b89178a865162553369025b%7EeGpI5NlJo0851008510eucas1p2D@eucas1p2.samsung.com Signed-off-by: Ingo Molnar commit 0fa809ca7f81c47bea6706bc689e941eb25d7e89 Author: Waiman Long Date: Tue Oct 16 09:45:07 2018 -0400 locking/pvqspinlock: Extend node size when pvqspinlock is configured The qspinlock code supports up to 4 levels of slowpath nesting using four per-CPU mcs_spinlock structures. For 64-bit architectures, they fit nicely in one 64-byte cacheline. For para-virtualized (PV) qspinlocks it needs to store more information in the per-CPU node structure than there is space for. It uses a trick to use a second cacheline to hold the extra information that it needs. So PV qspinlock needs to access two extra cachelines for its information whereas the native qspinlock code only needs one extra cacheline. Freshly added counter profiling of the qspinlock code, however, revealed that it was very rare to use more than two levels of slowpath nesting. So it doesn't make sense to penalize PV qspinlock code in order to have four mcs_spinlock structures in the same cacheline to optimize for a case in the native qspinlock code that rarely happens. Extend the per-CPU node structure to have two more long words when PV qspinlock locks are configured to hold the extra data that it needs. As a result, the PV qspinlock code will enjoy the same benefit of using just one extra cacheline like the native counterpart, for most cases. [ mingo: Minor changelog edits. ] Signed-off-by: Waiman Long Cc: Andrew Morton Cc: Linus Torvalds Cc: Paul E. McKenney Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Will Deacon Link: http://lkml.kernel.org/r/1539697507-28084-2-git-send-email-longman@redhat.com Signed-off-by: Ingo Molnar commit 1222109a53637f96c581224198b86856d503f892 Author: Waiman Long Date: Tue Oct 16 09:45:06 2018 -0400 locking/qspinlock_stat: Count instances of nested lock slowpaths Queued spinlock supports up to 4 levels of lock slowpath nesting - user context, soft IRQ, hard IRQ and NMI. However, we are not sure how often the nesting happens. So add 3 more per-CPU stat counters to track the number of instances where nesting index goes to 1, 2 and 3 respectively. On a dual-socket 64-core 128-thread Zen server, the following were the new stat counter values under different circumstances: State slowpath index1 index2 index3 ----- -------- ------ ------ ------- After bootup 1,012,150 82 0 0 After parallel build + perf-top 125,195,009 82 0 0 So the chance of having more than 2 levels of nesting is extremely low. [ mingo: Minor changelog edits. ] Signed-off-by: Waiman Long Cc: Andrew Morton Cc: Linus Torvalds Cc: Paul E. McKenney Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Will Deacon Link: http://lkml.kernel.org/r/1539697507-28084-1-git-send-email-longman@redhat.com Signed-off-by: Ingo Molnar commit 11e13696a08e838ba48c72404c2b3f41429b5b20 Author: Nicholas Mc Guire Date: Tue Oct 16 15:45:39 2018 +0200 sched/completions/Documentation: Add recommendation for dynamic and ONSTACK completions To prevent dynamic completion objects from being de-allocated while still in use, add a recommendation to embed them in long lived data structures. Also add a note for the on-stack case that emphasizes the dangers of the limited scope, and recommends dynamic allocation if scope limitations are not clearly understood. [ mingo: Minor touch-ups of the text, expanded it a bit to make the warnings Nicholas added more prominent. ] Signed-off-by: Nicholas Mc Guire Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: john.garry@huawei.com Link: http://lkml.kernel.org/r/1539697539-24055-1-git-send-email-hofrat@osadl.org Signed-off-by: Ingo Molnar commit 0797e6f1a85872ab48cb4986a06ebdcae22ecf1a Author: Nathan Chancellor Date: Wed Sep 26 22:12:23 2018 -0700 IB/rxe: Remove unnecessary enum values Clang warns when an emumerated type is implicitly converted to another. drivers/infiniband/sw/rxe/rxe.c:106:27: warning: implicit conversion from enumeration type 'enum rxe_device_param' to different enumeration type 'enum ib_atomic_cap' [-Wenum-conversion] rxe->attr.atomic_cap = RXE_ATOMIC_CAP; ~ ^~~~~~~~~~~~~~ drivers/infiniband/sw/rxe/rxe.c:131:22: warning: implicit conversion from enumeration type 'enum rxe_port_param' to different enumeration type 'enum ib_port_state' [-Wenum-conversion] port->attr.state = RXE_PORT_STATE; ~ ^~~~~~~~~~~~~~ drivers/infiniband/sw/rxe/rxe.c:132:24: warning: implicit conversion from enumeration type 'enum rxe_port_param' to different enumeration type 'enum ib_mtu' [-Wenum-conversion] port->attr.max_mtu = RXE_PORT_MAX_MTU; ~ ^~~~~~~~~~~~~~~~ drivers/infiniband/sw/rxe/rxe.c:133:27: warning: implicit conversion from enumeration type 'enum rxe_port_param' to different enumeration type 'enum ib_mtu' [-Wenum-conversion] port->attr.active_mtu = RXE_PORT_ACTIVE_MTU; ~ ^~~~~~~~~~~~~~~~~~~ drivers/infiniband/sw/rxe/rxe.c:151:24: warning: implicit conversion from enumeration type 'enum rxe_port_param' to different enumeration type 'enum ib_mtu' [-Wenum-conversion] ib_mtu_enum_to_int(RXE_PORT_ACTIVE_MTU); ~~~~~~~~~~~~~~~~~~ ^~~~~~~~~~~~~~~~~~~ 5 warnings generated. Use the appropriate values from the expected enumerated type so no conversion needs to happen then remove the unneeded definitions. Reported-by: Nick Desaulniers Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Signed-off-by: Jason Gunthorpe commit 34c201ae49fe9e0bf3b389da5869d810f201c740 Author: Helge Deller Date: Mon Oct 15 22:14:01 2018 +0200 parisc: Include compressed vmlinux file in vmlinuz boot kernel Change the parisc vmlinuz boot code to include and process the real compressed vmlinux.gz ELF file instead of a compressed memory dump. This brings parisc in sync on how it's done on x86_64. The benefit of this change is that, e.g. for debugging purposes, one can then extract the vmlinux file out of the vmlinuz which was booted which wasn't possible before. This can be archieved with the existing scripts/extract-vmlinux script, which just needs a small tweak to prefer to extract a compressed file before trying the existing given binary. The downside of this approach is that due to the extra round of decompression/ELF processing we need more physical memory installed to be able to boot a kernel. Signed-off-by: Helge Deller commit db139d71c4c377c56a67ae219f120186ce9934d1 Author: Helge Deller Date: Tue Oct 16 08:03:24 2018 +0200 extract-vmlinux: Check for uncompressed image as fallback As on x86-64 and other architectures, the boot kernel on parisc (vmlinuz and bzImage) contains a full compressed copy of the final kernel executable (vmlinux.bin.gz), which one should be able to extract with the extract-vmlinux script. But on parisc extracting the kernel with extract-vmlinux fails. Currently the script first checks if the given file is an ELF file (which is true on parisc) and if so returns it. Thus on parisc we unexpectedly get back the vmlinuz boot file instead of the uncompressed vmlinux image. This patch fixes this issue by reverting the logic. It now first tries to find a compression signature in the given file and if that fails it checks the file itself as fallback. Signed-off-by: Helge Deller commit 1138b6718ff74d2a934459643e3754423d23b5e2 Author: John David Anglin Date: Sat Oct 6 13:11:30 2018 -0400 parisc: Fix address in HPMC IVA Helge noticed that the address of the os_hpmc handler was not being correctly calculated in the hpmc macro. As a result, PDCE_CHECK would fail to call os_hpmc: e800009802e00000 0000000000000000 CC_ERR_CHECK_HPMC 37000f7302e00000 8040004000000000 CC_ERR_CPU_CHECK_SUMMARY f600105e02e00000 fffffff0f0c00000 CC_MC_HPMC_MONARCH_SELECTED 140003b202e00000 000000000000000b CC_ERR_HPMC_STATE_ENTRY 5600100b02e00000 00000000000001a0 CC_MC_OS_HPMC_LEN_ERR 5600106402e00000 fffffff0f0438e70 CC_MC_BR_TO_OS_HPMC_FAILED e800009802e00000 0000000000000000 CC_ERR_CHECK_HPMC 37000f7302e00000 8040004000000000 CC_ERR_CPU_CHECK_SUMMARY 4000109f02e00000 0000000000000000 CC_MC_HPMC_INITIATED 4000101902e00000 0000000000000000 CC_MC_MULTIPLE_HPMCS 030010d502e00000 0000000000000000 CC_CPU_STOP The address problem can be seen by dumping the fault vector: 0000000040159000 : 40159000: 63 6f 77 73 stb r15,-2447(dp) 40159004: 20 63 61 6e ldil L%b747000,r3 40159008: 20 66 6c 79 ldil L%-1c3b3000,r3 ... 40159020: 08 00 02 40 nop 40159024: 20 6e 60 02 ldil L%15d000,r3 40159028: 34 63 00 00 ldo 0(r3),r3 4015902c: e8 60 c0 02 bv,n r0(r3) 40159030: 08 00 02 40 nop 40159034: 00 00 00 00 break 0,0 40159038: c0 00 70 00 bb,*< r0,sar,40159840 4015903c: 00 00 00 00 break 0,0 Location 40159038 should contain the physical address of os_hpmc: 000000004015d000 : 4015d000: 08 1a 02 43 copy r26,r3 4015d004: 01 c0 08 a4 mfctl iva,r4 4015d008: 48 85 00 68 ldw 34(r4),r5 This patch moves the address setup into initialize_ivt to resolve the above problem. I tested the change by dumping the HPMC entry after setup: 0000000040209020: 8000240 0000000040209024: 206a2004 0000000040209028: 34630ac0 000000004020902c: e860c002 0000000040209030: 8000240 0000000040209034: 1bdddce6 0000000040209038: 15d000 000000004020903c: 1a0 Signed-off-by: John David Anglin Cc: Signed-off-by: Helge Deller commit 99a3ae51d557d8e38a7aece65678a31f9db215ee Author: Helge Deller Date: Sun Oct 14 21:58:00 2018 +0200 parisc: Fix exported address of os_hpmc handler In the C-code we need to put the physical address of the hpmc handler in the interrupt vector table (IVA) in order to get HPMCs working. Since on parisc64 function pointers are indirect (in fact they are function descriptors) we instead export the address as variable and not as function. This reverts a small part of commit f39cce654f9a ("parisc: Add cfi_startproc and cfi_endproc to assembly code"). Signed-off-by: Helge Deller Cc: [4.9+] commit 3c229b3f2dd8133f61bb81d3cb018be92f4bba39 Author: Helge Deller Date: Fri Oct 12 22:37:46 2018 +0200 parisc: Fix map_pages() to not overwrite existing pte entries Fix a long-existing small nasty bug in the map_pages() implementation which leads to overwriting already written pte entries with zero, *if* map_pages() is called a second time with an end address which isn't aligned on a pmd boundry. This happens for example if we want to remap only the text segment read/write in order to run alternative patching on the code. Exiting the loop when we reach the end address fixes this. Cc: stable@vger.kernel.org Signed-off-by: Helge Deller commit 4dd5b673fa625d647447ae4c477bf946ae877711 Author: John David Anglin Date: Thu Sep 20 22:31:48 2018 -0400 parisc: Purge TLB entries after updating page table entry and set page accessed flag in TLB handler This patch may resolve some races in TLB handling.  Hopefully, TLB inserts are accesses and protected by spin lock. If not, we may need to IPI calls and do local purges on PA 2.0. Signed-off-by: John David Anglin Signed-off-by: Helge Deller commit d27dfa13b9f77ae7e6ed09d70a0426ed26c1a8f9 Author: John David Anglin Date: Tue Oct 16 21:07:59 2018 -0400 parisc: Release spinlocks using ordered store This patch updates the spin unlock code to use an ordered store with release semanatics. All prior accesses are guaranteed to be performed before an ordered store is performed. Using an ordered store is significantly faster than using the sync memory barrier. Signed-off-by: John David Anglin Signed-off-by: Helge Deller commit 2e37787df0ed0047848dba2eba53510a9185b991 Author: Helge Deller Date: Sun Oct 7 23:28:45 2018 +0200 parisc: Ratelimit dino stuck interrupt warnings While playing with qemu with an emulated RT8139cp NIC, I faced lots of the following warnings: Dino 0x00810000: stuck interrupt 2 This patch ratelimits this warning and reports back that the IRQ was handled. Signed-off-by: Helge Deller commit 35d8be9c563c9b2d6550833ad494f90bffde7ff0 Author: Helge Deller Date: Sun Oct 7 22:59:13 2018 +0200 parisc: dino: Utilize DINO_MASK_IRQ() macro Signed-off-by: Helge Deller commit e98bc5ee9793742eca1129366109603010dc9389 Author: Helge Deller Date: Sun Oct 7 22:29:29 2018 +0200 parisc: Clean up crash header output On kernel crash, this is the current output: Kernel Fault: Code=26 (Data memory access rights trap) regs=(ptrval) (Addr=00000004) Drop the address of regs, it's of no use for debugging, and show the faulty address without parenthesis. Signed-off-by: Helge Deller commit 8dbac7746e55e0c83fe818c137b1235c9fa1bd75 Author: Helge Deller Date: Sat Oct 6 21:14:56 2018 +0200 parisc: Add SYSTEM_INFO and REGISTER TOC PAT functions Signed-off-by: Helge Deller commit 32a7901f6d1d518ce25290c78553428110399212 Author: John David Anglin Date: Sat Sep 29 16:34:59 2018 -0400 parisc: Remove PTE load and fault check from L2_ptep macro This change removes the PTE load and present check from the L2_ptep macro. The load and check for kernel pages is now done in the tlb_lock macro. This avoids a double load and check for user pages. The load and check for user pages is now done inside the lock so the fault handler can't be called while the entry is being updated. This version uses an ordered store to release the lock when the page table entry isn't present. It also corrects the check in the non SMP case. Signed-off-by: John David Anglin Signed-off-by: Helge Deller commit a886c9791aed64d73f8c0038cc1506741ba216fa Author: John David Anglin Date: Tue Oct 16 20:49:56 2018 -0400 parisc: Reorder TLB flush timing calculation On boot (mostly reboot), my c8000 sometimes crashes after it prints the TLB flush threshold. The lockup is hard. The front LED flashes red and the box must be unplugged to reset the error. I noticed that when the crash occurs the TLB flush threshold is about one quarter what it is on a successful boot. If I disabled the calculation, the crash didn't occur. There also seemed to be a timing dependency affecting the crash. I finally realized that the flush_tlb_all() timing test runs just after the secondary CPUs are started. There seems to be a problem with running flush_tlb_all() too soon after the CPUs are started. The timing for the range test always seemed okay. So, I reversed the order of the two timing tests and I haven't had a crash at this point so far. I added a couple of information messages which I have left to help with diagnosis if the problem should appear on another machine. This version reduces the minimum TLB flush threshold to 16 KiB. Signed-off-by: John David Anglin Signed-off-by: Helge Deller commit 7c4ba3d38a3b013b79c3c07a639504cdc68fefdf Author: Christoph Hellwig Date: Mon Aug 27 11:00:28 2018 +0200 parisc: remove the dead ccio-rm-dma driver This driver has never been wired up due to the life of the Linux git tree, and has severely bitrotted. Signed-off-by: Christoph Hellwig Signed-off-by: Helge Deller commit c9dfa0c796f2c21255c45fe85a72657a192e1a49 Author: Masahiro Yamada Date: Mon Aug 27 11:28:08 2018 +0900 parisc: remove check for minimum required GCC version Commit cafa0010cd51 ("Raise the minimum required gcc version to 4.6") bumped the minimum GCC version to 4.6 for all architectures. The version check in arch/parisc/Makefile is obsolete now. Signed-off-by: Masahiro Yamada Signed-off-by: Helge Deller commit cd2b8520681a57dec6986f5ba62b2b23e831b98c Author: Helge Deller Date: Thu Aug 23 23:06:25 2018 +0200 parisc: Use PARISC_ITLB_TRAP constant in entry.S Fixes: 5b00ca0b8035 ("parisc: Restore possibility to execute 64-bit applications") Signed-off-by: Helge Deller commit a1c6fd4308d37f072e939a2782f24214115fc7e8 Author: Harsh Jain Date: Sat Oct 13 13:46:56 2018 +0530 crypto: chelsio - Update ntx queue received from cxgb4 Update cxgb4 to send No. of Tx Queue created in lldinfo struct and use the same ntxq in chcr driver. This patch depends on following commit commit add92a817e60e308a419693413a38d9d1e663aff "Fix memory corruption in DMA Mapped buffers" v2: Free txq_info in error case as pointed by Lino Sanfilippo. Signed-off-by: Harsh Jain Signed-off-by: Herbert Xu commit 18e732b8035d175181aae2ded127994cb01694f7 Author: Nathan Chancellor Date: Wed Oct 10 14:40:07 2018 -0700 crypto: ccree - avoid implicit enum conversion Clang warns when one enumerated type is implicitly converted to another and this happens in several locations in this driver, ultimately related to the set_cipher_{mode,config0} functions. set_cipher_mode expects a mode of type drv_cipher_mode and set_cipher_config0 expects a mode of type drv_crypto_direction. drivers/crypto/ccree/cc_ivgen.c:58:35: warning: implicit conversion from enumeration type 'enum cc_desc_direction' to different enumeration type 'enum drv_crypto_direction' [-Wenum-conversion] set_cipher_config0(&iv_seq[idx], DESC_DIRECTION_ENCRYPT_ENCRYPT); drivers/crypto/ccree/cc_hash.c:99:28: warning: implicit conversion from enumeration type 'enum cc_hash_conf_pad' to different enumeration type 'enum drv_crypto_direction' [-Wenum-conversion] set_cipher_config0(desc, HASH_DIGEST_RESULT_LITTLE_ENDIAN); drivers/crypto/ccree/cc_aead.c:1643:30: warning: implicit conversion from enumeration type 'enum drv_hash_hw_mode' to different enumeration type 'enum drv_cipher_mode' [-Wenum-conversion] set_cipher_mode(&desc[idx], DRV_HASH_HW_GHASH); Since this fundamentally isn't a problem because these values just represent simple integers for a shift operation, make it clear to Clang that this is okay by making the mode parameter in both functions an int. Link: https://github.com/ClangBuiltLinux/linux/issues/46 Signed-off-by: Nathan Chancellor Acked-by: Gilad Ben-Yossef Reviewed-by: Nick Desaulniers Signed-off-by: Herbert Xu commit 618b5dc48365cecc03daffa46800f20ab11e3f80 Author: Horia Geantă Date: Wed Oct 10 14:26:48 2018 +0300 crypto: caam - add SPDX license identifier to all files Previously, a tree-wide change added SPDX license identifiers to files lacking licensing information: b24413180f56 ("License cleanup: add SPDX GPL-2.0 license identifier to files with no license") To be consistent update the rest of the files: -files with license specified by means of MODULE_LICENSE() -files with complete license text -Kconfig Signed-off-by: Horia Geantă Signed-off-by: Herbert Xu commit 29e83c757006fd751966bdc53392bb22d74179c6 Author: Horia Geantă Date: Mon Oct 8 14:09:37 2018 +0300 crypto: caam/qi - simplify CGR allocation, freeing CGRs (Congestion Groups) have to be freed by the same CPU that initialized them. This is why currently the driver takes special measures; however, using set_cpus_allowed_ptr() is incorrect - as reported by Sebastian. Instead of the generic solution of replacing set_cpus_allowed_ptr() with work_on_cpu_safe(), we use the qman_delete_cgr_safe() QBMan API instead of qman_delete_cgr() - which internally takes care of proper CGR deletion. Link: https://lkml.kernel.org/r/20181005125443.dfhd2asqktm22ney@linutronix.de Reported-by: Sebastian Andrzej Siewior Signed-off-by: Horia Geantă Signed-off-by: Herbert Xu commit 58c8a863550b19ab3559dd5f5e27cc698c03e53b Merge: ce4e45842de3 ba439a6cbfa2 Author: Herbert Xu Date: Wed Oct 17 14:14:06 2018 +0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Merge crypto tree to pick up chelsio bug fix. commit b93f654d73fa09088041efa77972b1d616a75fcb Author: Jens Axboe Date: Tue Oct 16 08:34:50 2018 -0600 f2fs: remove request_list check in is_idle() This doesn't work on stacked devices, and it doesn't work on blk-mq devices. The request_list is only used on legacy, which we don't have much of anymore, and soon won't have any of. Kill the check. Cc: Jaegeuk Kim Cc: linux-f2fs-devel@lists.sourceforge.net Signed-off-by: Jens Axboe Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit d021613ee3acb0d9a45038204e5699727719fe8a Author: YueHaibing Date: Thu Oct 4 10:51:02 2018 +0000 scsi: lpfc: Remove set but not used variables 'tgtp' Fixes gcc '-Wunused-but-set-variable' warning: drivers/scsi/lpfc/lpfc_debugfs.c: In function 'lpfc_debugfs_nodelist_data': drivers/scsi/lpfc/lpfc_debugfs.c:553:29: warning: variable 'tgtp' set but not used [-Wunused-but-set-variable] It never used since 2b65e18202fd ("scsi: lpfc: NVME Target: Add debugfs support") Signed-off-by: YueHaibing Signed-off-by: Martin K. Petersen commit 6940d12b3b02fadd9c8cfce551772470976c7ffc Author: Gustavo A. R. Silva Date: Thu Oct 4 09:10:09 2018 +0200 scsi: aic94xx: mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Addresses-Coverity-ID: 114988 ("Missing break in switch") Addresses-Coverity-ID: 114989 ("Missing break in switch") Addresses-Coverity-ID: 114990 ("Missing break in switch") Addresses-Coverity-ID: 114991 ("Missing break in switch") Addresses-Coverity-ID: 114992 ("Missing break in switch") Signed-off-by: Gustavo A. R. Silva Signed-off-by: Martin K. Petersen commit 20054597f169090109fc3f0dfa1a48583f4178a4 Author: Nathan Chancellor Date: Wed Oct 3 18:06:15 2018 -0700 scsi: iscsi_tcp: Explicitly cast param in iscsi_sw_tcp_host_get_param Clang warns when one enumerated type is implicitly converted to another. drivers/scsi/iscsi_tcp.c:803:15: warning: implicit conversion from enumeration type 'enum iscsi_host_param' to different enumeration type 'enum iscsi_param' [-Wenum-conversion] &addr, param, buf); ^~~~~ 1 warning generated. iscsi_conn_get_addr_param handles ISCSI_HOST_PARAM_IPADDRESS just fine so add an explicit cast to iscsi_param to make it clear to Clang that this is expected behavior. Link: https://github.com/ClangBuiltLinux/linux/issues/153 Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Signed-off-by: Martin K. Petersen commit f41d84d44a1d7538f15ced316fc7040da2886b80 Author: YueHaibing Date: Sat Sep 29 13:53:07 2018 +0000 scsi: lpfc: Remove set but not used variable 'psli' Fixes gcc '-Wunused-but-set-variable' warning: drivers/scsi/lpfc/lpfc_hbadisc.c: In function 'lpfc_free_tx': drivers/scsi/lpfc/lpfc_hbadisc.c:5431:19: warning: variable 'psli' set but not used [-Wunused-but-set-variable] Since commit 895427bd012c ("scsi: lpfc: NVME Initiator: Base modifications") 'psli' is not used any more. Signed-off-by: YueHaibing Signed-off-by: Martin K. Petersen commit 761c830ec7b3d0674b3ad89cefd77a692634e305 Author: Nathan Chancellor Date: Thu Sep 27 16:56:52 2018 -0700 scsi: bfa: Avoid implicit enum conversion in bfad_im_post_vendor_event Clang warns when one enumerated type is implicitly converted to another. drivers/scsi/bfa/bfa_fcs_lport.c:379:26: warning: implicit conversion from enumeration type 'enum bfa_lport_aen_event' to different enumeration type 'enum bfa_ioc_aen_event' [-Wenum-conversion] BFA_AEN_CAT_LPORT, event); ^~~~~ The root cause of these warnings is the bfad_im_post_vendor_event function, which expects a value from enum bfa_ioc_aen_event but there are multiple instances of values from enums bfa_port_aen_event, bfa_audit_aen_event, and bfa_lport_aen_event being used in this function. Given that this doesn't appear to be a problem since cat helps with differentiating the events, just change evt's type to int so that no conversion needs to happen and Clang won't warn. Update aen_type's type in bfa_aen_entry_s as members that hold enumerated types should be int. Link: https://github.com/ClangBuiltLinux/linux/issues/147 Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Signed-off-by: Martin K. Petersen commit 362b5da3dfceada6e74ecdd7af3991bbe42c0c0f Author: Nathan Chancellor Date: Wed Sep 26 17:12:00 2018 -0700 scsi: isci: Change sci_controller_start_task's return type to sci_status Clang warns when an enumerated type is implicitly converted to another. drivers/scsi/isci/request.c:3476:13: warning: implicit conversion from enumeration type 'enum sci_task_status' to different enumeration type 'enum sci_status' [-Wenum-conversion] status = sci_controller_start_task(ihost, ~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/scsi/isci/host.c:2744:10: warning: implicit conversion from enumeration type 'enum sci_status' to different enumeration type 'enum sci_task_status' [-Wenum-conversion] return SCI_SUCCESS; ~~~~~~ ^~~~~~~~~~~ drivers/scsi/isci/host.c:2753:9: warning: implicit conversion from enumeration type 'enum sci_status' to different enumeration type 'enum sci_task_status' [-Wenum-conversion] return status; ~~~~~~ ^~~~~~ Avoid all of these implicit conversion by just making sci_controller_start_task use sci_status. This silences Clang and has no functional change since sci_task_status has all of its values mapped to something in sci_status. Link: https://github.com/ClangBuiltLinux/linux/issues/153 Signed-off-by: Nathan Chancellor Signed-off-by: Martin K. Petersen commit e9e9a103528c7e199ead6e5374c9c52cf16b5802 Author: Nathan Chancellor Date: Wed Sep 26 17:11:50 2018 -0700 scsi: isci: Use proper enumerated type in atapi_d2h_reg_frame_handler Clang warns when one enumerated type is implicitly converted to another. drivers/scsi/isci/request.c:1629:13: warning: implicit conversion from enumeration type 'enum sci_io_status' to different enumeration type 'enum sci_status' [-Wenum-conversion] status = SCI_IO_FAILURE_RESPONSE_VALID; ~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/scsi/isci/request.c:1631:12: warning: implicit conversion from enumeration type 'enum sci_io_status' to different enumeration type 'enum sci_status' [-Wenum-conversion] status = SCI_IO_FAILURE_RESPONSE_VALID; ~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ status is of type sci_status but SCI_IO_FAILURE_RESPONSE_VALID is of type sci_io_status. Use SCI_FAILURE_IO_RESPONSE_VALID, which is from sci_status and has SCI_IO_FAILURE_RESPONSE_VALID's exact value since that is what SCI_IO_FAILURE_RESPONSE_VALID is mapped to in the isci.h file. Link: https://github.com/ClangBuiltLinux/linux/issues/153 Signed-off-by: Nathan Chancellor Signed-off-by: Martin K. Petersen commit feb59a34135cbc76c04767467a1cbdc0944b0dc1 Author: YueHaibing Date: Fri Sep 14 10:41:44 2018 +0000 scsi: lpfc: Remove set but not used variables 'fc_hdr' and 'hw_page_size' Fixes gcc '-Wunused-but-set-variable' warning: drivers/scsi/lpfc/lpfc_sli.c: In function 'lpfc_sli4_sp_handle_rcqe': drivers/scsi/lpfc/lpfc_sli.c:13430:26: warning: variable 'fc_hdr' set but not used [-Wunused-but-set-variable] drivers/scsi/lpfc/lpfc_sli.c: In function 'lpfc_cq_create': drivers/scsi/lpfc/lpfc_sli.c:14852:11: warning: variable 'hw_page_size' set but not used [-Wunused-but-set-variable] Signed-off-by: YueHaibing Signed-off-by: Martin K. Petersen commit b5a5fe4ef7fdfd00ac3937756d5f2fbb4e4be3a1 Author: Varun Prakash Date: Thu Sep 13 21:26:00 2018 +0530 scsi: cxgb4i: add DCB support for iSCSI connections Add IEEE and CEE DCBX support for iSCSI connections. Signed-off-by: Rohit Maheshwari Signed-off-by: Varun Prakash Signed-off-by: Martin K. Petersen commit 6f07f86c494074a0755930473f67cc8916654221 Author: Dan Williams Date: Wed Sep 26 10:48:38 2018 -0700 acpi, nfit: Introduce nfit_mem flags In preparation for adding a flag to indicate whether a DIMM publishes a dirty-shutdown count, convert the existing flags to a bit field. Reviewed-by: Keith Busch Signed-off-by: Dan Williams commit 44d520eb17cd5fd7a3ac28b9d872e655c3920021 Merge: 3f4c3127d332 753fb2ee0934 Author: Daniel Borkmann Date: Wed Oct 17 02:30:32 2018 +0200 Merge branch 'bpf-sk-msg-peek' John Fastabend says: ==================== This adds support for the MSG_PEEK flag when redirecting into an ingress psock sk_msg queue. The first patch adds some base support to the helpers, then the feature, and finally we add an option for the test suite to do a duplicate MSG_PEEK call on every recv to test the feature. With duplicate MSG_PEEK call all tests continue to PASS. ==================== Acked-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann commit 753fb2ee09345e0730e610b2ee3a01964fe22a63 Author: John Fastabend Date: Tue Oct 16 11:08:09 2018 -0700 bpf: sockmap, add msg_peek tests to test_sockmap Add tests that do a MSG_PEEK recv followed by a regular receive to test flag support. Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann commit 02c558b2d5d679fbbcaa5b9689484c7e0f8abb7b Author: John Fastabend Date: Tue Oct 16 11:08:04 2018 -0700 bpf: sockmap, support for msg_peek in sk_msg with redirect ingress This adds support for the MSG_PEEK flag when doing redirect to ingress and receiving on the sk_msg psock queue. Previously the flag was being ignored which could confuse applications if they expected the flag to work as normal. Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann commit 8734a162c13b1a893e7dff8de0df81fed04c51a6 Author: John Fastabend Date: Tue Oct 16 11:07:59 2018 -0700 bpf: skmsg, improve sk_msg_used_element to work in cork context Currently sk_msg_used_element is only called in zerocopy context where cork is not possible and if this case happens we fallback to copy mode. However the helper is more useful if it works in all contexts. This patch resolved the case where if end == head indicating a full or empty ring the helper always reports an empty ring. To fix this add a test for the full ring case to avoid reporting a full ring has 0 elements. This additional functionality will be used in the next patches from recvmsg context where end = head with a full ring is a valid case. Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann commit 3f4c3127d332000530349db4843deece27fe5e0c Author: John Fastabend Date: Tue Oct 16 10:36:01 2018 -0700 bpf: sockmap, fix skmsg recvmsg handler to track size correctly When converting sockmap to new skmsg generic data structures we missed that the recvmsg handler did not correctly use sg.size and instead was using individual elements length. The result is if a sock is closed with outstanding data we omit the call to sk_mem_uncharge() and can get the warning below. [ 66.728282] WARNING: CPU: 6 PID: 5783 at net/core/stream.c:206 sk_stream_kill_queues+0x1fa/0x210 To fix this correct the redirect handler to xfer the size along with the scatterlist and also decrement the size from the recvmsg handler. Now when a sock is closed the remaining 'size' will be decremented with sk_mem_uncharge(). Signed-off-by: John Fastabend Acked-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann commit 9023705192242a77f05c1647b9f0c6b55c955ecf Author: Gustavo A. R. Silva Date: Tue Oct 16 17:11:48 2018 -0700 Input: xen-kbdfront - mark expected switch fall-through In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Notice that in this particular case, I placed the "fall through" part at the beginning of the code comment, which is what GCC is expecting to find. Addresses-Coverity-ID: 114757 ("Missing break in switch") Signed-off-by: Gustavo A. R. Silva Signed-off-by: Dmitry Torokhov commit 480d99fdc3eee31a23c317927a335e9a71c2904f Author: Gregory CLEMENT Date: Wed Oct 10 20:18:38 2018 +0200 clk: mvebu: armada-37xx-tbg: Switch to clk_get and balance it in probe The parent clock is get only to have its name, and then the clock is no more used, so we can safely free it using clk_put. Furthermore as between the successful devm_clk_get() and the devm_clk_put() call we don't exit the probe function in error so I can use non managed version of clk_get() and clk_put(). Signed-off-by: Gregory CLEMENT Signed-off-by: Stephen Boyd commit f08c2e2865f6f9b172f37d7bbf24716f9ebad553 Author: Dong Aisheng Date: Fri Aug 31 12:45:55 2018 +0800 clk: add managed version of clk_bulk_get_all This patch introduces the managed version of clk_bulk_get_all. Cc: Michael Turquette Cc: Stephen Boyd Tested-by: Thor Thayer Signed-off-by: Dong Aisheng Signed-off-by: Stephen Boyd commit 616e45df7c4aa71279c07cc803a1d51f43f89f37 Author: Dong Aisheng Date: Fri Aug 31 12:45:54 2018 +0800 clk: add new APIs to operate on all available clocks This patch introduces of_clk_bulk_get_all and clk_bulk_x_all APIs to users who just want to handle all available clocks from device tree without need to know the detailed clock information likes clock numbers and names. This is useful in writing some generic drivers to handle clock part. Cc: Stephen Boyd Cc: Masahiro Yamada Tested-by: Thor Thayer Signed-off-by: Dong Aisheng Signed-off-by: Stephen Boyd commit cfdc0411cf01aff7bb44a4edcbaa578ad363ab77 Author: Dong Aisheng Date: Fri Aug 31 12:45:53 2018 +0800 clk: bulk: add of_clk_bulk_get() 'clock-names' property is optional in DT, so of_clk_bulk_get() is introduced here to handle this for DT users without 'clock-names' specified. Later clk_bulk_get_all() will be implemented on top of it and this API will be kept private until someone proves they need it because they don't have a struct device pointer. Cc: Stephen Boyd Cc: Michael Turquette Cc: Russell King Reported-by: Shawn Guo Tested-by: Thor Thayer Signed-off-by: Dong Aisheng Signed-off-by: Stephen Boyd commit 13eb34b669b8ac38fa4f3ea290237e936047d88b Author: YueHaibing Date: Wed Sep 26 19:09:40 2018 +0800 scsi: megaraid_mbox: remove set but not used variables Fixes gcc '-Wunused-but-set-variable' warning: drivers/scsi/megaraid/megaraid_mbox.c: In function 'megaraid_reset_handler': drivers/scsi/megaraid/megaraid_mbox.c:2580:7: warning: variable 'recovering' set but not used [-Wunused-but-set-variable] drivers/scsi/megaraid/megaraid_mbox.c: In function 'mbox_post_sync_cmd': drivers/scsi/megaraid/megaraid_mbox.c:2728:12: warning: variable 'mbox64' set but not used [-Wunused-but-set-variable] drivers/scsi/megaraid/megaraid_mbox.c: In function 'megaraid_mbox_support_random_del': drivers/scsi/megaraid/megaraid_mbox.c:3138:11: warning: variable 'mbox' set but not used [-Wunused-but-set-variable] drivers/scsi/megaraid/megaraid_mbox.c: In function 'megaraid_mbox_flush_cache': drivers/scsi/megaraid/megaraid_mbox.c:3266:10: warning: variable 'mbox' set but not used [-Wunused-but-set-variable] drivers/scsi/megaraid/megaraid_mbox.c: In function 'megaraid_mbox_fire_sync_cmd': drivers/scsi/megaraid/megaraid_mbox.c:3302:12: warning: variable 'mbox64' set but not used [-Wunused-but-set-variable] drivers/scsi/megaraid/megaraid_mbox.c: In function 'gather_hbainfo': drivers/scsi/megaraid/megaraid_mbox.c:3797:10: warning: variable 'dmajor' set but not used [-Wunused-but-set-variable] [mkp: applied by hand due to conflict with hch's DMA cleanup] Signed-off-by: YueHaibing Signed-off-by: Martin K. Petersen commit c8da78e8a1da5dc726b38db6cdb8bd992b3826ed Author: Stephen Boyd Date: Tue Oct 16 15:33:01 2018 -0700 clk: tegra210: Include size.h for compilation ease You can't compile this file by itself because it uses SZ_64K from sizes.h but doesn't include it. Instead it relies on some certain configuration pulling that in implicitly somewhere else. Just add the include to make random compile testing easier. Signed-off-by: Stephen Boyd commit a4dbbceeee3e0ba670875a147237d6566de78840 Author: Joseph Lo Date: Thu Sep 27 10:32:03 2018 +0800 clk: tegra: Fixes for MBIST work around Fix some incorrect data in LVL2 offset and bit mask. Fixes: e403d0057343 ("clk: tegra: MBIST work around for Tegra210") Signed-off-by: Joseph Lo Signed-off-by: Peter De Schrijver Acked-by: Jon Hunter Acked-by: Peter De Schrijver Signed-off-by: Stephen Boyd commit c851436a34cad09388f1303e11ccb6b9420e5692 Author: Jim Mattson Date: Tue Oct 16 14:29:19 2018 -0700 kvm: x86: Add has_payload and payload to kvm_queued_exception The payload associated with a #PF exception is the linear address of the fault to be loaded into CR2 when the fault is delivered. The payload associated with a #DB exception is a mask of the DR6 bits to be set (or in the case of DR6.RTM, cleared) when the fault is delivered. Add fields has_payload and payload to kvm_queued_exception to track payloads for pending exceptions. The new fields are introduced here, but for now, they are just cleared. Reported-by: Jim Mattson Suggested-by: Paolo Bonzini Signed-off-by: Jim Mattson Signed-off-by: Paolo Bonzini commit edbb4233e7efc37dbebb10f7774b38c64080dd66 Author: Paul Burton Date: Mon Oct 15 18:26:12 2018 +0000 MIPS: Cleanup DSP ASE detection Currently we hardcode a list of files for which we specify that the toolchain has DSP ASE support when building for MIPSr2 only. This has a number of problems: 1) It doesn't actually ensure that the toolchain supports the DSP ASE at all. 2) It's fragile if we try to use DSP ASE macros in other files. 3) It makes no provision for MIPSr6 & later systems which also support the DSP ASE & end up using the .word directive implementation of the DSP macros. Fix this by detecting assembler support for the DSP ASE globally, not just for a small set of files, and not just for MIPSr2. This now exposes use of toolchain DSP support to kernel builds targeting MIPSr1 and older, so we add .set MIPS_ISA_LEVEL directives prior to all .set dsp directives in order to prevent the assembler from complaining that the DSP ASE is only supported with MIPSr2 & higher. Signed-off-by: Paul Burton Patchwork: https://patchwork.linux-mips.org/patch/20901/ Cc: linux-mips@linux-mips.org commit bba9ce58d9cb7ba9e121627108eca986760ad0e8 Author: Jim Mattson Date: Tue Oct 16 14:29:18 2018 -0700 KVM: Documentation: Fix omission in struct kvm_vcpu_events The header file indicates that there are 36 reserved bytes at the end of this structure. Adjust the documentation to agree with the header file. Signed-off-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 18178ff862170ee4c9fd7450173c6fba9e3c4c3a Author: Vitaly Kuznetsov Date: Tue Oct 16 18:50:11 2018 +0200 KVM: selftests: add Enlightened VMCS test Modify test library and add eVMCS test. This includes nVMX save/restore testing. Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit c939989d74e27f44229a51d8fe96b5c297965bfa Author: Vitaly Kuznetsov Date: Tue Oct 16 18:50:10 2018 +0200 tools/headers: update kvm.h Pick up the latest kvm.h definitions. Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 8cab6507f64eff0ccfea01fccbc7e3e05e2aaf7e Author: Vitaly Kuznetsov Date: Tue Oct 16 18:50:09 2018 +0200 x86/kvm/nVMX: nested state migration for Enlightened VMCS Add support for get/set of nested state when Enlightened VMCS is in use. A new KVM_STATE_NESTED_EVMCS flag to indicate eVMCS on the vCPU was enabled is added. Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 1e7ecd1b3d21a6302f3ee4a3720f682eb2467a3c Author: Vitaly Kuznetsov Date: Tue Oct 16 18:50:08 2018 +0200 KVM: selftests: state_test: test bare VMXON migration Split prepare_for_vmx_operation() into prepare_for_vmx_operation() and load_vmcs() so we can inject GUEST_SYNC() in between. Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit a1b0c1c64dfef0cff8555bb708bfc5d7c66c6ca4 Author: Vitaly Kuznetsov Date: Tue Oct 16 18:50:07 2018 +0200 x86/kvm/nVMX: allow bare VMXON state migration It is perfectly valid for a guest to do VMXON and not do VMPTRLD. This state needs to be preserved on migration. Cc: stable@vger.kernel.org Fixes: 8fcc4b5923af5de58b80b53a069453b135693304 Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit a7c42bb6da6b1b54b2e7bd567636d72d87b10a79 Author: Vitaly Kuznetsov Date: Tue Oct 16 18:50:06 2018 +0200 x86/kvm/lapic: preserve gfn_to_hva_cache len on cache reinit vcpu->arch.pv_eoi is accessible through both HV_X64_MSR_VP_ASSIST_PAGE and MSR_KVM_PV_EOI_EN so on migration userspace may try to restore them in any order. Values match, however, kvm_lapic_enable_pv_eoi() uses different length: for Hyper-V case it's the whole struct hv_vp_assist_page, for KVM native case it is 8. In case we restore KVM-native MSR last cache will be reinitialized with len=8 so trying to access VP assist page beyond 8 bytes with kvm_read_guest_cached() will fail. Check if we re-initializing cache for the same address and preserve length in case it was greater. Signed-off-by: Vitaly Kuznetsov Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 12e0c6186ba44bb6194cf5d2eda8f46880126587 Author: Vitaly Kuznetsov Date: Tue Oct 16 18:50:05 2018 +0200 x86/kvm/hyperv: don't clear VP assist pages on init VP assist pages may hold valuable data which needs to be preserved across migration. Clean PV EOI portion of the data on init, the guest is responsible for making sure there's no garbage in the rest. This will be used for nVMX migration, eVMCS address needs to be preserved. Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit c4ebd6295ab730bf922c96d3c4045c3a84fd1cf7 Author: Vitaly Kuznetsov Date: Tue Oct 16 18:50:04 2018 +0200 KVM: nVMX: optimize prepare_vmcs02{,_full} for Enlightened VMCS case When Enlightened VMCS is in use by L1 hypervisor we can avoid vmwriting VMCS fields which did not change. Our first goal is to achieve minimal impact on traditional VMCS case so we're not wrapping each vmwrite() with an if-changed checker. We also can't utilize static keys as Enlightened VMCS usage is per-guest. This patch implements the simpliest solution: checking fields in groups. We skip single vmwrite() statements as doing the check will cost us something even in non-evmcs case and the win is tiny. Unfortunately, this makes prepare_vmcs02_full{,_full}() code Enlightened VMCS-dependent (and a bit ugly). Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit b8bbab928fb187530d6bb0932b86661f99e3a01d Author: Vitaly Kuznetsov Date: Tue Oct 16 18:50:03 2018 +0200 KVM: nVMX: implement enlightened VMPTRLD and VMCLEAR Per Hyper-V TLFS 5.0b: "The L1 hypervisor may choose to use enlightened VMCSs by writing 1 to the corresponding field in the VP assist page (see section 7.8.7). Another field in the VP assist page controls the currently active enlightened VMCS. Each enlightened VMCS is exactly one page (4 KB) in size and must be initially zeroed. No VMPTRLD instruction must be executed to make an enlightened VMCS active or current. After the L1 hypervisor performs a VM entry with an enlightened VMCS, the VMCS is considered active on the processor. An enlightened VMCS can only be active on a single processor at the same time. The L1 hypervisor can execute a VMCLEAR instruction to transition an enlightened VMCS from the active to the non-active state. Any VMREAD or VMWRITE instructions while an enlightened VMCS is active is unsupported and can result in unexpected behavior." Keep Enlightened VMCS structure for the current L2 guest permanently mapped from struct nested_vmx instead of mapping it every time. Suggested-by: Ladi Prosek Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 945679e301ea0de1148b64c7c3273d92059e7231 Author: Vitaly Kuznetsov Date: Tue Oct 16 18:50:02 2018 +0200 KVM: nVMX: add enlightened VMCS state Adds hv_evmcs pointer and implement copy_enlightened_to_vmcs12() and copy_enlightened_to_vmcs12(). prepare_vmcs02()/prepare_vmcs02_full() separation is not valid for Enlightened VMCS, do full sync for now. Suggested-by: Ladi Prosek Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 57b119da3594f5145a64fdebe0ac9ee0cc65f371 Author: Vitaly Kuznetsov Date: Tue Oct 16 18:50:01 2018 +0200 KVM: nVMX: add KVM_CAP_HYPERV_ENLIGHTENED_VMCS capability Enlightened VMCS is opt-in. The current version does not contain all fields supported by nested VMX so we must not advertise the corresponding VMX features if enlightened VMCS is enabled. Userspace is given the enlightened VMCS version supported by KVM as part of enabling KVM_CAP_HYPERV_ENLIGHTENED_VMCS. The version is to be advertised to the nested hypervisor, currently done via a cpuid leaf for Hyper-V. Suggested-by: Ladi Prosek Signed-off-by: Vitaly Kuznetsov Reviewed-by: Liran Alon Signed-off-by: Paolo Bonzini commit 5d7a6443368e48ca041fea086e345420c027a8cd Author: Vitaly Kuznetsov Date: Tue Oct 16 18:50:00 2018 +0200 KVM: VMX: refactor evmcs_sanitize_exec_ctrls() Split off EVMCS1_UNSUPPORTED_* macros so we can re-use them when enabling Enlightened VMCS for Hyper-V on KVM. Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 72bbf9358c3676bd89dc4bd8fb0b1f2a11c288fc Author: Ladi Prosek Date: Tue Oct 16 18:49:59 2018 +0200 KVM: hyperv: define VP assist page helpers The state related to the VP assist page is still managed by the LAPIC code in the pv_eoi field. Signed-off-by: Ladi Prosek Signed-off-by: Vitaly Kuznetsov Reviewed-by: Liran Alon Signed-off-by: Paolo Bonzini commit 970c0d4b94efcba5610b37f0118cb1a2286ba962 Author: Wei Yang Date: Tue Oct 9 10:41:15 2018 +0800 KVM: refine the comment of function gfn_to_hva_memslot_prot() The original comment is little hard to understand. No functional change, just amend the comment a little. Signed-off-by: Wei Yang Signed-off-by: Paolo Bonzini commit e7912386ede89d2aa1f72ebb74969e48e9d5f56c Author: Wei Yang Date: Thu Oct 4 10:04:23 2018 +0800 KVM: x86: reintroduce pte_list_remove, but including mmu_spte_clear_track_bits rmap_remove() removes the sptep after locating the correct rmap_head but, in several cases, the caller has already known the correct rmap_head. This patch introduces a new pte_list_remove(); because it is known that the spte is present (or it would not have an rmap_head), it is safe to remove the tracking bits without any previous check. Signed-off-by: Wei Yang Signed-off-by: Paolo Bonzini commit 8daf346226b22e565baf27ccaec58fed9e108b42 Author: Wei Yang Date: Thu Oct 4 10:04:22 2018 +0800 KVM: x86: rename pte_list_remove to __pte_list_remove This is a patch preparing for further change. Signed-off-by: Wei Yang Signed-off-by: Paolo Bonzini commit 0804c849f1df0992d39a37c4fc259f7f8b16f385 Author: Peng Hao Date: Sun Oct 14 07:09:55 2018 +0800 kvm/x86 : add coalesced pio support Coalesced pio is based on coalesced mmio and can be used for some port like rtc port, pci-host config port and so on. Specially in case of rtc as coalesced pio, some versions of windows guest access rtc frequently because of rtc as system tick. guest access rtc like this: write register index to 0x70, then write or read data from 0x71. writing 0x70 port is just as index and do nothing else. So we can use coalesced pio to handle this scene to reduce VM-EXIT time. When starting and closing a virtual machine, it will access pci-host config port frequently. So setting these port as coalesced pio can reduce startup and shutdown time. without my patch, get the vm-exit time of accessing rtc 0x70 and piix 0xcf8 using perf tools: (guest OS : windows 7 64bit) IO Port Access Samples Samples% Time% Min Time Max Time Avg time 0x70:POUT 86 30.99% 74.59% 9us 29us 10.75us (+- 3.41%) 0xcf8:POUT 1119 2.60% 2.12% 2.79us 56.83us 3.41us (+- 2.23%) with my patch IO Port Access Samples Samples% Time% Min Time Max Time Avg time 0x70:POUT 106 32.02% 29.47% 0us 10us 1.57us (+- 7.38%) 0xcf8:POUT 1065 1.67% 0.28% 0.41us 65.44us 0.66us (+- 10.55%) Signed-off-by: Peng Hao Signed-off-by: Paolo Bonzini commit 9943450b7b8831c5045362eed45f6fefd1986d72 Author: Peng Hao Date: Sun Oct 14 07:09:56 2018 +0800 kvm/x86 : add document for coalesced mmio Signed-off-by: Peng Hao Signed-off-by: Paolo Bonzini commit 39337ad1a783b8f2d3a708d62dc094dc5d8c9f29 Author: Peng Hao Date: Thu Oct 4 11:45:00 2018 -0400 kvm/x86 : fix some typo Signed-off-by: Peng Hao Signed-off-by: Paolo Bonzini commit a5c214dad1985092bd21c38c2a78befed9b02294 Author: Lan Tianyu Date: Sat Oct 13 22:54:05 2018 +0800 KVM/VMX: Change hv flush logic when ept tables are mismatched. If ept table pointers are mismatched, flushing tlb for each vcpus via hv flush interface still helps to reduce vmexits which are triggered by IPI and INEPT emulation. Signed-off-by: Lan Tianyu Signed-off-by: Paolo Bonzini commit 44c2d667ce3fa6933ac30a726f148f0c6d84ce5f Author: Uros Bizjak Date: Thu Oct 11 19:40:45 2018 +0200 KVM/x86: Use 32bit xor to clear register x86_64 zero-extends 32bit xor to a full 64bit register. Use %k asm operand modifier to force 32bit register and save 268 bytes in kvm.o Signed-off-by: Uros Bizjak Signed-off-by: Paolo Bonzini commit 4b1e54786e4862d3110bbfb27999c2c795013007 Author: Uros Bizjak Date: Thu Oct 11 19:40:44 2018 +0200 KVM/x86: Use assembly instruction mnemonics instead of .byte streams Recently the minimum required version of binutils was changed to 2.20, which supports all VMX instruction mnemonics. The patch removes all .byte #defines and uses real instruction mnemonics instead. The compiler is now able to pass memory operand to the instruction, so there is no need for memory clobber anymore. Also, the compiler adds CC register clobber automatically to all extended asm clauses, so the patch also removes explicit CC clobber. The immediate benefit of the patch is removal of many unnecesary register moves, resulting in 1434 saved bytes in vmx.o: text data bss dec hex filename 151257 18246 8500 178003 2b753 vmx.o 152691 18246 8500 179437 2bced vmx-old.o Some examples of improvement include removal of unneeded moves of %rsp to %rax in front of invept and invvpid instructions: a57e: b9 01 00 00 00 mov $0x1,%ecx a583: 48 89 04 24 mov %rax,(%rsp) a587: 48 89 e0 mov %rsp,%rax a58a: 48 c7 44 24 08 00 00 movq $0x0,0x8(%rsp) a591: 00 00 a593: 66 0f 38 80 08 invept (%rax),%rcx to: a45c: 48 89 04 24 mov %rax,(%rsp) a460: b8 01 00 00 00 mov $0x1,%eax a465: 48 c7 44 24 08 00 00 movq $0x0,0x8(%rsp) a46c: 00 00 a46e: 66 0f 38 80 04 24 invept (%rsp),%rax and the ability to use more optimal registers and memory operands in the instruction: 8faa: 48 8b 44 24 28 mov 0x28(%rsp),%rax 8faf: 4c 89 c2 mov %r8,%rdx 8fb2: 0f 79 d0 vmwrite %rax,%rdx to: 8e7c: 44 0f 79 44 24 28 vmwrite 0x28(%rsp),%r8 Signed-off-by: Uros Bizjak Signed-off-by: Paolo Bonzini commit 5ebb272b2ea7e02911a03a893f8d922d49f9bb4a Author: Uros Bizjak Date: Thu Oct 11 19:40:43 2018 +0200 KVM/x86: Fix invvpid and invept register operand size in 64-bit mode Register operand size of invvpid and invept instruction in 64-bit mode has always 64 bits. Adjust inline function argument type to reflect correct size. Signed-off-by: Uros Bizjak Signed-off-by: Paolo Bonzini commit bf627a9288372d065f157ea445d11b900575193e Author: Vitaly Kuznetsov Date: Mon Oct 8 21:28:13 2018 +0200 x86/kvm/mmu: check if MMU reconfiguration is needed in init_kvm_nested_mmu() We don't use root page role for nested_mmu, however, optimizing out re-initialization in case nothing changed is still valuable as this is done for every nested vmentry. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 7dcd575520082f186231777f4ac9f59ce14d6961 Author: Vitaly Kuznetsov Date: Mon Oct 8 21:28:12 2018 +0200 x86/kvm/mmu: check if tdp/shadow MMU reconfiguration is needed MMU reconfiguration in init_kvm_tdp_mmu()/kvm_init_shadow_mmu() can be avoided if the source data used to configure it didn't change; enhance MMU extended role with the required fields and consolidate common code in kvm_calc_mmu_role_common(). Signed-off-by: Vitaly Kuznetsov Reviewed-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit a336282d7753a92ced7b8e52ff959929f6e550ff Author: Vitaly Kuznetsov Date: Mon Oct 8 21:28:11 2018 +0200 x86/kvm/nVMX: introduce source data cache for kvm_init_shadow_ept_mmu() MMU re-initialization is expensive, in particular, update_permission_bitmask() and update_pkru_bitmask() are. Cache the data used to setup shadow EPT MMU and avoid full re-init when it is unchanged. Signed-off-by: Vitaly Kuznetsov Sean Christopherson Signed-off-by: Paolo Bonzini commit 36d9594dfbf22a59adb986d85e0543886ab898f2 Author: Vitaly Kuznetsov Date: Mon Oct 8 21:28:10 2018 +0200 x86/kvm/mmu: make space for source data caching in struct kvm_mmu In preparation to MMU reconfiguration avoidance we need a space to cache source data. As this partially intersects with kvm_mmu_page_role, create 64bit sized union kvm_mmu_role holding both base and extended data. No functional change. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit e173299101affc677db085b2894a43be4a17a94b Author: Paolo Bonzini Date: Mon Oct 8 21:28:09 2018 +0200 x86/kvm/mmu: get rid of redundant kvm_mmu_setup() Just inline the contents into the sole caller, kvm_init_mmu is now public. Suggested-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini Reviewed-by: Sean Christopherson commit 14c07ad89f4d728a468caaea6a769c018c2b8dd6 Author: Vitaly Kuznetsov Date: Mon Oct 8 21:28:08 2018 +0200 x86/kvm/mmu: introduce guest_mmu When EPT is used for nested guest we need to re-init MMU as shadow EPT MMU (nested_ept_init_mmu_context() does that). When we return back from L2 to L1 kvm_mmu_reset_context() in nested_vmx_load_cr3() resets MMU back to normal TDP mode. Add a special 'guest_mmu' so we can use separate root caches; the improved hit rate is not very important for single vCPU performance, but it avoids contention on the mmu_lock for many vCPUs. On the nested CPUID benchmark, with 16 vCPUs, an L2->L1->L2 vmexit goes from 42k to 26k cycles. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 6a82cd1c7b1e38d3b940fcb35a81e902dd52fb35 Author: Vitaly Kuznetsov Date: Mon Oct 8 21:28:07 2018 +0200 x86/kvm/mmu.c: add kvm_mmu parameter to kvm_mmu_free_roots() Add an option to specify which MMU root we want to free. This will be used when nested and non-nested MMUs for L1 are split. Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini Reviewed-by: Sean Christopherson commit 3dc773e745234d904b09da37075200ec46af4e7a Author: Vitaly Kuznetsov Date: Mon Oct 8 21:28:06 2018 +0200 x86/kvm/mmu.c: set get_pdptr hook in kvm_init_shadow_ept_mmu() kvm_init_shadow_ept_mmu() doesn't set get_pdptr() hook and is this not a problem just because MMU context is already initialized and this hook points to kvm_pdptr_read(). As we're intended to use a dedicated MMU for shadow EPT MMU set this hook explicitly. Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini Reviewed-by: Sean Christopherson commit 44dd3ffa7bb31126e0fc4f6f30398546eb494388 Author: Vitaly Kuznetsov Date: Mon Oct 8 21:28:05 2018 +0200 x86/kvm/mmu: make vcpu->mmu a pointer to the current MMU As a preparation to full MMU split between L1 and L2 make vcpu->arch.mmu a pointer to the currently used mmu. For now, this is always vcpu->arch.root_mmu. No functional change. Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini Reviewed-by: Sean Christopherson commit 0e0a53c551317654e2d7885fdfd23299fee99b6b Author: Paolo Bonzini Date: Wed Aug 22 19:59:33 2018 +0200 kvm: x86: optimize dr6 restore The quote from the comment almost says it all: we are currently zeroing the guest dr6 in kvm_arch_vcpu_put, because do_debug expects it. However, the host %dr6 is either: - zero because the guest hasn't run after kvm_arch_vcpu_load - written from vcpu->arch.dr6 by vcpu_enter_guest - written by the guest and copied to vcpu->arch.dr6 by ->sync_dirty_debug_regs(). Therefore, we can skip the write if vcpu->arch.dr6 is already zero. We may do extra useless writes if vcpu->arch.dr6 is nonzero but the guest hasn't run; however that is less important for performance. Signed-off-by: Paolo Bonzini commit f21dd494506ad002a5b6b32e50a5d4ccac6929fe Author: Vitaly Kuznetsov Date: Wed Oct 10 17:14:38 2018 +0200 KVM: x86: hyperv: optimize sparse VP set processing Rewrite kvm_hv_flush_tlb()/send_ipi_vcpus_mask() making them cleaner and somewhat more optimal. hv_vcpu_in_sparse_set() is converted to sparse_set_to_vcpu_mask() which copies sparse banks u64-at-a-time and then, depending on the num_mismatched_vp_indexes value, returns immediately or does vp index to vcpu index conversion by walking all vCPUs. To support the change and make kvm_hv_send_ipi() look similar to kvm_hv_flush_tlb() send_ipi_vcpus_mask() is introduced. Suggested-by: Roman Kagan Signed-off-by: Vitaly Kuznetsov Reviewed-by: Roman Kagan Signed-off-by: Paolo Bonzini commit e6b6c483ebe9b3f82710fc39eff5531b4d80b089 Author: Vitaly Kuznetsov Date: Mon Oct 8 19:19:04 2018 +0200 KVM: x86: hyperv: fix 'tlb_lush' typo Regardless of whether your TLB is lush or not it still needs flushing. Reported-by: Roman Kagan Reviewed-by: Roman Kagan Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 2768c0cc4ad591d846568a989bcdf2c49660a97e Author: Sean Christopherson Date: Wed Sep 26 09:23:58 2018 -0700 KVM: nVMX: WARN if nested run hits VMFail with early consistency checks enabled When early consistency checks are enabled, all VMFail conditions should be caught by nested_vmx_check_vmentry_hw(). Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 52017608da33182d0c8b397b21c95f8afab37784 Author: Sean Christopherson Date: Wed Sep 26 09:23:57 2018 -0700 KVM: nVMX: add option to perform early consistency checks via H/W KVM defers many VMX consistency checks to the CPU, ostensibly for performance reasons[1], including checks that result in VMFail (as opposed to VMExit). This behavior may be undesirable for some users since this means KVM detects certain classes of VMFail only after it has processed guest state, e.g. emulated MSR load-on-entry. Because there is a strict ordering between checks that cause VMFail and those that cause VMExit, i.e. all VMFail checks are performed before any checks that cause VMExit, we can detect (almost) all VMFail conditions via a dry run of sorts. The almost qualifier exists because some state in vmcs02 comes from L0, e.g. VPID, which means that hardware will never detect an invalid VPID in vmcs12 because it never sees said value. Software must (continue to) explicitly check such fields. After preparing vmcs02 with all state needed to pass the VMFail consistency checks, optionally do a "test" VMEnter with an invalid GUEST_RFLAGS. If the VMEnter results in a VMExit (due to bad guest state), then we can safely say that the nested VMEnter should not VMFail, i.e. any VMFail encountered in nested_vmx_vmexit() must be due to an L0 bug. GUEST_RFLAGS is used to induce VMExit as it is unconditionally loaded on all implementations of VMX, has an invalid value that is writable on a 32-bit system and its consistency check is performed relatively early in all implementations (the exact order of consistency checks is micro-architectural). Unfortunately, since the "passing" case causes a VMExit, KVM must be extra diligent to ensure that host state is restored, e.g. DR7 and RFLAGS are reset on VMExit. Failure to restore RFLAGS.IF is particularly fatal. And of course the extra VMEnter and VMExit impacts performance. The raw overhead of the early consistency checks is ~6% on modern hardware (though this could easily vary based on configuration), while the added latency observed from the L1 VMM is ~10%. The early consistency checks do not occur in a vacuum, e.g. spending more time in L0 can lead to more interrupts being serviced while emulating VMEnter, thereby increasing the latency observed by L1. Add a module param, early_consistency_checks, to provide control over whether or not VMX performs the early consistency checks. In addition to standard on/off behavior, the param accepts a value of -1, which is essentialy an "auto" setting whereby KVM does the early checks only when it thinks it's running on bare metal. When running nested, doing early checks is of dubious value since the resulting behavior is heavily dependent on L0. In the future, the "auto" setting could also be used to default to skipping the early hardware checks for certain configurations/platforms if KVM reaches a state where it has 100% coverage of VMFail conditions. [1] To my knowledge no one has implemented and tested full software emulation of the VMFail consistency checks. Until that happens, one can only speculate about the actual performance overhead of doing all VMFail consistency checks in software. Obviously any code is slower than no code, but in the grand scheme of nested virtualization it's entirely possible the overhead is negligible. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 5a5e8a15d76e6dd62e3a94fea499057bd048abbc Author: Sean Christopherson Date: Wed Sep 26 09:23:56 2018 -0700 KVM: vmx: write HOST_IA32_EFER in vmx_set_constant_host_state() EFER is constant in the host and writing it once during setup means we can skip writing the host value in add_atomic_switch_msr_special(). Signed-off-by: Sean Christopherson Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 09abb5e3e5e50eef72b09adaa798b7ef0ce9239b Author: Sean Christopherson Date: Wed Sep 26 09:23:55 2018 -0700 KVM: nVMX: call kvm_skip_emulated_instruction in nested_vmx_{fail,succeed} ... as every invocation of nested_vmx_{fail,succeed} is immediately followed by a call to kvm_skip_emulated_instruction(). This saves a bit of code and eliminates some silly paths, e.g. nested_vmx_run() ended up with a goto label purely used to call and return kvm_skip_emulated_instruction(). Signed-off-by: Sean Christopherson Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit c37a6116d85c7eda541769a2b3ba4c6c9164002e Author: Sean Christopherson Date: Wed Sep 26 09:23:54 2018 -0700 KVM: nVMX: do not call nested_vmx_succeed() for consistency check VMExit EFLAGS is set to a fixed value on VMExit, calling nested_vmx_succeed() is unnecessary and wrong. Signed-off-by: Sean Christopherson Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit cb61de2f4819b248dfb3f1380e046ab1276c5227 Author: Sean Christopherson Date: Wed Sep 26 09:23:53 2018 -0700 KVM: nVMX: do not skip VMEnter instruction that succeeds A successful VMEnter is essentially a fancy indirect branch that pulls the target RIP from the VMCS. Skipping the instruction is unnecessary (RIP will get overwritten by the VMExit handler) and is problematic because it can incorrectly suppress a #DB due to EFLAGS.TF when a VMFail is detected by hardware (happens after we skip the instruction). Now that vmx_nested_run() is not prematurely skipping the instr, use the full kvm_skip_emulated_instruction() in the VMFail path of nested_vmx_vmexit(). We also need to explicitly update the GUEST_INTERRUPTIBILITY_INFO when loading vmcs12 host state. Signed-off-by: Sean Christopherson Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 16fb9a46c54d1617dbc9b6baf0538abf9c004421 Author: Sean Christopherson Date: Wed Sep 26 09:23:52 2018 -0700 KVM: nVMX: do early preparation of vmcs02 before check_vmentry_postreqs() In anticipation of using vmcs02 to do early consistency checks, move the early preparation of vmcs02 prior to checking the postreqs. The downside of this approach is that we'll unnecessary load vmcs02 in the case that check_vmentry_postreqs() fails, but that is essentially our slow path anyways (not actually slow, but it's the path we don't really care about optimizing). Signed-off-by: Sean Christopherson Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 9d6105b2b59fbe899eb07ff03d3993ba910f8b85 Author: Sean Christopherson Date: Wed Sep 26 09:23:51 2018 -0700 KVM: nVMX: initialize vmcs02 constant exactly once (per VMCS) Add a dedicated flag to track if vmcs02 has been initialized, i.e. the constant state for vmcs02 has been written to the backing VMCS. The launched flag (in struct loaded_vmcs) gets cleared on logical CPU migration to mirror hardware behavior[1], i.e. using the launched flag to determine whether or not vmcs02 constant state needs to be initialized results in unnecessarily re-initializing the VMCS when migrating between logical CPUS. [1] The active VMCS needs to be VMCLEARed before it can be migrated to a different logical CPU. Hardware's VMCS cache is per-CPU and is not coherent between CPUs. VMCLEAR flushes the cache so that any dirty data is written back to memory. A side effect of VMCLEAR is that it also clears the VMCS's internal launch flag, which KVM must mirror because VMRESUME must be used to run a previously launched VMCS. Suggested-by: Jim Mattson Signed-off-by: Sean Christopherson Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 09abe32002665f97e61b42af0a045080663e9e7d Author: Sean Christopherson Date: Wed Sep 26 09:23:50 2018 -0700 KVM: nVMX: split pieces of prepare_vmcs02() to prepare_vmcs02_early() Add prepare_vmcs02_early() and move pieces of prepare_vmcs02() to the new function. prepare_vmcs02_early() writes the bits of vmcs02 that a) must be in place to pass the VMFail consistency checks (assuming vmcs12 is valid) and b) are needed recover from a VMExit, e.g. host state that is loaded on VMExit. Splitting the functionality will enable KVM to leverage hardware to do VMFail consistency checks via a dry run of VMEnter and recover from a potential VMExit without having to fully initialize vmcs02. Add prepare_vmcs02_constant_state() to handle writing vmcs02 state that comes from vmcs01 and never changes, i.e. we don't need to rewrite any of the vmcs02 that is effectively constant once defined. Signed-off-by: Sean Christopherson Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 860ff2aa84d386ba3576ef5c6e2b6dcb7de26a05 Author: Sean Christopherson Date: Wed Sep 26 09:23:49 2018 -0700 KVM: VMX: remove ASSERT() on vmx->pml_pg validity vmx->pml_pg is allocated by vmx_create_vcpu() and is only nullified when the vCPU is destroyed by vmx_free_vcpu(). Remove the ASSERTs on vmx->pml_pg, there is no need to carry debug code that provides no value to the current code base. Signed-off-by: Sean Christopherson Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 39f9c3885c70fd08ff0f8031d32d6fb1098f0118 Author: Sean Christopherson Date: Wed Sep 26 09:23:48 2018 -0700 KVM: vVMX: rename label for post-enter_guest_mode consistency check Rename 'fail' to 'vmentry_fail_vmexit_guest_mode' to make it more obvious that it's simply a different entry point to the VMExit path, whose purpose is unwind the updates done prior to calling prepare_vmcs02(). Signed-off-by: Sean Christopherson Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit a633e41e736279c6d3174f52deeb9b8b5fa85e13 Author: Sean Christopherson Date: Wed Sep 26 09:23:47 2018 -0700 KVM: nVMX: assimilate nested_vmx_entry_failure() into nested_vmx_enter_non_root_mode() Handling all VMExits due to failed consistency checks on VMEnter in nested_vmx_enter_non_root_mode() consolidates all relevant code into a single location, and removing nested_vmx_entry_failure() eliminates a confusing function name and label. For a VMEntry, "fail" and its derivatives has a very specific meaning due to the different behavior of a VMEnter VMFail versus VMExit, i.e. it wasn't obvious that nested_vmx_entry_failure() handled VMExit scenarios. Signed-off-by: Sean Christopherson Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 7671ce21b13b9596163a29f4712cb2451a9b97dc Author: Sean Christopherson Date: Wed Sep 26 09:23:46 2018 -0700 KVM: nVMX: move check_vmentry_postreqs() call to nested_vmx_enter_non_root_mode() In preparation of supporting checkpoint/restore for nested state, commit ca0bde28f2ed ("kvm: nVMX: Split VMCS checks from nested_vmx_run()") modified check_vmentry_postreqs() to only perform the guest EFER consistency checks when nested_run_pending is true. But, in the normal nested VMEntry flow, nested_run_pending is only set after check_vmentry_postreqs(), i.e. the consistency check is being skipped. Alternatively, nested_run_pending could be set prior to calling check_vmentry_postreqs() in nested_vmx_run(), but placing the consistency checks in nested_vmx_enter_non_root_mode() allows us to split prepare_vmcs02() and interleave the preparation with the consistency checks without having to change the call sites of nested_vmx_enter_non_root_mode(). In other words, the rest of the consistency check code in nested_vmx_run() will be joining the postreqs checks in future patches. Fixes: ca0bde28f2ed ("kvm: nVMX: Split VMCS checks from nested_vmx_run()") Signed-off-by: Sean Christopherson Cc: Jim Mattson Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit d63907dc7dd11d98c8ffbdaf8311987e5a508744 Author: Sean Christopherson Date: Wed Sep 26 09:23:45 2018 -0700 KVM: nVMX: rename enter_vmx_non_root_mode to nested_vmx_enter_non_root_mode ...to be more consistent with the nested VMX nomenclature. Signed-off-by: Sean Christopherson Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 3df5c37e55c8f9e20d0e9bf01a4e875f72a738f3 Author: Sean Christopherson Date: Wed Sep 26 09:23:44 2018 -0700 KVM: nVMX: try to set EFER bits correctly when initializing controls VM_ENTRY_IA32E_MODE and VM_{ENTRY,EXIT}_LOAD_IA32_EFER will be explicitly set/cleared as needed by vmx_set_efer(), but attempt to get the bits set correctly when intializing the control fields. Setting the value correctly can avoid multiple VMWrites. Signed-off-by: Sean Christopherson Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 02343cf207022ba349a9d66562659fce87144369 Author: Sean Christopherson Date: Wed Sep 26 09:23:43 2018 -0700 KVM: vmx: do not unconditionally clear EFER switching Do not unconditionally call clear_atomic_switch_msr() when updating EFER. This adds up to four unnecessary VMWrites in the case where guest_efer != host_efer, e.g. if the load_on_{entry,exit} bits were already set. Signed-off-by: Sean Christopherson Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit b7031fd40fcc741b0f9b0c04c8d844e445858b84 Author: Sean Christopherson Date: Wed Sep 26 09:23:42 2018 -0700 KVM: nVMX: reset cache/shadows when switching loaded VMCS Reset the vm_{entry,exit}_controls_shadow variables as well as the segment cache after loading a new VMCS in vmx_switch_vmcs(). The shadows/cache track VMCS data, i.e. they're stale every time we switch to a new VMCS regardless of reason. This fixes a bug where stale control shadows would be consumed after a nested VMExit due to a failed consistency check. Suggested-by: Jim Mattson Signed-off-by: Sean Christopherson Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 1abf23fb42f55eece2eefeea1b32aca865a14099 Author: Sean Christopherson Date: Wed Sep 26 09:23:41 2018 -0700 KVM: nVMX: use vm_exit_controls_init() to write exit controls for vmcs02 Write VM_EXIT_CONTROLS using vm_exit_controls_init() when configuring vmcs02, otherwise vm_exit_controls_shadow will be stale. EFER in particular can be corrupted if VM_EXIT_LOAD_IA32_EFER is not updated due to an incorrect shadow optimization, which can crash L0 due to EFER not being loaded on exit. This does not occur with the current code base simply because update_transition_efer() unconditionally clears VM_EXIT_LOAD_IA32_EFER before conditionally setting it, and because a nested guest always starts with VM_EXIT_LOAD_IA32_EFER clear, i.e. we'll only ever unnecessarily clear the bit. That is, until someone optimizes update_transition_efer()... Signed-off-by: Sean Christopherson Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 923ca1323196fe727907d4d9e704d7d32a1adbd3 Author: Marcel Ziswiler Date: Tue Aug 14 11:18:05 2018 +0200 clk: tegra: probe deferral error reporting Actually report the error code from devm_regulator_get() which may as well just be a probe deferral. Signed-off-by: Marcel Ziswiler Reviewed-by: Stefan Agner Signed-off-by: Stephen Boyd commit 5b8ba41dafd789a64cdfb2b5ab6b0eb71f821cfc Author: Sean Christopherson Date: Wed Sep 26 09:23:40 2018 -0700 KVM: nVMX: move vmcs12 EPTP consistency check to check_vmentry_prereqs() An invalid EPTP causes a VMFail(VMXERR_ENTRY_INVALID_CONTROL_FIELD), not a VMExit. Signed-off-by: Sean Christopherson Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 64a919f7b5d0593227d0ea7976949c1248ec36ba Author: Sean Christopherson Date: Wed Sep 26 09:23:39 2018 -0700 KVM: nVMX: move host EFER consistency checks to VMFail path Invalid host state related to loading EFER on VMExit causes a VMFail(VMXERR_ENTRY_INVALID_HOST_STATE_FIELD), not a VMExit. Signed-off-by: Sean Christopherson Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 31fc4f95dddc4ebc9f9596a2720662e15e5d444e Author: Wei Yang Date: Wed Aug 22 21:57:11 2018 +0800 KVM: leverage change to adjust slots->used_slots in update_memslots() update_memslots() is only called by __kvm_set_memory_region(), in which "change" is calculated and indicates how to adjust slots->used_slots * increase by one if it is KVM_MR_CREATE * decrease by one if it is KVM_MR_DELETE * not change for others This patch adjusts slots->used_slots in update_memslots() based on "change" value instead of re-calculate those states again. Signed-off-by: Wei Yang Signed-off-by: Paolo Bonzini commit 3c6e099fa15fdb6fb1892199ed8709012e1294f2 Author: Jim Mattson Date: Thu Sep 13 11:54:48 2018 -0700 KVM: nVMX: Always reflect #NM VM-exits to L1 When bit 3 (corresponding to CR0.TS) of the VMCS12 cr0_guest_host_mask field is clear, the VMCS12 guest_cr0 field does not necessarily hold the current value of the L2 CR0.TS bit, so the code that checked for L2's CR0.TS bit being set was incorrect. Moreover, I'm not sure that the CR0.TS check was adequate. (What if L2's CR0.EM was set, for instance?) Fortunately, lazy FPU has gone away, so L0 has lost all interest in intercepting #NM exceptions. See commit bd7e5b0899a4 ("KVM: x86: remove code for lazy FPU handling"). Therefore, there is no longer any question of which hypervisor gets first dibs. The #NM VM-exit should always be reflected to L1. (Note that the corresponding bit must be set in the VMCS12 exception_bitmap field for there to be an #NM VM-exit at all.) Fixes: ccf9844e5d99c ("kvm, vmx: Really fix lazy FPU on nested guest") Reported-by: Abhiroop Dabral Signed-off-by: Jim Mattson Reviewed-by: Peter Shier Tested-by: Abhiroop Dabral Reviewed-by: Liran Alon Signed-off-by: Paolo Bonzini commit 214ff83d4473a7757fa18a64dc7efe3b0e158486 Author: Vitaly Kuznetsov Date: Wed Sep 26 19:02:59 2018 +0200 KVM: x86: hyperv: implement PV IPI send hypercalls Using hypercall for sending IPIs is faster because this allows to specify any number of vCPUs (even > 64 with sparse CPU set), the whole procedure will take only one VMEXIT. Current Hyper-V TLFS (v5.0b) claims that HvCallSendSyntheticClusterIpi hypercall can't be 'fast' (passing parameters through registers) but apparently this is not true, Windows always uses it as 'fast' so we need to support that. Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 2cefc5feb80cf4237890a6a4582a0d20e50d9ced Author: Vitaly Kuznetsov Date: Wed Sep 26 19:02:58 2018 +0200 KVM: x86: hyperv: optimize kvm_hv_flush_tlb() for vp_index == vcpu_idx case VP inedx almost always matches VCPU and when it does it's faster to walk the sparse set instead of all vcpus. Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini commit 0b0a31badb2d98967175c6812ac81db20f9a67fc Author: Vitaly Kuznetsov Date: Wed Sep 26 19:02:57 2018 +0200 KVM: x86: hyperv: valid_bank_mask should be 'u64' This probably doesn't matter much (KVM_MAX_VCPUS is much lower nowadays) but valid_bank_mask is really u64 and not unsigned long. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Roman Kagan Signed-off-by: Paolo Bonzini commit 87ee613d076351950b74383215437f841ebbeb75 Author: Vitaly Kuznetsov Date: Wed Sep 26 19:02:56 2018 +0200 KVM: x86: hyperv: keep track of mismatched VP indexes In most common cases VP index of a vcpu matches its vcpu index. Userspace is, however, free to set any mapping it wishes and we need to account for that when we need to find a vCPU with a particular VP index. To keep search algorithms optimal in both cases introduce 'num_mismatched_vp_indexes' counter showing how many vCPUs with mismatching VP index we have. In case the counter is zero we can assume vp_index == vcpu_idx. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Roman Kagan Signed-off-by: Paolo Bonzini commit 1779a39f786397760ae7a7cc03cf37697d8ae58d Author: Vitaly Kuznetsov Date: Wed Sep 26 19:02:55 2018 +0200 KVM: x86: hyperv: consistently use 'hv_vcpu' for 'struct kvm_vcpu_hv' variables Rename 'hv' to 'hv_vcpu' in kvm_hv_set_msr/kvm_hv_get_msr(); 'hv' is 'reserved' for 'struct kvm_hv' variables across the file. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Roman Kagan Signed-off-by: Paolo Bonzini commit a812297c4fd9c2c9337b451ad8d66083c5b24ceb Author: Vitaly Kuznetsov Date: Wed Aug 22 12:18:29 2018 +0200 KVM: x86: hyperv: optimize 'all cpus' case in kvm_hv_flush_tlb() We can use 'NULL' to represent 'all cpus' case in kvm_make_vcpus_request_mask() and avoid building vCPU mask with all vCPUs. Suggested-by: Radim Krčmář Signed-off-by: Vitaly Kuznetsov Reviewed-by: Roman Kagan Signed-off-by: Paolo Bonzini commit 9170200ec0ebad70e5b9902bc93e2b1b11456a3b Author: Vitaly Kuznetsov Date: Wed Aug 22 12:18:28 2018 +0200 KVM: x86: hyperv: enforce vp_index < KVM_MAX_VCPUS Hyper-V TLFS (5.0b) states: > Virtual processors are identified by using an index (VP index). The > maximum number of virtual processors per partition supported by the > current implementation of the hypervisor can be obtained through CPUID > leaf 0x40000005. A virtual processor index must be less than the > maximum number of virtual processors per partition. Forbid userspace to set VP_INDEX above KVM_MAX_VCPUS. get_vcpu_by_vpidx() can now be optimized to bail early when supplied vpidx is >= KVM_MAX_VCPUS. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Roman Kagan Signed-off-by: Paolo Bonzini commit 0624fca9512d08cbd9b5d098d904c840d3432404 Author: Paolo Bonzini Date: Mon Oct 1 16:07:18 2018 +0200 kvm/x86: return meaningful value from KVM_SIGNAL_MSI If kvm_apic_map_get_dest_lapic() finds a disabled LAPIC, it will return with bitmap==0 and (*r == -1) will be returned to userspace. QEMU may then record "KVM: injection failed, MSI lost (Operation not permitted)" in its log, which is quite puzzling. Reported-by: Peng Hao Signed-off-by: Paolo Bonzini commit 4fef0f491347785dfd4cca206b80f75c4ec2dc9f Author: Wei Yang Date: Fri Sep 28 22:08:50 2018 +0800 KVM: x86: move definition PT_MAX_HUGEPAGE_LEVEL and KVM_NR_PAGE_SIZES together Currently, there are two definitions related to huge page, but a little bit far from each other and seems loosely connected: * KVM_NR_PAGE_SIZES defines the number of different size a page could map * PT_MAX_HUGEPAGE_LEVEL means the maximum level of huge page The number of different size a page could map equals the maximum level of huge page, which is implied by current definition. While current implementation may not be kind to readers and further developers: * KVM_NR_PAGE_SIZES looks like a stand alone definition at first sight * in case we need to support more level, two places need to change This patch tries to make these two definition more close, so that reader and developer would feel more comfortable to manipulate. Signed-off-by: Wei Yang Signed-off-by: Paolo Bonzini commit aaa45da24e5d8f3906a6500a3e0da64877d69f04 Author: Tianyu Lan Date: Fri Sep 28 12:45:16 2018 +0000 KVM/VMX: Remve unused function is_external_interrupt(). is_external_interrupt() is not used now and so remove it. Signed-off-by: Lan Tianyu Signed-off-by: Paolo Bonzini commit daefb7949e661e2ee5e40dc5ca51e5bf42f6c823 Author: Wei Yang Date: Tue Sep 4 23:57:32 2018 +0800 KVM: x86: return 0 in case kvm_mmu_memory_cache has min number of objects The code tries to pre-allocate *min* number of objects, so it is ok to return 0 when the kvm_mmu_memory_cache meets the requirement. Signed-off-by: Wei Yang Signed-off-by: Paolo Bonzini commit 55c1dcd80bdf0e9cf30a963fffd3131145f26938 Author: Krish Sadhukhan Date: Thu Sep 27 14:33:27 2018 -0400 nVMX x86: Make nested_vmx_check_pml_controls() concise Suggested-by: Jim Mattson Signed-off-by: Krish Sadhukhan Reviewed-by: Mark Kanda Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 3ff519f29d98ecdc1961d825d105d68711093b6b Author: Wei Yang Date: Thu Sep 6 05:58:16 2018 +0800 KVM: x86: adjust kvm_mmu_page member to save 8 bytes On a 64bits machine, struct is naturally aligned with 8 bytes. Since kvm_mmu_page member *unsync* and *role* are less then 4 bytes, we can rearrange the sequence to compace the struct. As the comment shows, *role* and *gfn* are used to key the shadow page. In order to keep the comment valid, this patch moves the *unsync* up and exchange the position of *role* and *gfn*. From /proc/slabinfo, it shows the size of kvm_mmu_page is 8 bytes less and with one more object per slap after applying this patch. # name kvm_mmu_page_header 0 0 168 24 kvm_mmu_page_header 0 0 160 25 Signed-off-by: Wei Yang Signed-off-by: Paolo Bonzini commit bd18bffca35397214ae68d85cf7203aca25c3c1d Author: Sean Christopherson Date: Wed Aug 22 14:57:07 2018 -0700 KVM: nVMX: restore host state in nested_vmx_vmexit for VMFail A VMEnter that VMFails (as opposed to VMExits) does not touch host state beyond registers that are explicitly noted in the VMFail path, e.g. EFLAGS. Host state does not need to be loaded because VMFail is only signaled for consistency checks that occur before the CPU starts to load guest state, i.e. there is no need to restore any state as nothing has been modified. But in the case where a VMFail is detected by hardware and not by KVM (due to deferring consistency checks to hardware), KVM has already loaded some amount of guest state. Luckily, "loaded" only means loaded to KVM's software model, i.e. vmcs01 has not been modified. So, unwind our software model to the pre-VMEntry host state. Not restoring host state in this VMFail path leads to a variety of failures because we end up with stale data in vcpu->arch, e.g. CR0, CR4, EFER, etc... will all be out of sync relative to vmcs01. Any significant delta in the stale data is all but guaranteed to crash L1, e.g. emulation of SMEP, SMAP, UMIP, WP, etc... will be wrong. An alternative to this "soft" reload would be to load host state from vmcs12 as if we triggered a VMExit (as opposed to VMFail), but that is wildly inconsistent with respect to the VMX architecture, e.g. an L1 VMM with separate VMExit and VMFail paths would explode. Note that this approach does not mean KVM is 100% accurate with respect to VMX hardware behavior, even at an architectural level (the exact order of consistency checks is microarchitecture specific). But 100% emulation accuracy isn't the goal (with this patch), rather the goal is to be consistent in the information delivered to L1, e.g. a VMExit should not fall-through VMENTER, and a VMFail should not jump to HOST_RIP. This technically reverts commit "5af4157388ad (KVM: nVMX: Fix mmu context after VMLAUNCH/VMRESUME failure)", but retains the core aspects of that patch, just in an open coded form due to the need to pull state from vmcs01 instead of vmcs12. Restoring host state resolves a variety of issues introduced by commit "4f350c6dbcb9 (kvm: nVMX: Handle deferred early VMLAUNCH/VMRESUME failure properly)", which remedied the incorrect behavior of treating VMFail like VMExit but in doing so neglected to restore arch state that had been modified prior to attempting nested VMEnter. A sample failure that occurs due to stale vcpu.arch state is a fault of some form while emulating an LGDT (due to emulated UMIP) from L1 after a failed VMEntry to L3, in this case when running the KVM unit test test_tpr_threshold_values in L1. L0 also hits a WARN in this case due to a stale arch.cr4.UMIP. L1: BUG: unable to handle kernel paging request at ffffc90000663b9e PGD 276512067 P4D 276512067 PUD 276513067 PMD 274efa067 PTE 8000000271de2163 Oops: 0009 [#1] SMP CPU: 5 PID: 12495 Comm: qemu-system-x86 Tainted: G W 4.18.0-rc2+ #2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:native_load_gdt+0x0/0x10 ... Call Trace: load_fixmap_gdt+0x22/0x30 __vmx_load_host_state+0x10e/0x1c0 [kvm_intel] vmx_switch_vmcs+0x2d/0x50 [kvm_intel] nested_vmx_vmexit+0x222/0x9c0 [kvm_intel] vmx_handle_exit+0x246/0x15a0 [kvm_intel] kvm_arch_vcpu_ioctl_run+0x850/0x1830 [kvm] kvm_vcpu_ioctl+0x3a1/0x5c0 [kvm] do_vfs_ioctl+0x9f/0x600 ksys_ioctl+0x66/0x70 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x4f/0x100 entry_SYSCALL_64_after_hwframe+0x44/0xa9 L0: WARNING: CPU: 2 PID: 3529 at arch/x86/kvm/vmx.c:6618 handle_desc+0x28/0x30 [kvm_intel] ... CPU: 2 PID: 3529 Comm: qemu-system-x86 Not tainted 4.17.2-coffee+ #76 Hardware name: Intel Corporation Kabylake Client platform/KBL S RIP: 0010:handle_desc+0x28/0x30 [kvm_intel] ... Call Trace: kvm_arch_vcpu_ioctl_run+0x863/0x1840 [kvm] kvm_vcpu_ioctl+0x3a1/0x5c0 [kvm] do_vfs_ioctl+0x9f/0x5e0 ksys_ioctl+0x66/0x70 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x49/0xf0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: 5af4157388ad (KVM: nVMX: Fix mmu context after VMLAUNCH/VMRESUME failure) Fixes: 4f350c6dbcb9 (kvm: nVMX: Handle deferred early VMLAUNCH/VMRESUME failure properly) Cc: Jim Mattson Cc: Krish Sadhukhan Cc: Paolo Bonzini Cc: Radim KrÄmář Cc: Wanpeng Li Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit cfb634fe3052aefc4e1360fa322018c9a0b49755 Author: Jim Mattson Date: Fri Sep 21 10:36:17 2018 -0700 KVM: nVMX: Clear reserved bits of #DB exit qualification According to volume 3 of the SDM, bits 63:15 and 12:4 of the exit qualification field for debug exceptions are reserved (cleared to 0). However, the SDM is incorrect about bit 16 (corresponding to DR6.RTM). This bit should be set if a debug exception (#DB) or a breakpoint exception (#BP) occurred inside an RTM region while advanced debugging of RTM transactional regions was enabled. Note that this is the opposite of DR6.RTM, which "indicates (when clear) that a debug exception (#DB) or breakpoint exception (#BP) occurred inside an RTM region while advanced debugging of RTM transactional regions was enabled." There is still an issue with stale DR6 bits potentially being misreported for the current debug exception. DR6 should not have been modified before vectoring the #DB exception, and the "new DR6 bits" should be available somewhere, but it was and they aren't. Fixes: b96fb439774e1 ("KVM: nVMX: fixes to nested virt interrupt injection") Signed-off-by: Jim Mattson Reviewed-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 5b8ee8792f6bda46978e6e86fda4650bcbae07ab Author: Andrew Jones Date: Tue Sep 18 19:54:36 2018 +0200 kvm: selftests: support high GPAs in dirty_log_test Signed-off-by: Andrew Jones Signed-off-by: Paolo Bonzini commit e28934e661c1d9425f1cc41b405dcd8626507206 Author: Andrew Jones Date: Tue Sep 18 19:54:35 2018 +0200 kvm: selftests: stop lying to aarch64 tests about PA-bits Let's add the 40 PA-bit versions of the VM modes, that AArch64 should have been using, so we can extend the dirty log test without breaking things. Signed-off-by: Andrew Jones Signed-off-by: Paolo Bonzini commit e1b376f140ad9cbb1e1976f347377b8ef08a5bc9 Author: Andrew Jones Date: Tue Sep 18 19:54:34 2018 +0200 kvm: selftests: dirty_log_test: also test 64K pages on aarch64 Signed-off-by: Andrew Jones Signed-off-by: Paolo Bonzini commit fff8dcd7b4a242e3752d6f316967b02f933031d0 Author: Andrew Jones Date: Tue Sep 18 19:54:32 2018 +0200 kvm: selftests: port dirty_log_test to aarch64 While we're messing with the code for the port and to support guest page sizes that are less than the host page size, we also make some code formatting cleanups and apply sync_global_to_guest(). Signed-off-by: Andrew Jones Signed-off-by: Paolo Bonzini commit 81d1cca0c062a589953eef7e98f1e68b8222a918 Author: Andrew Jones Date: Tue Sep 18 19:54:33 2018 +0200 kvm: selftests: introduce new VM mode for 64K pages Rename VM_MODE_FLAT48PG to be more descriptive of its config and add a new config that has the same parameters, except with 64K pages. Signed-off-by: Andrew Jones Signed-off-by: Paolo Bonzini commit febb6548498f6c22dfb40d48c7c52b03a4263407 Author: Anson Huang Date: Wed Aug 8 12:39:27 2018 +0800 clk: imx: imx7d: remove clks_init_on array Clock framework will enable those clocks registered with CLK_IS_CRITICAL flag, so no need to have clks_init_on array during clock initialization now. Signed-off-by: Anson Huang Signed-off-by: Stephen Boyd commit 686b8b8c7f99cc9f6c340b14935ccaa8bf1b99af Author: Anson Huang Date: Wed Aug 8 12:39:26 2018 +0800 clk: imx: imx7d: remove unnecessary clocks from clks_init_on array On i.MX7D, IMX7D_NAND_USDHC_BUS_ROOT_CLK is NOT necessary for system, and IMX7D_AHB_CHANNEL_ROOT_CLK is NOT existing at all, remove them from clks_init_on array. Signed-off-by: Anson Huang Signed-off-by: Stephen Boyd commit 0bec140fb6c106a70aac183e5fa99de0ef1d161a Author: Andrew Jones Date: Tue Sep 18 19:54:31 2018 +0200 kvm: selftests: add vcpu support for aarch64 This code adds VM and VCPU setup code for the VM_MODE_FLAT48PG mode. The VM_MODE_FLAT48PG isn't yet fully supportable, as it defines the guest physical address limit as 52-bits, and KVM currently only supports guests with up to 40-bit physical addresses (see KVM_PHYS_SHIFT). VM_MODE_FLAT48PG will work fine, though, as long as no >= 40-bit physical addresses are used. Signed-off-by: Andrew Jones Signed-off-by: Paolo Bonzini commit 7a6629ef746d1a50cc9247bd7c92ce6b38b8ed68 Author: Andrew Jones Date: Tue Sep 18 19:54:30 2018 +0200 kvm: selftests: add virt mem support for aarch64 Signed-off-by: Andrew Jones Signed-off-by: Paolo Bonzini commit d5106539cfef362e3870b6aa8b5ca587cd67e93d Author: Andrew Jones Date: Tue Sep 18 19:54:29 2018 +0200 kvm: selftests: add vm_phy_pages_alloc Signed-off-by: Andrew Jones Signed-off-by: Paolo Bonzini commit eabe7881d264fd8ee074636fe50c8a8af08fedfd Author: Andrew Jones Date: Tue Sep 18 19:54:28 2018 +0200 kvm: selftests: tidy up kvm_util Tidy up kvm-util code: code/comment formatting, remove unused code, and move x86 specific code out. We also move vcpu_dump() out of common code, because not all arches (AArch64) have KVM_GET_REGS. Signed-off-by: Andrew Jones Signed-off-by: Paolo Bonzini commit eea192bfd96db157151d27dd9c5e3e6a50c5d6be Author: Andrew Jones Date: Tue Sep 18 19:54:27 2018 +0200 kvm: selftests: add cscope make target Signed-off-by: Andrew Jones Signed-off-by: Paolo Bonzini commit cc68765d418721ab854a03626c01e8eb82711922 Author: Andrew Jones Date: Tue Sep 18 19:54:26 2018 +0200 kvm: selftests: move arch-specific files to arch-specific locations Signed-off-by: Andrew Jones Signed-off-by: Paolo Bonzini commit 14c47b7530e2db1ab1d42ebbe99b2a58b8443ce7 Author: Andrew Jones Date: Tue Sep 18 19:54:25 2018 +0200 kvm: selftests: introduce ucall Rework the guest exit to userspace code to generalize the concept into what it is, a "hypercall to userspace", and provide two implementations of it: the PortIO version currently used, but only useable by x86, and an MMIO version that other architectures (except s390) can use. Signed-off-by: Andrew Jones Signed-off-by: Paolo Bonzini commit 6c930268bcc4cef62194daf151097d2b94f67718 Author: Andrew Jones Date: Tue Sep 18 19:54:24 2018 +0200 kvm: selftests: vcpu_setup: set cr4.osfxsr Guest code may want to call functions that have variable arguments. To do so, we either need to compile with -mno-sse or enable SSE in the VCPUs. As it should be pretty safe to turn on the feature, and -mno-sse would make linking test code with standard libraries difficult, we choose the feature enabling. Signed-off-by: Andrew Jones Signed-off-by: Paolo Bonzini commit 3b8a5df6c4dc6df2ab17d099fb157032f80bdca2 Author: Wanpeng Li Date: Tue Oct 9 09:02:08 2018 +0800 KVM: LAPIC: Tune lapic_timer_advance_ns automatically In cloud environment, lapic_timer_advance_ns is needed to be tuned for every CPU generations, and every host kernel versions(the kvm-unit-tests/tscdeadline_latency.flat is 5700 cycles for upstream kernel and 9600 cycles for our 3.10 product kernel, both preemption_timer=N, Skylake server). This patch adds the capability to automatically tune lapic_timer_advance_ns step by step, the initial value is 1000ns as 'commit d0659d946be0 ("KVM: x86: add option to advance tscdeadline hrtimer expiration")' recommended, it will be reduced when it is too early, and increased when it is too late. The guest_tsc and tsc_deadline are hard to equal, so we assume we are done when the delta is within a small scope e.g. 100 cycles. This patch reduces latency (kvm-unit-tests/tscdeadline_latency, busy waits, preemption_timer enabled) from ~2600 cyles to ~1200 cyles on our Skylake server. Cc: Paolo Bonzini Cc: Radim Krčmář Cc: Liran Alon Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini commit 0bfe7d3cae58f02a05c39fba6829d6e7b50802f5 Author: Nathan Chancellor Date: Thu Sep 20 17:27:23 2018 -0700 scsi: qla2xxx: Simplify conditional check Clang generates a warning when it sees a logical not followed by a conditional operator like ==, >, or < because it thinks that the logical not should be applied to the whole statement: drivers/scsi/qla2xxx/qla_nx.c:3702:7: warning: logical not is only applied to the left hand side of this comparison [-Wlogical-not-parentheses] if (!qla2x00_eh_wait_for_pending_commands(vha, 0, 0, ^ drivers/scsi/qla2xxx/qla_nx.c:3702:7: note: add parentheses after the '!' to evaluate the comparison first if (!qla2x00_eh_wait_for_pending_commands(vha, 0, 0, ^ ( drivers/scsi/qla2xxx/qla_nx.c:3702:7: note: add parentheses around left hand side expression to silence this warning if (!qla2x00_eh_wait_for_pending_commands(vha, 0, 0, ^ ( 1 warning generated. It assumes the author might have made a mistake in their logic: if (!a == b) -> if (!(a == b)) Sometimes that is the case; other times, it's just a super convoluted way of saying 'if (a)' when b = 0: if (!1 == 0) -> if (0 == 0) -> if (true) Alternatively: if (!1 == 0) -> if (!!1) -> if (1) Simplify this comparison so that Clang doesn't complain. Link: https://github.com/ClangBuiltLinux/linux/issues/80 Signed-off-by: Nathan Chancellor Signed-off-by: Martin K. Petersen commit 9032c10e94fc44bb3245dc7f0d52aeeb3e8715b6 Merge: ab9e08482122 44b6fed0c16e Author: Alexei Starovoitov Date: Tue Oct 16 15:23:59 2018 -0700 Merge branch 'nfp-improve-bpf-offload' Jakub Kicinski says: ==================== this set adds check to make sure offload behaviour is correct. First when atomic counters are used, we must make sure the map does not already contain data we did not prepare for holding atomics. Second patch double checks vNIC capabilities for program offload in case program is shared by multiple vNICs with different constraints. ==================== Signed-off-by: Alexei Starovoitov commit 44b6fed0c16ea0057292d57c381a31e8986fa7a7 Author: Jakub Kicinski Date: Tue Oct 16 15:19:10 2018 -0700 nfp: bpf: double check vNIC capabilities after object sharing Program translation stage checks that program can be offloaded to the netdev which was passed during the load (bpf_attr->prog_ifindex). After program sharing was introduced, however, the netdev on which program is loaded can theoretically be different, and therefore we should recheck the program size and max stack size at load time. This was found by code inspection, AFAIK today all vNICs have identical caps. Signed-off-by: Jakub Kicinski Reviewed-by: Quentin Monnet Signed-off-by: Alexei Starovoitov commit 527db74b71ee5a279f818aae51f2c26b4e5c7648 Author: Jakub Kicinski Date: Tue Oct 16 15:19:09 2018 -0700 nfp: bpf: protect against mis-initializing atomic counters Atomic operations on the NFP are currently always in big endian. The driver keeps track of regions of memory storing atomic values and byte swaps them accordingly. There are corner cases where the map values may be initialized before the driver knows they are used as atomic counters. This can happen either when the datapath is performing the update and the stack contents are unknown or when map is updated before the program which will use it for atomic values is loaded. To avoid situation where user initializes the value to 0 1 2 3 and then after loading a program which uses the word as an atomic counter starts reading 3 2 1 0 - only allow atomic counters to be initialized to endian-neutral values. For updates from the datapath the stack information may not be as precise, so just allow initializing such values to 0. Example code which would break: struct bpf_map_def SEC("maps") rxcnt = { .type = BPF_MAP_TYPE_HASH, .key_size = sizeof(__u32), .value_size = sizeof(__u64), .max_entries = 1, }; int xdp_prog1() { __u64 nonzeroval = 3; __u32 key = 0; __u64 *value; value = bpf_map_lookup_elem(&rxcnt, &key); if (!value) bpf_map_update_elem(&rxcnt, &key, &nonzeroval, BPF_ANY); else __sync_fetch_and_add(value, 1); return XDP_PASS; } $ offload bpftool map dump key: 00 00 00 00 value: 00 00 00 03 00 00 00 00 should be: $ offload bpftool map dump key: 00 00 00 00 value: 03 00 00 00 00 00 00 00 Reported-by: David Beckett Signed-off-by: Jakub Kicinski Reviewed-by: Quentin Monnet Signed-off-by: Alexei Starovoitov commit 6498cbc57f258bc3d079cdae6c22583ce3c174d0 Author: Nathan Chancellor Date: Thu Sep 20 16:02:12 2018 -0700 scsi: bfa: Remove unused functions Clang warns when a variable is assigned to itself. drivers/scsi/bfa/bfa_fcbuild.c:199:6: warning: explicitly assigning value of variable of type 'int' to itself [-Wself-assign] len = len; ~~~ ^ ~~~ drivers/scsi/bfa/bfa_fcbuild.c:838:6: warning: explicitly assigning value of variable of type 'int' to itself [-Wself-assign] len = len; ~~~ ^ ~~~ drivers/scsi/bfa/bfa_fcbuild.c:917:6: warning: explicitly assigning value of variable of type 'int' to itself [-Wself-assign] len = len; ~~~ ^ ~~~ drivers/scsi/bfa/bfa_fcbuild.c:981:6: warning: explicitly assigning value of variable of type 'int' to itself [-Wself-assign] len = len; ~~~ ^ ~~~ drivers/scsi/bfa/bfa_fcbuild.c:1008:6: warning: explicitly assigning value of variable of type 'int' to itself [-Wself-assign] len = len; ~~~ ^ ~~~ 5 warnings generated. This construct is usually used to avoid unused variable warnings, which I assume is the case here. -Wunused-parameter is hidden behind -Wextra with GCC 4.6, which is the minimum version to compile the kernel as of commit cafa0010cd51 ("Raise the minimum required gcc version to 4.6"). However, upon further inspection, these functions aren't actually used anywhere; they're just defined. Rather than just removing the self assignments, remove all of this dead code. Link: https://github.com/ClangBuiltLinux/linux/issues/148 Signed-off-by: Nathan Chancellor Signed-off-by: Martin K. Petersen commit 226dfa4726ebb102479d668e01160a1dc77485e8 Author: Paul Cercueil Date: Thu Aug 23 15:17:44 2018 +0200 clk: Add Ingenic jz4725b CGU driver Add support for the clocks provided by the CGU in the Ingenic JZ4725B SoC. Signed-off-by: Paul Cercueil Signed-off-by: Stephen Boyd commit 3e59790e07a94dc3bef541aa044dde36fdb61714 Author: Nathan Chancellor Date: Thu Sep 20 15:17:06 2018 -0700 scsi: qla2xxx: Remove unnecessary self assignment Clang warns when a variable is assigned to itself. drivers/scsi/qla2xxx/qla_mbx.c:1514:4: warning: explicitly assigning value of variable of type 'uint64_t' (aka 'unsigned long long') to itself [-Wself-assign] l = l; ~ ^ ~ 1 warning generated. This construct is usually used to avoid unused variable warnings, which I assume is the case here. -Wunused-parameter is hidden behind -Wextra with GCC 4.6, which is the minimum version to compile the kernel as of commit cafa0010cd51 ("Raise the minimum required gcc version to 4.6"). Just remove this line to silence Clang. Link: https://github.com/ClangBuiltLinux/linux/issues/83 Signed-off-by: Nathan Chancellor Signed-off-by: Martin K. Petersen commit 2fdecde7752be5696c0ae301a0d1b1884081a0f1 Author: Paul Cercueil Date: Thu Aug 23 15:17:43 2018 +0200 dt-bindings: clock: Add jz4725b-cgu.h header This will be used from the devicetree bindings to specify the clocks that should be obtained from the jz4725b-cgu driver. Signed-off-by: Paul Cercueil Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd commit 067b6dedeb34ffda811ebbadf8bbad9311f28dc4 Author: Paul Cercueil Date: Thu Aug 23 15:17:42 2018 +0200 dt-bindings: clock: ingenic: Explicitly list compatible strings This is better than letting the other developers wondering what are the supported strings. Signed-off-by: Paul Cercueil Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd commit 0880fb86608acf1bbf4df9b3580e5a1b58fe8ba6 Author: Paul Cercueil Date: Thu Aug 23 15:17:41 2018 +0200 clk: ingenic: Add proper Kconfig entries Previously, the CGU code corresponding to the SoC for which we're compiling the kernel was the only one enabled, which made it impossible to build one kernel that supports them all. Now, it is possible to select more than one SoC to support. Signed-off-by: Paul Cercueil Signed-off-by: Stephen Boyd commit ab9e084821221b2eda57a512535fe35b49e672d8 Author: Andrey Ignatov Date: Mon Oct 15 22:50:34 2018 -0700 libbpf: Per-symbol visibility for DSO Make global symbols in libbpf DSO hidden by default with -fvisibility=hidden and export symbols that are part of ABI explicitly with __attribute__((visibility("default"))). This is common practice that should prevent from accidentally exporting a symbol, that is not supposed to be a part of ABI what, in turn, improves both libbpf developer- and user-experiences. See [1] for more details. Export control becomes more important since more and more projects use libbpf. The patch doesn't export a bunch of netlink related functions since as agreed in [2] they'll be reworked. That doesn't break bpftool since bpftool links libbpf statically. [1] https://www.akkadia.org/drepper/dsohowto.pdf (2.2 Export Control) [2] https://www.mail-archive.com/netdev@vger.kernel.org/msg251434.html Signed-off-by: Andrey Ignatov Signed-off-by: Alexei Starovoitov commit 242b4a39be7364979cbccf5bc446d8db45cb2014 Author: YueHaibing Date: Fri Oct 12 10:36:23 2018 +0000 scsi: arcmsr: Remove set but not used variables 'id, lun' Fixes gcc '-Wunused-but-set-variable' warning: drivers/scsi/arcmsr/arcmsr_hba.c: In function 'arcmsr_drain_donequeue': drivers/scsi/arcmsr/arcmsr_hba.c:1320:10: warning: variable 'lun' set but not used [-Wunused-but-set-variable] drivers/scsi/arcmsr/arcmsr_hba.c:1320:6: warning: variable 'id' set but not used [-Wunused-but-set-variable] Never used since introduction in commit ae52e7f09ff5 ("arcmsr: Support 1024 scatter-gather list entries and improve AP while FW trapped and behaviors of EHs"). Signed-off-by: YueHaibing Signed-off-by: Martin K. Petersen commit 652f1813c113a3f5169cd1325201fdf9b2d22ded Author: Shefali Jain Date: Wed Oct 10 20:21:38 2018 +0530 clk: qcom: gcc: Add global clock controller driver for QCS404 Add the clocks supported in global clock controller which clock the peripherals like BLSPs, SDCC, USB, MDSS etc. Register all the clocks to the clock framework for the clients to be able to request for them. Signed-off-by: Shefali Jain Signed-off-by: Taniya Das Co-developed-by: Taniya Das Signed-off-by: Anu Ramanathan [bamse, vkoul: rebase and tidyup for upstream] Signed-off-by: Bjorn Andersson Signed-off-by: Vinod Koul Acked-by: Rob Herring [sboyd@kernel.org: Lowercase hex] Signed-off-by: Stephen Boyd commit a3d152e40ed9061d085f405bc71eba81fce63ad6 Author: Bjorn Andersson Date: Wed Oct 10 20:21:37 2018 +0530 clk: qcom: Export clk_alpha_pll_configure() This is used by the QCS404 GCC driver, export it to allow that driver to be compiled as a module.. Signed-off-by: Bjorn Andersson Signed-off-by: Vinod Koul Signed-off-by: Stephen Boyd commit f2a76a2955c0eb7514cdb5885e3d60a973301ae0 Author: Taniya Das Date: Tue Sep 25 18:35:58 2018 +0100 clk: qcom: Add Global Clock controller (GCC) driver for SDM660 Add support for the global clock controller found on SDM660 based devices. This should allow most non-multimedia device drivers to probe and control their clocks. Based on CAF implementation. Signed-off-by: Taniya Das [craig: rename parents to fit upstream, and other cleanups] Signed-off-by: Craig Tatlor Acked-by: Rob Herring [sboyd@kernel.org: Rename gcc_660 to gcc_sdm660 and fix numbering of defines to avoid duplicates] Signed-off-by: Stephen Boyd commit 47db7873136a9c57c45390a53b57019cf73c8259 Author: Wenwen Wang Date: Sat Oct 6 13:34:21 2018 -0500 scsi: megaraid_sas: fix a missing-check bug In megasas_mgmt_compat_ioctl_fw(), to handle the structure compat_megasas_iocpacket 'cioc', a user-space structure megasas_iocpacket 'ioc' is allocated before megasas_mgmt_ioctl_fw() is invoked to handle the packet. Since the two data structures have different fields, the data is copied from 'cioc' to 'ioc' field by field. In the copy process, 'sense_ptr' is prepared if the field 'sense_len' is not null, because it will be used in megasas_mgmt_ioctl_fw(). To prepare 'sense_ptr', the user-space data 'ioc->sense_off' and 'cioc->sense_off' are copied and saved to kernel-space variables 'local_sense_off' and 'user_sense_off' respectively. Given that 'ioc->sense_off' is also copied from 'cioc->sense_off', 'local_sense_off' and 'user_sense_off' should have the same value. However, 'cioc' is in the user space and a malicious user can race to change the value of 'cioc->sense_off' after it is copied to 'ioc->sense_off' but before it is copied to 'user_sense_off'. By doing so, the attacker can inject different values into 'local_sense_off' and 'user_sense_off'. This can cause undefined behavior in the following execution, because the two variables are supposed to be same. This patch enforces a check on the two kernel variables 'local_sense_off' and 'user_sense_off' to make sure they are the same after the copy. In case they are not, an error code EINVAL will be returned. Signed-off-by: Wenwen Wang Acked-by: Sumit Saxena Signed-off-by: Martin K. Petersen commit fd13f0517d2f99cfac6a82fe4654aa62ec14284c Author: Colin Ian King Date: Tue Oct 16 18:46:32 2018 +0100 scsi: be2iscsi: fix spelling mistake "Retreiving" -> "Retrieving" Trivial fix to spelling mistake in beiscsi_log message. Signed-off-by: Colin Ian King Signed-off-by: Martin K. Petersen commit c4dba187e69ecb1a1dc390c055325e3752d090fe Author: Colin Ian King Date: Tue Oct 16 18:28:53 2018 +0100 scsi: lpfc: fix spelling mistake "Resrouce" -> "Resource" Trivial fix to spelling mistake in lpfc_printf_log message text. Signed-off-by: Colin Ian King Signed-off-by: Martin K. Petersen commit fe5fb42de36227c1c2dbb1e7403329ec8a915c20 Author: John Garry Date: Tue Oct 16 23:00:36 2018 +0800 scsi: hisi_sas: Fix spin lock management in slot_index_alloc_quirk_v2_hw() Currently a spin_unlock_irqrestore() call is missing on the error path, so add it. Reported-by: Julia Lawall Signed-off-by: John Garry Signed-off-by: Martin K. Petersen commit abaf75dd610ccfe1d085cb17061ac8862aabd2ea Author: Jens Axboe Date: Tue Oct 16 08:38:47 2018 -0600 scsi: sg: remove bad blk_end_request_all() call We just need to free the request here. Additionally, this is currently wrong for a queue that's using MQ currently, it'll crash. Cc: Doug Gilbert Cc: linux-scsi@vger.kernel.org Signed-off-by: Jens Axboe Acked-by: Douglas Gilbert Signed-off-by: Martin K. Petersen commit 0f5cb0e6225cae2f029944cb8c74617aab6ddd49 Author: Ronald Wahl Date: Wed Oct 10 15:54:54 2018 +0200 clk: at91: Fix division by zero in PLL recalc_rate() Commit a982e45dc150 ("clk: at91: PLL recalc_rate() now using cached MUL and DIV values") removed a check that prevents a division by zero. This now causes a stacktrace when booting the kernel on a at91 platform if the PLL DIV register contains zero. This commit reintroduces this check. Fixes: a982e45dc150 ("clk: at91: PLL recalc_rate() now using cached...") Cc: Signed-off-by: Ronald Wahl Acked-by: Ludovic Desroches Signed-off-by: Stephen Boyd commit 8d849275dce493837792a70f710f6bd83c8db5c0 Author: Jens Axboe Date: Tue Oct 16 08:33:16 2018 -0600 scsi: osd: initiator should use mq variant of request ending This is currently wrong since it isn't dependent on if we're using mq or not. At least now it'll be correct when we force mq. Cc: linux-scsi@vger.kernel.org Signed-off-by: Jens Axboe Signed-off-by: Martin K. Petersen commit c1a3308a0629f6467994959aa617c2a31038befa Author: Manivannan Sadhasivam Date: Thu Sep 20 23:01:03 2018 -0700 clk: hisilicon: Add clock driver for Hi3670 SoC Add clock driver for HiSilicon Hi3670 SoC utilizing HiSilicon's common clk code. Signed-off-by: Manivannan Sadhasivam Signed-off-by: Stephen Boyd commit 3b6b13ede0e3129e4449a83dced7d7fd1cd32e8a Author: Manivannan Sadhasivam Date: Thu Sep 20 23:01:00 2018 -0700 dt-bindings: clk: hisilicon: Add bindings for Hi3670 clk Add devicetree bindings for HiSilicon Hi3670 clock controller. Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd commit 8985167ecf57f97061599a155bb9652c84ea4913 Author: Krzysztof Kozlowski Date: Wed Aug 29 21:20:10 2018 +0200 clk: s2mps11: Fix matching when built as module and DT node contains compatible When driver is built as module and DT node contains clocks compatible (e.g. "samsung,s2mps11-clk"), the module will not be autoloaded because module aliases won't match. The modalias from uevent: of:NclocksTCsamsung,s2mps11-clk The modalias from driver: platform:s2mps11-clk The devices are instantiated by parent's MFD. However both Device Tree bindings and parent define the compatible for clocks devices. In case of module matching this DT compatible will be used. The issue will not happen if this is a built-in (no need for module matching) or when clocks DT node does not contain compatible (not correct from bindings perspective but working for driver). Note when backporting to stable kernels: adjust the list of device ID entries. Cc: Fixes: 53c31b3437a6 ("mfd: sec-core: Add of_compatible strings for clock MFD cells") Signed-off-by: Krzysztof Kozlowski Acked-by: Stephen Boyd Signed-off-by: Stephen Boyd commit 5d25ff7a544889bc4b749fda31778d6a18dddbcb Author: Gustavo A. R. Silva Date: Tue Oct 16 11:12:23 2018 +0200 scsi: ips: fix missing break in switch Add missing break statement in order to prevent the code from falling through to case TEST_UNIT_READY. Addresses-Coverity-ID: 1357338 ("Missing break in switch") Suggested-by: Martin K. Petersen Signed-off-by: Gustavo A. R. Silva Signed-off-by: Martin K. Petersen commit 5ddf0cdf9395b0f58ec863cefd497626c9ff0ad8 Author: Manivannan Sadhasivam Date: Fri Aug 10 15:21:13 2018 +0530 clk: actions: Add Actions Semi S900 SoC Reset Management Unit support Add Reset Management Unit (RMU) support for Actions Semi S900 SoC. Signed-off-by: Manivannan Sadhasivam Signed-off-by: Stephen Boyd commit c4dd4a2eb6b99f06cf395e22ac8326cf54bd4e07 Author: Manivannan Sadhasivam Date: Fri Aug 10 15:21:12 2018 +0530 clk: actions: Add Actions Semi S700 SoC Reset Management Unit support Add Reset Management Unit (RMU) support for Actions Semi S700 SoC. Signed-off-by: Manivannan Sadhasivam Signed-off-by: Stephen Boyd commit 09dbde0154ab1edbcaef4fef5f9ab12b5449d7fa Author: Manivannan Sadhasivam Date: Fri Aug 10 15:21:11 2018 +0530 clk: actions: Add Actions Semi Owl SoCs Reset Management Unit support Add Reset Management Unit (RMU) support for Actions Semi Owl SoCs. Signed-off-by: Manivannan Sadhasivam Signed-off-by: Stephen Boyd commit a35bcf7c7f28623271c733dd4d41f24a79237754 Author: Manivannan Sadhasivam Date: Fri Aug 10 15:21:08 2018 +0530 dt-bindings: reset: Add binding constants for Actions Semi S900 RMU Add device tree binding constants for Actions Semi S900 SoC Reset Management Unit (RMU). Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd commit 73a5e67efa0822ce1773718d7ae24c80bf816c1e Author: Manivannan Sadhasivam Date: Fri Aug 10 15:21:07 2018 +0530 dt-bindings: reset: Add binding constants for Actions Semi S700 RMU Add device tree binding constants for Actions Semi S700 SoC Reset Management Unit (RMU). Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd commit 46b5dfab75eea06b84480d0b6fcecbfc7120801f Author: Manivannan Sadhasivam Date: Fri Aug 10 15:21:06 2018 +0530 dt-bindings: clock: Add reset controller bindings for Actions Semi Owl SoCs Add Reset Controller bindings to clock bindings for Actions Semi Owl SoCs, S700 and S900. Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd commit 3a23eb725b5c37dae17d1b7e2a2f9dc276ec767c Author: Manivannan Sadhasivam Date: Fri Aug 10 15:21:05 2018 +0530 clk: actions: Cache regmap info in private clock descriptor In order to support the reset controller, regmap info needs to be cached in the private clock descriptor, owl_clk_desc. Hence, save that and also make the clock descriptor struct non const. Signed-off-by: Manivannan Sadhasivam Signed-off-by: Stephen Boyd commit d344b21bf405eed05963627bfed6dd3df422623c Author: Dan Carpenter Date: Thu Jun 14 17:45:23 2018 +0300 drm/amd/amdgpu: Fix debugfs error handling The error handling is wrong and "ent" could be NULL we when dereference it to get "ent->d_inode". The thing is that normally debugfs_create_file() is not supposed to require (or have) any error handling. That function does return error pointers if debugfs is turned off but we know it's enable here. When it's enabled, then it returns NULL on error. So what I did was I stripped out all the error handling except around the i_size_write(). I could have just used a NULL check instead of an IS_ERR_OR_NULL() but I figured this was more clear because that way you don't have to look at the surrounding code to see whether debugfs is enabled or not. Signed-off-by: Dan Carpenter Reviewed-by: Christian König Signed-off-by: Alex Deucher commit c55045adf7210d246a016c961916f078ed31a951 Author: Feifei Xu Date: Tue Oct 16 14:54:46 2018 +0800 drm/amdgpu: Update gc_9_0 golden settings. Add mmDB_DEBUG3 settings. Signed-off-by: Feifei Xu Reviewed-by: Evan Quan Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit e26f70a6539cc9d4b1d2589d1c50b2a2c8b22bea Author: Evan Quan Date: Mon Oct 8 12:41:19 2018 +0800 drm/amd/powerplay: update PPtable with DC BTC and Tvr SocLimit fields Update the PPtable structure to fit the latest SMC firmware. Signed-off-by: Evan Quan Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit d579fd827000dfe3c45635fded8bbbbdc78eb5ff Author: Evan Quan Date: Fri Sep 28 16:19:08 2018 +0800 drm/amd/powerplay: added I2C controller configuration PPTABLE structure is stretched to add I2C controller configuration. Hold on the PPTABLE_V20_SMU_VERSION bump until the VBIOS is ready. Signed-off-by: Evan Quan Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit dd46e5f0f732cac6746609f54a5f013118e27116 Author: Evan Quan Date: Fri Oct 12 09:37:29 2018 +0800 drm/amdgpu: update Vega20 SDMA golden setting Update SDMA golden settings. Signed-off-by: Evan Quan Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit 3df27645395e8f79c0dc20a15cf1da61f376000d Author: Rex Zhu Date: Fri Oct 12 22:26:11 2018 +0800 drm/amdgpu: Fix typo in amdgpu_vmid_mgr_init fix a typo in for loop: i->j Reviewed-by: Christian König Signed-off-by: Rex Zhu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit aadd4355918fe6e9044a9042fa5968e0a0901681 Author: Daniel Borkmann Date: Tue Oct 16 21:31:35 2018 +0200 tcp, ulp: remove socket lock assertion on ULP cleanup Eric reported that syzkaller triggered a splat in tcp_cleanup_ulp() where assertion sock_owned_by_me() failed. This happened through inet_csk_prepare_forced_close() first releasing the socket lock, then calling into tcp_done(newsk) which is called after the inet_csk_prepare_forced_close() and therefore without the socket lock held. The sock_owned_by_me() assertion can generally be removed as the only place where tcp_cleanup_ulp() is called from now is out of inet_csk_destroy_sock() -> sk->sk_prot->destroy() where socket is in dead state and unreachable. Therefore, add a comment why the check is not needed instead. Fixes: 8b9088f806e1 ("tcp, ulp: enforce sock_owned_by_me upon ulp init and cleanup") Reported-by: Eric Dumazet Signed-off-by: Daniel Borkmann Signed-off-by: David S. Miller commit 94a04d1d3d3681adde1a3e022b25dbac7b345b7e Author: Yonatan Cohen Date: Tue Oct 9 12:05:12 2018 +0300 net/mlx5: Expose DC scatter to CQE capability bit dc_req_scat_data_cqe capability bit determines if requester scatter to cqe is available for 64 bytes CQE over DC transport type. Signed-off-by: Yonatan Cohen Reviewed-by: Guy Levi Signed-off-by: Leon Romanovsky commit 551d315e34a5e6961f8deaf2d6f37ad24fccaa08 Author: Leon Romanovsky Date: Tue Oct 2 11:13:30 2018 +0300 RDMA/umad: Use kernel API to allocate umad indexes Replace custom code to allocate indexes to generic kernel API. Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford commit 90f6e41cc03a4055d56e94ad7c97df4b1add7f61 Author: Leon Romanovsky Date: Tue Oct 2 11:13:29 2018 +0300 RDMA/uverbs: Use kernel API to allocate uverbs indexes Replace custom code to allocate indexes to generic kernel API. Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford commit 7d65cbf0b0ac7d7eebf397ff9af6645b2b3004c2 Author: Leon Romanovsky Date: Tue Oct 2 11:13:28 2018 +0300 RDMA/core: Increase total number of RDMA ports across all devices IDA adds overhead to store IDs bitmap with maximal value of IDA can be upto 2099202 (IDA_MAX = 0x80000000U / IDA_BITMAP_BITS - 1). However, there is no need to add such enormous number of devices and it is enough for now to limit it to be 8192. Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford commit bab5d988841e58fec6ae22f486905ddde2d715f4 Author: Igor Stoppa Date: Fri Sep 7 20:03:37 2018 +0300 dm: remove unnecessary unlikely() around WARN_ON_ONCE() WARN_ON() already contains an unlikely(), so it's not necessary to wrap it into another. Signed-off-by: Igor Stoppa Signed-off-by: Mike Snitzer commit 4585add948b14b45b45b104f2a9653c543819ec4 Author: Florian Fainelli Date: Tue Oct 16 11:31:28 2018 -0700 MAINTAINERS: Add entry for Broadcom SPI controller Add an entry for the Broadcom SPI controller in the MAINTAINERS file. Signed-off-by: Florian Fainelli Signed-off-by: Mark Brown commit 092b5648760a23656f6dcc83b74f4cf661094aca Author: John Pittman Date: Thu Aug 23 13:35:57 2018 -0400 dm zoned: target: use refcount_t for dm zoned reference counters The API surrounding refcount_t should be used in place of atomic_t when variables are being used as reference counters. This API can prevent issues such as counter overflows and use-after-free conditions. Within the dm zoned target stack, the atomic_t API is used for bioctx->ref and cw->refcount. Change these to use refcount_t, avoiding the issues mentioned. Signed-off-by: John Pittman Reviewed-by: Damien Le Moal Tested-by: Damien Le Moal Signed-off-by: Mike Snitzer commit 22d4c291f58752d14efb8a185b772a3fc3e947d2 Author: John Pittman Date: Thu Aug 23 13:35:55 2018 -0400 dm thin: use refcount_t for thin_c reference counting The API surrounding refcount_t should be used in place of atomic_t when variables are being used as reference counters. It can potentially prevent reference counter overflows and use-after-free conditions. In the dm thin layer, one such example is tc->refcount. Change this from the atomic_t API to the refcount_t API to prevent mentioned conditions. Signed-off-by: John Pittman Signed-off-by: Mike Snitzer commit b4c542df5ae83f079f867011a8f7721fb8a1f44c Author: Håkon Bugge Date: Tue Oct 9 15:27:40 2018 +0200 IB/mlx4: Add port and TID to MAD debug print Add said information and make the debug print format consistent. Signed-off-by: Håkon Bugge Acked-by: Leon Romanovsky Signed-off-by: Doug Ledford commit 0a094ff0619607a36c18d07a81d2ea62e6cdf074 Author: Håkon Bugge Date: Tue Oct 9 15:27:39 2018 +0200 IB/mlx4: Enable debug print of SMPs IB Subnet Management Packets (SMPs) were excluded from debug prints. Fixed by enabling print even on QP0 MADs. Signed-off-by: Håkon Bugge Signed-off-by: Doug Ledford commit 1ae4cfa03902c83d1d77123e5ac8f0812c61b90e Author: Parav Pandit Date: Sun Oct 7 12:12:41 2018 +0300 RDMA/core: Rename ports_parent to ports_kobj Normally kobj objects have kobj suffix to reflect it. Rename ports_parent to ports_kobj. Signed-off-by: Parav Pandit Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford commit 0f6ef65d1c6ec8deb5d0f11f86631ec4cfe8f22e Author: Parav Pandit Date: Sun Oct 7 12:12:40 2018 +0300 RDMA/core: Do not expose unsupported counters If the provider driver (such as rdma_rxe) doesn't support pma counters, avoid exposing its directory similar to optional hw_counters directory. If core fails to read the PMA counter, return an error so that user can retry later if needed. Fixes: 35c4cbb17811 ("IB/core: Create get_perf_mad function in sysfs.c") Reported-by: Holger Hoffstätte Tested-by: Holger Hoffstätte Signed-off-by: Parav Pandit Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford commit 60f1fc204940fc0352394866b2af0987fd5b2563 Author: Parav Pandit Date: Sun Oct 7 12:12:39 2018 +0300 IB/mlx4: Refer to the device kobject instead of ports_parent iov sysfs tree is created under ib device at /sys/class/infiniband/mlx4_0/iov. And, ibdev->ports_parent->parent = &ibdev->dev. Therefore, refer to device's kobject directly instead of indirect access to it. Additionally, iov entries are created under device kobject and deleted before device is removed. There is no need to hold additional reference to device kobject in provider driver. Signed-off-by: Parav Pandit Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford commit 05d940d3a3ec4e6d5d6a726aae4d73c5c64603c6 Author: Leon Romanovsky Date: Wed Oct 10 09:19:12 2018 +0300 RDMA/nldev: Allow IB device rename through RDMA netlink Provide an option to rename IB device name through RDMA netlink and limit it to users with ADMIN capability only. Signed-off-by: Leon Romanovsky Reviewed-by: Parav Pandit Signed-off-by: Doug Ledford commit d21943dd19b5c79dc09bb0e8bf80cd5ee09c41c2 Author: Leon Romanovsky Date: Wed Oct 10 09:19:11 2018 +0300 RDMA/core: Implement IB device rename function Generic implementation of IB device rename function. Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford commit cb20f2d2c0507d60d94ef896991e95708f051dd1 Author: Paolo Abeni Date: Tue Oct 16 16:52:05 2018 +0200 netfilter: xt_nat: fix DNAT target for shifted portmap ranges The commit 2eb0f624b709 ("netfilter: add NAT support for shifted portmap ranges") did not set the checkentry/destroy callbacks for the newly added DNAT target. As a result, rulesets using only such nat targets are not effective, as the relevant conntrack hooks are not enabled. The above affect also nft_compat rulesets. Fix the issue adding the missing initializers. Fixes: 2eb0f624b709 ("netfilter: add NAT support for shifted portmap ranges") Signed-off-by: Paolo Abeni Signed-off-by: Pablo Neira Ayuso commit dbace111e5b320682eee63d7173959a2b2bd9ccb Author: Leon Romanovsky Date: Thu Oct 11 17:30:05 2018 +0300 RDMA/core: Annotate timeout as unsigned long The ucma users supply timeout in u32 format, it means that any number with most significant bit set will be converted to negative value by various rdma_*, cma_* and sa_query functions, which treat timeout as int. In the lowest level, the timeout is converted back to be unsigned long. Remove this ambiguous conversion by updating all function signatures to receive unsigned long. Reported-by: Noa Osherovich Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford commit 9549c2bd094f0f54b8827d64886f5b1de370dff3 Author: Leon Romanovsky Date: Thu Oct 11 17:30:04 2018 +0300 RDMA/core: Align multiple functions to kernel coding style This patch changes the small number of functions to be aligned to kernel coding style. It is needed to minimize the diffstat of the following patch. It doesn't change any functionality. Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford commit d6f9125207902ace40d36d6571cda251b43a8f95 Author: Leon Romanovsky Date: Thu Oct 11 17:30:03 2018 +0300 RDMA/cma: Remove unused timeout_ms parameter from cma_resolve_iw_route() cma_resolve_iw_route() doesn't use timeout_ms parameter, so let's remove it. Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford commit 29ce85f349c2f77a3c035f70fafeaa8b22608328 Merge: eb385146f90d bcdb12b70c52 Author: David S. Miller Date: Tue Oct 16 10:09:59 2018 -0700 Merge branch 'hns3-Some-cleanup-and-bugfix-for-desc-filling' Yunsheng Lin says: ==================== Some cleanup and bugfix for desc filling When retransmiting packets, skb_cow_head which is called in hns3_set_tso may clone a new header. And driver will clear the checksum of the header after doing DMA map, so HW will read the old header whose L3 checksum is not cleared and calculate a wrong L3 checksum. Also When sending a big fragment using multiple buffer descriptor, hns3 does one maping, but do multiple unmapping when tx is done, which may cause unmapping problem. This patchset does some cleanup before fixing the above problem. ==================== Signed-off-by: David S. Miller commit bcdb12b70c5266a78430a248e57c8c122839b951 Author: Fuyun Liang Date: Tue Oct 16 19:58:52 2018 +0800 net: hns3: fix for multiple unmapping DMA problem When sending a big fragment using multiple buffer descriptor, hns3 does one maping, but do multiple unmapping when tx is done, which may cause unmapping problem. To fix it, this patch makes sure the value of desc_cb.length of the non-first bd is zero. If desc_cb.length is zero, we do not unmap the buffer. Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC") Signed-off-by: Fuyun Liang Signed-off-by: Peng Li Signed-off-by: Yunsheng Lin Signed-off-by: David S. Miller commit ba3f808f5cc15882e5aa565d253522e179148c64 Author: Fuyun Liang Date: Tue Oct 16 19:58:51 2018 +0800 net: hns3: rename hns_nic_dma_unmap To keep symmetrical, this patch renames hns_nic_dma_unmap to hns3_clear_desc. Signed-off-by: Fuyun Liang Signed-off-by: Peng Li Signed-off-by: Yunsheng Lin Signed-off-by: David S. Miller commit 1e8a7977d09ffb487f7327f1e10df48e5294aaa5 Author: Fuyun Liang Date: Tue Oct 16 19:58:50 2018 +0800 net: hns3: add handling for big TX fragment This patch unifies big tx fragment handling for tso and non-tso case. Signed-off-by: Fuyun Liang Signed-off-by: Peng Li Signed-off-by: Yunsheng Lin Signed-off-by: David S. Miller commit 5188f218fc860da15755bfa5cc357baf2114d586 Author: Peng Li Date: Tue Oct 16 19:58:49 2018 +0800 net: hns3: move DMA map into hns3_fill_desc To solve the L3 checksum error problem which happens when driver does not clear L3 checksum, DMA map should be done after calling skb_cow_head. This patch moves DMA map into hns3_fill_desc to ensure that DMA map is done after calling skb_cow_head. Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC") Signed-off-by: Fuyun Liang Signed-off-by: Peng Li Signed-off-by: Yunsheng Lin Signed-off-by: David S. Miller commit 0bbbf15dea4ffec4206cea22e8b54e61203a42a2 Author: Peng Li Date: Tue Oct 16 19:58:48 2018 +0800 net: hns3: remove hns3_fill_desc_tso This patch removes hns3_fill_desc_tso in preparation for fixing some desc filling bug, because for tso or non-tso case, we will use the unified hns3_fill_desc. Signed-off-by: Fuyun Liang Signed-off-by: Peng Li Signed-off-by: Yunsheng Lin Signed-off-by: David S. Miller commit eb385146f90da429a94fb448905a32d7235e6fbf Merge: 0ba4ad32de3f 1c90eabcbdfb Author: David S. Miller Date: Tue Oct 16 10:04:29 2018 -0700 Merge branch 'qed-Align-PTT-and-add-various-link-modes' Rahul Verma says: ==================== Align PTT and add various link modes. This series aligns the ptt propagation as local ptt or global ptt. Adds new transceiver modes, speed capabilities and board config, which is utilized to display the enhanced link modes, media types and speed. Enhances the link with detailed information. ==================== Signed-off-by: David S. Miller commit 1c90eabcbdfb513c20460a9f3254479af48ee30b Author: Rahul Verma Date: Tue Oct 16 03:59:22 2018 -0700 qed: Prevent link getting down in case of autoneg-off. Newly added link modes are required to be added during setting link modes. If the new link mode is not available during qed_set_link, it may cause link getting down due to empty supported capability, being passed to MFW, after setting autoneg off/on with current/supported speed. Signed-off-by: Rahul Verma Signed-off-by: Ariel Elior Signed-off-by: David S. Miller commit 1e6e2ded0f3c86c5ccee6ae9d78d01c7017f3a2e Author: Rahul Verma Date: Tue Oct 16 03:59:21 2018 -0700 qede: Check available link modes before link set from ethtool. Set link mode after checking available "supported" link caps of the port. Signed-off-by: Rahul Verma Signed-off-by: Ariel Elior Signed-off-by: David S. Miller commit c56a8be7e7aa855ebcccf0e9d9eba2216514d399 Author: Rahul Verma Date: Tue Oct 16 03:59:20 2018 -0700 qed: Add supported link and advertise link to display in ethtool. Added transceiver type, speed capability and board types in HSI, are utilizing to display the accurate link information in ethtool. Signed-off-by: Rahul Verma Signed-off-by: Ariel Elior Signed-off-by: David S. Miller commit e292b636f9403ade30a501e5803ed6776e717a35 Author: Rahul Verma Date: Tue Oct 16 03:59:19 2018 -0700 qed: Added supported transceiver modes, speed capability and board config to HSI. Added transceiver modes with different speed and media type, speed capability and supported board types in HSI, which will be utilizing to display correct specification of link modes and speed type. Signed-off-by: Rahul Verma Signed-off-by: Ariel Elior Signed-off-by: David S. Miller commit 706d08913d1f68610c32b4a001026aa989878dd9 Author: Rahul Verma Date: Tue Oct 16 03:59:18 2018 -0700 qed: Align local and global PTT to propagate through the APIs. Align the use of local PTT to propagate through the qed_mcp* API's. Global ptt should not be used. Register access should be done through layers. Register address is mapped into a PTT, PF translation table. Several interface functions require a PTT to direct read/write into register. There is a pool of PTT maintained, and several PTT are used simultaneously to access device registers in different flows. Same PTT should not be used in flows that can run concurrently. To avoid running out of PTT resources, too many PTT should not be acquired without releasing them. Every PF has a global PTT, which is used throughout the life of PF, in most important flows for register access. Generic functions acquire the PTT locally and release after the use. This patch aligns the use of Global PTT and Local PTT accordingly. Signed-off-by: Rahul Verma Signed-off-by: Ariel Elior Signed-off-by: David S. Miller commit 0ba4ad32de3fda12eb608faea6e7c57012ecc050 Author: YueHaibing Date: Tue Oct 16 18:50:56 2018 +0800 net: aquantia: make function aq_fw2x_update_stats static Fixes the following sparse warning: drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c:282:5: warning: symbol 'aq_fw2x_update_stats' was not declared. Should it be static? Signed-off-by: YueHaibing Signed-off-by: David S. Miller commit c61c7def1fa0a722610d89790e0255b74f3c07dd Author: Huacai Chen Date: Tue Oct 16 09:20:42 2018 +0800 MIPS: VDSO: Reduce VDSO_RANDOMIZE_SIZE to 64MB for 64bit Commit ea7e0480a4b6 ("MIPS: VDSO: Always map near top of user memory") set VDSO_RANDOMIZE_SIZE to 256MB for 64bit kernel. But take a look at arch/mips/mm/mmap.c we can see that MIN_GAP is 128MB, which means the mmap_base may be at (user_address_top - 128MB). This make the stack be surrounded by mmaped areas, then stack expanding fails and causes a segmentation fault. Therefore, VDSO_RANDOMIZE_SIZE should be less than MIN_GAP and this patch reduce it to 64MB. Signed-off-by: Huacai Chen Signed-off-by: Paul Burton Fixes: ea7e0480a4b6 ("MIPS: VDSO: Always map near top of user memory") Patchwork: https://patchwork.linux-mips.org/patch/20910/ Cc: Ralf Baechle Cc: James Hogan Cc: linux-mips@linux-mips.org Cc: Fuxin Zhang Cc: Zhangjin Wu Cc: Huacai Chen commit 730746ce88da943088fe9aeb845a5daf6e315d98 Author: Jaegeuk Kim Date: Tue Oct 2 17:20:58 2018 -0700 f2fs: allow to mount, if quota is failed Since we can use the filesystem without quotas till next boot. Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 6390398ec78fa527dd8346f126eca06129155668 Author: Sahitya Tummala Date: Fri Oct 5 10:47:40 2018 +0530 f2fs: update REQ_TIME in f2fs_cross_rename() Update REQ_TIME in the missing path - f2fs_cross_rename(). Signed-off-by: Sahitya Tummala [Jaegeuk Kim: add it in f2fs_rename()] Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit c75f2feb80eb8cbb579a3677dce4c165f3102a04 Author: Sahitya Tummala Date: Fri Oct 5 10:47:39 2018 +0530 f2fs: do not update REQ_TIME in case of error conditions The REQ_TIME should be updated only in case of success cases as followed at all other places in the file system. Signed-off-by: Sahitya Tummala Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 3b30eb19dcf1f79d1c3283da8c5f064be6175fbe Author: Chao Yu Date: Thu Oct 4 11:15:20 2018 +0800 f2fs: remove unneeded disable_nat_bits() Commit 7735730d39d7 ("f2fs: fix to propagate error from __get_meta_page()") added disable_nat_bits() in error path of __get_nat_bitmaps(), but it's unneeded, beause we will fail mount, we won't have chance to change nid usage status w/o nat full/empty bitmaps. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 850971b23f0cabb5103a2de9f4b9fe7177c96a9d Author: Chao Yu Date: Thu Oct 4 11:15:19 2018 +0800 f2fs: remove unused sbi->trigger_ssr_threshold Commit a2a12b679f36 ("f2fs: export SSR allocation threshold") introduced two threshold .min_ssr_sections and .trigger_ssr_threshold, but only .min_ssr_sections is used, so just remove redundant one for cleanup. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit ed15ba14155962c328ceb69712164aea8c444a82 Author: Chao Yu Date: Thu Oct 4 11:15:18 2018 +0800 f2fs: shrink sbi->sb_lock coverage in set_file_temperature() file_set_{cold,hot} doesn't need holding sbi->sb_lock, so moving them out of the lock. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 4dada3fd7025e9dbc56c93d9996cba6e47915c62 Author: Chao Yu Date: Thu Oct 4 11:18:30 2018 +0800 f2fs: use rb_*_cached friends As rbtree supports caching leftmost node natively, update f2fs codes to use rb_*_cached helpers to speed up leftmost node visiting. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit ef2a007134b4eaa39264c885999f296577bc87d2 Author: Chao Yu Date: Wed Oct 3 22:32:44 2018 +0800 f2fs: fix to recover cold bit of inode block during POR Testcase to reproduce this bug: 1. mkfs.f2fs /dev/sdd 2. mount -t f2fs /dev/sdd /mnt/f2fs 3. touch /mnt/f2fs/file 4. sync 5. chattr +A /mnt/f2fs/file 6. xfs_io -f /mnt/f2fs/file -c "fsync" 7. godown /mnt/f2fs 8. umount /mnt/f2fs 9. mount -t f2fs /dev/sdd /mnt/f2fs 10. chattr -A /mnt/f2fs/file 11. xfs_io -f /mnt/f2fs/file -c "fsync" 12. umount /mnt/f2fs 13. mount -t f2fs /dev/sdd /mnt/f2fs 14. lsattr /mnt/f2fs/file -----------------N- /mnt/f2fs/file But actually, we expect the corrct result is: -------A---------N- /mnt/f2fs/file The reason is in step 9) we missed to recover cold bit flag in inode block, so later, in fsync, we will skip write inode block due to below condition check, result in lossing data in another SPOR. f2fs_fsync_node_pages() if (!IS_DNODE(page) || !is_cold_node(page)) continue; Note that, I guess that some non-dir inode has already lost cold bit during POR, so in order to reenable recovery for those inode, let's try to recover cold bit in f2fs_iget() to save more fsynced data. Fixes: c56675750d7c ("f2fs: remove unneeded set_cold_node()") Cc: 4.17+ Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 48018b4cfd07dd2df9a067fb3a6a3221c19eed11 Author: Chao Yu Date: Thu Sep 13 07:40:53 2018 +0800 f2fs: submit cached bio to avoid endless PageWriteback When migrating encrypted block from background GC thread, we only add them into f2fs inner bio cache, but forget to submit the cached bio, it may cause potential deadlock when we are waiting page writebacked, fix it. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 4354994f097d068a894aa1a0860da54571df3582 Author: Daniel Rosenberg Date: Mon Aug 20 19:21:43 2018 -0700 f2fs: checkpoint disabling Note that, it requires "f2fs: return correct errno in f2fs_gc". This adds a lightweight non-persistent snapshotting scheme to f2fs. To use, mount with the option checkpoint=disable, and to return to normal operation, remount with checkpoint=enable. If the filesystem is shut down before remounting with checkpoint=enable, it will revert back to its apparent state when it was first mounted with checkpoint=disable. This is useful for situations where you wish to be able to roll back the state of the disk in case of some critical failure. Signed-off-by: Daniel Rosenberg [Jaegeuk Kim: use SB_RDONLY instead of MS_RDONLY] Signed-off-by: Jaegeuk Kim commit 0585b75437d335c6580066c1ab9ea3092139df32 Author: Jens Axboe Date: Mon Oct 15 08:53:45 2018 -0600 sx8: convert to blk-mq Convert from the old request_fn style driver to blk-mq. Signed-off-by: Jens Axboe commit 8535fd6f702a4b3e225258a86dcbf5dd93b73d51 Author: Jens Axboe Date: Mon Oct 15 09:02:45 2018 -0600 z2ram: convert to blk-mq Straight forward conversion to blk-mq, nothing special about this driver. Signed-off-by: Jens Axboe commit ad5fc6bb72214615f300af1f4ed57f71bc3be510 Author: Jens Axboe Date: Mon Oct 15 09:01:40 2018 -0600 gdrom: convert to blk-mq Ditch the deffered list, lock, and workqueue handling. Just mark the set as being blocking, so we are invoked from a workqueue already. Signed-off-by: Jens Axboe commit a9f38e1dec107af70d81338332494bf0a1e76597 Author: Omar Sandoval Date: Mon Oct 15 09:21:34 2018 -0600 floppy: convert to blk-mq This driver likes to fetch requests from all over the place, so make queue_rq put requests on a list so that the logic stays the same. Tested with QEMU. Signed-off-by: Omar Sandoval Converted to blk_mq_init_sq_queue() and fixed a few spots where the tag_set leaked on cleanup. Signed-off-by: Jens Axboe commit 6ec3938cff95fe792a05fdf4ba14f92977e5e31d Author: Omar Sandoval Date: Mon Oct 15 09:18:24 2018 -0600 ataflop: convert to blk-mq This driver is already pretty broken, in that it has two wait_events() (one in stdma_lock()) in request_fn. Get rid of the first one by freezing/quiescing the queue on format, and the second one by replacing it with stdma_try_lock(). The rest is straightforward. Compile-tested only and probably incorrect. Cc: Laurent Vivier Signed-off-by: Omar Sandoval Converted to blk_mq_init_sq_queue() Signed-off-by: Jens Axboe commit 71327f547ee3a46ec5c39fdbbd268401b2578d0e Author: Omar Sandoval Date: Thu Oct 11 12:20:49 2018 -0700 ataflop: fix error handling during setup Move queue allocation next to disk allocation to fix a couple of issues: - If add_disk() hasn't been called, we should clear disk->queue before calling put_disk(). - If we fail to allocate a request queue, we still need to put all of the disks, not just the ones that we allocated queues for. Signed-off-by: Omar Sandoval Signed-off-by: Jens Axboe commit 3e6b8c3c4b14f4f0c4a74027156eb31544c0b0da Author: Omar Sandoval Date: Thu Oct 11 12:20:48 2018 -0700 ataflop: fold headers into C file atafd.h and atafdreg.h are only used from ataflop.c, so merge them in there. Signed-off-by: Omar Sandoval Signed-off-by: Jens Axboe commit 21b07f35544af5e2c11f079057e8fb4263d35dd3 Author: Omar Sandoval Date: Mon Oct 15 09:16:37 2018 -0600 amiflop: convert to blk-mq Straightforward conversion, just use the existing amiflop_lock to serialize access to the controller. Compile-tested only. Cc: Laurent Vivier Signed-off-by: Omar Sandoval Converted to blk_mq_init_sq_queue() Signed-off-by: Jens Axboe commit 53d0f8dbde89cf6c862c7a62e00c6123e02cba41 Author: Omar Sandoval Date: Thu Oct 11 12:20:46 2018 -0700 amiflop: clean up on errors during setup The error handling in fd_probe_drives() doesn't clean up at all. Fix it up in preparation for converting to blk-mq. While we're here, get rid of the commented out amiga_floppy_remove(). Signed-off-by: Omar Sandoval Signed-off-by: Jens Axboe commit c87228f16f0acdf242dee62f139013212208473f Author: Omar Sandoval Date: Thu Oct 11 12:20:45 2018 -0700 amiflop: fold headers into C file amifd.h and amifdreg.h are only used from amiflop.c, and they're pretty small, so move the contents to amiflop.c and get rid of the .h files. This is preparation for adding a struct blk_mq_tag_set to struct amiga_floppy_struct. Signed-off-by: Omar Sandoval Signed-off-by: Jens Axboe commit 8ccb8cb1892b27655247ff42867665763793ffe8 Author: Omar Sandoval Date: Mon Oct 15 09:14:46 2018 -0600 swim3: convert to blk-mq Pretty simple conversion. grab_drive() could probably be replaced by some freeze/quiesce incantation, but I left it alone, and just used freeze/quiesce for eject. Compile-tested only. Cc: Benjamin Herrenschmidt Signed-off-by: Omar Sandoval Converted to blk_mq_init_sq_queue(). Signed-off-by: Jens Axboe commit dbaa54b65e7a06e6ff2192f8fe92ecd51accc766 Author: Omar Sandoval Date: Thu Oct 11 12:20:43 2018 -0700 swim3: add real error handling in setup The driver doesn't have support for removing a device that has already been configured, but with more careful ordering we can avoid the need for that and make sure that we don't leak generic resources. Signed-off-by: Omar Sandoval Signed-off-by: Jens Axboe commit e3896d77b7025c39150eb5ada33ec2c88f4ad445 Author: Omar Sandoval Date: Mon Oct 15 09:12:12 2018 -0600 swim: convert to blk-mq The only interesting thing here is that there may be two floppies (i.e., request queues) sharing the same controller, so we use the global struct swim_priv->lock to check whether the controller is busy. Compile-tested only. Tested-by: Finn Thain Acked-by: Laurent Vivier Signed-off-by: Omar Sandoval Converted to blk_mq_init_sq_queue() Signed-off-by: Jens Axboe commit 1448a2a5360ae06f25e2edc61ae070dff5c0beb4 Author: Omar Sandoval Date: Thu Oct 11 12:20:41 2018 -0700 swim: fix cleanup on setup error If we fail to allocate the request queue for a disk, we still need to free that disk, not just the previous ones. Additionally, we need to cleanup the previous request queues. Signed-off-by: Omar Sandoval Signed-off-by: Jens Axboe commit a72d785021cb92cc0abd4bb3d75607c82150fade Author: Stephen Boyd Date: Mon Oct 15 16:38:33 2018 -0700 clk: ti: Prepare for remove of OF node name Another patch is going to change this code to use %pOFn for DT node names. Fix up the code to make this easy to pick this side of the merge instead of fixing it up in a merge commit later. Cc: Tero Kristo Cc: Rob Herring Signed-off-by: Stephen Boyd commit 7aa54be2976550f17c11a1c3e3630002dea39303 Author: Peter Zijlstra Date: Wed Sep 26 13:01:20 2018 +0200 locking/qspinlock, x86: Provide liveness guarantee On x86 we cannot do fetch_or() with a single instruction and thus end up using a cmpxchg loop, this reduces determinism. Replace the fetch_or() with a composite operation: tas-pending + load. Using two instructions of course opens a window we previously did not have. Consider the scenario: CPU0 CPU1 CPU2 1) lock trylock -> (0,0,1) 2) lock trylock /* fail */ 3) unlock -> (0,0,0) 4) lock trylock -> (0,0,1) 5) tas-pending -> (0,1,1) load-val <- (0,1,0) from 3 6) clear-pending-set-locked -> (0,0,1) FAIL: _2_ owners where 5) is our new composite operation. When we consider each part of the qspinlock state as a separate variable (as we can when _Q_PENDING_BITS == 8) then the above is entirely possible, because tas-pending will only RmW the pending byte, so the later load is able to observe prior tail and lock state (but not earlier than its own trylock, which operates on the whole word, due to coherence). To avoid this we need 2 things: - the load must come after the tas-pending (obviously, otherwise it can trivially observe prior state). - the tas-pending must be a full word RmW instruction, it cannot be an XCHGB for example, such that we cannot observe other state prior to setting pending. On x86 we can realize this by using "LOCK BTS m32, r32" for tas-pending followed by a regular load. Note that observing later state is not a problem: - if we fail to observe a later unlock, we'll simply spin-wait for that store to become visible. - if we observe a later xchg_tail(), there is no difference from that xchg_tail() having taken place before the tas-pending. Suggested-by: Will Deacon Reported-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Will Deacon Cc: Linus Torvalds Cc: Peter Zijlstra Cc: andrea.parri@amarulasolutions.com Cc: longman@redhat.com Fixes: 59fb586b4a07 ("locking/qspinlock: Remove unbounded cmpxchg() loop from locking slowpath") Link: https://lkml.kernel.org/r/20181003130957.183726335@infradead.org Signed-off-by: Ingo Molnar commit 288e4521f0f6717909933116563e66bb894ae2af Author: Peter Zijlstra Date: Wed Oct 3 12:34:10 2018 +0200 x86/asm: 'Simplify' GEN_*_RMWcc() macros Currently the GEN_*_RMWcc() macros include a return statement, which pretty much mandates we directly wrap them in a (inline) function. Macros with return statements are tricky and, as per the above, limit use, so remove the return statement and make them statement-expressions. This allows them to be used more widely. Also, shuffle the arguments a bit. Place the @cc argument as 3rd, this makes it consistent between UNARY and BINARY, but more importantly, it makes the @arg0 argument last. Since the @arg0 argument is now last, we can do CPP trickery and make it an optional argument, simplifying the users; 17 out of 18 occurences do not need this argument. Finally, change to asm symbolic names, instead of the numeric ordering of operands, which allows us to get rid of __BINARY_RMWcc_ARG and get cleaner code overall. Signed-off-by: Peter Zijlstra (Intel) Cc: JBeulich@suse.com Cc: Linus Torvalds Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Brian Gerst Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: bp@alien8.de Cc: hpa@linux.intel.com Link: https://lkml.kernel.org/r/20181003130957.108960094@infradead.org Signed-off-by: Ingo Molnar commit 756b1df4c2c82a1cdffeafa9d2aa76c92e7fb405 Author: Peter Zijlstra Date: Wed Sep 26 13:01:19 2018 +0200 locking/qspinlock: Rework some comments While working my way through the code again; I felt the comments could use help. Signed-off-by: Peter Zijlstra (Intel) Acked-by: Will Deacon Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: andrea.parri@amarulasolutions.com Cc: longman@redhat.com Link: https://lkml.kernel.org/r/20181003130257.156322446@infradead.org Signed-off-by: Ingo Molnar commit 53bf57fab7321fb42b703056a4c80fc9d986d170 Author: Peter Zijlstra Date: Wed Sep 26 13:01:18 2018 +0200 locking/qspinlock: Re-order code Flip the branch condition after atomic_fetch_or_acquire(_Q_PENDING_VAL) such that we loose the indent. This also result in a more natural code flow IMO. Signed-off-by: Peter Zijlstra (Intel) Acked-by: Will Deacon Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: andrea.parri@amarulasolutions.com Cc: longman@redhat.com Link: https://lkml.kernel.org/r/20181003130257.156322446@infradead.org Signed-off-by: Ingo Molnar commit ec57e2f0acb01710cd465bc04495ed03a9e0fea1 Merge: 4766ab5677a2 72a9c673636b Author: Ingo Molnar Date: Tue Oct 16 17:30:11 2018 +0200 Merge branch 'x86/build' into locking/core, to pick up dependent patches and unify jump-label work Signed-off-by: Ingo Molnar commit d4ae552982de39417d17f823df1f06b1cbc3686c Author: Jiri Olsa Date: Thu Sep 6 15:57:48 2018 +0200 perf/x86/intel: Export mem events only if there's PEBS support Memory events depends on PEBS support and access to LDLAT MSR, but we display them in /sys/devices/cpu/events even if the CPU does not provide those, like for KVM guests. That brings the false assumption that those events should be available, while they fail event to open. Separating the mem-* events attributes and merging them with cpu_events only if there's PEBS support detected. We could also check if LDLAT MSR is available, but the PEBS check seems to cover the need now. Suggested-by: Peter Zijlstra Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Michael Petlan Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Link: http://lkml.kernel.org/r/20180906135748.GC9577@krava Signed-off-by: Ingo Molnar commit 421f4292f46e871cdcf8bdc3e6fdfcefe2e81a9d Author: Daniel Borkmann Date: Tue Oct 16 15:59:36 2018 +0200 bpf, tls: add tls header to tools infrastructure Andrey reported a build error for the BPF kselftest suite when compiled on a machine which does not have tls related header bits installed natively: test_sockmap.c:120:23: fatal error: linux/tls.h: No such file or directory #include ^ compilation terminated. Fix it by adding the header to the tools include infrastructure and add definitions such as SOL_TLS that could potentially be missing. Fixes: e9dd904708c4 ("bpf: add tls support for testing in test_sockmap") Reported-by: Andrey Ignatov Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov commit 27d8d2d7a9b7eb05c4484b74b749eaee7b50b845 Author: Christian Lamparter Date: Sun Oct 14 23:28:50 2018 +0200 dmaengine: ppc4xx: fix off-by-one build failure There are two poly_store, but one should have been poly_show. |adma.c:4382:16: error: conflicting types for 'poly_store' | static ssize_t poly_store(struct device_driver *dev, const char *buf, | ^~~~~~~~~~ |adma.c:4363:16: note: previous definition of 'poly_store' was here | static ssize_t poly_store(struct device_driver *dev, char *buf) | ^~~~~~~~~~ CC: stable@vger.kernel.org Fixes: 13efe1a05384 ("dmaengine: ppc4xx: remove DRIVER_ATTR() usage") Signed-off-by: Christian Lamparter Signed-off-by: Vinod Koul commit 013c2403bf32e48119aeb13126929f81352cc7ac Author: Artemy Kovalyov Date: Mon Oct 15 14:13:35 2018 +0300 IB/mlx5: Fix MR cache initialization Schedule MR cache work only after bucket was initialized. Cc: # 4.10 Fixes: 49780d42dfc9 ("IB/mlx5: Expose MR cache for mlx5_ib") Signed-off-by: Artemy Kovalyov Reviewed-by: Majd Dibbiny Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit e54b6a3bcd1ec972b25a164bdf495d9e7120b107 Author: Leon Romanovsky Date: Thu Oct 11 22:36:10 2018 +0300 RDMA/cm: Respect returned status of cm_init_av_by_path Add missing check for failure of cm_init_av_by_path Fixes: e1444b5a163e ("IB/cm: Fix automatic path migration support") Reported-by: Slava Shwartsman Reviewed-by: Parav Pandit Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 4d6e4d12da2c308f8f976d3955c45ee62539ac98 Author: Denis Drozdov Date: Thu Oct 11 22:33:57 2018 +0300 IB/ipoib: Clear IPCB before icmp_send IPCB should be cleared before icmp_send, since it may contain data from previous layers and the data could be misinterpreted as ip header options, which later caused the ihl to be set to an invalid value and resulted in the following stack corruption: [ 1083.031512] ib0: packet len 57824 (> 2048) too long to send, dropping [ 1083.031843] ib0: packet len 37904 (> 2048) too long to send, dropping [ 1083.032004] ib0: packet len 4040 (> 2048) too long to send, dropping [ 1083.032253] ib0: packet len 63800 (> 2048) too long to send, dropping [ 1083.032481] ib0: packet len 23960 (> 2048) too long to send, dropping [ 1083.033149] ib0: packet len 63800 (> 2048) too long to send, dropping [ 1083.033439] ib0: packet len 63800 (> 2048) too long to send, dropping [ 1083.033700] ib0: packet len 63800 (> 2048) too long to send, dropping [ 1083.034124] ib0: packet len 63800 (> 2048) too long to send, dropping [ 1083.034387] ================================================================== [ 1083.034602] BUG: KASAN: stack-out-of-bounds in __ip_options_echo+0xf08/0x1310 [ 1083.034798] Write of size 4 at addr ffff880353457c5f by task kworker/u16:0/7 [ 1083.034990] [ 1083.035104] CPU: 7 PID: 7 Comm: kworker/u16:0 Tainted: G O 4.19.0-rc5+ #1 [ 1083.035316] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu2 04/01/2014 [ 1083.035573] Workqueue: ipoib_wq ipoib_cm_skb_reap [ib_ipoib] [ 1083.035750] Call Trace: [ 1083.035888] dump_stack+0x9a/0xeb [ 1083.036031] print_address_description+0xe3/0x2e0 [ 1083.036213] kasan_report+0x18a/0x2e0 [ 1083.036356] ? __ip_options_echo+0xf08/0x1310 [ 1083.036522] __ip_options_echo+0xf08/0x1310 [ 1083.036688] icmp_send+0x7b9/0x1cd0 [ 1083.036843] ? icmp_route_lookup.constprop.9+0x1070/0x1070 [ 1083.037018] ? netif_schedule_queue+0x5/0x200 [ 1083.037180] ? debug_show_all_locks+0x310/0x310 [ 1083.037341] ? rcu_dynticks_curr_cpu_in_eqs+0x85/0x120 [ 1083.037519] ? debug_locks_off+0x11/0x80 [ 1083.037673] ? debug_check_no_obj_freed+0x207/0x4c6 [ 1083.037841] ? check_flags.part.27+0x450/0x450 [ 1083.037995] ? debug_check_no_obj_freed+0xc3/0x4c6 [ 1083.038169] ? debug_locks_off+0x11/0x80 [ 1083.038318] ? skb_dequeue+0x10e/0x1a0 [ 1083.038476] ? ipoib_cm_skb_reap+0x2b5/0x650 [ib_ipoib] [ 1083.038642] ? netif_schedule_queue+0xa8/0x200 [ 1083.038820] ? ipoib_cm_skb_reap+0x544/0x650 [ib_ipoib] [ 1083.038996] ipoib_cm_skb_reap+0x544/0x650 [ib_ipoib] [ 1083.039174] process_one_work+0x912/0x1830 [ 1083.039336] ? wq_pool_ids_show+0x310/0x310 [ 1083.039491] ? lock_acquire+0x145/0x3a0 [ 1083.042312] worker_thread+0x87/0xbb0 [ 1083.045099] ? process_one_work+0x1830/0x1830 [ 1083.047865] kthread+0x322/0x3e0 [ 1083.050624] ? kthread_create_worker_on_cpu+0xc0/0xc0 [ 1083.053354] ret_from_fork+0x3a/0x50 For instance __ip_options_echo is failing to proceed with invalid srr and optlen passed from another layer via IPCB [ 762.139568] IPv4: __ip_options_echo rr=0 ts=0 srr=43 cipso=0 [ 762.139720] IPv4: ip_options_build: IPCB 00000000f3cd969e opt 000000002ccb3533 [ 762.139838] IPv4: __ip_options_echo in srr: optlen 197 soffset 84 [ 762.139852] IPv4: ip_options_build srr=0 is_frag=0 rr_needaddr=0 ts_needaddr=0 ts_needtime=0 rr=0 ts=0 [ 762.140269] ================================================================== [ 762.140713] IPv4: __ip_options_echo rr=0 ts=0 srr=0 cipso=0 [ 762.141078] BUG: KASAN: stack-out-of-bounds in __ip_options_echo+0x12ec/0x1680 [ 762.141087] Write of size 4 at addr ffff880353457c7f by task kworker/u16:0/7 Signed-off-by: Denis Drozdov Reviewed-by: Erez Shitrit Reviewed-by: Feras Daoud Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit fe9bc1644918aa1d02a889b4ca788bfb67f90816 Author: Leon Romanovsky Date: Thu Oct 11 22:10:10 2018 +0300 RDMA/restrack: Protect from reentry to resource return path Nullify the resource task struct pointer to ensure that subsequent calls won't try to release task_struct again. ------------[ cut here ]------------ ODEBUG: free active (active state 1) object type: rcu_head hint: (null) WARNING: CPU: 0 PID: 6048 at lib/debugobjects.c:329 debug_print_object+0x16a/0x210 lib/debugobjects.c:326 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 6048 Comm: syz-executor022 Not tainted 4.19.0-rc7-next-20181008+ #89 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x244/0x3ab lib/dump_stack.c:113 panic+0x238/0x4e7 kernel/panic.c:184 __warn.cold.8+0x163/0x1ba kernel/panic.c:536 report_bug+0x254/0x2d0 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:178 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:271 do_invalid_op+0x36/0x40 arch/x86/kernel/traps.c:290 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:969 RIP: 0010:debug_print_object+0x16a/0x210 lib/debugobjects.c:326 Code: 41 88 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 92 00 00 00 48 8b 14 dd 60 02 41 88 4c 89 fe 48 c7 c7 00 f8 40 88 e8 36 2f b4 fd <0f> 0b 83 05 a9 f4 5e 06 01 48 83 c4 18 5b 41 5c 41 5d 41 5e 41 5f RSP: 0018:ffff8801d8c3eda8 EFLAGS: 00010086 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8164d235 RDI: 0000000000000005 RBP: ffff8801d8c3ede8 R08: ffff8801d70aa280 R09: ffffed003b5c3eda R10: ffffed003b5c3eda R11: ffff8801dae1f6d7 R12: 0000000000000001 R13: ffffffff8939a760 R14: 0000000000000000 R15: ffffffff8840fca0 __debug_check_no_obj_freed lib/debugobjects.c:786 [inline] debug_check_no_obj_freed+0x3ae/0x58d lib/debugobjects.c:818 kmem_cache_free+0x202/0x290 mm/slab.c:3759 free_task_struct kernel/fork.c:163 [inline] free_task+0x16e/0x1f0 kernel/fork.c:457 __put_task_struct+0x2e6/0x620 kernel/fork.c:730 put_task_struct include/linux/sched/task.h:96 [inline] finish_task_switch+0x66c/0x900 kernel/sched/core.c:2715 context_switch kernel/sched/core.c:2834 [inline] __schedule+0x8d7/0x21d0 kernel/sched/core.c:3480 schedule+0xfe/0x460 kernel/sched/core.c:3524 freezable_schedule include/linux/freezer.h:172 [inline] futex_wait_queue_me+0x3f9/0x840 kernel/futex.c:2530 futex_wait+0x45c/0xa50 kernel/futex.c:2645 do_futex+0x31a/0x26d0 kernel/futex.c:3528 __do_sys_futex kernel/futex.c:3589 [inline] __se_sys_futex kernel/futex.c:3557 [inline] __x64_sys_futex+0x472/0x6a0 kernel/futex.c:3557 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x446549 Code: e8 2c b3 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f3a998f5da8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: ffffffffffffffda RBX: 00000000006dbc38 RCX: 0000000000446549 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00000000006dbc38 RBP: 00000000006dbc30 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dbc3c R13: 2f646e6162696e69 R14: 666e692f7665642f R15: 00000000006dbd2c Kernel Offset: disabled Reported-by: syzbot+71aff6ea121ffefc280f@syzkaller.appspotmail.com Fixes: ed7a01fd3fd7 ("RDMA/restrack: Release task struct which was hold by CM_ID object") Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 891b7c5fbf619d2a314e424775b3c232eb227e90 Author: Jens Axboe Date: Tue Oct 16 08:09:58 2018 -0600 mtd_blkdevs: convert to blk-mq Straight forward conversion, using an internal list to enable the driver to pull requests at will. Dynamically allocate the tag set to avoid having to pull in the block headers for blktrans.h, since various mtd drivers use block conflicting names for defines and functions. Cc: David Woodhouse Cc: linux-mtd@lists.infradead.org Tested-by: Richard Weinberger Signed-off-by: Jens Axboe commit 93048c0944150b316a15f92c41a4d626c8df37fd Author: Alexander Shishkin Date: Tue Oct 16 14:13:40 2018 +0300 lib: Fix ia64 bootloader linkage kbuild robot reports that since commit ce76d938dd98 ("lib: Add memcat_p(): paste 2 pointer arrays together") the ia64/hp/sim/boot fails to link: > LD arch/ia64/hp/sim/boot/bootloader > lib/string.o: In function `__memcat_p': > string.c:(.text+0x1f22): undefined reference to `__kmalloc' > string.c:(.text+0x1ff2): undefined reference to `__kmalloc' > make[1]: *** [arch/ia64/hp/sim/boot/Makefile:37: arch/ia64/hp/sim/boot/bootloader] Error 1 The reason is, the above commit, via __memcat_p(), adds a call to __kmalloc to string.o, which happens to be used in the bootloader, but there's no kmalloc or slab or anything. Since the linker would only pull in objects that contain referenced symbols, moving __memcat_p() to a different compilation unit solves the problem. Fixes: ce76d938dd98 ("lib: Add memcat_p(): paste 2 pointer arrays together") Signed-off-by: Alexander Shishkin Reported-by: kbuild test robot Cc: Fenghua Yu Cc: Tony Luck Cc: Joe Perches Signed-off-by: Greg Kroah-Hartman commit 2153bbc12f77fb2203276befc0f0dddbfb023bb1 Author: Hans de Goede Date: Sun Oct 14 17:12:02 2018 +0200 pwm: lpss: Only set update bit if we are actually changing the settings According to the datasheet the update bit must be set if the on-time-div or the base-unit changes. Now that we properly order device resume on Cherry Trail so that the GFX0 _PS0 method no longer exits with an error, we end up with a sequence of events where we are writing the same values twice in a row. First the _PS0 method restores the duty cycle of 0% the GPU driver set on suspend and then the GPU driver first updates just the enabled bit in the pwm_state from 0 to 1, causing us to write the same values again, before restoring the pre-suspend duty-cycle in a separate pwm_apply call. When writing the update bit the second time, without changing any of the values the update bit clears immediately / instantly, instead of staying 1 for a while as usual. After this the next setting of the update bit seems to be ignored, causing the restoring of the pre-suspend duty-cycle to not get applied. This makes the backlight come up with a 0% dutycycle after suspend/resume. Any further brightness changes after this do work. This commit moves the setting of the update bit into pwm_lpss_prepare() and only sets the bit if we have actually changed any of the values. This avoids the setting of the update bit the second time we configure the PWM to 0% dutycycle, this fixes the backlight coming up with 0% duty-cycle after a suspend/resume. Signed-off-by: Hans de Goede Signed-off-by: Thierry Reding commit 4743765babb278a7d399df5733fc8a6b6bbedf3e Author: Hans de Goede Date: Sun Oct 14 17:12:01 2018 +0200 pwm: lpss: Force runtime-resume on suspend on Cherry Trail On Cherry Trail devices under Windows the PWM controller used for the backlight is considered part of the GPU even though it is part of the LPSS block and thus is an entirely different independent hardware unit. Because of this on Cherry Trail the GPU's (GFX0 ACPI node) _PS3 and _PS0 methods save and restore the PWM controller registers. If userspace blanks the screen before suspending, such as e.g. GNOME does, then the PWM controller will be runtime-suspended when the suspend starts. This causes the GFX0 _PS? methods to save a value of 0xffffffff for the PWM control register and to restore this value on resume. 0xffffffff is not a valid value for the register and writing this causes problems such as e.g. a flickering backlight. This commit adds a prepare method to the dev_pm_ops and makes it return 0 on Cherry Trail devices forcing a runtime-resume before other device's suspend methods run. This fixes the reading and writing back of 0xffffffff. Since we now always runtime-resume the device on suspend, it will be resumed on resume too and we no longer need to check for the GFX0 _PS0 method having resumed it underneath us, so this commit removes the now no longer necessary complete dev_pm_op. Signed-off-by: Hans de Goede Signed-off-by: Thierry Reding commit 6f37709fb0a61f09ca96348044c5bb13e333e518 Author: Vignesh R Date: Tue Oct 16 11:34:02 2018 +0530 pwm: Enable TI ECAP driver for ARCH_K3 K3 devices have the same ECAP IP as OMAP SoCs. Enable driver to be built for K3 devices. Also, drop reference to AM33xx in help text, as IP is found on multiple TI SoCs. Signed-off-by: Vignesh R Signed-off-by: Thierry Reding commit 3c413e7e39224d171ef697277cd4629b59103101 Author: Vignesh R Date: Tue Oct 16 11:34:01 2018 +0530 dt-bindings: pwm: tiecap: Add TI AM654 SoC specific compatible Add a new compatible string "ti,am654-ecap" to support PWM ECAP IP of TI AM654 SoC. Signed-off-by: Vignesh R Reviewed-by: Rob Herring Signed-off-by: Thierry Reding commit c3e04915b8674a748916db6f7adf92da03b68bef Author: Gustavo A. R. Silva Date: Thu Oct 4 15:07:01 2018 +0200 rtc: m41t80: mark expected switch fall-through In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Notice that in this particular case, I replaced "Fall" with a proper "Fall through" comment. Addresses-Coverity-ID: 1373875 ("Missing break in switch") Signed-off-by: Gustavo A. R. Silva Signed-off-by: Alexandre Belloni commit fe0b5cedc2b73c9b005e1812c0ae5b922a96243a Author: Thierry Reding Date: Fri Sep 21 12:12:09 2018 +0200 rtc: tegra: Propagate errors from platform_get_irq() Instead of confusingly returning -EBUSY on failure to obtain an interrupt, propagate the real error code. While at it, let the user know why the interrupt could not be acquired. Signed-off-by: Thierry Reding Signed-off-by: Alexandre Belloni commit 4afe8e79da920bdf6698b01bc668fffc6758f37b Author: Suzuki K Poulose Date: Tue Oct 9 14:47:07 2018 +0100 arm64: cpufeature: Trap CTR_EL0 access only where it is necessary When there is a mismatch in the CTR_EL0 field, we trap access to CTR from EL0 on all CPUs to expose the safe value. However, we could skip trapping on a CPU which matches the safe value. Cc: Mark Rutland Cc: Will Deacon Signed-off-by: Suzuki K Poulose Signed-off-by: Catalin Marinas commit 1602df02f33f61fe0de1bbfeba0d1c97c14bff19 Author: Suzuki K Poulose Date: Tue Oct 9 14:47:06 2018 +0100 arm64: cpufeature: Fix handling of CTR_EL0.IDC field CTR_EL0.IDC reports the data cache clean requirements for instruction to data coherence. However, if the field is 0, we need to check the CLIDR_EL1 fields to detect the status of the feature. Currently we don't do this and generate a warning with tainting the kernel, when there is a mismatch in the field among the CPUs. Also the userspace doesn't have a reliable way to check the CLIDR_EL1 register to check the status. This patch fixes the problem by checking the CLIDR_EL1 fields, when (CTR_EL0.IDC == 0) and updates the kernel's copy of the CTR_EL0 for the CPU with the actual status of the feature. This would allow the sanity check infrastructure to do the proper checking of the fields and also allow the CTR_EL0 emulation code to supply the real status of the feature. Now, if a CPU has raw CTR_EL0.IDC == 0 and effective IDC == 1 (with overall system wide IDC == 1), we need to expose the real value to the user. So, we trap CTR_EL0 access on the CPU which reports incorrect CTR_EL0.IDC. Fixes: commit 6ae4b6e057888 ("arm64: Add support for new control bits CTR_EL0.DIC and CTR_EL0.IDC") Cc: Shanker Donthineni Cc: Philip Elcan Cc: Will Deacon Cc: Mark Rutland Signed-off-by: Suzuki K Poulose Signed-off-by: Catalin Marinas commit 8ab66cbe63aeaf9e5970fb4aaef1c660fca59321 Author: Suzuki K Poulose Date: Tue Oct 9 14:47:05 2018 +0100 arm64: cpufeature: ctr: Fix cpu capability check for late CPUs The matches() routine for a capability must honor the "scope" passed to it and return the proper results. i.e, when passed with SCOPE_LOCAL_CPU, it should check the status of the capability on the current CPU. This is used by verify_local_cpu_capabilities() on a late secondary CPU to make sure that it's compliant with the established system features. However, ARM64_HAS_CACHE_{IDC/DIC} always checks the system wide registers and this could mean that a late secondary CPU could return "true" (since the CPU hasn't updated the system wide registers yet) and thus lead the system in an inconsistent state, where the system assumes it has IDC/DIC feature, while the new CPU doesn't. Fixes: commit 6ae4b6e0578886eb36 ("arm64: Add support for new control bits CTR_EL0.DIC and CTR_EL0.IDC") Cc: Philip Elcan Cc: Shanker Donthineni Cc: Mark Rutland Cc: Will Deacon Signed-off-by: Suzuki K Poulose Signed-off-by: Catalin Marinas commit 09d1ea1c7309c8ca91151778bb3efe514f2e03ed Author: Bartosz Golaszewski Date: Sun Oct 14 17:20:09 2018 +0200 devres: provide devm_kstrdup_const() Provide a resource managed version of kstrdup_const(). This variant internally calls devm_kstrdup() on pointers that are outside of .rodata section and returns the string as is otherwise. Make devm_kfree() check if the passed pointer doesn't point to .rodata and if so - don't actually destroy the resource. Signed-off-by: Bartosz Golaszewski Reviewed-by: Bjorn Andersson Acked-by: Mike Rapoport Acked-by: Rasmus Villemoes Reviewed-by: Geert Uytterhoeven Reviewed-by: Andy Shevchenko Signed-off-by: Greg Kroah-Hartman commit 59c3f82ad1d6ed83fde9d7608afb9fb221a211ab Author: Bartosz Golaszewski Date: Sun Oct 14 17:20:08 2018 +0200 mm: move is_kernel_rodata() to asm-generic/sections.h Export this routine so that we can use it later in devm_kstrdup_const() and devm_kfree(). Signed-off-by: Bartosz Golaszewski Reviewed-by: Bjorn Andersson Acked-by: Mike Rapoport Acked-by: Rasmus Villemoes Reviewed-by: Geert Uytterhoeven Reviewed-by: Andy Shevchenko Signed-off-by: Greg Kroah-Hartman commit 0571967dfb5d2573c2a06871517d748932a899d1 Author: Bartosz Golaszewski Date: Sun Oct 14 17:20:07 2018 +0200 devres: constify p in devm_kfree() Make devm_kfree() signature uniform with that of kfree(). To avoid compiler warnings: cast p to (void *) when calling devres_destroy(). Signed-off-by: Bartosz Golaszewski Reviewed-by: Bjorn Andersson Reviewed-by: Geert Uytterhoeven Acked-by: Rasmus Villemoes Reviewed-by: Andy Shevchenko Signed-off-by: Greg Kroah-Hartman commit 8514c470dc18e58f27dee10a787175ef8f31162f Author: Greg Kroah-Hartman Date: Wed Jul 11 15:20:32 2018 +0200 driver core: add BUS_ATTR_WO() macro Many bus attributes are write-only, so provide a simple macro for that to be able to match the other driver core attribute macros. Cc: "Rafael J. Wysocki" Cc: Ioana Ciornei Signed-off-by: Greg Kroah-Hartman commit dd71c89b2c1ae049d2018107e9d7a41261db3f7b Author: Greg Kroah-Hartman Date: Tue Oct 16 12:45:13 2018 +0200 staging: MAINTAINERS: remove obsolete IPX staging directory The IPX code was removed from staging back in November 2017, but the MAINTAINERS entry stuck around. Remove the invalid directory from the file as it does not actually point to anything anymore. Reported-by: Joe Perches Signed-off-by: Greg Kroah-Hartman commit 5c1cea8c2da056d2d4dbad73455be71d88367c3c Author: Greg Kroah-Hartman Date: Tue Oct 16 12:42:50 2018 +0200 staging: MAINTAINERS: remove NCP filesystem entry The ncp filesystem got removed in November of 2017, yet the MAINTAINERS entry persisted. Remove that now. Reported-by: Joe Perches Cc: Petr Vandrovec Signed-off-by: Greg Kroah-Hartman commit 9793c1fd1775859450ac18fa645e31902e4b0173 Author: Dan Williams Date: Fri Oct 12 21:35:15 2018 -0700 MAINTAINERS: Clarify UIO vs UIOVEC maintainer The UIO file mask in MAINTAINERS was incorrectly directing UIOVEC (include/linux/uio.h) patches to Greg. Tag Al as the UIOVEC maintainer as Ingo and others have explicitly required his ack before taking architecture patches that touch lib/iov_iter.c. Cc: Al Viro Reported-by: Greg Kroah-Hartman Signed-off-by: Dan Williams Signed-off-by: Greg Kroah-Hartman commit 5cb6b5fc013ee711d19bfc4e9deb8d6ae80741db Author: Hans de Goede Date: Tue Oct 16 12:18:21 2018 +0200 ALSA: hda: Add 2 more models to the power_save blacklist Power-saving is causing plops on audio start/stop on Dell Precision T3600 laptops and Intel DZ77BH boards, add these to the power_save blacklist. BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1525104 Signed-off-by: Hans de Goede Cc: Signed-off-by: Takashi Iwai commit da5e79bc70b84971d2b3a55fb252e34e51d81d48 Author: Rafael J. Wysocki Date: Mon Oct 15 23:21:05 2018 +0200 cpufreq: conservative: Take limits changes into account properly If the policy limits change between invocations of cs_dbs_update(), the requested frequency value stored in dbs_info may not be updated and the function may use a stale value of it next time. Moreover, if idle periods are takem into account by cs_dbs_update(), the requested frequency value stored in dbs_info may be below the min policy limit, which is incorrect. To fix these problems, always update the requested frequency value in dbs_info along with the local copy of it when the previous requested frequency is beyond the policy limits and avoid decreasing the requested frequency below the min policy limit when taking idle periods into account. Fixes: abb6627910a1 (cpufreq: conservative: Fix next frequency selection) Fixes: 00bfe05889e9 (cpufreq: conservative: Decrease frequency faster for deferred updates) Reported-by: Waldemar Rymarkiewicz Cc: All applicable Signed-off-by: Rafael J. Wysocki Acked-by: Waldemar Rymarkiewicz Acked-by: Viresh Kumar commit 19b201705445d967f95d45ad1e907b94c9b92d57 Author: Will Korteland Date: Tue Oct 16 08:57:44 2018 +0000 docs/uio: fix a grammar nitpick This patch fixes a minor, incorrect piece of grammar in the UIO howto. Signed-off-by: Will Korteland Acked-by: Randy Dunlap Signed-off-by: Greg Kroah-Hartman commit 4a6ff3c9a6fadd98ca4ba8e78820a06ad3e50863 Author: Alan Tull Date: Mon Oct 15 17:20:04 2018 -0500 docs: fpga: document programming fpgas using regions Clarify the intention that interfaces and upper layers use regions rather than managers directly. Rearrange API documentation to better group the API functions used to create FPGA mgr/bridge/regions and the API used for programming FPGAs. Signed-off-by: Alan Tull Suggested-by: Federico Vaga Acked-by: Moritz Fischer Signed-off-by: Greg Kroah-Hartman commit fea82b7f6670002ff36bf1bc77d0345b0b2f2d1c Author: Alan Tull Date: Mon Oct 15 17:20:03 2018 -0500 fpga: add devm_fpga_region_create Add devm_fpga_region_create() which is the managed version of fpga_region_create(). Change current region drivers to use devm_fpga_region_create(). Signed-off-by: Alan Tull Suggested-by: Federico Vaga Acked-by: Moritz Fischer Signed-off-by: Greg Kroah-Hartman commit 213befe049c70cfcfcbb4f6010bd5276dbc1f7b9 Author: Alan Tull Date: Mon Oct 15 17:20:02 2018 -0500 fpga: bridge: add devm_fpga_bridge_create Add devm_fpga_bridge_create() which is the managed version of fpga_bridge_create(). Change current bridge drivers to use devm_fpga_bridge_create(). Signed-off-by: Alan Tull Suggested-by: Federico Vaga Acked-by: Moritz Fischer Signed-off-by: Greg Kroah-Hartman commit 084181fe8cc7472695b907f0018f4cd00934cb12 Author: Alan Tull Date: Mon Oct 15 17:20:01 2018 -0500 fpga: mgr: add devm_fpga_mgr_create Add devm_fpga_mgr_create() which is the managed version of fpga_mgr_create(). Change current FPGA manager drivers to use devm_fpga_mgr_create() Signed-off-by: Alan Tull Suggested-by: Federico Vaga Acked-by: Moritz Fischer Signed-off-by: Greg Kroah-Hartman commit 92e2921f7eee63450a5f953f4b15dc6210219430 Author: Hou Tao Date: Sat Oct 6 17:09:35 2018 +0800 jffs2: free jffs2_sb_info through jffs2_kill_sb() When an invalid mount option is passed to jffs2, jffs2_parse_options() will fail and jffs2_sb_info will be freed, but then jffs2_sb_info will be used (use-after-free) and freeed (double-free) in jffs2_kill_sb(). Fix it by removing the buggy invocation of kfree() when getting invalid mount options. Fixes: 92abc475d8de ("jffs2: implement mount option parsing and compression overriding") Cc: stable@kernel.org Signed-off-by: Hou Tao Reviewed-by: Richard Weinberger Signed-off-by: Boris Brezillon commit 4b73d334c50dcde25437be52a01e2f5cbf5f9e21 Author: Srinivas Pandruvada Date: Mon Oct 15 10:37:21 2018 -0700 Documentation: intel_pstate: Add base_frequency information Updated documentation to explain base_frequency attribute. Suggested-by: Rafael J. Wysocki Signed-off-by: Srinivas Pandruvada Signed-off-by: Rafael J. Wysocki commit 86d333a8cc7f66c2314ab1e147834a1cd95ec2de Author: Srinivas Pandruvada Date: Mon Oct 15 10:37:20 2018 -0700 cpufreq: intel_pstate: Add base_frequency attribute Expose base_frequency to user space via cpufreq sysfs when HWP is in use. This HWP base frequency is read from the ACPI _CPC object if present, or from the HWP Capabilities MSR otherwise. On the majority of the HWP platforms the _CPC object will point to the HWP Capabilities MSR using the "Functional Fixed Hardware" address space type. The address space type also can simply be ACPI_TYPE_INTEGER, however, in which case the platform firmware can set its value at the initialization time based on the system constraints. Signed-off-by: Srinivas Pandruvada [ rjw: Changelog ] Signed-off-by: Rafael J. Wysocki commit 29523f095397637edca60c627bc3e5c25a02c40f Author: Srinivas Pandruvada Date: Mon Oct 15 10:37:19 2018 -0700 ACPI / CPPC: Add support for guaranteed performance The Continuous Performance Control package may contain an optional guaranteed performance field. Add support to read guaranteed performance from _CPC. Signed-off-by: Srinivas Pandruvada Signed-off-by: Rafael J. Wysocki commit 9a69e3ac41a5ab2daf230cf8503ed1aea3419a0f Merge: 18d3f8fc0c2c f69ffc5d3db8 Author: Rafael J. Wysocki Date: Tue Oct 16 10:10:35 2018 +0200 Merge tag 'linux-cpupower-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux into pm-tools Pull cpupower utility changes for 4.20 from Shuah Khan: "This cpupower update consists of fixes for bugs and compile warnings from Prarit Bhargava and Anders Roxell." * tag 'linux-cpupower-4.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux: cpupower: Fix coredump on VMWare cpupower: Fix AMD Family 0x17 msr_pstate size cpupower: remove stringop-truncation waring commit a93a676b079144009f55fff2ab0e34c3b7258c8a Author: Christophe JAILLET Date: Tue Oct 16 08:22:28 2018 +0200 pinctrl: sunxi: Fix a memory leak in 'sunxi_pinctrl_build_state()' If 'krealloc()' fails, 'pctl->functions' is set to NULL. We should instead use a temp variable in order to be able to free the previously allocated memeory, in case of OOM. Signed-off-by: Christophe JAILLET Acked-by: Maxime Ripard Signed-off-by: Linus Walleij commit 4cf841e398503990df640f7a7c5b2ea56f11c08c Author: Tony Luck Date: Mon Oct 15 16:11:31 2018 -0700 ACPI/ADXL: Add address translation interface using an ACPI DSM Some new Intel servers provide an interface so that the OS can ask the BIOS to translate a system physical address to a memory address (socket, memory controller, channel, rank, dimm, etc.). This is useful for EDAC drivers that want to take the address of an error reported in a machine check bank and let the user know which DIMM may need to be replaced. Specification for this interface is available at: https://cdrdv2.intel.com/v1/dl/getContent/603354 [ Based on earlier code by Qiuxu Zhuo . ] [ bp: Make the first pr_info() in adxl_init() pr_debug() so that it doesn't pollute every dmesg. ] Signed-off-by: Tony Luck Signed-off-by: Borislav Petkov Acked-by: Rafael J. Wysocki Tested-by: Qiuxu Zhuo CC: Len Brown CC: linux-acpi@vger.kernel.org CC: linux-edac@vger.kernel.org Link: http://lkml.kernel.org/r/20181015202620.23610-1-tony.luck@intel.com commit ee8edbf8ca6bfde89bb2a9e6efe261b9ea622ee7 Author: Masahiro Yamada Date: Tue Oct 16 13:11:33 2018 +0900 gpio: uniphier: include instead of The reason of including here is just for BIT() and GENMASK macros. Since commit 8bd9cb51daac8 ("locking/atomics, asm-generic: Move some macros from to a new file"), is enough for such compile-time macros. Signed-off-by: Masahiro Yamada Signed-off-by: Linus Walleij commit e24cf513cb9801c72a9c461806b62cea430dd28a Author: Masahiro Yamada Date: Tue Oct 16 13:09:58 2018 +0900 pinctrl: uniphier: include instead of The reason of including here is just for BIT() macro. Since commit 8bd9cb51daac8 ("locking/atomics, asm-generic: Move some macros from to a new file"), is enough for such compile-time macros. Signed-off-by: Masahiro Yamada Signed-off-by: Linus Walleij commit 95c97998aa9fc7992f2f9d3a70f518c4b9abca9e Author: Taehee Yoo Date: Sun Oct 7 00:17:07 2018 +0900 netfilter: nf_nat_snmp_basic: add missing helper alias name In order to upload helper module automatically, helper alias name is needed. so that MODULE_ALIAS_NFCT_HELPER() should be added. And unlike other nat helper modules, the nf_nat_snmp_basic can be used independently. helper name is "snmp_trap" so that alias name will be "nfct-helper-snmp_trap" by MODULE_ALIAS_NFCT_HELPER(snmp_trap) test command: %iptables -t raw -I PREROUTING -p udp -j CT --helper snmp_trap %lsmod | grep nf_nat_snmp_basic We can see nf_nat_snmp_basic module is uploaded automatically. Signed-off-by: Taehee Yoo Signed-off-by: Pablo Neira Ayuso commit e891e50a8ad9cbed68c9a90d8879faf7c1d8318a Author: Pablo Neira Ayuso Date: Thu Oct 11 10:58:26 2018 +0200 netfilter: xt_osf: simplify xt_osf_match_packet() info area in match is always available, and remove unneeded variables. Signed-off-by: Pablo Neira Ayuso commit 1321a6af30e45e467d0a5da00e8480c48cb627ee Author: Florian Westphal Date: Wed Oct 10 17:25:47 2018 +0200 netfilter: nft_xfrm: use state family, not hook one Eyal says: doesn't the use of nft_pf(pkt) in this context limit the matching of encapsulated packets to the same family? IIUC when an e.g. IPv6-in-IPv4 packet is matched, the nft_pf(pkt) will be the decapsulated packet family - IPv6 - whereas the state may be IPv4. So this check would not allow matching the 'underlay' address in such cases. I know this was a limitation in xt_policy. but is this intentional in this matcher? or is it possible to use state->props.family when validating the match instead of nft_pf(pkt)? Userspace already tells us which address family it expects to match, so we can just use the real state family rather than the hook family. so change it as suggested above. Reported-by: Eyal Birger Suggested-by: Eyal Birger Fixes: 6c47260250fc6 ("netfilter: nf_tables: add xfrm expression") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit a218dc82f0b5c6c8ad3d58c9870ed69e26c08b3e Author: Fernando Fernandez Mancera Date: Wed Oct 10 09:57:13 2018 +0200 netfilter: nft_osf: Add ttl option support Add ttl option support to the nftables "osf" expression. Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso commit ea9cf2a55a7bb84ba862a0fc13044a4311c9bbfe Author: YueHaibing Date: Wed Oct 10 02:14:12 2018 +0000 netfilter: cttimeout: remove set but not used variable 'l3num' Fixes gcc '-Wunused-but-set-variable' warning: net/netfilter/nfnetlink_cttimeout.c: In function 'cttimeout_default_set': net/netfilter/nfnetlink_cttimeout.c:353:8: warning: variable 'l3num' set but not used [-Wunused-but-set-variable] It not used any more after commit dd2934a95701 ("netfilter: conntrack: remove l3->l4 mapping information") Signed-off-by: YueHaibing Signed-off-by: Pablo Neira Ayuso commit 4b87dd54be21ad611a1c740f9df0c4376d496e09 Author: Lance Roy Date: Tue Oct 2 22:39:00 2018 -0700 netfilter: Replace spin_is_locked() with lockdep lockdep_assert_held() is better suited to checking locking requirements, since it won't get confused when someone else holds the lock. This is also a step towards possibly removing spin_is_locked(). Signed-off-by: Lance Roy Cc: Pablo Neira Ayuso Cc: Jozsef Kadlecsik Cc: Florian Westphal Cc: "David S. Miller" Cc: Cc: Cc: Acked-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso commit 93d39737b29eaf1974bf850ccdc903b2418c800b Author: Rafał Miłecki Date: Mon Oct 15 11:30:13 2018 +0200 dt-bindings: pinctrl: bcm4708-pinmux: improve example binding Broadcom SoC pins are controlled using CRU ("Clock and Reset Unit" or "Central Resource Unit") registers. There are more CRU registers and functions so CRU should be represented as a separated block in DT. Moreover CRU is a sub-block of DMU ("Device Management Unit") so that one should also get its own node. Signed-off-by: Rafał Miłecki Signed-off-by: Linus Walleij commit 40f5ff4f9f23a849ad135cb736d4d448d810ac17 Author: Stephen Boyd Date: Mon Oct 8 09:32:16 2018 -0700 gpio: Clarify kerneldoc on gpiochip_set_chained_irqchip() This doesn't support nested anymore, so drivers shouldn't call it with the handler set to NULL. Cc: Evan Green Cc: Thierry Reding Cc: Grygorii Strashko Signed-off-by: Stephen Boyd Signed-off-by: Linus Walleij commit 3c1f6b2d116c74f96691989258cad90dfe454d8d Author: Stephen Boyd Date: Mon Oct 8 09:32:15 2018 -0700 gpio: Remove unused 'irqchip' argument to gpiochip_set_cascaded_irqchip() This argument hasn't ever been used since it was introduced in commit 1425052097b5 ("gpio: add IRQ chip helpers in gpiolib"). Let's drop it to reduce reading confusion. Cc: Evan Green Cc: Thierry Reding Cc: Grygorii Strashko Signed-off-by: Stephen Boyd Signed-off-by: Linus Walleij commit 9cb7cf9c4ebb19981cfa156cc60e2a75a51ccf1b Author: Stephen Boyd Date: Mon Oct 8 09:32:14 2018 -0700 gpio: Drop parent irq assignment during cascade setup We want to set the irq parent for interrupts that we're setting up to be cascaded from another interrupt controller, but we may or may not have already mapped the gpiochip irqs into the kernel's virtual irq number space at this point. If we have mapped irqs before calling here, then we've gone through gpiochip_irq_map() and called irq_set_parent() already. If we haven't mapped irqs, then the gpiochip is dynamically mapping irqs and we can rely on gpiochip_irq_map() or the gpio driver's irqdomain ops to setup the irq parent properly. Either way, setting the parent here when cascading the gpiochip doesn't make much sense because it should be done at irq mapping time. In the dynamic mapping case, this code is mapping virq 0 to some parent virq in a loop. While that's benign, let's drop this code to simplify. Cc: Evan Green Cc: Thierry Reding Cc: Grygorii Strashko Signed-off-by: Stephen Boyd Signed-off-by: Linus Walleij commit ce96a3a04130b8b6294e1d66e167d88577cf9746 Author: Andy Shevchenko Date: Thu Oct 4 18:33:21 2018 +0300 pinctrl: geminilake: Sort register offsets by value No functional change. Signed-off-by: Andy Shevchenko Acked-by: Mika Westerberg Signed-off-by: Linus Walleij commit 2b3445c7eb72f377e335a83e91327da4104adf22 Author: Andy Shevchenko Date: Thu Oct 4 18:33:20 2018 +0300 pinctrl: geminilake: Get rid of unneeded ->probe() stub The local ->probe() stub does nothing except calling a generic Intel pin control probe function. Thus, it's not needed and generic function may be called directly. This patch converts the driver accordingly. Signed-off-by: Andy Shevchenko Acked-by: Mika Westerberg Signed-off-by: Linus Walleij commit 08a3e5dca04ada02516102acf8cbd77f89baee6d Author: Andy Shevchenko Date: Thu Oct 4 18:33:18 2018 +0300 pinctrl: geminilake: Update pin list for B0 stepping According to an updated pin list few names of the pins can be spelled better, taking into account their primary functions. Thus, update a pin list to cover B0 stepping. Note, SPI numbering had been fixed even in A0 public documentation. Signed-off-by: Andy Shevchenko Acked-by: Mika Westerberg Signed-off-by: Linus Walleij commit 2c59f06cc0442862d589c36bd2f29667f96c35e7 Merge: e85679511e48 e4e92fb160d7 Author: David S. Miller Date: Tue Oct 16 00:14:18 2018 -0700 Merge branch 'net-Kernel-side-filtering-for-route-dumps' David Ahern says: ==================== net: Kernel side filtering for route dumps Implement kernel side filtering of route dumps by protocol (e.g., which routing daemon installed the route), route type (e.g., unicast), table id and nexthop device. iproute2 has been doing this filtering in userspace for years; pushing the filters to the kernel side reduces the amount of data the kernel sends and reduces wasted cycles on both sides processing unwanted data. These initial options provide a huge improvement for efficiently examining routes on large scale systems. v2 - better handling of requests for a specific table. Rather than walking the hash of all tables, lookup the specific table and dump it - refactor mr_rtm_dumproute moving the loop over the table into a helper that can be invoked directly - add hook to return NLM_F_DUMP_FILTERED in DONE message to ensure it is returned even when the dump returns nothing ==================== Signed-off-by: David S. Miller commit e4e92fb160d7bef689c6ad00108b4e52599ca05e Author: David Ahern Date: Mon Oct 15 18:56:51 2018 -0700 net/ipv4: Bail early if user only wants prefix entries Unlike IPv6, IPv4 does not have routes marked with RTF_PREFIX_RT. If the flag is set in the dump request, just return. In the process of this change, move the CLONE check to use the new filter flags. Signed-off-by: David Ahern Signed-off-by: David S. Miller commit 08e814c9e8eb5a982cbd1e8f6bd255d97c51026f Author: David Ahern Date: Mon Oct 15 18:56:50 2018 -0700 net/ipv6: Bail early if user only wants cloned entries Similar to IPv4, IPv6 fib no longer contains cloned routes. If a user requests a route dump for only cloned entries, no sense walking the FIB and returning everything. Signed-off-by: David Ahern Signed-off-by: David S. Miller commit 196cfebf897266c3450519e916bab9daff74e52c Author: David Ahern Date: Mon Oct 15 18:56:49 2018 -0700 net/mpls: Handle kernel side filtering of route dumps Update the dump request parsing in MPLS for the non-INET case to enable kernel side filtering. If INET is disabled the only filters that make sense for MPLS are protocol and nexthop device. Signed-off-by: David Ahern Signed-off-by: David S. Miller commit effe6792662495ad9c175bf0d9c53459a51fdbbd Author: David Ahern Date: Mon Oct 15 18:56:48 2018 -0700 net: Enable kernel side filtering of route dumps Update parsing of route dump request to enable kernel side filtering. Allow filtering results by protocol (e.g., which routing daemon installed the route), route type (e.g., unicast), table id and nexthop device. These amount to the low hanging fruit, yet a huge improvement, for dumping routes. ip_valid_fib_dump_req is called with RTNL held, so __dev_get_by_index can be used to look up the device index without taking a reference. From there filter->dev is only used during dump loops with the lock still held. Set NLM_F_DUMP_FILTERED in the answer_flags so the user knows the results have been filtered should no entries be returned. Signed-off-by: David Ahern Signed-off-by: David S. Miller commit cb167893f41e21e6bd283d78e53489289dc0592d Author: David Ahern Date: Mon Oct 15 18:56:47 2018 -0700 net: Plumb support for filtering ipv4 and ipv6 multicast route dumps Implement kernel side filtering of routes by egress device index and table id. If the table id is given in the filter, lookup table and call mr_table_dump directly for it. Signed-off-by: David Ahern Signed-off-by: David S. Miller commit e1cedae1ba6b09ae8376c1486712bf91ea0dfc41 Author: David Ahern Date: Mon Oct 15 18:56:46 2018 -0700 ipmr: Refactor mr_rtm_dumproute Move per-table loops from mr_rtm_dumproute to mr_table_dump and export mr_table_dump for dumps by specific table id. Signed-off-by: David Ahern Signed-off-by: David S. Miller commit bae9a78b17b87a7cef56cf492916007a58f65172 Author: David Ahern Date: Mon Oct 15 18:56:45 2018 -0700 net/mpls: Plumb support for filtering route dumps Implement kernel side filtering of routes by egress device index and protocol. MPLS uses only a single table and route type. Signed-off-by: David Ahern Signed-off-by: David S. Miller commit 13e38901d46ca60156c53c0d5e0b8bb58db66da5 Author: David Ahern Date: Mon Oct 15 18:56:44 2018 -0700 net/ipv6: Plumb support for filtering route dumps Implement kernel side filtering of routes by table id, egress device index, protocol, and route type. If the table id is given in the filter, lookup the table and call fib6_dump_table directly for it. Move the existing route flags check for prefix only routes to the new filter. Signed-off-by: David Ahern Signed-off-by: David S. Miller commit 18a8021a7be3207686851208f91a2f105b2d4703 Author: David Ahern Date: Mon Oct 15 18:56:43 2018 -0700 net/ipv4: Plumb support for filtering route dumps Implement kernel side filtering of routes by table id, egress device index, protocol and route type. If the table id is given in the filter, lookup the table and call fib_table_dump directly for it. Signed-off-by: David Ahern Signed-off-by: David S. Miller commit 4724676d551c0961659b1da3fb4b5928169fb184 Author: David Ahern Date: Mon Oct 15 18:56:42 2018 -0700 net: Add struct for fib dump filter Add struct fib_dump_filter for options on limiting which routes are returned in a dump request. The current list is table id, protocol, route type, rtm_flags and nexthop device index. struct net is needed to lookup the net_device from the index. Declare the filter for each route dump handler and plumb the new arguments from dump handlers to ip_valid_fib_dump_req. Signed-off-by: David Ahern Signed-off-by: David S. Miller commit 22e6c58b8c2843337ec4e8464b1ce6e869ca5bf4 Author: David Ahern Date: Mon Oct 15 18:56:41 2018 -0700 netlink: Add answer_flags to netlink_callback With dump filtering we need a way to ensure the NLM_F_DUMP_FILTERED flag is set on a message back to the user if the data returned is influenced by some input attributes. Normally this can be done as messages are added to the skb, but if the filter results in no data being returned, the user could be confused as to why. This patch adds answer_flags to the netlink_callback allowing dump handlers to set the NLM_F_DUMP_FILTERED at a minimum in the NLMSG_DONE message ensuring the flag gets back to the user. The netlink_callback space is initialized to 0 via a memset in __netlink_dump_start, so init of the new answer_flags is covered. Signed-off-by: David Ahern Signed-off-by: David S. Miller commit ba4a41198324be2e6fbb06c270fdc8500c0e38de Author: Mark Bloch Date: Wed Oct 10 09:55:10 2018 +0300 RDMA/mlx5: Add support for flow tag to raw create flow A user can provide a hint which will be attached to the packet and written to the CQE on receive. This can be used as a way to offload operations into the HW, for example parsing a packet which is a tunneled packet, and if so, pass 0x1 as the hint. The software can use that hint to decapsulate the packet and parse only the inner headers thus saving CPU cycles. Signed-off-by: Mark Bloch Reviewed-by: Yishai Hadas Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 645ba5970c0766c610920fd5e8dd34e62766af5a Author: Gal Pressman Date: Mon Oct 8 19:44:03 2018 +0300 RDMA/mlx5: Remove extraneous error check Remove double error check from create user RQ error flow. Fixes: 79b20a6c3014 ("IB/mlx5: Add receive Work Queue verbs") Signed-off-by: Gal Pressman Reviewed-by: Majd Dibbiny Signed-off-by: Jason Gunthorpe commit 4766ab5677a2842834f9bc4a21587256a811531c Author: Waiman Long Date: Fri Oct 12 17:42:27 2018 -0400 locking/lockdep: Remove duplicated 'lock_class_ops' percpu array Remove the duplicated 'lock_class_ops' percpu array that is not used anywhere. Signed-off-by: Waiman Long Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Will Deacon Fixes: 8ca2b56cd7da ("locking/lockdep: Make class->ops a percpu counter and move it under CONFIG_DEBUG_LOCKDEP=y") Link: http://lkml.kernel.org/r/1539380547-16726-1-git-send-email-longman@redhat.com Signed-off-by: Ingo Molnar commit e85679511e48168b0f066b6ae585556b5e0d8f5b Merge: c45d7150656f 0b592b5a01be Author: David S. Miller Date: Mon Oct 15 23:21:07 2018 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Daniel Borkmann says: ==================== pull-request: bpf-next 2018-10-16 The following pull-request contains BPF updates for your *net-next* tree. The main changes are: 1) Convert BPF sockmap and kTLS to both use a new sk_msg API and enable sk_msg BPF integration for the latter, from Daniel and John. 2) Enable BPF syscall side to indicate for maps that they do not support a map lookup operation as opposed to just missing key, from Prashant. 3) Add bpftool map create command which after map creation pins the map into bpf fs for further processing, from Jakub. 4) Add bpftool support for attaching programs to maps allowing sock_map and sock_hash to be used from bpftool, from John. 5) Improve syscall BPF map update/delete path for map-in-map types to wait a RCU grace period for pending references to complete, from Daniel. 6) Couple of follow-up fixes for the BPF socket lookup to get it enabled also when IPv6 is compiled as a module, from Joe. 7) Fix a generic-XDP bug to handle the case when the Ethernet header was mangled and thus update skb's protocol and data, from Jesper. 8) Add a missing BTF header length check between header copies from user space, from Wenwen. 9) Minor fixups in libbpf to use __u32 instead u32 types and include proper perf_event.h uapi header instead of perf internal one, from Yonghong. 10) Allow to pass user-defined flags through EXTRA_CFLAGS and EXTRA_LDFLAGS to bpftool's build, from Jiri. 11) BPF kselftest tweaks to add LWTUNNEL to config fragment and to install with_addr.sh script from flow dissector selftest, from Anders. ==================== Signed-off-by: David S. Miller commit 2351776e87a18318b5f4732e7790f0c726cc37a0 Author: Yishai Hadas Date: Sun Oct 7 12:06:34 2018 +0300 IB/mlx5: Verify DEVX object type Verify that the input DEVX object type matches the created object. As the obj_id in the firmware is not globally unique the object type must be considered upon checking for a valid object id. Once both the type and the id match we know that the lock was taken on the correct object by the uverbs layer. Fixes: e662e14d801b ("IB/mlx5: Add DEVX support for modify and query commands") Signed-off-by: Yishai Hadas Reviewed-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 68a997c5d28c581ae23594eb8a1420d834c30d24 Author: Yixian Liu Date: Fri Oct 5 17:53:24 2018 +0800 RDMA/hns: Add FRMR support for hip08 This patch adds fast register physical memory region (FRMR) support for hip08. Signed-off-by: Yixian Liu Signed-off-by: Jason Gunthorpe commit c45d7150656fc33181af5806c94bfe0e8f90c1a6 Author: Heiner Kallweit Date: Mon Oct 15 21:25:13 2018 +0200 net: phy: merge phy_start_aneg and phy_start_aneg_priv After commit 9f2959b6b52d ("net: phy: improve handling delayed work") the sync parameter isn't needed any longer in phy_start_aneg_priv(). This allows to merge phy_start_aneg() and phy_start_aneg_priv(). Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 965f22bc425298b619c5463e8af49aa98f744462 Author: Songjun Wu Date: Mon Sep 24 18:27:50 2018 +0800 MIPS: dts: Change upper case to lower case All the upper case in unit-address and hex constants are changed to lower case according to the DT conventions. Signed-off-by: Songjun Wu Signed-off-by: Paul Burton Reviewed-by: Rob Herring Patchwork: https://patchwork.linux-mips.org/patch/20768/ Cc: yixin.zhu@linux.intel.com Cc: chuanhua.lei@linux.intel.com Cc: hauke.mehrtens@intel.com Cc: devicetree@vger.kernel.org Cc: James Hogan Cc: linux-mips@linux-mips.org Cc: linux-kernel@vger.kernel.org Cc: Thomas Gleixner Cc: Philippe Ombredanne Cc: Rob Herring Cc: Kate Stewart Cc: Greg Kroah-Hartman Cc: Mark Rutland Cc: Ralf Baechle commit 0e557a3e061399820f15c92f5ac62b6d0000e84b Author: Alexandre Belloni Date: Fri Aug 31 17:04:34 2018 +0200 MIPS: generic: Add Network, SPI and I2C to ocelot_defconfig Add support for the integrated switch, and the SPI and I2C controller found on MSCC Ocelot. Signed-off-by: Alexandre Belloni Signed-off-by: Paul Burton Patchwork: https://patchwork.linux-mips.org/patch/20345/ Cc: James Hogan Cc: Ralf Baechle Cc: linux-kernel@vger.kernel.org Cc: linux-mips@linux-mips.org commit 360fe725f8849aaddc53475fef5d4a0c439b05ae Author: Huacai Chen Date: Wed Sep 5 17:33:09 2018 +0800 MIPS: Loongson-3: Fix BRIDGE irq delivery problem After commit e509bd7da149dc349160 ("genirq: Allow migration of chained interrupts by installing default action") Loongson-3 fails at here: setup_irq(LOONGSON_HT1_IRQ, &cascade_irqaction); This is because both chained_action and cascade_irqaction don't have IRQF_SHARED flag. This will cause Loongson-3 resume fails because HPET timer interrupt can't be delivered during S3. So we set the irqchip of the chained irq to loongson_irq_chip which doesn't disable the chained irq in CP0.Status. Cc: stable@vger.kernel.org Signed-off-by: Huacai Chen Signed-off-by: Paul Burton Patchwork: https://patchwork.linux-mips.org/patch/20434/ Cc: Ralf Baechle Cc: James Hogan Cc: linux-mips@linux-mips.org Cc: Fuxin Zhang Cc: Zhangjin Wu Cc: Huacai Chen commit d06f8a2f1befb5a3d0aa660ab1c05e9b744456ea Author: Huacai Chen Date: Wed Sep 5 17:33:08 2018 +0800 MIPS: Loongson-3: Fix CPU UART irq delivery problem Masking/unmasking the CPU UART irq in CP0_Status (and redirecting it to other CPUs) may cause interrupts be lost, especially in multi-package machines (Package-0's UART irq cannot be delivered to others). So make mask_loongson_irq() and unmask_loongson_irq() be no-ops. The original problem (UART IRQ may deliver to any core) is also because of masking/unmasking the CPU UART irq in CP0_Status. So it is safe to remove all of the stuff. Signed-off-by: Huacai Chen Signed-off-by: Paul Burton Patchwork: https://patchwork.linux-mips.org/patch/20433/ Cc: Ralf Baechle Cc: James Hogan Cc: linux-mips@linux-mips.org Cc: Fuxin Zhang Cc: Zhangjin Wu Cc: Huacai Chen commit 7f8502a539bbfca7c3027e0279060eb46dfde59f Author: Paul Burton Date: Mon Oct 15 18:33:23 2018 +0000 MIPS: Remove unused PREF, PREFE & PREFX macros asm/asm.h provides PREF(), PREFE() & PREFX() macros which are now entirely unused. Delete the dead code. Signed-off-by: Paul Burton Patchwork: https://patchwork.linux-mips.org/patch/20908/ Cc: linux-mips@linux-mips.org commit 1d6fb222bd23696a25b9b256a3e076b9c60677b8 Author: Paul Burton Date: Mon Oct 15 18:33:22 2018 +0000 MIPS: lib: Use kernel_pref & user_pref in memcpy() memcpy() is the only user of the PREF() & PREFE() macros from asm/asm.h. Switch to using the kernel_pref() & user_pref() macros from asm/asm-eva.h which fit more consistently with other abstractions of EVA vs non-EVA instructions. Signed-off-by: Paul Burton Patchwork: https://patchwork.linux-mips.org/patch/20907/ Cc: linux-mips@linux-mips.org commit e2b405439903b20675de30090aab0fcadef5bbba Author: Paul Burton Date: Mon Oct 15 18:33:21 2018 +0000 MIPS: Remove unused CAT macro asm/asm.h provides a CAT macro which is unused throughout the tree, and if anyone wanted it the generic CONCATENATE macro in linux/kernel.h provides the same functionality. Delete the dead code. Signed-off-by: Paul Burton Patchwork: https://patchwork.linux-mips.org/patch/20905/ Cc: linux-mips@linux-mips.org commit 4021c30a86ec7c2e51738eaa065317ce321d9798 Author: Paul Burton Date: Mon Oct 15 18:33:21 2018 +0000 MIPS: Add kernel_pref & user_pref helpers Add kernel_pref & user_pref macros to asm/asm-eva.h, providing an abstraction around EVA & non-EVA pref instructions consistent with the existing macros we have for cache & load/store instructions. Signed-off-by: Paul Burton Patchwork: https://patchwork.linux-mips.org/patch/20906/ Cc: linux-mips@linux-mips.org commit da1d25e79a46fab38c73570bd7c3a0f545fbbb9d Author: Paul Burton Date: Mon Oct 15 18:33:20 2018 +0000 MIPS: Remove unused TTABLE macro asm/asm.h contains a TTABLE macro to generate "text tables" which would appear to be arrays of pointers to strings. It is unused throughout the kernel tree, so delete the dead code. Signed-off-by: Paul Burton Patchwork: https://patchwork.linux-mips.org/patch/20904/ Cc: linux-mips@linux-mips.org commit fce362c7fc3f89687b4b0eecefd7de8baa91a679 Author: Paul Burton Date: Mon Oct 15 18:33:19 2018 +0000 MIPS: Remove unused PIC macros asm/asm.h contains CPRESTORE, CPADD & CPLOAD macros that are intended for use with position independent code, but are not used anywhere in the kernel - along with a comment to that effect. Remove the dead code. Signed-off-by: Paul Burton Patchwork: https://patchwork.linux-mips.org/patch/20903/ Cc: linux-mips@linux-mips.org commit 7b2d13f2e24002c5113d30993c5297cb4fea1437 Author: Paul Burton Date: Mon Oct 15 18:33:19 2018 +0000 MIPS: Remove unused MOVN & MOVZ macros We have macros in asm/asm.h to allow for use of the MOVN & MOVZ instructions with compare-and-branch sequences providing compatibility for ISA versions which don't include those instructions. However the macros are unused, and appear to have always been unused. Delete the dead code. Signed-off-by: Paul Burton Patchwork: https://patchwork.linux-mips.org/patch/20909/ Cc: linux-mips@linux-mips.org commit 5df950994934814a8b91f0cf9f653842d2ba082d Author: Selvin Xavier Date: Mon Oct 8 03:28:04 2018 -0700 RDMA/bnxt_re: Avoid resource leak in case the NQ registration fails In case the NQ alloc/enable fails, free up the already allocated/enabled NQ before reporting failure. Also, track the alloc/enable using proper state checking. Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit a08b9e9a705675ba05fa44f0342e2875fd1bda28 Author: Selvin Xavier Date: Mon Oct 8 03:28:03 2018 -0700 RDMA/bnxt_re: Wait for delayed work to finish before device removal Delayed work bnxt_re_worker would be still running even after cancel_delayed_work returns. This causes crash as the driver proceeds with device removal. To make sure that the work is finished before returning, use cancel_delayed_work_sync. Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 854a202001171594df8988b335410adebac641d5 Author: Devesh Sharma Date: Mon Oct 8 03:28:02 2018 -0700 RDMA/bnxt_re: Limit max_pkey to 16 bit value Some FW versios return pkey values more than 0xFFFF. pkey_tbl_len of ib_port_attr is 16bit value. So restricting max_pkeys to 0xFFFF. Signed-off-by: Devesh Sharma Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 4c01f2e3a906a0d2d798be5751c331cf501bc129 Author: Devesh Sharma Date: Mon Oct 8 03:28:01 2018 -0700 RDMA/bnxt_re: Fix qp async event reporting Reports affiliated async event on the qp-async event channel instead of global event channel. Signed-off-by: Devesh Sharma Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 316dd2825db1396304fb3003fad6cf1fef1883a0 Author: Selvin Xavier Date: Mon Oct 8 03:28:00 2018 -0700 RDMA/bnxt_re: Report out of sequence hw counters Expose out of sequence errors received from FW. This counter is a 32 bit counter and driver has to accumulate the counter. Stores the previous value for calculating the difference in the next query. Also, update the HW statistics structure with new fields. Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 5c80c9138e28f600e185d0f23fca5ea7fe45bd95 Author: Selvin Xavier Date: Mon Oct 8 03:27:59 2018 -0700 RDMA/bnxt_re: Expose rx discards and drop counters Expose the RoCE discard and drop counters from the HW statistics context Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit bb22c36cbaaeff351b8a6956d88be98497cc14aa Author: Somnath Kotur Date: Mon Oct 8 03:27:58 2018 -0700 RDMA/bnxt_re: Prevent driver crash due to NULL pointer in error message print crsqe->resp would be NULL in case the host command timed out before getting a response from HW. Check for NULL pointer to avoid a potential crash while printing the error message. Signed-off-by: Somnath Kotur Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit f2bd4d096eb4e0074b476452789a3b10a31af162 Author: Devesh Sharma Date: Mon Oct 8 03:27:57 2018 -0700 RDMA/bnxt_re: Drop L2 async events silently In some FW versions, RoCE driver also receives an async notification which was directed to L2 driver. RoCE driver does not handle this and print a message to syslog. Drop these notifications silently. Signed-off-by: Devesh Sharma Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit ed51efd2ce44091a858ad829f666727e7c95695e Author: Selvin Xavier Date: Mon Oct 8 03:27:56 2018 -0700 RDMA/bnxt_re: Avoid accessing nq->bar_reg_iomem in failure case In the failure path, nq->bar_reg_iomem gets accessed without initializing. Avoid this by calling the bnxt_qplib_nq_stop_irq only if the initialization is complete. Reported-by: Dan Carpenter Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") Fixes: 6e04b1035689 ("RDMA/bnxt_re: Fix broken RoCE driver due to recent L2 driver changes") Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit eae4ad1b0c9a77ef0cbac212d58d46976eaacfc1 Author: Selvin Xavier Date: Mon Oct 8 03:27:55 2018 -0700 RDMA/bnxt_re: Avoid NULL check after accessing the pointer This is reported by smatch check. rcfw->creq_bar_reg_iomem is accessed in bnxt_qplib_rcfw_stop_irq and this variable check afterwards doesn't make sense. Also, rcfw->creq_bar_reg_iomem will never be NULL. So Removing this check. Reported-by: Dan Carpenter Fixes: 6e04b1035689 ("RDMA/bnxt_re: Fix broken RoCE driver due to recent L2 driver changes") Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 1b7042d7a586a4b8c9d257ceba6f40390bcd21ee Author: Selvin Xavier Date: Mon Oct 8 03:27:54 2018 -0700 RDMA/bnxt_re: Remove the unnecessary version macro definition Version macro is not required as the driver is not maintaining the version. Removing the references of this macro too. Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit d455f29f6d76a5f94881ca1289aaa1e90617ff5d Author: Selvin Xavier Date: Mon Oct 8 03:27:53 2018 -0700 RDMA/bnxt_re: Fix recursive lock warning in debug kernel Fix possible recursive lock warning. Its a false warning as the locks are part of two differnt HW Queue data structure - cmdq and creq. Debug kernel is throwing the following warning and stack trace. [ 783.914967] ============================================ [ 783.914970] WARNING: possible recursive locking detected [ 783.914973] 4.19.0-rc2+ #33 Not tainted [ 783.914976] -------------------------------------------- [ 783.914979] swapper/2/0 is trying to acquire lock: [ 783.914982] 000000002aa3949d (&(&hwq->lock)->rlock){..-.}, at: bnxt_qplib_service_creq+0x232/0x350 [bnxt_re] [ 783.914999] but task is already holding lock: [ 783.915002] 00000000be73920d (&(&hwq->lock)->rlock){..-.}, at: bnxt_qplib_service_creq+0x2a/0x350 [bnxt_re] [ 783.915013] other info that might help us debug this: [ 783.915016] Possible unsafe locking scenario: [ 783.915019] CPU0 [ 783.915021] ---- [ 783.915034] lock(&(&hwq->lock)->rlock); [ 783.915035] lock(&(&hwq->lock)->rlock); [ 783.915037] *** DEADLOCK *** [ 783.915038] May be due to missing lock nesting notation [ 783.915039] 1 lock held by swapper/2/0: [ 783.915040] #0: 00000000be73920d (&(&hwq->lock)->rlock){..-.}, at: bnxt_qplib_service_creq+0x2a/0x350 [bnxt_re] [ 783.915044] stack backtrace: [ 783.915046] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.19.0-rc2+ #33 [ 783.915047] Hardware name: Dell Inc. PowerEdge R730/0599V5, BIOS 1.0.4 08/28/2014 [ 783.915048] Call Trace: [ 783.915049] [ 783.915054] dump_stack+0x90/0xe3 [ 783.915058] __lock_acquire+0x106c/0x1080 [ 783.915061] ? sched_clock+0x5/0x10 [ 783.915063] lock_acquire+0xbd/0x1a0 [ 783.915065] ? bnxt_qplib_service_creq+0x232/0x350 [bnxt_re] [ 783.915069] _raw_spin_lock_irqsave+0x4a/0x90 [ 783.915071] ? bnxt_qplib_service_creq+0x232/0x350 [bnxt_re] [ 783.915073] bnxt_qplib_service_creq+0x232/0x350 [bnxt_re] [ 783.915078] tasklet_action_common.isra.17+0x197/0x1b0 [ 783.915081] __do_softirq+0xcb/0x3a6 [ 783.915084] irq_exit+0xe9/0x100 [ 783.915085] do_IRQ+0x6a/0x120 [ 783.915087] common_interrupt+0xf/0xf [ 783.915088] Use nested notation for the spin_lock to avoid this warning. Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 5a23e0b1dd51fe0efae666b03fdb15e1301f437a Author: Selvin Xavier Date: Mon Oct 8 03:27:52 2018 -0700 RDMA/bnxt_re: Add missing spin lock initialization Add the missing initalization of the cq_lock and qplib.flush_lock. Fixes: 942c9b6ca8de ("RDMA/bnxt_re: Avoid Hard lockup during error CQE processing") Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 59bfc59a68286c5e6824ec3dddcf5232a73c217e Merge: ed7a01fd3fd7 dd9a40349570 Author: Jason Gunthorpe Date: Tue Oct 16 00:01:02 2018 -0600 Merge branch 'for-rc' into rdma.git for-next From git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git This is required to resolve dependencies of the next series of RDMA patches. The code motion conflicts in drivers/infiniband/core/cache.c were resolved. Signed-off-by: Jason Gunthorpe commit 005479556197f80139771960dda0dfdcd2d2aad5 Author: Haiyang Zhang Date: Mon Oct 15 19:06:15 2018 +0000 hv_netvsc: fix vf serial matching with pci slot info The VF device's serial number is saved as a string in PCI slot's kobj name, not the slot->number. This patch corrects the netvsc driver, so the VF device can be successfully paired with synthetic NIC. Fixes: 00d7ddba1143 ("hv_netvsc: pair VF based on serial number") Reported-by: Vitaly Kuznetsov Signed-off-by: Haiyang Zhang Reviewed-by: Stephen Hemminger Signed-off-by: David S. Miller commit b13949678b0abd374214dfd1472b4087a0898562 Merge: 1a3aea2534f4 825e1c523d50 Author: David S. Miller Date: Mon Oct 15 22:56:42 2018 -0700 Merge branch 'tcp-second-round-for-EDT-conversion' Eric Dumazet says: ==================== tcp: second round for EDT conversion First round of EDT patches left TCP stack in a non optimal state. - High speed flows suffered from loss of performance, addressed by the first patch of this series. - Second patch brings pacing to the current state of networking, since we now reach ~100 Gbit on a single TCP flow. - Third patch implements a mitigation for scheduling delays, like the one we did in sch_fq in the past. - Fourth patch removes one special case in sch_fq for ACK packets. - Fifth patch removes a serious perfomance cost for TCP internal pacing. We should setup the high resolution timer only if really needed. - Sixth patch fixes a typo in BBR. - Last patch is one minor change in cdg congestion control. Neal Cardwell also has a patch series fixing BBR after EDT adoption. ==================== Signed-off-by: David S. Miller commit 825e1c523d5000f067a1614e4a66bb282a2d373c Author: Eric Dumazet Date: Mon Oct 15 09:37:58 2018 -0700 tcp: cdg: use tcp high resolution clock cache We store in tcp socket a cache of most recent high resolution clock, there is no need to call local_clock() again, since this cache is good enough. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 97ec3eb33dd300764ca5fa8923e5430dc4dbac13 Author: Neal Cardwell Date: Mon Oct 15 09:37:57 2018 -0700 tcp_bbr: fix typo in bbr_pacing_margin_percent There was a typo in this parameter name. Signed-off-by: Neal Cardwell Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 864e5c090749448e879e86bec06ee396aa2c19c5 Author: Eric Dumazet Date: Mon Oct 15 09:37:56 2018 -0700 tcp: optimize tcp internal pacing When TCP implements its own pacing (when no fq packet scheduler is used), it is arming high resolution timer after a packet is sent. But in many cases (like TCP_RR kind of workloads), this high resolution timer expires before the application attempts to write the following packet. This overhead also happens when the flow is ACK clocked and cwnd limited instead of being limited by the pacing rate. This leads to extra overhead (high number of IRQ) Now tcp_wstamp_ns is reserved for the pacing timer only (after commit "tcp: do not change tcp_wstamp_ns in tcp_mstamp_refresh"), we can setup the timer only when a packet is about to be sent, and if tcp_wstamp_ns is in the future. This leads to a ~10% performance increase in TCP_RR workloads. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 7baf33bdac37da65ddce3adf4daa8c7805802174 Author: Eric Dumazet Date: Mon Oct 15 09:37:55 2018 -0700 net_sched: sch_fq: no longer use skb_is_tcp_pure_ack() With the new EDT model, sch_fq no longer has to special case TCP pure acks, since their skb->tstamp will allow them being sent without pacing delay. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit a7a2563064e963bc5e3f39f533974f2730c0ff56 Author: Eric Dumazet Date: Mon Oct 15 09:37:54 2018 -0700 tcp: mitigate scheduling jitter in EDT pacing model In commit fefa569a9d4b ("net_sched: sch_fq: account for schedule/timers drifts") we added a mitigation for scheduling jitter in fq packet scheduler. This patch does the same in TCP stack, now it is using EDT model. Note that this mitigation is valid for both external (fq packet scheduler) or internal TCP pacing. This uses the same strategy than the above commit, allowing a time credit of half the packet currently sent. Consider following case : An skb is sent, after an idle period of 300 usec. The air-time (skb->len/pacing_rate) is 500 usec Instead of setting the pacing timer to now+500 usec, it will use now+min(500/2, 300) -> now+250usec This is like having a token bucket with a depth of half an skb. Tested: tc qdisc replace dev eth0 root pfifo_fast Before netperf -P0 -H remote -- -q 1000000000 # 8000Mbit 540000 262144 262144 10.00 7710.43 After : netperf -P0 -H remote -- -q 1000000000 # 8000 Mbit 540000 262144 262144 10.00 7999.75 # Much closer to 8000Mbit target Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 76a9ebe811fb3d0605cb084f1ae6be5610541865 Author: Eric Dumazet Date: Mon Oct 15 09:37:53 2018 -0700 net: extend sk_pacing_rate to unsigned long sk_pacing_rate has beed introduced as a u32 field in 2013, effectively limiting per flow pacing to 34Gbit. We believe it is time to allow TCP to pace high speed flows on 64bit hosts, as we now can reach 100Gbit on one TCP flow. This patch adds no cost for 32bit kernels. The tcpi_pacing_rate and tcpi_max_pacing_rate were already exported as 64bit, so iproute2/ss command require no changes. Unfortunately the SO_MAX_PACING_RATE socket option will stay 32bit and we will need to add a new option to let applications control high pacing rates. State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 1787144 10.246.9.76:49992 10.246.9.77:36741 timer:(on,003ms,0) ino:91863 sk:2 <-> skmem:(r0,rb540000,t66440,tb2363904,f605944,w1822984,o0,bl0,d0) ts sack bbr wscale:8,8 rto:201 rtt:0.057/0.006 mss:1448 rcvmss:536 advmss:1448 cwnd:138 ssthresh:178 bytes_acked:256699822585 segs_out:177279177 segs_in:3916318 data_segs_out:177279175 bbr:(bw:31276.8Mbps,mrtt:0,pacing_gain:1.25,cwnd_gain:2) send 28045.5Mbps lastrcv:73333 pacing_rate 38705.0Mbps delivery_rate 22997.6Mbps busy:73333ms unacked:135 retrans:0/157 rcv_space:14480 notsent:2085120 minrtt:0.013 Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 5f6188a8003d080e3753b8f14f4a5a2325ae1ff6 Author: Eric Dumazet Date: Mon Oct 15 09:37:52 2018 -0700 tcp: do not change tcp_wstamp_ns in tcp_mstamp_refresh In EDT design, I made the mistake of using tcp_wstamp_ns to store the last tcp_clock_ns() sample and to store the pacing virtual timer. This causes major regressions at high speed flows. Introduce tcp_clock_cache to store last tcp_clock_ns(). This is needed because some arches have slow high-resolution kernel time service. tcp_wstamp_ns is only updated when a packet is sent. Note that we can remove tcp_mstamp in the future since tcp_mstamp is essentially tcp_clock_cache/1000, so the apparent socket size increase is temporary. Fixes: 9799ccb0e984 ("tcp: add tcp_wstamp_ns socket field") Signed-off-by: Eric Dumazet Acked-by: Soheil Hassas Yeganeh Signed-off-by: David S. Miller commit 1a3aea2534f4f3083f29b2b047aa83a9d6c777a4 Author: Li RongQing Date: Mon Oct 15 19:00:31 2018 +0800 net: bridge: fix a possible memory leak in __vlan_add After per-port vlan stats, vlan stats should be released when fail to add vlan Fixes: 9163a0fc1f0c0 ("net: bridge: add support for per-port vlan stats") CC: bridge@lists.linux-foundation.org cc: Nikolay Aleksandrov CC: Roopa Prabhu Signed-off-by: Zhang Yu Signed-off-by: Li RongQing Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit bc0e7cf43370a8e229224623f516c9b0396e08b9 Author: David Howells Date: Mon Oct 15 11:31:03 2018 +0100 rxrpc: Add /proc/net/rxrpc/peers to display peer list Add /proc/net/rxrpc/peers to display the list of peers currently active. Signed-off-by: David Howells Signed-off-by: David S. Miller commit d275444cc36130313119777fefd077b7d575d040 Author: Wei Yongjun Date: Mon Oct 15 03:07:16 2018 +0000 fore200e: fix missing unlock on error in bsq_audit() Add the missing unlock before return from function bsq_audit() in the error handling case. Fixes: 1d9d8be91788 ("fore200e: check for dma mapping failures") Signed-off-by: Wei Yongjun Signed-off-by: David S. Miller commit 65f2247d615532ab1909e0892cc01d04c5262032 Merge: 9e983c589853 1ab968d2f1d6 Author: David S. Miller Date: Mon Oct 15 22:44:33 2018 -0700 Merge branch 'bnxt_en-Add-support-for-new-57500-chips' Michael Chan says: ==================== bnxt_en: Add support for new 57500 chips. This patch-set is larger than normal because I wanted a complete series to add basic support for the new 57500 chips. The new chips have the following main differences compared to legacy chips: 1. Requires the PF driver to allocate DMA context memory as a backing store. 2. New NQ (notification queue) for interrupt events. 3. One or more CP rings can be associated with an NQ. 4. 64-bit doorbells. Most other structures and firmware APIs are compatible with legacy devices with some exceptions. For example, ring groups are no longer used and RSS table format has changed. The patch-set includes the usual firmware spec. update, some refactoring and restructuring, and adding the new code to add basic support for the new class of devices. ==================== Signed-off-by: David S. Miller commit 1ab968d2f1d6d654052dbbf95f9461a6428a5487 Author: Michael Chan Date: Sun Oct 14 07:02:59 2018 -0400 bnxt_en: Add PCI ID for BCM57508 device. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 0fcec9854ab478551debaef11e9c7875fc837906 Author: Michael Chan Date: Sun Oct 14 07:02:58 2018 -0400 bnxt_en: Add new NAPI poll function for 57500 chips. Add a new poll function that polls for NQ events. If the NQ event is a CQ notification, we locate the CP ring from the cq_handle and call __bnxt_poll_work() to handle RX/TX events on the CP ring. Add a new has_more_work field in struct bnxt_cp_ring_info to indicate budget has been reached. __bnxt_poll_cqs_done() is called to update or ARM the CP rings if budget has not been reached or not. If budget has been reached, the next bnxt_poll_p5() call will continue to poll from the CQ rings directly. Otherwise, the NQ will be ARMed for the next IRQ. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 3675b92fa70ece4c9263b812fc8cbf3bd606398c Author: Michael Chan Date: Sun Oct 14 07:02:57 2018 -0400 bnxt_en: Refactor bnxt_poll_work(). Separate the CP ring polling logic in bnxt_poll_work() into 2 separate functions __bnxt_poll_work() and __bnxt_poll_work_done(). Since the logic is separated, we need to add tx_pkts and events fields to struct bnxt_napi to keep track of the events to handle between the 2 functions. We also add had_work_done field to struct bnxt_cp_ring_info to indicate whether some work was performed on the CP ring. This is needed to better support the 57500 chips. We need to poll up to 2 separate CP rings before we update or ARM the CP rings on the 57500 chips. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 58590c8d9044dd6ff1757d9e9af63a253cc15101 Author: Michael Chan Date: Sun Oct 14 07:02:56 2018 -0400 bnxt_en: Add coalescing setup for 57500 chips. On legacy chips, the CP ring may be shared between RX and TX and so only setup the RX coalescing parameters in such a case. On 57500 chips, we always have a dedicated CP ring for TX so we can always set up the TX coalescing parameters in bnxt_hwrm_set_coal(). Also, the min_timer coalescing parameter applies to the NQ on the new chips and a separate firmware call needs to be made to set it up. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit e44758b78ae81461a3269e7958653f1af0f78989 Author: Michael Chan Date: Sun Oct 14 07:02:55 2018 -0400 bnxt_en: Use bnxt_cp_ring_info struct pointer as parameter for RX path. In the RX code path, we current use the bnxt_napi struct pointer to identify the associated RX/CP rings. Change it to use the struct bnxt_cp_ring_info pointer instead since there are now up to 2 CP rings per MSIX. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 7b3af4f75b81bec06ed5bf411039fbd0646da44e Author: Michael Chan Date: Sun Oct 14 07:02:54 2018 -0400 bnxt_en: Add RSS support for 57500 chips. RSS context allocation and RSS indirection table setup are very different on the new chip. Refactor bnxt_setup_vnic() to call 2 different functions to set up RSS for the vnic based on chip type. On the new chip, the number of RSS contexts and the indirection table size depends on the number of RX rings. Each indirection table entry is also different on the new chip since ring groups are no longer used. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 44c6f72a4c30496c7378a62e13605b217e49f991 Author: Michael Chan Date: Sun Oct 14 07:02:53 2018 -0400 bnxt_en: Increase RSS context array count and skip ring groups on 57500 chips. On the new 57500 chips, we need to allocate one RSS context for every 64 RX rings. In previous chips, only one RSS context per vnic is required regardless of the number of RX rings. So increase the max RSS context array count to 8. Hardware ring groups are not used on the new chips. Note that the software ring group structure is still maintained in the driver to keep track of the rings associated with the vnic. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 3e08b1841bc8debf6b3d722b9d355093a1537b1e Author: Michael Chan Date: Sun Oct 14 07:02:52 2018 -0400 bnxt_en: Allocate/Free CP rings for 57500 series chips. On the new 57500 chips, we allocate/free one CP ring for each RX ring or TX ring separately. Using separate CP rings for RX/TX is an improvement as TX events will no longer be stuck behind RX events. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 23aefdd761599e42d7f1f6504ff38c558e18de2a Author: Michael Chan Date: Sun Oct 14 07:02:51 2018 -0400 bnxt_en: Modify bnxt_ring_alloc_send_msg() to support 57500 chips. Firmware ring allocation semantics are slightly different for most ring types on 57500 chips. Allocation/deallocation for NQ rings are also added for the new chips. A CP ring handle is also added so that from the NQ interrupt event, we can locate the CP ring. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 2c61d2117ecb065aaad9e9ea9bc8bc4a6c30ec24 Author: Michael Chan Date: Sun Oct 14 07:02:50 2018 -0400 bnxt_en: Add helper functions to get firmware CP ring ID. On the new 57500 chips, getting the associated CP ring ID associated with an RX ring or TX ring is different than before. On the legacy chips, we find the associated ring group and look up the CP ring ID. On the 57500 chips, each RX ring and TX ring has a dedicated CP ring even if they share the MSIX. Use these helper functions at appropriate places to get the CP ring ID. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 50e3ab7836b5efdc25e935316b3a156de3ff972e Author: Michael Chan Date: Sun Oct 14 07:02:49 2018 -0400 bnxt_en: Allocate completion ring structures for 57500 series chips. On 57500 chips, the original bnxt_cp_ring_info struct now refers to the NQ. bp->cp_nr_rings refer to the number of NQs on 57500 chips. There are now 2 pointers for the CP rings associated with RX and TX rings. Modify bnxt_alloc_cp_rings() and bnxt_free_cp_rings() accordingly. With multiple CP rings per NAPI, we need to add a pointer in bnxt_cp_ring_info struct to point back to the bnxt_napi struct. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 41e8d7983752f2a0ada01fac11cbac7413e7beec Author: Michael Chan Date: Sun Oct 14 07:02:48 2018 -0400 bnxt_en: Modify the ring reservation functions for 57500 series chips. The ring reservation functions have to be modified for P5 chips in the following ways: - bnxt_cp_ring_info structs map to internal NQs as well as CP rings. - Ring groups are not used. - 1 CP ring must be available for each RX or TX ring. - number of RSS contexts to reserve is multiples of 64 RX rings. - RFS currently not supported. Also, RX AGG rings are only used for jumbo frames, so we need to unconditionally call bnxt_reserve_rings() in __bnxt_open_nic() to see if we need to reserve AGG rings in case MTU has changed. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 9c1fabdf424f27370790f1e0868b35cf63b70981 Author: Michael Chan Date: Sun Oct 14 07:02:47 2018 -0400 bnxt_en: Adjust MSIX and ring groups for 57500 series chips. Store the maximum MSIX capability in PCIe config. space earlier. When we call firmware to query capability, we need to compare the PCIe MSIX max count with the firmware count and use the smaller one as the MSIX count for 57500 (P5) chips. The new chips don't use ring groups. But previous chips do and the existing logic limits the available rings based on resource calculations including ring groups. Setting the max ring groups to the max rx rings will work on the new chips without changing the existing logic. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 697197e5a1735325c0e1ef85dde2b2986354beb9 Author: Michael Chan Date: Sun Oct 14 07:02:46 2018 -0400 bnxt_en: Re-structure doorbells. The 57500 series chips have a new 64-bit doorbell format. Use a new bnxt_db_info structure to unify the new and the old 32-bit doorbells. Add a new bnxt_set_db() function to set up the doorbell addreses and doorbell keys ahead of time. Modify and introduce new doorbell helpers to help abstract and unify the old and new doorbells. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit e38287b72ec5455eb1e16b1de0ba4ed54e2a748c Author: Michael Chan Date: Sun Oct 14 07:02:45 2018 -0400 bnxt_en: Add 57500 new chip ID and basic structures. 57500 series is a new chip class (P5) that requires some driver changes in the next several patches. This adds basic chip ID, doorbells, and the notification queue (NQ) structures. Each MSIX is associated with an NQ instead of a CP ring in legacy chips. Each NQ has up to 2 associated CP rings for RX and TX. The same bnxt_cp_ring_info struct will be used for the NQ. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 1b9394e5a2ad48be7906557ea6a500c5e8e91ee1 Author: Michael Chan Date: Sun Oct 14 07:02:44 2018 -0400 bnxt_en: Configure context memory on new devices. Call firmware to configure the DMA addresses of all context memory pages on new devices requiring context memory. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 98f04cf0f1fc26ee8401e7c06b422508acc8374c Author: Michael Chan Date: Sun Oct 14 07:02:43 2018 -0400 bnxt_en: Check context memory requirements from firmware. New device requires host context memory as a backing store. Call firmware to check for context memory requirements and store the parameters. Allocate host pages accordingly. We also need to move the call bnxt_hwrm_queue_qportcfg() earlier so that all the supported hardware queues and the IDs are known before checking and allocating context memory. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 66cca20abcf742e2e39ec437144e7787ecefa037 Author: Michael Chan Date: Sun Oct 14 07:02:42 2018 -0400 bnxt_en: Add new flags to setup new page table PTE bits on newer devices. Newer chips require the PTU_PTE_VALID bit to be set for every page table entry for context memory and rings. Additional bits are also required for page table entries for all rings. Add a flags field to bnxt_ring_mem_info struct to specify these additional bits to be used when setting up the pages tables as needed. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 6fe19886858f1c7f96a5da3420bd040c58bcaca6 Author: Michael Chan Date: Sun Oct 14 07:02:41 2018 -0400 bnxt_en: Refactor bnxt_ring_struct. Move the DMA page table and vmem fields in bnxt_ring_struct to a new bnxt_ring_mem_info struct. This will allow context memory management for a new device to re-use some of the existing infrastructure. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 74706afa712d3d2aa497585af44f11319b2b6348 Author: Michael Chan Date: Sun Oct 14 07:02:40 2018 -0400 bnxt_en: Update interrupt coalescing logic. New firmware spec. allows interrupt coalescing parameters, such as maximums, timer units, supported features to be queried. Update the driver to make use of the new call to query these parameters and provide the legacy defaults if the call is not available. Replace the hard-coded values with these parameters. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 1dfddc41ae4990b991059de8dfc8e802ab67244c Author: Michael Chan Date: Sun Oct 14 07:02:39 2018 -0400 bnxt_en: Add maximum extended request length fw message support. Support the max_ext_req_len field from the HWRM_VER_GET_RESPONSE. If this field is valid and greater than the mailbox size, use the short command format to send firmware messages greater than the mailbox size. Newer devices use this method to send larger messages to the firmware. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 36e53349b60bc6c629949e041567a376c9c42228 Author: Michael Chan Date: Sun Oct 14 07:02:38 2018 -0400 bnxt_en: Add additional extended port statistics. Latest firmware spec. has some additional rx extended port stats and new tx extended port stats added. We now need to check the size of the returned rx and tx extended stats and determine how many counters are valid. New counters added include CoS byte and packet counts for rx and tx. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 31d357c0697dadb760bf682bf1ffd9fd7053ed59 Author: Michael Chan Date: Sun Oct 14 07:02:37 2018 -0400 bnxt_en: Update firmware interface spec. to 1.10.0.3. Among the new changes are trusted VF support, 200Gbps support, and new API to dump ring information on the new chips. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 9e983c589853bc4052631f43e328543a3d6097bd Merge: 2527e4037f92 bb059fb20447 Author: David S. Miller Date: Mon Oct 15 22:37:28 2018 -0700 Merge branch 'selftests-pmtu-Add-test-choice-and-captures' Stefano Brivio says: ==================== selftests: pmtu: Add test choice and captures This series adds a couple of features useful for debugging: 1/2 allows selecting single tests and 2/2 adds optional traffic captures. Semantics for current invocation of test script are preserved. ==================== Signed-off-by: David S. Miller commit bb059fb20447c869970ebd296010c1a822706c58 Author: Stefano Brivio Date: Fri Oct 12 23:54:14 2018 +0200 selftests: pmtu: Add optional traffic captures for single tests If --trace is passed as an option and tcpdump is available, capture traffic for all relevant interfaces to per-test pcap files named _.pcap. Signed-off-by: Stefano Brivio Reviewed-by: Sabrina Dubroca Signed-off-by: David S. Miller commit 55bbc8ff4987d05b7d2f2d513caabd0a58fec021 Author: Stefano Brivio Date: Fri Oct 12 23:54:13 2018 +0200 selftests: pmtu: Allow selection of single tests As number of tests is growing, it's quite convenient to allow single tests to be run. Display usage when the script is run with any invalid argument, keep existing semantics when no arguments are passed so that automated runs won't break. Instead of just looping on the list of requested tests, if any, check first that they exist, and go through them in a nested loop to keep the existing way to display test descriptions. Signed-off-by: Stefano Brivio Reviewed-by: Sabrina Dubroca Signed-off-by: David S. Miller commit 2527e4037f92d4ac70a843cf602236846b693262 Author: Heiner Kallweit Date: Fri Oct 12 23:30:52 2018 +0200 r8169: remove unneeded call to netif_stop_queue in rtl8169_net_suspend netif_device_detach() stops all tx queues already, so we don't need this call. Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 34bc009543c052da3c9771311274babf568f0233 Author: Heiner Kallweit Date: Fri Oct 12 23:23:57 2018 +0200 r8169: simplify rtl8169_set_magic_reg Simplify this function, no functional change intended. Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 44eb385bc5f315c3707ffdaffd5cb9d3e78c1839 Author: Arnd Bergmann Date: Fri Oct 12 21:52:22 2018 +0200 octeontx2-af: remove unused cgx_fwi_link_change The newly added driver causes a warning about a function that is not used anywhere: drivers/net/ethernet/marvell/octeontx2/af/cgx.c:320:12: error: 'cgx_fwi_link_change' defined but not used [-Werror=unused-function] Remove it for now, until a user gets added. If we want to use this function from another module, we also need a declaration in a header file, which is currently missing, so it would have to change anyway. Fixes: 1463f382f58d ("octeontx2-af: Add support for CGX link management") Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller commit 5948185b97fa1f83d7855e638a72982a1073ebf5 Author: Ryan C Goodfellow Date: Fri Oct 12 11:09:01 2018 -0700 nfp: devlink port split support for 1x100G CXP NIC This commit makes it possible to use devlink to split the 100G CXP Netronome into two 40G interfaces. Currently when you ask for 2 interfaces, the math in src/nfp_devlink.c:nfp_devlink_port_split calculates that you want 5 lanes per port because for some reason eth_port.port_lanes=10 (shouldn't this be 12 for CXP?). What we really want when asking for 2 breakout interfaces is 4 lanes per port. This commit makes that happen by calculating based on 8 lanes if 10 are present. Signed-off-by: Ryan C Goodfellow Reviewed-by: Jakub Kicinski Reviewed-by: Greg Weeks Signed-off-by: David S. Miller commit ca0f32d5d9746e1d8db65d4b52bbda0208c307ca Merge: 5b3a5a14f84c b948c8c6a779 Author: David S. Miller Date: Mon Oct 15 22:23:20 2018 -0700 Merge branch 'dpaa2-eth-code-cleanup' Ioana Ciornei says: ==================== dpaa2-eth: code cleanup There are no functional changes in this patch set, only some cleanup changes such as: unused parameters, uninitialized variables and unnecessary Kconfig dependencies. ==================== Signed-off-by: David S. Miller commit b948c8c6a77944486ea4de909bc6790c334ebf07 Author: Ioana Radulescu Date: Fri Oct 12 16:27:40 2018 +0000 dpaa2-eth: remove unused FD field According to the hardware ArchDef, the PTV1 field in FD[CTRL] is ignored by WRIOP, so setting it for Tx FDs is pointless. Remove all references to it from the code. Signed-off-by: Ioana Radulescu Signed-off-by: Ioana Ciornei Signed-off-by: David S. Miller commit b00c898c00e11dd98516f31810013be4b768130f Author: Ioana Ciornei Date: Fri Oct 12 16:27:38 2018 +0000 dpaa2-eth: mark unused parameter in dpaa2_eth_tx_conf The ch parameter is never used in the dpaa2_eth_tx_conf function but since its prototype must match the type defined in the consume field of struct dpaa2_eth_fq, just mark it as __always_unused. Signed-off-by: Ioana Ciornei Signed-off-by: David S. Miller commit fdb6ca9e46745c24d4a9c23d05c4188957721f27 Author: Ioana Ciornei Date: Fri Oct 12 16:27:35 2018 +0000 dpaa2-eth: remove unused priv parameter The priv parameter is never used in the build_linear_skb and drain_channel function. Remove it from the function definitions. Signed-off-by: Ioana Ciornei Signed-off-by: David S. Miller commit 85b7a342baf58c42199795cbb2d60ab98ef298ad Author: Ioana Ciornei Date: Fri Oct 12 16:27:33 2018 +0000 dpaa2-eth: fix uninitialized variable warnings All 3 cases of possible uninitialized variables are false positives since they are used only as output parameters. Nonetheless, fix the warnings. Signed-off-by: Ioana Ciornei Signed-off-by: David S. Miller commit 3233c1514f757350c17fa8ba929ee91165fc854c Author: Ioana Ciornei Date: Fri Oct 12 16:27:29 2018 +0000 dpaa2-eth: make dpaa2_eth_set_dist_key static The dpaa2_eth_set_dist_key function is only used in a single file. Make it static. Signed-off-by: Ioana Ciornei Signed-off-by: David S. Miller commit b12cef51b537d869f423c0f4bb2d2245ce2e5619 Author: Ioana Radulescu Date: Fri Oct 12 16:27:25 2018 +0000 dpaa2-eth: Fix Kconfig dependencies Both ARCH_LAYERSCAPE and COMPILE_TEST dependencies are already implied through the FSL_MC_BUS dep, so there's no need to state it explicitly. Also, the fsl-mc bus depends on COMPILE_TEST only for some architectures (arm, arm64, ppc, x86), so it's not correct to claim build support unconditionally. Signed-off-by: Ioana Radulescu Signed-off-by: Ioana Ciornei Signed-off-by: David S. Miller commit 5b3a5a14f84c326413d00a213ad4c950d43af2c8 Author: Ivan Khoronzhuk Date: Fri Oct 12 19:06:29 2018 +0300 net: ethernet: ti: cpsw: use for mcast entries only host port In dual-emac mode the cpsw driver sends directed packets, that means that packets go to the directed port, but an ALE lookup is performed to determine untagged egress only. It means that on tx side no need to add port bit for ALE mcast entry mask, and basically ALE entry for port identification is needed only on rx side. So, add only host port in dual_emac mode as used directed transmission, and no need in one more port. For single port boards and switch mode all ports used, as usual, so no changes for them. Also it simplifies farther changes. In other words, mcast entries for dual-emac should behave exactly like unicast. It also can help avoid leaking packets between ports with same vlan on h/w level if ports could became members of same vid. So now, for instance, if mcast address 33:33:00:00:00:01 is added then entries in ALE table: vid = 1, addr = 33:33:00:00:00:01, port_mask = 0x1 vid = 2, addr = 33:33:00:00:00:01, port_mask = 0x1 Instead of: vid = 1, addr = 33:33:00:00:00:01, port_mask = 0x3 vid = 2, addr = 33:33:00:00:00:01, port_mask = 0x5 With the same considerations, set only host port for unregistered mcast for dual-emac mode in case of IFF_ALLMULTI is set, exactly like it's done in cpsw_ale_set_allmulti(). Signed-off-by: Ivan Khoronzhuk Reviewed-by: Grygorii Strashko Signed-off-by: David S. Miller commit ba722f9b6f9870bdf85bcfe5828bd4c6ab1118c4 Merge: 5985d5631dc3 5da1948969bc Author: David S. Miller Date: Mon Oct 15 22:21:28 2018 -0700 Merge branch 'net-ethernet-ti-cpsw-fix-mcast-packet-lost' Ivan Khoronzhuk says: ==================== net: ethernet: ti: cpsw fix mcast packet lost The patchset omits redundant refresh of mcast address table and prevents mcast packet lost. Based on net-next/master tested on am572x evm ==================== Signed-off-by: David S. Miller commit 5da1948969bc1991920987ce4361ea56046e5a98 Author: Ivan Khoronzhuk Date: Fri Oct 12 18:28:15 2018 +0300 net: ethernet: ti: cpsw: fix lost of mcast packets while rx_mode update Whenever kernel or user decides to call rx mode update, it clears every multicast entry from forwarding table and in some time adds it again. This time can be enough to drop incoming multicast packets. That's why clear only staled multicast entries and update or add new one afterwards. Signed-off-by: Ivan Khoronzhuk Signed-off-by: David S. Miller commit 58bdeac8b0e7ba6a5b60339fe3c197a52715abbf Author: Ivan Khoronzhuk Date: Fri Oct 12 18:28:14 2018 +0300 net: ethernet: ti: cpsw_ale: use const for API having pointer on mac address It allows to use function under callbacks with same const qualifier of mac address for farther changes. Signed-off-by: Ivan Khoronzhuk Signed-off-by: David S. Miller commit aa73237dcb2d96d7a3292af8ca943dd149fd39af Author: Bart Van Assche Date: Mon Oct 15 08:51:39 2018 -0700 scsi: target/core: Always call transport_complete_callback() upon failure COMPARE AND WRITE command execution starts with a call of sbc_compare_and_write(). That function locks the caw_sem member in the backend device data structure and submits a read request to the backend driver. Upon successful completion of the read compare_and_write_callback() gets called. That last function compares the data that has been read. If it matches transport_complete_callback is set to compare_and_write_post and a write request is submitted. compare_and_write_post() submits a write request to the backend driver. XDWRITEREAD command execution starts with sbc_execute_rw() submitting a read to the backend device. Upon successful completion of the read the xdreadwrite_callback() gets called. That function xors the data that has been read with the data in the data-out buffer and stores the result in the data-in buffer. Call transport_complete_callback() not only if COMPARE AND WRITE fails but also if XDWRITEREAD fails. This makes the code more systematic. Make sure that the callback functions handle (cmd, false, NULL) argument triples fine. Reviewed-by: Christoph Hellwig Reviewed-by: Nicholas Bellinger Cc: Mike Christie Cc: Hannes Reinecke Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 81b6ca6dbada186d0d41c67db8d8eb223a64a56f Author: Bart Van Assche Date: Mon Oct 15 08:51:38 2018 -0700 scsi: target/core: Use sg_alloc_table() instead of open-coding it The purpose of sg_alloc_table() is to allocate and initialize an sg-list. Use that function instead of open-coding it. This patch will make it easier to share code for caching sg-list allocations between the SCSI and NVMe target cores. Signed-off-by: Bart Van Assche Cc: Nicholas Bellinger Cc: Mike Christie Cc: Christoph Hellwig Cc: Hannes Reinecke Signed-off-by: Martin K. Petersen commit 80b045b385cfef10939c913fbfeb19ce5491c1f2 Author: Bart Van Assche Date: Mon Oct 15 08:51:37 2018 -0700 scsi: target/core: Use the SECTOR_SHIFT constant Instead of duplicating the SECTOR_SHIFT definition from , use it. This patch does not change any functionality. Reviewed-by: Christoph Hellwig Cc: Nicholas Bellinger Cc: Mike Christie Cc: Hannes Reinecke Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 5e568d22fc7963a1cfe0d7d87c46c2ed6a934369 Author: Bart Van Assche Date: Mon Oct 15 08:51:36 2018 -0700 scsi: target/core: Remove the SCF_COMPARE_AND_WRITE_POST flag Commit 057085e522f8 ("target: Fix race for SCF_COMPARE_AND_WRITE_POST checking") removed the code that checks the SCF_COMPARE_AND_WRITE_POST flag. Hence also remove the flag itself. Cc: Nicholas Bellinger Cc: Mike Christie Cc: Christoph Hellwig Cc: Hannes Reinecke Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit c1fbff863595a3ca9bbb93ec4abec7c05cb0839c Author: Bart Van Assche Date: Mon Oct 15 08:51:35 2018 -0700 scsi: target/core: Remove an unused data member from struct xcopy_pt_cmd A value is assigned to the xcopy_op member of struct xcopy_pt_cmd but that value is never used. Hence remove the xcopy_op member. Reviewed-by: Christoph Hellwig Cc: Nicholas Bellinger Cc: Mike Christie Cc: Hannes Reinecke Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 4240d448a483e8c2811dc914a1408f606fe13347 Author: Bart Van Assche Date: Mon Oct 15 08:51:34 2018 -0700 scsi: target/core: Fix spelling in two source code comments Change one occurrence of "aleady" into "already" and one occurrence of "is" into "if". Reviewed-by: Christoph Hellwig Cc: Nicholas Bellinger Cc: Mike Christie Cc: Hannes Reinecke Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 5985d5631dc352dadd34b692b962a3f3cb2a5088 Merge: 0813e95760f1 eb4c470a154d Author: David S. Miller Date: Mon Oct 15 22:06:38 2018 -0700 Merge branch 'net-phy-improve-and-simplify-state-machine' Heiner Kallweit says: ==================== net: phy: improve and simplify state machine Improve / simplify handling of states PHY_RUNNING and PHY_RESUMING in phylib state machine. ==================== Signed-off-by: David S. Miller commit eb4c470a154d2d3176d08155c3136973661f69ad Author: Heiner Kallweit Date: Thu Oct 11 22:37:38 2018 +0200 net: phy: simplify handling of PHY_RESUMING in state machine Simplify code for handling state PHY_RESUMING, no functional change intended. Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 74fb5e25a3e925286e80eb2e0253f88f2b44ec96 Author: Heiner Kallweit Date: Thu Oct 11 22:36:56 2018 +0200 net: phy: improve handling of PHY_RUNNING in state machine Handling of state PHY_RUNNING seems to be more complex than it needs to be. If not polling, then we don't have to do anything, we'll receive an interrupt and go to state PHY_CHANGELINK once the link goes down. If polling and link is down, we don't have to go the extra mile over PHY_CHANGELINK and call phy_read_status() again but can set status PHY_NOLINK directly. Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 0813e95760f1963c3ca0c47b4bb3583f07147a2e Author: Roopa Prabhu Date: Thu Oct 11 12:35:13 2018 -0700 vxlan: support NTF_USE refresh of fdb entries This makes use of NTF_USE in vxlan driver consistent with bridge driver. Signed-off-by: Roopa Prabhu Acked-by: Stephen Hemminger Signed-off-by: David S. Miller commit 9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392 Author: Justin.Lee1@Dell.com Date: Thu Oct 11 18:07:37 2018 +0000 net/ncsi: Extend NC-SI Netlink interface to allow user space to send NC-SI command The new command (NCSI_CMD_SEND_CMD) is added to allow user space application to send NC-SI command to the network card. Also, add a new attribute (NCSI_ATTR_DATA) for transferring request and response. The work flow is as below. Request: User space application -> Netlink interface (msg) -> new Netlink handler - ncsi_send_cmd_nl() -> ncsi_xmit_cmd() Response: Response received - ncsi_rcv_rsp() -> internal response handler - ncsi_rsp_handler_xxx() -> ncsi_rsp_handler_netlink() -> ncsi_send_netlink_rsp () -> Netlink interface (msg) -> user space application Command timeout - ncsi_request_timeout() -> ncsi_send_netlink_timeout () -> Netlink interface (msg with zero data length) -> user space application Error: Error detected -> ncsi_send_netlink_err () -> Netlink interface (err msg) -> user space application Signed-off-by: Justin Lee Reviewed-by: Samuel Mendoza-Jonas Signed-off-by: David S. Miller commit 6384e483239fd07a2d4393f888027118fecd4c6e Author: Heiner Kallweit Date: Thu Oct 11 19:31:47 2018 +0200 net: phy: trigger state machine immediately in phy_start_machine When starting the state machine there may be work to be done immediately, e.g. if the initial state is PHY_UP then the state machine may trigger an autonegotiation. Having said that I see no need to wait a second until the state machine is run first time. Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit a75d1801a9fc12e43a26b366b1a7494083cdf5ba Merge: acad76a5f616 d397b9682c1c Author: David S. Miller Date: Mon Oct 15 21:58:46 2018 -0700 Merge branch 'veth-XDP-stats-improvement' Toshiaki Makita says: ==================== veth: XDP stats improvement ndo_xdp_xmit in veth did not update packet counters as described in [1]. Also, current implementation only updates counters on tx side so rx side events like XDP_DROP were not collected. This series implements the missing accounting as well as support for ethtool per-queue stats in veth. Patch 1: Update drop counter in ndo_xdp_xmit. Patch 2: Update packet and byte counters for all XDP path, and drop counter on XDP_DROP. Patch 3: Support per-queue ethtool stats for XDP counters. Note that counters are maintained on per-queue basis for XDP but not otherwise (per-cpu and atomic as before). This is because 1) tx path in veth is essentially lockless so we cannot update per-queue stats on tx, and 2) rx path is net core routine (process_backlog) which cannot update per-queue based stats when XDP is disabled. On the other hand there are real rxqs and napi handlers for veth XDP, so update per-queue stats on rx for XDP packets, and use them to calculate tx counters as well, contrary to the existing non-XDP counters. [1] https://patchwork.ozlabs.org/cover/953071/#1967449 ==================== Signed-off-by: Toshiaki Makita Signed-off-by: David S. Miller commit d397b9682c1c808344dd93b43de8750fa4d9f581 Author: Toshiaki Makita Date: Thu Oct 11 18:36:50 2018 +0900 veth: Add ethtool statistics support for XDP Expose per-queue stats for ethtool -S. As there are only rx queues, and rx queues are used only when XDP is used, per-queue counters are only rx XDP ones. Example: $ ethtool -S veth0 NIC statistics: peer_ifindex: 11 rx_queue_0_xdp_packets: 28601434 rx_queue_0_xdp_bytes: 1716086040 rx_queue_0_xdp_drops: 28601434 rx_queue_1_xdp_packets: 17873050 rx_queue_1_xdp_bytes: 1072383000 rx_queue_1_xdp_drops: 17873050 Signed-off-by: Toshiaki Makita Signed-off-by: David S. Miller commit 4195e54aaf1c8d465666333f47662088c9e63672 Author: Toshiaki Makita Date: Thu Oct 11 18:36:49 2018 +0900 veth: Account for XDP packet statistics on rx side On XDP path veth has napi handler so we can collect statistics on per-queue basis for XDP. By this change now we can collect XDP_DROP drop count as well as packets and bytes coming through ndo_xdp_xmit. Packet counters shown by "ip -s link", sysfs stats or /proc/net/dev is now correct for XDP. Signed-off-by: Toshiaki Makita Signed-off-by: David S. Miller commit 2131479df66d320e327341ccf0be97924f108327 Author: Toshiaki Makita Date: Thu Oct 11 18:36:48 2018 +0900 veth: Account for packet drops in ndo_xdp_xmit Use existing atomic drop counter. Since drop path is really an exceptional case here, I'm thinking atomic ops would not hurt the performance. XDP packets and bytes are not counted in ndo_xdp_xmit, but will be accounted on rx side by the following commit. Signed-off-by: Toshiaki Makita Signed-off-by: David S. Miller commit acad76a5f6165dc451c5f35edb35d77def1f2e15 Author: Hoang Le Date: Thu Oct 11 08:43:08 2018 +0700 tipc: support binding to specific ip address when activating UDP bearer INADDR_ANY is hard-coded when activating UDP bearer. So, we could not bind to a specific IP address even with replicast mode using - given remote ip address instead of using multicast ip address. In this commit, we fixed it by checking and switch to use appropriate local ip address. before: $netstat -plu Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address udp 0 0 **0.0.0.0:6118** 0.0.0.0:* after: $netstat -plu Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address udp 0 0 **10.0.0.2:6118** 0.0.0.0:* Acked-by: Ying Xue Acked-by: Jon Maloy Signed-off-by: Hoang Le Signed-off-by: David S. Miller commit 1986647c2fc369b1865fb9bc9a213b48444580cb Merge: 3325cf9e51bc 779d986d60de Author: David S. Miller Date: Mon Oct 15 21:49:56 2018 -0700 Merge tag 'mlx5e-updates-2018-10-10' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5e-updates-2018-10-10 IPoIB netlink support and mlx5e pre-allocated netdevice initialization IP link was broken due to the changes in IPoIB for the rdma_netdev support after commit cd565b4b51e5 ("IB/IPoIB: Support acceleration options callbacks"). This patchset fixes IPoIB pkey creation and removal using rtnetlink by adding support in both IPoIB ULP layer and mlx5 layer: From Jason and Denis: 1) Introduces changes in the RDMA netdev code in order to allow allocation of the netdev to be done by the rtnl netdev code. 2) Reworks IPoIB initialization to use the two step rdma_netdev creation. From Feras and Saeed, mlx5e netdev layer refactoring to allow accepting pre-allocated netdevs: 3) Adds support to initialize/cleanup netdevs that are not created by mlx5 driver. 4) Change mlx5e netdevice layer to accept the pre-allocated netdevice queue number. 5) Initialize mlx5e generic structures in one place to be used for all netdevs types NIC/representors/IPoIB (both mlx5 allocated and pre-allocted). ==================== Signed-off-by: David S. Miller commit 3325cf9e51bc7c44e296343557251a74fde10b33 Merge: df52eab23d70 9f9a742db40f Author: David S. Miller Date: Mon Oct 15 21:46:07 2018 -0700 Merge branch 'defza-fddi' Maciej W. Rozycki says: ==================== FDDI: DEC FDDIcontroller 700 TURBOchannel adapter support This is an update to . I believe I have addressed all the requests made in the previous review round. There is still one `checkpatch.pl' warning remaining: WARNING: quoted string split across lines + pr_info("%s: ROM rev. %.4s, firmware rev. %.4s, RMC rev. %.4s, " + "SMT ver. %u\n", fp->name, rom_rev, fw_rev, rmc_rev, smt_ver); total: 0 errors, 1 warnings, 2458 lines checked however I think the value of staying within 80 columns is higher than the value of having the string on a single line. This is because with all the formatting specifiers there it is not directly greppable based on the final output produced to the kernel log on one hand, e.g.: tc2: ROM rev. 1.0, firmware rev. 1.2, RMC rev. A, SMT ver. 1 while it can be easily tracked down by grepping for an obvious substring such as "RMC rev" on the other. The issue with MMIO barriers I discussed in the course of the original review turned out mostly irrelevant to this driver, because as I have learnt in a recent Alpha/Linux discussion starting here: our MMIO API mandates the `readX' and `writeX' accessors to be strongly ordered with respect to each other, even if that is not implicitly enforced by hardware. Consequently I have removed all the explicit ordering barriers and instead submitted a fix for MIPS MMIO implementation, which currently does not guarantee strong ordering (the MIPS architecture does not define bus ordering rules except in terms of SYNC barriers), as recorded here: . Enforcing strong MMIO ordering can be costly however and is often unnecessary, e.g. when using PIO to access network frame data in onboard packet memory. I have therefore retained the information that would be lost by the removal of barriers, by defining accessor wrappers suffixed by `_o' and `_u', for accesses that have to be ordered and can be unordered respectively. If we ever have an API defined for weakly-ordered MMIO accesses, then these wrappers can be redefined accordingly. Right now they all expand to the respective `_relaxed' accessors, because, again, enforcing the ordering WRT DMA transfers can be costly and we don't need it here except in one place, where I chose to use explicit `dma_rmb' instead. Similarly I have replaced the completion barriers with a read back from the respective MMIO location (all adapter MMIO registers can be read with no side effects incurred), which will serve its purpose on the basis of MMIO being strongly ordered (although a read from TURBOchannel is going to be slower than `iob', making the delay incurred unnecessarily longer). And last but not least, I have split off the SMT Tx network tap support to a separate change, 2/2 in this series, so that it does not block the driver proper and can be discussed separately. I think it has value in that it makes the view of the outgoing network traffic complete, as if one actually physically tapped into the outgoing line of the ring, between the station being examined and its downstream neighbour. Without this part only traffic passed from applications through the whole protocol stack can be captured and this is only a part of the view. With the `dev_queue_xmit_nit' interface now exported it's only `ptype_all' that remains private, and to define a properly abstracted API I propose to provide am exported `dev_nit_active' predicate that tells whether any taps are active. This predicate is then used accordingly. NB if there is a long-term maintenance concern about the `dev_nit_active' predicate, then well, corresponding inline code currently present in `xmit_one' has to be maintained anyway, and if the resulting changes require `defza' to be updated accordingly, then I am going to handle it; after some 20 years with Linux it's not that I am going to disappear anywhere anytime. And once I am dead, which is inevitably going to happen sooner or later, then the driver can simply be ripped from the kernel. Though I suspect that at that point no DECstation Linux users may survive anymore, even though hardware, being as sturdy as it is, likely will. I have a patch for `tcpdump' to actually decode SMT frames, which I plan to upstream sometime. Here's a sample of SMT traffic captured through the `defza' driver in a small network of 4 stations and no concentrators, printed in the most verbose mode: 01:16:59.138381 4f 00:60:b0:58:41:e7 00:60:b0:58:41:e7 73: SMT NIF ann vid:1 tid:00000270 sid:00-00-00-60-b0-58-41-e7 len:40: UNA: 00 00 00 06 0d 1a 02 ae StationDescr: 00 01 02 00 StationState: 00 00 30 00 MACFrameStatusFunctions.3: 00 00 00 01 01:17:00.332750 4f 08:00:2b:a3:a3:29 08:00:2b:a3:a3:29 73: SMT NIF ann vid:1 tid:0000013b sid:00-00-08-00-2b-a3-a3-29 len:40: UNA: 00 00 00 06 0d 1a 82 e7 StationDescr: 00 01 02 00 StationState: 00 00 30 00 MACFrameStatusFunctions.3: 00 00 00 01 01:17:00.354479 4f 00:60:b0:58:40:75 00:60:b0:58:40:75 73: SMT NIF ann vid:1 tid:0000029c sid:00-00-00-60-b0-58-40-75 len:40: UNA: 00 00 10 00 d4 74 b6 ae StationDescr: 00 01 02 00 StationState: 00 00 31 00 MACFrameStatusFunctions.3: 00 00 00 01 01:17:00.442175 4f 00:60:b0:58:41:e7 Broadcast 73: SMT NIF req vid:1 tid:00000271 sid:00-00-00-60-b0-58-41-e7 len:40: UNA: 00 00 00 06 0d 1a 02 ae StationDescr: 00 01 02 00 StationState: 00 00 30 00 MACFrameStatusFunctions.3: 00 00 00 01 01:17:00.448657 41 08:00:2b:a3:a3:29 00:60:b0:58:41:e7 73: SMT NIF rsp vid:1 tid:00000271 sid:00-00-08-00-2b-a3-a3-29 len:40: UNA: 00 00 00 06 0d 1a 82 e7 StationDescr: 00 01 02 00 StationState: 00 00 30 00 MACFrameStatusFunctions.3: 00 00 00 01 01:17:01.015152 4f 08:00:2b:a3:a3:29 Broadcast 73: SMT NIF req vid:1 tid:0000013c sid:00-00-08-00-2b-a3-a3-29 len:40: UNA: 00 00 00 06 0d 1a 82 e7 StationDescr: 00 01 02 00 StationState: 00 00 30 00 MACFrameStatusFunctions.3: 00 00 00 01 01:17:01.111644 41 08:00:2b:2e:6d:75 08:00:2b:a3:a3:29 73: SMT NIF rsp vid:1 tid:0000013c sid:00-00-08-00-2b-2e-6d-75 len:40: UNA: 00 00 10 00 d4 c5 c5 94 StationDescr: 00 01 01 00 StationState: 00 00 11 00 MACFrameStatusFunctions.2: 00 00 00 01 01:17:04.814603 4f 08:00:2b:2e:6d:75 Broadcast 73: SMT NIF req vid:1 tid:0000013c sid:00-00-08-00-2b-2e-6d-75 len:40: UNA: 00 00 10 00 d4 c5 c5 94 StationDescr: 00 01 01 00 StationState: 00 00 11 00 MACFrameStatusFunctions.2: 00 00 00 01 01:17:04.814939 4f 08:00:2b:2e:6d:75 Broadcast 73: SMT NIF req vid:1 tid:0000013c sid:00-00-08-00-2b-2e-6d-75 len:40: UNA: 00 00 10 00 d4 c5 c5 94 StationDescr: 00 01 01 00 StationState: 00 00 11 00 MACFrameStatusFunctions.2: 00 00 00 01 01:17:04.820960 4f 08:00:2b:2e:6d:75 08:00:2b:2e:6d:75 73: SMT NIF ann vid:1 tid:0000013b sid:00-00-08-00-2b-2e-6d-75 len:40: UNA: 00 00 10 00 d4 c5 c5 94 StationDescr: 00 01 01 00 StationState: 00 00 11 00 MACFrameStatusFunctions.2: 00 00 00 01 Questions, comments? Otherwise, please apply. ==================== Signed-off-by: David S. Miller commit 9f9a742db40f95f4dc20fc7293de4ea6ddb24e47 Author: Maciej W. Rozycki Date: Tue Oct 9 23:57:49 2018 +0100 FDDI: defza: Support capturing outgoing SMT traffic DEC FDDIcontroller 700 (DEFZA) uses a Tx/Rx queue pair to communicate SMT frames with adapter's firmware. Any SMT frame received from the RMC via the Rx queue is queued back by the driver to the SMT Rx queue for the firmware to process. Similarly the firmware uses the SMT Tx queue to supply the driver with SMT frames which are queued back to the Tx queue for the RMC to send to the ring. When a network tap is attached to an FDDI interface handled by `defza' any incoming SMT frames captured are queued to our usual processing of network data received, which in turn delivers them to any listening taps. However the outgoing SMT frames produced by the firmware bypass our network protocol stack and are therefore not delivered to taps. This in turn means that taps are missing a part of network traffic sent by the adapter, which may make it more difficult to track down network problems or do general traffic analysis. Call `dev_queue_xmit_nit' then in the SMT Tx path, having checked that a network tap is attached, with a newly-created `dev_nit_active' helper wrapping the usual condition used in the transmit path. Signed-off-by: Maciej W. Rozycki Signed-off-by: David S. Miller commit 61414f5ec9834df8aa4f55c90de16b71a3d6ca8d Author: Maciej W. Rozycki Date: Tue Oct 9 23:57:43 2018 +0100 FDDI: defza: Add support for DEC FDDIcontroller 700 TURBOchannel adapter Add support for the DEC FDDIcontroller 700 (DEFZA), Digital Equipment Corporation's first-generation FDDI network interface adapter, made for TURBOchannel and based on a discrete version of what eventually became Motorola's widely used CAMEL chipset. The CAMEL chipset is present for example in the DEC FDDIcontroller TURBOchannel, EISA and PCI adapters (DEFTA/DEFEA/DEFPA) that we support with the `defxx' driver, however the host bus interface logic and the firmware API are different in the DEFZA and hence a separate driver is required. There isn't much to say about the driver except that it works, but there is one peculiarity to mention. The adapter implements two Tx/Rx queue pairs. Of these one pair is the usual network Tx/Rx queue pair, in this case used by the adapter to exchange frames with the ring, via the RMC (Ring Memory Controller) chip. The Tx queue is handled directly by the RMC chip and resides in onboard packet memory. The Rx queue is maintained via DMA in host memory by adapter's firmware copying received data stored by the RMC in onboard packet memory. The other pair is used to communicate SMT frames with adapter's firmware. Any SMT frame received from the RMC via the Rx queue must be queued back by the driver to the SMT Rx queue for the firmware to process. Similarly the firmware uses the SMT Tx queue to supply the driver with SMT frames that must be queued back to the Tx queue for the RMC to send to the ring. This solution was chosen because the designers ran out of PCB space and could not squeeze in more logic onto the board that would be required to handle this SMT frame traffic without the need to involve the driver, as with the later DEFTA/DEFEA/DEFPA adapters. Finally the driver does some Frame Control byte decoding, so to avoid magic numbers some macros are added to . Signed-off-by: Maciej W. Rozycki Signed-off-by: David S. Miller commit df52eab23d703142c766ac00bdb8db19d71238d0 Author: Serhey Popovych Date: Tue Oct 9 21:21:01 2018 +0300 tun: Consistently configure generic netdev params via rtnetlink Configuring generic network device parameters on tun will fail in presence of IFLA_INFO_KIND attribute in IFLA_LINKINFO nested attribute since tun_validate() always return failure. This can be visualized with following ip-link(8) command sequences: # ip link set dev tun0 group 100 # ip link set dev tun0 group 100 type tun RTNETLINK answers: Invalid argument with contrast to dummy and veth drivers: # ip link set dev dummy0 group 100 # ip link set dev dummy0 type dummy # ip link set dev veth0 group 100 # ip link set dev veth0 group 100 type veth Fix by returning zero in tun_validate() when @data is NULL that is always in case since rtnl_link_ops->maxtype is zero in tun driver. Fixes: f019a7a594d9 ("tun: Implement ip link del tunXXX") Signed-off-by: Serhey Popovych Signed-off-by: David S. Miller commit 33b3f8ca510a2181574d6dcbd312c2b07dd9f0fa Author: David Disseldorp Date: Fri Oct 12 12:01:20 2018 +0200 scsi: target: stash sess_err_stats on Data-Out timeout sess_err_stats are currently filled on NOP ping timeout, but not Data-Out timeout. Stash details of Data-Out timeouts using a ISCSI_SESS_ERR_CXN_TIMEOUT value for last_sess_failure_type. Signed-off-by: David Disseldorp Signed-off-by: Martin K. Petersen commit dce6190ca78adf7cf6fe794833653e4cb1cb2b73 Author: David Disseldorp Date: Sun Oct 14 01:13:54 2018 +0200 scsi: target: split out helper for cxn timeout error stashing Replace existing nested code blocks with helper function calls. Signed-off-by: David Disseldorp Signed-off-by: Martin K. Petersen commit c62ae3005b3551078a8cf959de8018a2852708bd Author: David Disseldorp Date: Fri Oct 12 12:01:18 2018 +0200 scsi: target: log NOP ping timeouts as errors Events resulting in connection outages like this should be logged as errors. Include the I_T Nexus in the message to aid path identification. Signed-off-by: David Disseldorp Signed-off-by: Martin K. Petersen commit d9a771fd42712cd530544674b04bc3e42cc7927a Author: David Disseldorp Date: Fri Oct 12 12:01:17 2018 +0200 scsi: target: log Data-Out timeouts as errors Data-Out timeouts resulting in connection outages should be logged as errors. Include the I_T Nexus in the message to aid path identification. Signed-off-by: David Disseldorp Signed-off-by: Martin K. Petersen commit df711553f4440e16af5b731ed41841dee1e2abb4 Author: David Disseldorp Date: Fri Oct 12 12:01:16 2018 +0200 scsi: target: use ISCSI_IQN_LEN in iscsi_target_stat Move the ISCSI_IQN_LEN definition up, so that it can be used in more places instead of a hardcoded value. Signed-off-by: David Disseldorp Signed-off-by: Martin K. Petersen commit 3bccfba8312762becfb05b35d698ba8cffd440f2 Author: Xiang Chen Date: Mon Sep 24 23:06:34 2018 +0800 scsi: hisi_sas: Update v3 hw AIP_LIMIT and CFG_AGING_TIME register values Update registers as follows: - Default value of AIP timer is 1ms, and it is easy for some expanders to cause IO error. Change the value to max value 65ms to avoid IO error for those expanders. - A CQ completion will be reported by HW when 4 CQs have occurred or the aging timer expires, whichever happens first. Sor serial IO scenario, it will still wait 8us for every IO before it is reported. So in the situation, the performance is poor. So to improve it, change the limit time to the least value. For other scenario, it does little affect to the performance. Signed-off-by: Xiang Chen Signed-off-by: John Garry Signed-off-by: Martin K. Petersen commit 784b46b7cba0ae914dd293f23848c5057c6ba017 Author: Xiang Chen Date: Mon Sep 24 23:06:33 2018 +0800 scsi: hisi_sas: Use block layer tag instead for IPTT Currently we use the IPTT defined in LLDD to identify IOs. Actually for IOs which are from the block layer, they have tags to identify them. So for those IOs, use tag of the block layer directly, and for IOs which is not from the block layer (such as internal IOs from libsas/LLDD), reserve 96 IPTTs for them. Signed-off-by: Xiang Chen Signed-off-by: John Garry Signed-off-by: Martin K. Petersen commit 6ecf5ba13cd5959eb75f617ff32c93bb67790e48 Author: Xiang Chen Date: Mon Sep 24 23:06:32 2018 +0800 scsi: hisi_sas: unmask interrupts ent72 and ent74 The interrupts of ent72 and ent74 are not processed by PCIe AER handling, so we need to unmask the interrupts and process them first in the driver. Signed-off-by: Xiang Chen Signed-off-by: John Garry Signed-off-by: Martin K. Petersen commit 3e178f3ecfcf91a258e832b0f0843a4cfd9059ac Author: Xiang Chen Date: Mon Sep 24 23:06:31 2018 +0800 scsi: hisi_sas: Free slot later in slot_complete_vx_hw() If an SSP/SMP IO times out, it may be actually in reality be simultaneously processing completion of the slot in slot_complete_vx_hw(). Then if the slot is freed in slot_complete_vx_hw() (this IPTT is freed and it may be re-used by other slot), and we may abort the wrong slot in hisi_sas_abort_task(). So to solve the issue, free the slot after the check of SAS_TASK_STATE_ABORTED in slot_complete_vx_hw(). Signed-off-by: Xiang Chen Signed-off-by: John Garry Signed-off-by: Martin K. Petersen commit 584f53fe5f529d877968c711a095923c1ed12307 Author: Xiang Chen Date: Mon Sep 24 23:06:30 2018 +0800 scsi: hisi_sas: Fix the race between IO completion and timeout for SMP/internal IO If SMP/internal IO times out, we will possibly free the task immediately. However if the IO actually completes at the same time, the IO completion may refer to task which has been freed. So to solve the issue, flush the tasklet to finish IO completion before free'ing slot/task. Signed-off-by: Xiang Chen Signed-off-by: John Garry Signed-off-by: Martin K. Petersen commit 1668e3b6f8f8ed2ce685691c92b90dfadeaa3f2f Author: Luo Jiaxing Date: Mon Sep 24 23:06:29 2018 +0800 scsi: hisi_sas: Move evaluation of hisi_hba in hisi_sas_task_prep() In evaluating hisi_hba, the sas_port may be NULL, so for safety relocate the the check to value possible NULL deference. Signed-off-by: Luo Jiaxing Signed-off-by: John Garry Signed-off-by: Martin K. Petersen commit 5a54691f874ab29ec82f08bc6936866a3ccdaa91 Author: Luo Jiaxing Date: Mon Sep 24 23:06:28 2018 +0800 scsi: hisi_sas: Feed back linkrate(max/min) when re-attached At directly attached situation, if the user modifies the sysfs interface of maximum_linkrate and minimum_linkrate to renegotiate the linkrate between SAS controller and target, the value of both files mentioned above should have change to user setting after renegotiate is over, but it remains unchanged. To fix this bug, maximum_linkrate and minimum_linkrate will be directly fed back to relevant sas_phy structure. Signed-off-by: Luo Jiaxing Signed-off-by: John Garry Signed-off-by: Martin K. Petersen commit 38fe73cc2c96fbc9942b07220f2a4f1bab37392d Author: Nicholas Bellinger Date: Wed Oct 10 03:23:10 2018 +0000 scsi: target: Fix target_wait_for_sess_cmds breakage with active signals With the addition of commit 00d909a10710 ("scsi: target: Make the session shutdown code also wait for commands that are being aborted") in v4.19-rc, it incorrectly assumes no signals will be pending for task_struct executing the normal session shutdown and I/O quiesce code-path. For example, iscsi-target and iser-target issue SIGINT to all kthreads as part of session shutdown. This has been the behaviour since day one. As-is when signals are pending with se_cmds active in se_sess->sess_cmd_list, wait_event_interruptible_lock_irq_timeout() returns a negative number and immediately kills the machine because of the do while (ret <= 0) loop that was added in commit 00d909a107 to spin while backend I/O is taking any amount of extended time (say 30 seconds) to complete. Here's what it looks like in action with debug plus delayed backend I/O completion: [ 4951.909951] se_sess: 000000003e7e08fa before target_wait_for_sess_cmds [ 4951.914600] target_wait_for_sess_cmds: signal_pending: 1 [ 4951.918015] wait_event_interruptible_lock_irq_timeout ret: -512 signal_pending: 1 loop count: 0 [ 4951.921639] wait_event_interruptible_lock_irq_timeout ret: -512 signal_pending: 1 loop count: 1 [ 4951.921944] wait_event_interruptible_lock_irq_timeout ret: -512 signal_pending: 1 loop count: 2 [ 4951.921944] wait_event_interruptible_lock_irq_timeout ret: -512 signal_pending: 1 loop count: 3 [ 4951.921944] wait_event_interruptible_lock_irq_timeout ret: -512 signal_pending: 1 loop count: 4 [ 4951.921944] wait_event_interruptible_lock_irq_timeout ret: -512 signal_pending: 1 loop count: 5 [ 4951.921944] wait_event_interruptible_lock_irq_timeout ret: -512 signal_pending: 1 loop count: 6 [ 4951.921944] wait_event_interruptible_lock_irq_timeout ret: -512 signal_pending: 1 loop count: 7 [ 4951.921944] wait_event_interruptible_lock_irq_timeout ret: -512 signal_pending: 1 loop count: 8 [ 4951.921944] wait_event_interruptible_lock_irq_timeout ret: -512 signal_pending: 1 loop count: 9 ... followed by the usual RCU CPU stalls and deadlock. There was never a case pre commit 00d909a107 where wait_for_complete(&se_cmd->cmd_wait_comp) was able to be interrupted, so to address this for v4.19+ moving forward go ahead and use wait_event_lock_irq_timeout() instead so new code works with all fabric drivers. Also for commit 00d909a107, fix a minor regression in target_release_cmd_kref() to only wake_up the new se_sess->cmd_list_wq only when shutdown has actually been triggered via se_sess->sess_tearing_down. Fixes: 00d909a10710 ("scsi: target: Make the session shutdown code also wait for commands that are being aborted") Cc: # v4.19+ Cc: Bart Van Assche Cc: Mike Christie Cc: Hannes Reinecke Cc: Christoph Hellwig Cc: Sagi Grimberg Cc: Bryant G. Ly Tested-by: Nicholas Bellinger Signed-off-by: Nicholas Bellinger Reviewed-by: Bryant G. Ly Signed-off-by: Martin K. Petersen commit 25ab0bc334b43bbbe4eabc255006ce42a9424da2 Author: Nicholas Bellinger Date: Wed Oct 10 03:23:09 2018 +0000 scsi: sched/wait: Add wait_event_lock_irq_timeout for TASK_UNINTERRUPTIBLE usage Short of reverting commit 00d909a10710 ("scsi: target: Make the session shutdown code also wait for commands that are being aborted") for v4.19, target-core needs a wait_event_t macro can be executed using TASK_UNINTERRUPTIBLE to function correctly with existing fabric drivers that expect to run with signals pending during session shutdown and active se_cmd I/O quiesce. The most notable is iscsi-target/iser-target, while ibmvscsi_tgt invokes session shutdown logic from userspace via configfs attribute that could also potentially have signals pending. So go ahead and introduce wait_event_lock_irq_timeout() to achieve this, and update + rename __wait_event_lock_irq_timeout() to make it accept 'state' as a parameter. Fixes: 00d909a10710 ("scsi: target: Make the session shutdown code also wait for commands that are being aborted") Cc: # v4.19+ Cc: Bart Van Assche Cc: Mike Christie Cc: Hannes Reinecke Cc: Christoph Hellwig Cc: Sagi Grimberg Cc: Bryant G. Ly Cc: Peter Zijlstra (Intel) Tested-by: Nicholas Bellinger Signed-off-by: Nicholas Bellinger Reviewed-by: Bryant G. Ly Acked-by: Peter Zijlstra (Intel) Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 0b4aafc332e49e143d3ee1c2460367ba0f07da1a Author: Hannes Reinecke Date: Sun Oct 7 10:35:37 2018 +0200 scsi: libfc: retry PRLI if we cannot analyse the payload When we fail to analyse the payload of a PRLI response we should reset the state machine to retry the PRLI; eventually we will be getting a proper frame. Not doing so will result in a stuck state machine and the port never to be presented to the systsm. Suggested-by: Chad Dupuis Signed-off-by: Hannes Reinecke Reviewed-by: Arun Easi Signed-off-by: Martin K. Petersen commit aad1271a4845f948b2721c0ab243baa74786916e Author: Thomas Abraham Date: Sun Oct 7 10:35:36 2018 +0200 scsi: libfc: check fc_frame_payload_get() return value for null We should not assume the payload of a PRLI or PLOGI respons is always present. Signed-off-by: Thomas Abraham Reviewed-by: Hannes Reinecke Reviewed-by: Arun Easi Signed-off-by: Martin K. Petersen commit a33e5bfb29721015349a3864c91abe11f6195d5c Author: Hannes Reinecke Date: Sun Oct 7 10:35:35 2018 +0200 scsi: core: Allow state transitions from OFFLINE to BLOCKED When an RSCN gets delayed (or not being sent at all), the transport class will detect an error, EH kicks in, and eventually will be setting the device to offline. If we receive an RSCN after that, the device will stay in 'offline'. This patch allows for an 'offline' to 'blocked' transition, thereby allowing the device to become active again. Signed-off-by: Hannes Reinecke Signed-off-by: Martin K. Petersen commit 86117d7f9569820795c8f6b9a1c9b911cb5037c7 Author: Christoph Hellwig Date: Sat Oct 13 09:26:28 2018 +0200 scsi: esp_scsi: remove union in esp_cmd_priv The dma_addr_t member is unused ever since we switched the SCSI layer to send down single-segement command using a scatterlist as well many years ago. Signed-off-by: Christoph Hellwig Tested-by: Finn Thain Signed-off-by: Martin K. Petersen commit 3f9295b65ea44194252d60376036a3618d822152 Author: Christoph Hellwig Date: Sat Oct 13 09:26:27 2018 +0200 scsi: esp_scsi: move dma mapping into the core code Except for the mac_esp driver, which uses PIO or pseudo DMA, all drivers share the same dma mapping calls. Move the dma mapping into the core code using the scsi_dma_map / scsi_dma_unmap helpers, with a special identify mapping variant triggered off a new ESP_FLAG_NO_DMA_MAP flag for mac_esp. Signed-off-by: Christoph Hellwig Tested-by: Finn Thain Signed-off-by: Martin K. Petersen commit 44b1b4d24b2d65134efeccb3cc2341c61227f0f9 Author: Christoph Hellwig Date: Sat Oct 13 09:26:26 2018 +0200 scsi: esp_scsi: remove the dev argument to scsi_esp_register We can simplify use esp->dev now. Signed-off-by: Christoph Hellwig Tested-by: Finn Thain Signed-off-by: Martin K. Petersen commit 98cda6a2e0d46507c084bf1488f5627b9e487a2a Author: Christoph Hellwig Date: Sat Oct 13 09:26:25 2018 +0200 scsi: esp_scsi: use strong typing for the dev field esp->dev is a void pointer that points either to a struct device, or a struct platform_device. As we can easily get from the device to the platform_device if needed change it to always point to a struct device and properly type the pointer to avoid errors. Signed-off-by: Christoph Hellwig Tested-by: Finn Thain Signed-off-by: Martin K. Petersen commit 10c0cd38ce4cd2015a683e296596738adab9221f Author: Christoph Hellwig Date: Sat Oct 13 09:26:24 2018 +0200 scsi: sun_esp: don't use GFP_ATOMIC for command block allocation esp_sbus_map_command_block is called straight from the probe routine without any locks held, so we can safely use GFP_KERNEL here. Signed-off-by: Christoph Hellwig Tested-by: Finn Thain Signed-off-by: Martin K. Petersen commit d47b3bd797f158366a4b2193ae82e191a21c45f3 Author: Christoph Hellwig Date: Sat Oct 13 09:26:23 2018 +0200 scsi: am53c974: use the generic DMA API Remove usage of the legacy PCI DMA API. To make this easier we also store a struct device instead of pci_dev in the dev field of struct esp. Signed-off-by: Christoph Hellwig Tested-by: Finn Thain Signed-off-by: Martin K. Petersen commit 5adaf1e8d5e56cd7c06f0e4fa0c6b5148220e6ad Author: Venkat Gopalakrishnan Date: Fri Oct 12 19:25:02 2018 -0700 scsi: ufs: make UFS Tx lane1 clock optional for QCOM platforms Per Qcom's UFS host controller HW design, the UFS Tx lane1 clock could be muxed with Tx lane0 clock, hence keep Tx lane1 clock optional by ignoring it if it is not provided in device tree. This change also performs some cleanup to lanes per direction checks when enable/disable lane clocks just for symmetry. Signed-off-by: Venkat Gopalakrishnan Signed-off-by: Subhash Jadavani Signed-off-by: Can Guo Reviewed-by: Vivek Gautam Reviewed-by: Douglas Anderson Tested-by: Douglas Anderson Signed-off-by: Martin K. Petersen commit 664e68bcab5b3e59479494246db980a75822e963 Author: Arnd Bergmann Date: Fri Oct 12 12:41:28 2018 +0200 scsi: ufs: fix integer type usage in uapi header We get a warning from 'make headers_check' about a newly introduced usage of integer types in the scsi/scsi_bsg_ufs.h uapi header: usr/include/scsi/scsi_bsg_ufs.h:18: found __[us]{8,16,32,64} type without #include Aside from the missing linux/types.h inclusion, I also noticed that it uses the wrong types: 'u32' is not available at all in user space, and 'uint32_t' depends on the inclusion of a standard header that we should not include from kernel headers. Change the all to __u32 and similar types here. I also note the usage of '__be32' and '__be16' that seems unfortunate for a user space API. I wonder if it would be better to define the interface in terms of a CPU-endian structure and convert it in kernel space. Fixes: e77044c5a842 ("scsi: ufs-bsg: Add support for uic commands in ufs_bsg_request()") Fixes: df032bf27a41 ("scsi: ufs: Add a bsg endpoint that supports UPIUs") Signed-off-by: Arnd Bergmann Reviewed-by: Avri Altman Signed-off-by: Martin K. Petersen commit 416c461372b3fe635e5f9a8fbf32f629d3b22c13 Author: Christoph Hellwig Date: Thu Oct 11 09:16:13 2018 +0200 scsi: lpfc: remove a bogus pci_dma_sync_single_for_device call dma_alloc_coherent allocates memory that can be used by the cpu and the device at the same time, calls to pci_dma_sync_* are not required, and in fact actively harmful on some architectures like arm. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit 67d98f0a83f8d5eafe8f584fef70b1d790a36411 Author: Christoph Hellwig Date: Thu Oct 11 09:15:35 2018 +0200 scsi: megaraid_mbox: remove bogus use of pci_dma_sync_sg_* APIs The dma_map_sg / dma_unmap_sg APIs called from scsi_dma_map / scsi_dma_unmap already transfer memory ownership to the device or cpu respectively. Adding additional calls to pci_dma_sync_sg_* will in fact lead to data corruption if we end up using swiotlb for some reason. Also remove the now pointless megaraid_mbox_sync_scb function. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit 804186fa95c871aba621da280284d3bc46746d50 Author: Jens Axboe Date: Mon Oct 15 09:05:59 2018 -0600 xsysace: convert to blk-mq Straight forward conversion, using an internal list to enable the driver to pull requests at will. Acked-by: Michal Simek Signed-off-by: Jens Axboe commit 77218ddf46d8d71161776a37739cd1723706ec95 Author: Jens Axboe Date: Mon Oct 15 08:38:08 2018 -0600 paride: convert pf to blk-mq Tested-by: Ondrej Zary Signed-off-by: Jens Axboe commit 99fe8b02a82597a8fa8add6455d0a3037ca16e06 Author: Jens Axboe Date: Mon Oct 15 13:53:50 2018 -0600 paride: convert pd to blk-mq Tested-by: Ondrej Zary Signed-off-by: Jens Axboe commit 89c6b16509693332fe13d4bb6b812134de56c16f Author: Jens Axboe Date: Mon Oct 15 08:38:52 2018 -0600 paride: convert pcd to blk-mq Tested-by: Ondrej Zary Signed-off-by: Jens Axboe commit fab1adcf9503ccf191aec9ee42580f7dc1eb6237 Author: Jens Axboe Date: Mon Oct 15 13:32:01 2018 -0600 ps3disk: convert to blk-mq Convert from the old request_fn style driver to blk-mq. Cc: Benjamin Herrenschmidt Tested-by: Geoff Levand Signed-off-by: Jens Axboe commit 9316a9ed6895c4ad2f0cde171d486f80c55d8283 Author: Jens Axboe Date: Mon Oct 15 08:40:37 2018 -0600 blk-mq: provide helper for setting up an SQ queue and tag set This pattern is repeated throughout all the blk-mq conversions. Provide a basic helper to get it done. Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit de038597be8809619c4f17d70e86dab936bb1a10 Author: YueHaibing Date: Tue Oct 16 01:45:26 2018 +0000 null_blk: remove set but not used variable 'q' Fixes gcc '-Wunused-but-set-variable' warning: drivers/block/null_blk_main.c: In function 'end_cmd': drivers/block/null_blk_main.c:609:24: warning: variable 'q' set but not used [-Wunused-but-set-variable] It not used any more after commit e50b1e327aeb ("null_blk: remove legacy IO path") Signed-off-by: YueHaibing Signed-off-by: Jens Axboe commit 381fdd62c38344a771aed06adaf14aae65c47454 Author: Angelo Dureghello Date: Fri Sep 7 14:44:25 2018 +0200 m68k: fix command-line parsing when passed from u-boot This patch fixes command_line array zero-terminated one byte over the end of the array, causing boot to hang. Signed-off-by: Angelo Dureghello Signed-off-by: Greg Ungerer commit 0b592b5a01bef5416472ec610d3191e019c144a5 Author: Jakub Kicinski Date: Mon Oct 15 16:30:36 2018 -0700 tools: bpftool: add map create command Add a way of creating maps from user space. The command takes as parameters most of the attributes of the map creation system call command. After map is created its pinned to bpffs. This makes it possible to easily and dynamically (without rebuilding programs) test various corner cases related to map creation. Map type names are taken from bpftool's array used for printing. In general these days we try to make use of libbpf type names, but there are no map type names in libbpf as of today. As with most features I add the motivation is testing (offloads) :) Signed-off-by: Jakub Kicinski Reviewed-by: Quentin Monnet Signed-off-by: Alexei Starovoitov commit 2f1d774f7d356a7e95ac7c41373d518cf0d716c7 Merge: 7d1f12b8b2ab c034a177d3c8 Author: Alexei Starovoitov Date: Mon Oct 15 16:13:15 2018 -0700 Merge branch 'bpftool_sockmap' John Fastabend says: ==================== The first patch adds support for attaching programs to maps. This is needed to support sock{map|hash} use from bpftool. Currently, I carry around custom code to do this so doing it using standard bpftool will be great. The second patch adds a compat mode to ignore non-zero entries in the map def. This allows using bpftool with maps that have a extra fields that the user knows can be ignored. This is needed to work correctly with maps being loaded by other tools or directly via syscalls. v3: add bash completion and doc updates for --mapcompat ==================== Signed-off-by: Alexei Starovoitov commit c034a177d3c898f370f52877e7252da8c4f8235c Author: John Fastabend Date: Mon Oct 15 11:19:55 2018 -0700 bpf: bpftool, add flag to allow non-compat map definitions Multiple map definition structures exist and user may have non-zero fields in their definition that are not recognized by bpftool and libbpf. The normal behavior is to then fail loading the map. Although this is a good default behavior users may still want to load the map for debugging or other reasons. This patch adds a --mapcompat flag that can be used to override the default behavior and allow loading the map even when it has additional non-zero fields. For now the only user is 'bpftool prog' we can switch over other subcommands as needed. The library exposes an API that consumes a flags field now but I kept the original API around also in case users of the API don't want to expose this. The flags field is an int in case we need more control over how the API call handles errors/features/etc in the future. Signed-off-by: John Fastabend Acked-by: Jakub Kicinski Signed-off-by: Alexei Starovoitov commit b7d3826c2ed6c3e626e7ae796c5df2c0d2551c6a Author: John Fastabend Date: Mon Oct 15 11:19:50 2018 -0700 bpf: bpftool, add support for attaching programs to maps Sock map/hash introduce support for attaching programs to maps. To date I have been doing this with custom tooling but this is less than ideal as we shift to using bpftool as the single CLI for our BPF uses. This patch adds new sub commands 'attach' and 'detach' to the 'prog' command to attach programs to maps and then detach them. Signed-off-by: John Fastabend Reviewed-by: Jakub Kicinski Signed-off-by: Alexei Starovoitov commit 7d1f12b8b2abab0a7af240b89b5ad68bf7f183e7 Merge: d04fb13c9fcd 5ef0ae84f02a Author: Alexei Starovoitov Date: Mon Oct 15 16:08:39 2018 -0700 Merge branch 'ipv6_sk_lookup_fixes' Joe Stringer says: ==================== This series includes a couple of fixups for the IPv6 socket lookup helper, to make the API more consistent (always supply all arguments in network byte-order) and to allow its use when IPv6 is compiled as a module. ==================== Acked-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov commit 5ef0ae84f02a4dbe0e09f89c6481ac13649cb19b Author: Joe Stringer Date: Mon Oct 15 10:27:46 2018 -0700 bpf: Fix IPv6 dport byte-order in bpf_sk_lookup Commit 6acc9b432e67 ("bpf: Add helper to retrieve socket in BPF") mistakenly passed the destination port in network byte-order to the IPv6 TCP/UDP socket lookup functions, which meant that BPF writers would need to either manually swap the byte-order of this field or otherwise IPv6 sockets could not be located via this helper. Fix the issue by swapping the byte-order appropriately in the helper. This also makes the API more consistent with the IPv4 version. Fixes: 6acc9b432e67 ("bpf: Add helper to retrieve socket in BPF") Signed-off-by: Joe Stringer Signed-off-by: Alexei Starovoitov commit 8a615c6b0352a9ec56151b6c95d68e0a2eef5cf0 Author: Joe Stringer Date: Mon Oct 15 10:27:45 2018 -0700 bpf: Allow sk_lookup with IPv6 module This is a more complete fix than d71019b54bff ("net: core: Fix build with CONFIG_IPV6=m"), so that IPv6 sockets may be looked up if the IPv6 module is loaded (not just if it's compiled in). Signed-off-by: Joe Stringer Signed-off-by: Alexei Starovoitov commit 43c3ff27a47d83d153c4adc088243ba594582bf5 Author: Su Sung Chung Date: Thu Sep 20 15:03:27 2018 -0400 drm/amd/display: fix bug of accessing invalid memory [Why] A loop inside of build_evenly_distributed_points function that traverse through the array of points become an infinite loop when m_GammaUpdates does not get assigned to any value. [How] In DMColor, clear m_gammaIsValid bit just before writting all Zeromem for m_GammaUpdates, to prevent calling build_evenly_distributed_points before m_GammaUpdates gets assigned to some value. Signed-off-by: Su Sung Chung Reviewed-by: Aric Cyr Acked-by: Bhawanpreet Lakha Signed-off-by: Alex Deucher commit 46924030475b6d44061a9a393f4e3b82b713f820 Author: Jonathan Gray Date: Mon Oct 15 15:47:01 2018 +1100 drm/radeon: change SPDX identifier to MIT Commit b24413180f5600bcb3bb70fbed5cf186b60864bd added "SPDX-License-Identifier: GPL-2.0" to files which previously had no license, change this to MIT for radeon matching the license text of the other radeon files. Signed-off-by: Jonathan Gray Signed-off-by: Alex Deucher commit 4c450f056cae111a48bb33c3ddb33296a206faad Author: Jonathan Gray Date: Mon Oct 15 15:45:49 2018 +1100 drm/amdgpu: correct SPDX identifier in amdgpu_trace_points.c Commit b24413180f5600bcb3bb70fbed5cf186b60864bd 'License cleanup: add SPDX GPL-2.0 license identifier to files with no license' incorrectly added "SPDX-License-Identifier: GPL-2.0" to a file with MIT license text. Change the SPDX identifier to match the license text. Signed-off-by: Jonathan Gray Signed-off-by: Alex Deucher commit e7c6a55606b5c46b449d76588968b4d8caae903f Author: Dmitry Bazhenov Date: Mon Oct 15 14:21:22 2018 +0500 hwmon: (pmbus) Fix page count auto-detection. Devices with compatible="pmbus" field have zero initial page count, and pmbus_clear_faults() being called before the page count auto- detection does not actually clear faults because it depends on the page count. Non-cleared faults in its turn may fail the subsequent page count auto-detection. This patch fixes this problem by calling pmbus_clear_fault_page() for currently set page and calling pmbus_clear_faults() after the page count was detected. Cc: stable@vger.kernel.org Signed-off-by: Dmitry Bazhenov Signed-off-by: Guenter Roeck commit fe278d1a959283c185ceef0703d8570bf907b95d Author: Christoph Hellwig Date: Sun Oct 14 20:13:04 2018 +0200 xtensa: remove ZONE_DMA ZONE_DMA is intended for magic < 32-bit pools (usually ISA DMA), which isn't required on xtensa. Move all the non-highmem memory into ZONE_NORMAL instead to match other architectures. Signed-off-by: Christoph Hellwig Signed-off-by: Max Filippov commit d04fb13c9fcdad850c0fcaeb155863de3d8169a0 Merge: 67e89ac32828 eea0d2adcf11 Author: Alexei Starovoitov Date: Mon Oct 15 12:23:20 2018 -0700 Merge branch 'sockmap_and_ktls' Daniel Borkmann says: ==================== This work adds a generic sk_msg layer and converts both sockmap and later ktls over to make use of it as a common data structure for application data (similarly as sk_buff for network packets). With that in place the sk_msg framework spans accross ULP layer in the kernel and allows for introspection or filtering of L7 data with the help of BPF programs operating on a common input context. In a second step, we enable the latter for ktls which was previously not possible, meaning, ktls and sk_msg verdict programs were mutually exclusive in the ULP layer which created challenges for the orchestrator when trying to apply TCP based policy, for example. Leveraging the prior consolidation we can finally overcome this limitation. Note, there's no change in behavior when ktls is not used in combination with BPF, and also no change in behavior for stand alone sockmap. The kselftest suites for ktls, sockmap and ktls with sockmap combined also runs through successfully. For further details please see individual patches. Thanks! v1 -> v2: - Removed leftover comment spotted by Alexei - Improved commit messages, rebase ==================== Signed-off-by: Alexei Starovoitov commit eea0d2adcf112dd9e5d9a13779c0ab262583444d Author: Daniel Borkmann Date: Sat Oct 13 02:46:03 2018 +0200 bpf, doc: add maintainers entry to related files Add a MAINTAINERS entry to the skmsg and related files such that patches, features, bug reports land with the right Cc. Signed-off-by: Daniel Borkmann Signed-off-by: John Fastabend Signed-off-by: Alexei Starovoitov commit e9dd904708c463ff57d019f4482c48d057fa4d7e Author: John Fastabend Date: Sat Oct 13 02:46:02 2018 +0200 bpf: add tls support for testing in test_sockmap This adds a --ktls option to test_sockmap in order to enable the combination of ktls and sockmap to run, which makes for another batch of 648 test cases for both in combination. Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov commit d3b18ad31f93d0b6bae105c679018a1ba7daa9ca Author: John Fastabend Date: Sat Oct 13 02:46:01 2018 +0200 tls: add bpf support to sk_msg handling This work adds BPF sk_msg verdict program support to kTLS allowing BPF and kTLS to be combined together. Previously kTLS and sk_msg verdict programs were mutually exclusive in the ULP layer which created challenges for the orchestrator when trying to apply TCP based policy, for example. To resolve this, leveraging the work from previous patches that consolidates the use of sk_msg, we can finally enable BPF sk_msg verdict programs so they continue to run after the kTLS socket is created. No change in behavior when kTLS is not used in combination with BPF, the kselftest suite for kTLS also runs successfully. Joint work with Daniel. Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov commit 924ad65ed01ee0eec5d2a3280c01c394343d6df7 Author: John Fastabend Date: Sat Oct 13 02:46:00 2018 +0200 tls: replace poll implementation with read hook Instead of re-implementing poll routine use the poll callback to trigger read from kTLS, we reuse the stream_memory_read callback which is simpler and achieves the same. This helps to align sockmap and kTLS so we can more easily embed BPF in kTLS. Joint work with Daniel. Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov commit d829e9c4112b52f4f00195900fd4c685f61365ab Author: Daniel Borkmann Date: Sat Oct 13 02:45:59 2018 +0200 tls: convert to generic sk_msg interface Convert kTLS over to make use of sk_msg interface for plaintext and encrypted scattergather data, so it reuses all the sk_msg helpers and data structure which later on in a second step enables to glue this to BPF. This also allows to remove quite a bit of open coded helpers which are covered by the sk_msg API. Recent changes in kTLs 80ece6a03aaf ("tls: Remove redundant vars from tls record structure") and 4e6d47206c32 ("tls: Add support for inplace records encryption") changed the data path handling a bit; while we've kept the latter optimization intact, we had to undo the former change to better fit the sk_msg model, hence the sg_aead_in and sg_aead_out have been brought back and are linked into the sk_msg sgs. Now the kTLS record contains a msg_plaintext and msg_encrypted sk_msg each. In the original code, the zerocopy_from_iter() has been used out of TX but also RX path. For the strparser skb-based RX path, we've left the zerocopy_from_iter() in decrypt_internal() mostly untouched, meaning it has been moved into tls_setup_from_iter() with charging logic removed (as not used from RX). Given RX path is not based on sk_msg objects, we haven't pursued setting up a dummy sk_msg to call into sk_msg_zerocopy_from_iter(), but it could be an option to prusue in a later step. Joint work with John. Signed-off-by: Daniel Borkmann Signed-off-by: John Fastabend Signed-off-by: Alexei Starovoitov commit 604326b41a6fb9b4a78b6179335decee0365cd8c Author: Daniel Borkmann Date: Sat Oct 13 02:45:58 2018 +0200 bpf, sockmap: convert to generic sk_msg interface Add a generic sk_msg layer, and convert current sockmap and later kTLS over to make use of it. While sk_buff handles network packet representation from netdevice up to socket, sk_msg handles data representation from application to socket layer. This means that sk_msg framework spans across ULP users in the kernel, and enables features such as introspection or filtering of data with the help of BPF programs that operate on this data structure. Latter becomes in particular useful for kTLS where data encryption is deferred into the kernel, and as such enabling the kernel to perform L7 introspection and policy based on BPF for TLS connections where the record is being encrypted after BPF has run and came to a verdict. In order to get there, first step is to transform open coding of scatter-gather list handling into a common core framework that subsystems can use. The code itself has been split and refactored into three bigger pieces: i) the generic sk_msg API which deals with managing the scatter gather ring, providing helpers for walking and mangling, transferring application data from user space into it, and preparing it for BPF pre/post-processing, ii) the plain sock map itself where sockets can be attached to or detached from; these bits are independent of i) which can now be used also without sock map, and iii) the integration with plain TCP as one protocol to be used for processing L7 application data (later this could e.g. also be extended to other protocols like UDP). The semantics are the same with the old sock map code and therefore no change of user facing behavior or APIs. While pursuing this work it also helped finding a number of bugs in the old sockmap code that we've fixed already in earlier commits. The test_sockmap kselftest suite passes through fine as well. Joint work with John. Signed-off-by: Daniel Borkmann Signed-off-by: John Fastabend Signed-off-by: Alexei Starovoitov commit 1243a51f6c05ecbb2c5c9e02fdcc1e7a06f76f26 Author: Daniel Borkmann Date: Sat Oct 13 02:45:57 2018 +0200 tcp, ulp: remove ulp bits from sockmap In order to prepare sockmap logic to be used in combination with kTLS we need to detangle it from ULP, and further split it in later commits into a generic API. Joint work with John. Signed-off-by: Daniel Borkmann Signed-off-by: John Fastabend Signed-off-by: Alexei Starovoitov commit 8b9088f806e1ccd10c3d48b3b6d3d5d7855d92c5 Author: Daniel Borkmann Date: Sat Oct 13 02:45:56 2018 +0200 tcp, ulp: enforce sock_owned_by_me upon ulp init and cleanup Whenever the ULP data on the socket is mangled, enforce that the caller has the socket lock held as otherwise things may race with initialization and cleanup callbacks from ulp ops as both would mangle internal socket state. Joint work with John. Signed-off-by: Daniel Borkmann Signed-off-by: John Fastabend Signed-off-by: Alexei Starovoitov commit 1c87dc897b8c8ace3aa4480fa29ef6439dabb3ab Author: Lance Roy Date: Tue Oct 2 22:38:48 2018 -0700 hv_balloon: Replace spin_is_locked() with lockdep lockdep_assert_held() is better suited to checking locking requirements, since it won't get confused when someone else holds the lock. This is also a step towards possibly removing spin_is_locked(). Signed-off-by: Lance Roy Cc: "K. Y. Srinivasan" Cc: Haiyang Zhang Cc: Stephen Hemminger Reviewed-by: Vitaly Kuznetsov Signed-off-by: Greg Kroah-Hartman commit f21996255f42eee28048ede652a592d6048b06b3 Author: Lance Roy Date: Tue Oct 2 22:38:49 2018 -0700 sgi-xp: Replace spin_is_locked() with lockdep lockdep_assert_held() is better suited to checking locking requirements, since it won't get confused when someone else holds the lock. This is also a step towards possibly removing spin_is_locked(). Signed-off-by: Lance Roy Cc: Cliff Whickman Cc: Arnd Bergmann Acked-by: Robin Holt Signed-off-by: Greg Kroah-Hartman commit 3b7584a296c4fac45e59ab3a264880e1a2fedbfe Author: Jean Delvare Date: Sun Oct 7 19:05:00 2018 +0200 eeprom: New ee1004 driver for DDR4 memory The EEPROMs which hold the SPD data on DDR4 memory modules are no longer standard AT24C02-compatible EEPROMs. They are 512-byte EEPROMs which use only 1 I2C address for data access. You need to switch between the lower page and the upper page of data by sending commands on the SMBus. Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit 5fe9f6ccbb7bc82a92e5d32b3eb68eebb3ea4a93 Author: YueHaibing Date: Fri Oct 5 06:19:12 2018 +0000 eeprom: at25: remove unneeded 'at25_remove' Fixes gcc '-Wunused-but-set-variable' warning: drivers/misc/eeprom/at25.c: In function 'at25_remove': drivers/misc/eeprom/at25.c:384:20: warning: variable 'at25' set but not used [-Wunused-but-set-variable] Since commit 96d08fb43e30 ("eeprom: at25: use devm_nvmem_register()"), at25_remove is do nothing, so can be removed. Signed-off-by: YueHaibing Acked-by: Arnd Bergmann Reviewed-by: Geert Uytterhoeven Signed-off-by: Greg Kroah-Hartman commit 6eaafbb6998e999467cf78a76e155ee00e372b14 Author: Julien Folly Date: Tue Oct 9 19:47:45 2018 +0200 w1: IAD Register is yet readable trough iad sys file. Fix snprintf (%u for unsigned, count for max size). IAD Register is yet readable trough the "iad" sys file. A write to the "iad" sys file enables or disables the current measurement, but it was not possible to get the measured value by reading it. Fix: %u in snprintf for unsigned values (vdd and vad) Fix: Avoid possibles overflows (Usage of the 'count' variables) Signed-off-by: Julien Folly Acked-by: Evgeniy Polyakov Signed-off-by: Greg Kroah-Hartman commit 3c3f76248e79d69f3b8ceaa31b68051dad45e92b Author: YueHaibing Date: Fri Oct 12 03:25:56 2018 +0000 misc: mic: scif: remove set but not used variables 'src_dma_addr, dst_dma_addr' Fixes gcc '-Wunused-but-set-variable' warning: drivers/misc/mic/scif/scif_dma.c: In function 'scif_rma_list_dma_copy_wrapper': drivers/misc/mic/scif/scif_dma.c:1558:27: warning: variable 'dst_dma_addr' set but not used [-Wunused-but-set-variable] drivers/misc/mic/scif/scif_dma.c:1558:13: warning: variable 'src_dma_addr' set but not used [-Wunused-but-set-variable] They never used since introduction in commit 7cc31cd27752 ("misc: mic: SCIF DMA and CPU copy interface") Signed-off-by: YueHaibing Signed-off-by: Greg Kroah-Hartman commit 6b995f4eec34745f6cb20d66d5277611f0b3c3fa Author: Wenwen Wang Date: Wed Oct 10 18:38:28 2018 -0500 misc: mic: fix a DMA pool free failure In _scif_prog_signal(), the boolean variable 'x100' is used to indicate whether the MIC Coprocessor is X100. If 'x100' is true, the status descriptor will be used to write the value to the destination. Otherwise, a DMA pool will be allocated for this purpose. Specifically, if the DMA pool is allocated successfully, two memory addresses will be returned. One is for the CPU and the other is for the device to access the DMA pool. The former is stored to the variable 'status' and the latter is stored to the variable 'src'. After the allocation, the address in 'src' is saved to 'status->src_dma_addr', which is actually in the DMA pool, and 'src' is then modified. Later on, if an error occurs, the execution flow will transfer to the label 'dma_fail', which will check 'x100' and free up the allocated DMA pool if 'x100' is false. The point here is that 'status->src_dma_addr' is used for freeing up the DMA pool. As mentioned before, 'status->src_dma_addr' is in the DMA pool. And thus, the device is able to modify this data. This can potentially cause failures when freeing up the DMA pool because of the modified device address. This patch avoids the above issue by using the variable 'src' (with necessary calculation) to free up the DMA pool. Signed-off-by: Wenwen Wang Signed-off-by: Greg Kroah-Hartman commit 8d452721628db190964ab44e302c3e3fb3bdb8ef Author: Lukasz Majewski Date: Fri Sep 28 00:26:55 2018 +0200 dt-bindings: misc: bk4: Add device tree binding for Liebherr's BK4 SPI bus Add Device Tree binding document for Liebherr's BK4 external SPI bus. Signed-off-by: Lukasz Majewski Signed-off-by: Rob Herring commit 6d7d725b2e62b00f6b0b36639ba597efe9cc8ea9 Author: Roman Kiryanov Date: Wed Oct 3 10:17:13 2018 -0700 platform: goldfish: pipe: Add a blank line to separate varibles and code checkpacth: Missing a blank line after declarations Signed-off-by: Roman Kiryanov Signed-off-by: Greg Kroah-Hartman commit e6fb3193307dc6bd1de9354a7937385e73fd06cb Author: Roman Kiryanov Date: Wed Oct 3 10:17:10 2018 -0700 platform: goldfish: pipe: Remove redundant casting This casting is not required. Signed-off-by: Roman Kiryanov Signed-off-by: Greg Kroah-Hartman commit 60a6e5233fcbe82a89b5b83b95b5d87e04b3be60 Author: Roman Kiryanov Date: Wed Oct 3 10:17:09 2018 -0700 platform: goldfish: pipe: Call misc_deregister if init fails Undo effects of misc_register if driver's init fails after misc_register. Signed-off-by: Roman Kiryanov Signed-off-by: Greg Kroah-Hartman commit 08360e26f2a8eba0105ca7cd598547a1749b1c68 Author: Roman Kiryanov Date: Wed Oct 3 10:17:08 2018 -0700 platform: goldfish: pipe: Move the file-scope goldfish_pipe_dev variable into the driver state This is the last patch in the series of patches to move file-scope variables into the driver state. This change will help to introduce another version of the pipe driver (with different state) for the older host interface or having several instances of this device. Signed-off-by: Roman Kiryanov Signed-off-by: Greg Kroah-Hartman commit 43c2cc2864bca0cceff331f27fe762fcf0d804b2 Author: Roman Kiryanov Date: Wed Oct 3 10:17:07 2018 -0700 platform: goldfish: pipe: Move the file-scope goldfish_pipe_miscdev variable into the driver state This is a series of patches to move mutable file-scope variables into the driver state. This change will help to introduce another version of the pipe driver (with different state) for the older host interface or having several instances of this device. Signed-off-by: Roman Kiryanov Signed-off-by: Greg Kroah-Hartman commit c394cc3b470c0adfee2dff4b8b2a907a73a0ee81 Author: Roman Kiryanov Date: Wed Oct 3 10:17:06 2018 -0700 platform: goldfish: pipe: Move the file-scope goldfish_interrupt_tasklet variable into the driver state This is a series of patches to move mutable file-scope variables into the driver state. This change will help to introduce another version of the pipe driver (with different state) for the older host interface or having several instances of this device. Signed-off-by: Roman Kiryanov Signed-off-by: Greg Kroah-Hartman commit 40970f7a43d6bddb5e47baf16449d6f5fd329531 Author: Krzysztof Kozlowski Date: Thu Sep 27 19:04:40 2018 +0200 dt-bindings: thermal: samsung: Add SPDX license identifier Replace GPL license statement with SPDX license identifier (GPL-2.0+). Signed-off-by: Krzysztof Kozlowski Signed-off-by: Rob Herring commit cd9102e9add8ec1f5a01cfbcad52cac8c2c380b7 Author: Krzysztof Kozlowski Date: Thu Sep 27 19:03:47 2018 +0200 dt-bindings: clock: samsung: Add SPDX license identifiers Replace GPL license statements with SPDX license identifiers (GPL-2.0). Signed-off-by: Krzysztof Kozlowski Acked-by: Chanwoo Choi Reviewed-by: Rob Herring Signed-off-by: Rob Herring commit 8942b2d5094b01e4509f0118a7940bb07350e128 Author: Furquan Shaikh Date: Fri Oct 12 10:04:48 2018 -0600 gsmi: Add GSMI commands to log S0ix info Add new GSMI commands (GSMI_CMD_LOG_S0IX_SUSPEND = 0xa, GSMI_CMD_LOG_S0IX_RESUME = 0xb) that allow firmware to log any information during S0ix suspend/resume paths. Traditional ACPI suspend S3 involves BIOS both during the suspend and the resume paths. However, modern suspend type like S0ix does not involve firmware on either of the paths. This command gives the firmware an opportunity to log any required information about the suspend and resume operations e.g. wake sources. Additionally, this change adds a module parameter to allow platforms to specifically enable S0ix logging if required. This prevents any other platforms from unnecessarily making a GSMI call which could have any side-effects. Tested by verifying that wake sources are correctly logged in eventlog. Signed-off-by: Furquan Shaikh Reviewed-by: Aaron Durbin Reviewed-by: Rajat Jain Signed-off-by: Furquan Shaikh Tested-by: Furquan Shaikh Reviewed-by: Aaron Durbin [zwisler: update changelog for upstream] Signed-off-by: Ross Zwisler Reviewed-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit d31655ba89575a2d1559a345642338eecd49c96d Author: Duncan Laurie Date: Fri Oct 12 10:04:47 2018 -0600 gsmi: Remove autoselected dependency on EFI and EFI_VARS Instead of selecting EFI and EFI_VARS automatically when GSMI is enabled let that portion of the driver be conditionally compiled if EFI and EFI_VARS are enabled. This allows the rest of the driver (specifically event log) to be used if EFI_VARS is not enabled. To test: 1) verify that EFI_VARS is not automatically selected when CONFIG_GOOGLE_GSMI is enabled 2) verify that the kernel boots on Link and that GSMI event log is still available and functional 3) specifically boot the kernel on Alex to ensure it does not try to load efivars and that gsmi also does not load because it is not in the supported DMI table Signed-off-by: Duncan Laurie Reviewed-by: Olof Johansson Signed-off-by: Benson Leung Signed-off-by: Ben Zhang Signed-off-by: Filipe Brandenburger Signed-off-by: Furquan Shaikh Tested-by: Furquan Shaikh Reviewed-by: Aaron Durbin [zwisler: update changelog for upstream] Signed-off-by: Ross Zwisler Reviewed-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit 255d7447cf92821ded63079ffe4019d9f0fa0a6c Author: Duncan Laurie Date: Fri Oct 12 10:04:46 2018 -0600 gsmi: Add coreboot to list of matching BIOS vendors In order to use this coreboot needs board support for: CONFIG_ELOG=y CONFIG_ELOG_GSMI=y And the kernel driver needs enabled: CONFIG_GOOGLE_GSMI=y To test, verify that clean shutdown event is added to the log: > mosys eventlog list | grep 'Clean Shutdown' 11 | 2012-06-25 09:49:24 | Kernl Event | Clean Shutdown Signed-off-by: Duncan Laurie Reviewed-by: Vadim Bendebury Reviewed-by: Stefan Reinauer Signed-off-by: Furquan Shaikh Tested-by: Furquan Shaikh Reviewed-by: Aaron Durbin Reviewed-by: Justin TerAvest [zwisler: update changelog for upstream] Signed-off-by: Ross Zwisler Reviewed-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit 655603de68469adaff16842ac17a5aec9c9ce89b Author: Duncan Laurie Date: Fri Oct 12 10:04:45 2018 -0600 gsmi: Fix bug in append_to_eventlog sysfs handler The sysfs handler should return the number of bytes consumed, which in the case of a successful write is the entire buffer. Also fix a bug where param.data_len was being set to (count - (2 * sizeof(u32))) instead of just (count - sizeof(u32)). The latter is correct because we skip over the leading u32 which is our param.type, but we were also incorrectly subtracting sizeof(u32) on the line where we were actually setting param.data_len: param.data_len = count - sizeof(u32); This meant that for our example event.kernel_software_watchdog with total length 10 bytes, param.data_len was just 2 prior to this change. To test, successfully append an event to the log with gsmi sysfs. This sample event is for a "Kernel Software Watchdog" > xxd -g 1 event.kernel_software_watchdog 0000000: 01 00 00 00 ad de 06 00 00 00 > cat event.kernel_software_watchdog > /sys/firmware/gsmi/append_to_eventlog > mosys eventlog list | tail -1 14 | 2012-06-25 10:14:14 | Kernl Event | Software Watchdog Signed-off-by: Duncan Laurie Reviewed-by: Vadim Bendebury Reviewed-by: Stefan Reinauer Signed-off-by: Furquan Shaikh Tested-by: Furquan Shaikh Reviewed-by: Aaron Durbin Reviewed-by: Justin TerAvest [zwisler: updated changelog for 2nd bug fix and upstream] Signed-off-by: Ross Zwisler Reviewed-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit 22be0c6cec357ba4e15655a695d8abd9bab1290c Author: Chris Brandt Date: Thu Sep 27 09:12:58 2018 -0500 dt-bindings: timer: ostm: Add R7S9210 support The R7S9210 belongs to the RZ/A2 SoC series Signed-off-by: Chris Brandt Reviewed-by: Simon Horman Signed-off-by: Rob Herring commit b3da72593e14511967a5f96f5e329b022239a90e Author: Biju Das Date: Thu Sep 27 13:23:34 2018 +0100 dt-bindings: phy: rcar-gen2: Add r8a7744 support Add USB PHY support for r8a7744 SoC. Renesas RZ/G1N (R8A7744) USB PHY is identical to the R-Car Gen2 family. Signed-off-by: Biju Das Reviewed-by: Chris Paterson Reviewed-by: Simon Horman Signed-off-by: Rob Herring commit 4a2b2662e9d21648502e5be10dcd312b8fe85bca Author: Joel Fernandes (Google) Date: Thu Oct 4 18:49:52 2018 -0700 MAINTAINERS: Add me to Android drivers I am one of the main engineers working on ashmem. I have been fixing bugs in the driver and have been involved in the memfd conversion discussions and sending patches about that. I also have an understanding of the binder driver and was involved with some of the development on finer grained locking. So I would like to be added to the MAINTAINERS file for android drivers for review and maintenance of ashmem and other Android drivers. Signed-off-by: Joel Fernandes (Google) Acked-by: Todd Kjos Signed-off-by: Greg Kroah-Hartman commit 700992d361c7912923d1e570681eed65b54a6d9b Author: Biju Das Date: Thu Sep 27 13:08:48 2018 +0100 dt-bindings: can: rcar_can: Add r8a7744 support Document RZ/G1N (r8a7744) SoC specific bindings. Signed-off-by: Biju Das Reviewed-by: Chris Paterson Reviewed-by: Simon Horman Signed-off-by: Rob Herring commit 03bf67817ec1b8eb3017d2884486ef1bac128764 Author: Gustavo A. R. Silva Date: Mon Oct 15 11:21:47 2018 -0700 Input: atmel_mxt_ts - mark expected switch fall-through In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Signed-off-by: Gustavo A. R. Silva Signed-off-by: Dmitry Torokhov commit 15ee2992c07eb67576bab2d764f34d76aabb9143 Author: Gustavo A. R. Silva Date: Mon Oct 15 11:21:18 2018 -0700 Input: cyapa - mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Notice that in this particular case, I replaced the "Fallthrough state" commern with a proper "Fall through", which is what GCC is expecting to find. Addresses-Coverity-ID: 114758 ("Missing break in switch") Addresses-Coverity-ID: 114759 ("Missing break in switch") Signed-off-by: Gustavo A. R. Silva Signed-off-by: Dmitry Torokhov commit a3f7c3fcf60868c1e90671df5d0cf9be5900a09b Author: Randy Dunlap Date: Mon Oct 15 11:16:58 2018 -0700 Input: wm97xx-ts - fix exit path Loading then unloading wm97xx-ts.ko when CONFIG_AC97_BUS=m causes a WARNING: from drivers/base/driver.c: Unexpected driver unregister! WARNING: CPU: 0 PID: 1709 at ../drivers/base/driver.c:193 driver_unregister+0x30/0x40 Fix this by only calling driver_unregister() with the same condition that driver_register() is called. Fixes: ae9d1b5fbd7b ("Input: wm97xx: add new AC97 bus support") Signed-off-by: Randy Dunlap Signed-off-by: Dmitry Torokhov commit c9e58fb2aad5231e7c49d90d059caa3c67a3ff31 Author: Bob Peterson Date: Mon Oct 15 12:17:30 2018 -0500 gfs2: write revokes should traverse sd_ail1_list in reverse All the other functions that deal with the sd_ail_list run the list from the tail back to the head, iow, in reverse. We should do the same while writing revokes, otherwise we might miss removing entries properly from the list when we hit the limit of how many revokes we can write at one time (based on block size, which determines how many block pointers will fit in the revoke block). Signed-off-by: Bob Peterson commit a3e403161fe1cc87bdbcfb8a4a4eab7aa6ac1a96 Author: Manivannan Sadhasivam Date: Mon Oct 8 22:46:31 2018 +0530 dmaengine: owl: Fix warnings generated during build Following warnings are generated when compiled with W=1, drivers/dma/owl-dma.c:170: warning: Function parameter or member 'cyclic' not described in 'owl_dma_txd' drivers/dma/owl-dma.c:198: warning: Function parameter or member 'cfg' not described in 'owl_dma_vchan' drivers/dma/owl-dma.c:198: warning: Function parameter or member 'drq' not described in 'owl_dma_vchan' drivers/dma/owl-dma.c:225: warning: Function parameter or member 'irq' not described in 'owl_dma' Fix this by adding comments for relevant struct members to appear in kernel-doc. Fixes: d64e1b3f5cce ("dmaengine: owl: Add Slave and Cyclic mode support for Actions Semi Owl S900 SoC") Reported-by: Vinod Koul Signed-off-by: Manivannan Sadhasivam Reviewed-by: Andreas Färber Signed-off-by: Vinod Koul commit 6df9543da2b2a2f98f8a6ebbf9530bd3546b7268 Merge: 5b394b2ddf03 9dbcfe1ace4e Author: Stephen Boyd Date: Mon Oct 15 10:01:41 2018 -0700 Merge tag 'clk-v4.20-samsung' of git://git.kernel.org/pub/scm/linux/kernel/git/snawrocki/clk into clk-samsung Pull Samsung clk driver updates from Sylwester Nawrocki: - consolidation of system suspend related code in Exynos, S5P, S3C SoC clk drivers, - fixes of system suspend support on Exynos542x (Odroid boards) and Exynos5433 SoC, - removal of obsoleted Exynos4212 ISP clock definitions, - correction of Exynos CPU clock implementation, - addition of SPDX license identifiers. * tag 'clk-v4.20-samsung' of git://git.kernel.org/pub/scm/linux/kernel/git/snawrocki/clk: dt-bindings: clock: samsung: Add SPDX license identifiers clk: samsung: Use clk_hw API for calling clk framework from clk notifiers clk: samsung: exynos5420: Enable PERIS clocks for suspend clk: samsung: exynos5420: Define CLK_SECKEY gate clock only or Exynos5420 clk: samsung: exynos5433: Keep sclk_uart clocks enabled in suspend clk: samsung: Remove obsolete code for Exynos4412 ISP clocks clk: samsung: exynos5433: Add suspend state for TOP, CPIF & PERIC CMUs clk: samsung: Use NOIRQ stage for Exynos5433 clocks suspend/resume clk: samsung: exynos5420: Use generic helper for handling suspend/resume clk: samsung: exynos4: Use generic helper for handling suspend/resume clk: samsung: Add support for setting registers state before suspend clk: samsung: exynos5250: Use generic helper for handling suspend/resume clk: samsung: s5pv210: Use generic helper for handling suspend/resume clk: samsung: s3c64xx: Use generic helper for handling suspend/resume clk: samsung: s3c2443: Use generic helper for handling suspend/resume clk: samsung: s3c2412: Use generic helper for handling suspend/resume clk: samsung: s3c2410: Use generic helper for handling suspend/resume clk: samsung: Remove excessive include commit 7c4189c75b0b40bfe559b185e30847398e9ac206 Author: Biju Das Date: Tue Sep 25 18:18:16 2018 +0100 dt-bindings: timer: renesas, cmt: Document r8a7744 CMT support Document SoC specific compatible strings for r8a7744. No driver change is needed as the fallback strings will activate the right code. Signed-off-by: Biju Das Reviewed-by: Chris Paterson Reviewed-by: Simon Horman Reviewed-by: Geert Uytterhoeven Signed-off-by: Rob Herring commit c54ed7c02bd79abe7a62943d308ecb51cf1d4ffe Author: Biju Das Date: Tue Sep 25 18:07:21 2018 +0100 dt-bindings: watchdog: renesas-wdt: Document r8a7744 support RZ/G1N (R8A7744) watchdog implementation is compatible with R-Car Gen2, therefore add relevant documentation. Signed-off-by: Biju Das Reviewed-by: Chris Paterson Reviewed-by: Simon Horman Reviewed-by: Geert Uytterhoeven Reviewed-by: Guenter Roeck Signed-off-by: Rob Herring commit 4583af182007d3f0779b8ca3c83fb2325c12d4d7 Author: Biju Das Date: Tue Sep 25 18:01:04 2018 +0100 dt-bindings: thermal: rcar: Add device tree support for r8a7744 Add thermal sensor support for r8a7744 SoC. The Renesas RZ/G1N (r8a7744) thermal sensor module is identical to the R-Car Gen2 family. No driver change is needed due to the fallback compatible value "renesas,rcar-gen2-thermal". Signed-off-by: Biju Das Reviewed-by: Chris Paterson Reviewed-by: Daniel Lezcano Reviewed-by: Simon Horman Reviewed-by: Geert Uytterhoeven Signed-off-by: Rob Herring commit d9352794dad9f28535439d85a815978878c141ab Author: Lu Fengqi Date: Thu Oct 11 13:40:38 2018 +0800 btrfs: switch return_bigger to bool in find_ref_head Using bool is more suitable than int here, and add the comment about the return_bigger. Signed-off-by: Lu Fengqi Reviewed-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7c8616278b19c42141ff4617573cbf950f4a456b Author: Lu Fengqi Date: Thu Oct 11 13:40:36 2018 +0800 btrfs: remove fs_info from btrfs_should_throttle_delayed_refs The avg_delayed_ref_runtime can be referenced from the transaction handle. Signed-off-by: Lu Fengqi Reviewed-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit af9b8a0e2085fc90dca85acd85ee83ece7c05130 Author: Lu Fengqi Date: Thu Oct 11 13:40:35 2018 +0800 btrfs: remove fs_info from btrfs_check_space_for_delayed_refs It can be referenced from the transaction handle. Signed-off-by: Lu Fengqi Reviewed-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9e920a6f03e40b1eb712f38b29ad5880153754e2 Author: Lu Fengqi Date: Thu Oct 11 13:40:34 2018 +0800 btrfs: delayed-ref: pass delayed_refs directly to btrfs_delayed_ref_lock Since trans is only used for referring to delayed_refs, there is no need to pass it instead of delayed_refs to btrfs_delayed_ref_lock(). No functional change. Reviewed-by: Nikolay Borisov Signed-off-by: Lu Fengqi Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5637c74b01458d4bc392c2bb721bd102f316ad2d Author: Lu Fengqi Date: Thu Oct 11 13:40:33 2018 +0800 btrfs: delayed-ref: pass delayed_refs directly to btrfs_select_ref_head Since trans is only used for referring to delayed_refs, there is no need to pass it instead of delayed_refs to btrfs_select_ref_head(). No functional change. Signed-off-by: Lu Fengqi Reviewed-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit b90e22ba4804d31160f6cd625efa599ba9d286af Author: Lu Fengqi Date: Thu Oct 11 13:42:56 2018 +0800 btrfs: qgroup: move the qgroup->members check out from (!qgroup)'s else branch There is no reason to put this check in (!qgroup)'s else branch because if qgroup is null, it will goto out directly. So move it out to reduce indentation level. No functional change. Signed-off-by: Lu Fengqi Reviewed-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 06bbf67244fc63c66340bd31f4b2b60d797e886e Author: Qu Wenruo Date: Fri Sep 21 15:20:30 2018 +0800 btrfs: relocation: Remove redundant tree level check Commit 581c1760415c ("btrfs: Validate child tree block's level and first key") has made tree block level check mandatory. So if tree block level doesn't match, we won't get a valid extent buffer. The extra WARN_ON() check can be removed completely. Reviewed-by: Nikolay Borisov Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 98ff7b94e4daca8d7ea4352a9a7905cced597a4c Author: Qu Wenruo Date: Fri Sep 21 15:20:29 2018 +0800 btrfs: relocation: Cleanup while loop using rbtree_postorder_for_each_entry_safe And add one line comment explaining what we're doing for each loop. Reviewed-by: Nikolay Borisov Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3628b4ca64f24a4ec55055597d0cb1c814729f8b Author: Qu Wenruo Date: Tue Oct 9 14:36:45 2018 +0800 btrfs: qgroup: Avoid calling qgroup functions if qgroup is not enabled Some qgroup trace events like btrfs_qgroup_release_data() and btrfs_qgroup_free_delayed_ref() can still be triggered even if qgroup is not enabled. This is caused by the lack of qgroup status check before calling some qgroup functions. Thankfully the functions can handle quota disabled case well and just do nothing for qgroup disabled case. This patch will do earlier check before triggering related trace events. And for enabled <-> disabled race case: 1) For enabled->disabled case Disable will wipe out all qgroups data including reservation and excl/rfer. Even if we leak some reservation or numbers, it will still be cleared, so nothing will go wrong. 2) For disabled -> enabled case Current btrfs_qgroup_release_data() will use extent_io tree to ensure we won't underflow reservation. And for delayed_ref we use head->qgroup_reserved to record the reserved space, so in that case head->qgroup_reserved should be 0 and we won't underflow. CC: stable@vger.kernel.org # 4.14+ Reported-by: Chris Murphy Link: https://lore.kernel.org/linux-btrfs/CAJCQCtQau7DtuUUeycCkZ36qjbKuxNzsgqJ7+sJ6W0dK_NLE3w@mail.gmail.com/ Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0f375eed92b5a407657532637ed9652611a682f5 Author: Filipe Manana Date: Tue Oct 9 15:05:29 2018 +0100 Btrfs: fix wrong dentries after fsync of file that got its parent replaced In a scenario like the following: mkdir /mnt/A # inode 258 mkdir /mnt/B # inode 259 touch /mnt/B/bar # inode 260 sync mv /mnt/B/bar /mnt/A/bar mv -T /mnt/A /mnt/B fsync /mnt/B/bar After replaying the log we end up with file bar having 2 hard links, both with the name 'bar' and one in the directory with inode number 258 and the other in the directory with inode number 259. Also, we end up with the directory inode 259 still existing and with the directory inode 258 still named as 'A', instead of 'B'. In this scenario, file 'bar' should only have one hard link, located at directory inode 258, the directory inode 259 should not exist anymore and the name for directory inode 258 should be 'B'. This incorrect behaviour happens because when attempting to log the old parents of an inode, we skip any parents that no longer exist. Fix this by forcing a full commit if an old parent no longer exists. A test case for fstests follows soon. CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit f2d72f42d5fa3bf33761d9e47201745f624fcff5 Author: Filipe Manana Date: Mon Oct 8 11:12:55 2018 +0100 Btrfs: fix warning when replaying log after fsync of a tmpfile When replaying a log which contains a tmpfile (which necessarily has a link count of 0) we end up calling inc_nlink(), at fs/btrfs/tree-log.c:replay_one_buffer(), which produces a warning like the following: [195191.943673] WARNING: CPU: 0 PID: 6924 at fs/inode.c:342 inc_nlink+0x33/0x40 [195191.943723] CPU: 0 PID: 6924 Comm: mount Not tainted 4.19.0-rc6-btrfs-next-38 #1 [195191.943724] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.2-0-gf9626ccb91-prebuilt.qemu-project.org 04/01/2014 [195191.943726] RIP: 0010:inc_nlink+0x33/0x40 [195191.943728] RSP: 0018:ffffb96e425e3870 EFLAGS: 00010246 [195191.943730] RAX: 0000000000000000 RBX: ffff8c0d1e6af4f0 RCX: 0000000000000006 [195191.943731] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8c0d1e6af4f0 [195191.943731] RBP: 0000000000000097 R08: 0000000000000001 R09: 0000000000000000 [195191.943732] R10: 0000000000000000 R11: 0000000000000000 R12: ffffb96e425e3a60 [195191.943733] R13: ffff8c0d10cff0c8 R14: ffff8c0d0d515348 R15: ffff8c0d78a1b3f8 [195191.943735] FS: 00007f570ee24480(0000) GS:ffff8c0dfb200000(0000) knlGS:0000000000000000 [195191.943736] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [195191.943737] CR2: 00005593286277c8 CR3: 00000000bb8f2006 CR4: 00000000003606f0 [195191.943739] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [195191.943740] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [195191.943741] Call Trace: [195191.943778] replay_one_buffer+0x797/0x7d0 [btrfs] [195191.943802] walk_up_log_tree+0x1c1/0x250 [btrfs] [195191.943809] ? rcu_read_lock_sched_held+0x3f/0x70 [195191.943825] walk_log_tree+0xae/0x1d0 [btrfs] [195191.943840] btrfs_recover_log_trees+0x1d7/0x4d0 [btrfs] [195191.943856] ? replay_dir_deletes+0x280/0x280 [btrfs] [195191.943870] open_ctree+0x1c3b/0x22a0 [btrfs] [195191.943887] btrfs_mount_root+0x6b4/0x800 [btrfs] [195191.943894] ? rcu_read_lock_sched_held+0x3f/0x70 [195191.943899] ? pcpu_alloc+0x55b/0x7c0 [195191.943906] ? mount_fs+0x3b/0x140 [195191.943908] mount_fs+0x3b/0x140 [195191.943912] ? __init_waitqueue_head+0x36/0x50 [195191.943916] vfs_kern_mount+0x62/0x160 [195191.943927] btrfs_mount+0x134/0x890 [btrfs] [195191.943936] ? rcu_read_lock_sched_held+0x3f/0x70 [195191.943938] ? pcpu_alloc+0x55b/0x7c0 [195191.943943] ? mount_fs+0x3b/0x140 [195191.943952] ? btrfs_remount+0x570/0x570 [btrfs] [195191.943954] mount_fs+0x3b/0x140 [195191.943956] ? __init_waitqueue_head+0x36/0x50 [195191.943960] vfs_kern_mount+0x62/0x160 [195191.943963] do_mount+0x1f9/0xd40 [195191.943967] ? memdup_user+0x4b/0x70 [195191.943971] ksys_mount+0x7e/0xd0 [195191.943974] __x64_sys_mount+0x21/0x30 [195191.943977] do_syscall_64+0x60/0x1b0 [195191.943980] entry_SYSCALL_64_after_hwframe+0x49/0xbe [195191.943983] RIP: 0033:0x7f570e4e524a [195191.943986] RSP: 002b:00007ffd83589478 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [195191.943989] RAX: ffffffffffffffda RBX: 0000563f335b2060 RCX: 00007f570e4e524a [195191.943990] RDX: 0000563f335b2240 RSI: 0000563f335b2280 RDI: 0000563f335b2260 [195191.943992] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000020 [195191.943993] R10: 00000000c0ed0000 R11: 0000000000000206 R12: 0000563f335b2260 [195191.943994] R13: 0000563f335b2240 R14: 0000000000000000 R15: 00000000ffffffff [195191.944002] irq event stamp: 8688 [195191.944010] hardirqs last enabled at (8687): [] console_unlock+0x503/0x640 [195191.944012] hardirqs last disabled at (8688): [] trace_hardirqs_off_thunk+0x1a/0x1c [195191.944018] softirqs last enabled at (8638): [] __set_page_dirty_nobuffers+0x101/0x150 [195191.944020] softirqs last disabled at (8634): [] wb_wakeup_delayed+0x2e/0x60 [195191.944022] ---[ end trace 5d6e873a9a0b811a ]--- This happens because the inode does not have the flag I_LINKABLE set, which is a runtime only flag, not meant to be persisted, set when the inode is created through open(2) if the flag O_EXCL is not passed to it. Except for the warning, there are no other consequences (like corruptions or metadata inconsistencies). Since it's pointless to replay a tmpfile as it would be deleted in a later phase of the log replay procedure (it has a link count of 0), fix this by not logging tmpfiles and if a tmpfile is found in a log (created by a kernel without this change), skip the replay of the inode. A test case for fstests follows soon. Fixes: 471d557afed1 ("Btrfs: fix loss of prealloc extents past i_size after fsync log replay") CC: stable@vger.kernel.org # 4.18+ Reported-by: Martin Steigerwald Link: https://lore.kernel.org/linux-btrfs/3666619.NTnn27ZJZE@merkaba/ Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit ad80cf50c3f09a88eed918feeb95edaaf8d72b0a Author: Josef Bacik Date: Fri Sep 28 07:18:19 2018 -0400 btrfs: drop min_size from evict_refill_and_join We don't need it, rsv->size is set once and never changes throughout its lifetime, so just use that for the reserve size. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit e187831e1875b2754a3ba3c683bd277d4a5f7be8 Author: Josef Bacik Date: Fri Sep 28 07:18:03 2018 -0400 btrfs: assert on non-empty delayed iputs I ran into an issue where there was some reference being held on an inode that I couldn't track. This assert wasn't triggered, but it at least rules out we're doing something stupid. Reviewed-by: Omar Sandoval Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 545e3366db823dc3342ca9d7fea803f829c9062f Author: Josef Bacik Date: Fri Sep 28 07:18:02 2018 -0400 btrfs: make sure we create all new block groups Allocating new chunks modifies both the extent and chunk tree, which can trigger new chunk allocations. So instead of doing list_for_each_safe, just do while (!list_empty()) so we make sure we don't exit with other pending bg's still on our list. CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Omar Sandoval Reviewed-by: Liu Bo Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 553cceb49681d60975d00892877d4c871bf220f9 Author: Josef Bacik Date: Fri Sep 28 07:18:00 2018 -0400 btrfs: reset max_extent_size on clear in a bitmap We need to clear the max_extent_size when we clear bits from a bitmap since it could have been from the range that contains the max_extent_size. CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Liu Bo Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit 84de76a2fb217dc1b6bc2965cc397d1648aa1404 Author: Josef Bacik Date: Fri Sep 28 07:17:49 2018 -0400 btrfs: protect space cache inode alloc with GFP_NOFS If we're allocating a new space cache inode it's likely going to be under a transaction handle, so we need to use memalloc_nofs_save() in order to avoid deadlocks, and more importantly lockdep messages that make xfstests fail. CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Omar Sandoval Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit f45c752b65af46bf42963295c332865d95f97fff Author: Josef Bacik Date: Fri Sep 28 07:17:48 2018 -0400 btrfs: release metadata before running delayed refs We want to release the unused reservation we have since it refills the delayed refs reserve, which will make everything go smoother when running the delayed refs if we're short on our reservation. CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Omar Sandoval Reviewed-by: Liu Bo Reviewed-by: Nikolay Borisov Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit 523983401644ebeb331c923c28c9591c07430a7d Author: Liu Bo Date: Wed Aug 22 05:54:37 2018 +0800 Btrfs: kill btrfs_clear_path_blocking Btrfs's btree locking has two modes, spinning mode and blocking mode, while searching btree, locking is always acquired in spinning mode and then converted to blocking mode if necessary, and in some hot paths we may switch the locking back to spinning mode by btrfs_clear_path_blocking(). When acquiring locks, both of reader and writer need to wait for blocking readers and writers to complete before doing read_lock()/write_lock(). The problem is that btrfs_clear_path_blocking() needs to switch nodes in the path to blocking mode at first (by btrfs_set_path_blocking) to make lockdep happy before doing its actual clearing blocking job. When switching to blocking mode from spinning mode, it consists of step 1) bumping up blocking readers counter and step 2) read_unlock()/write_unlock(), this has caused serious ping-pong effect if there're a great amount of concurrent readers/writers, as waiters will be woken up and go to sleep immediately. 1) Killing this kind of ping-pong results in a big improvement in my 1600k files creation script, MNT=/mnt/btrfs mkfs.btrfs -f /dev/sdf mount /dev/def $MNT time fsmark -D 10000 -S0 -n 100000 -s 0 -L 1 -l /tmp/fs_log.txt \ -d $MNT/0 -d $MNT/1 \ -d $MNT/2 -d $MNT/3 \ -d $MNT/4 -d $MNT/5 \ -d $MNT/6 -d $MNT/7 \ -d $MNT/8 -d $MNT/9 \ -d $MNT/10 -d $MNT/11 \ -d $MNT/12 -d $MNT/13 \ -d $MNT/14 -d $MNT/15 w/o patch: real 2m27.307s user 0m12.839s sys 13m42.831s w/ patch: real 1m2.273s user 0m15.802s sys 8m16.495s 1.1) latency histogram from funclatency[1] Overall with the patch, there're ~50% less write lock acquisition and the 95% max latency that write lock takes also reduces to ~100ms from >500ms. -------------------------------------------- w/o patch: -------------------------------------------- Function = btrfs_tree_lock msecs : count distribution 0 -> 1 : 2385222 |****************************************| 2 -> 3 : 37147 | | 4 -> 7 : 20452 | | 8 -> 15 : 13131 | | 16 -> 31 : 3877 | | 32 -> 63 : 3900 | | 64 -> 127 : 2612 | | 128 -> 255 : 974 | | 256 -> 511 : 165 | | 512 -> 1023 : 13 | | Function = btrfs_tree_read_lock msecs : count distribution 0 -> 1 : 6743860 |****************************************| 2 -> 3 : 2146 | | 4 -> 7 : 190 | | 8 -> 15 : 38 | | 16 -> 31 : 4 | | -------------------------------------------- w/ patch: -------------------------------------------- Function = btrfs_tree_lock msecs : count distribution 0 -> 1 : 1318454 |****************************************| 2 -> 3 : 6800 | | 4 -> 7 : 3664 | | 8 -> 15 : 2145 | | 16 -> 31 : 809 | | 32 -> 63 : 219 | | 64 -> 127 : 10 | | Function = btrfs_tree_read_lock msecs : count distribution 0 -> 1 : 6854317 |****************************************| 2 -> 3 : 2383 | | 4 -> 7 : 601 | | 8 -> 15 : 92 | | 2) dbench also proves the improvement, dbench -t 120 -D /mnt/btrfs 16 w/o patch: Throughput 158.363 MB/sec w/ patch: Throughput 449.52 MB/sec 3) xfstests didn't show any additional failures. One thing to note is that callers may set path->leave_spinning to have all nodes in the path stay in spinning mode, which means callers are ready to not sleep before releasing the path, but it won't cause problems if they don't want to sleep in blocking mode. [1]: https://github.com/iovisor/bcc/blob/master/tools/funclatency.py Signed-off-by: Liu Bo Signed-off-by: David Sterba commit 9b142115ed3593480b813a9331593e9f199da340 Author: David Sterba Date: Thu Apr 5 01:19:50 2018 +0200 btrfs: dev-replace: remove pointless assert in write unlock The value of blocking_readers is increased only when the lock is taken for read, no way we can fail the condition with the write lock. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit 7f8d236ae132a8886a0186008c828e21f7460474 Author: David Sterba Date: Thu Apr 5 01:04:49 2018 +0200 btrfs: dev-replace: move replace members out of fs_info The replace_wait and bio_counter were mistakenly added to fs_info in commit c404e0dc2c843b154f ("Btrfs: fix use-after-free in the finishing procedure of the device replace"), but they logically belong to fs_info::dev_replace. Besides, bio_counter is a very generic name and is confusing in bare fs_info context. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit aa144bfeaa7f87c536ab323edfe2692285343e68 Author: David Sterba Date: Fri Aug 24 17:44:05 2018 +0200 btrfs: dev-replace: avoid useless lock on error handling path The exit sequence in btrfs_dev_replace_start does not allow to simply add a label to the right place so the error handling after starting transaction failure jumps there. Currently there's a lock that pairs with the unlock in the section, which is unnecessary and only raises questions. Add a variable to track the locking status and avoid the extra locking. Reviewed-by: Omar Sandoval Reviewed-by: Anand Jain Signed-off-by: David Sterba commit 9f6cbcbb09d0f2a73ccb9998f6ac34606da9c938 Author: David Sterba Date: Fri Aug 24 17:41:17 2018 +0200 btrfs: open code btrfs_after_dev_replace_commit Too trivial, the purpose can be simply documented in a comment. Reviewed-by: Omar Sandoval Reviewed-by: Anand Jain Signed-off-by: David Sterba commit e37abe9725bf45b292d5653cc02bbd791773c205 Author: David Sterba Date: Wed Apr 4 17:20:52 2018 +0200 btrfs: open code btrfs_dev_replace_stats_inc The wrapper is too trivial, open coding does not make it less readable. Reviewed-by: Omar Sandoval Reviewed-by: Anand Jain Signed-off-by: David Sterba commit 7fb2eced105f67676eb86473d5b1ce6a96f6eab4 Author: David Sterba Date: Fri Aug 24 17:33:58 2018 +0200 btrfs: open code btrfs_dev_replace_clear_lock_blocking There's a single caller and the function name does not say it's actually taking the lock, so open coding makes it more explicit. For now, btrfs_dev_replace_read_lock is used instead of read_lock so it's paired with the unlocking wrapper in the same block. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit 3280f874576d31b03fe19cbcc23585d96feb4ceb Author: David Sterba Date: Fri Aug 24 17:32:29 2018 +0200 btrfs: remove btrfs_dev_replace::read_locks This member seems to be copied from the extent_buffer locking scheme and is at least used to assert that the read lock/unlock is properly nested. In some way. While the _inc/_dec are called inside the read lock section, the asserts are both inside and outside, so the ordering is not guaranteed and we can see read/inc/dec ordered in any way (theoretically). A missing call of btrfs_dev_replace_clear_lock_blocking could cause unexpected read_locks count, so this at least looks like a valid assertion, but this will become unnecessary with later updates. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit f556faa46eb4e96d0d0772e74ecf66781e132f72 Author: Qu Wenruo Date: Fri Sep 28 07:59:34 2018 +0800 btrfs: tree-checker: Check level for leaves and nodes Although we have tree level check at tree read runtime, it's completely based on its parent level. We still need to do accurate level check to avoid invalid tree blocks sneak into kernel space. The check itself is simple, for leaf its level should always be 0. For nodes its level should be in range [1, BTRFS_MAX_LEVEL - 1]. Signed-off-by: Qu Wenruo Reviewed-by: Su Yue Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3d0174f78e72301324a5b0ba7d67676474e36fff Author: Qu Wenruo Date: Thu Sep 27 14:42:35 2018 +0800 btrfs: qgroup: Only trace data extents in leaves if we're relocating data block group For qgroup_trace_extent_swap(), if we find one leaf that needs to be traced, we will also iterate all file extents and trace them. This is OK if we're relocating data block groups, but if we're relocating metadata block groups, balance code itself has ensured that both subtree of file tree and reloc tree contain the same contents. That's to say, if we're relocating metadata block groups, all file extents in reloc and file tree should match, thus no need to trace them. This should reduce the total number of dirty extents processed in metadata block group balance. [[Benchmark]] (with all previous enhancement) Hardware: VM 4G vRAM, 8 vCPUs, disk is using 'unsafe' cache mode, backing device is SAMSUNG 850 evo SSD. Host has 16G ram. Mkfs parameter: --nodesize 4K (To bump up tree size) Initial subvolume contents: 4G data copied from /usr and /lib. (With enough regular small files) Snapshots: 16 snapshots of the original subvolume. each snapshot has 3 random files modified. balance parameter: -m So the content should be pretty similar to a real world root fs layout. | v4.19-rc1 | w/ patchset | diff (*) --------------------------------------------------------------- relocated extents | 22929 | 22851 | -0.3% qgroup dirty extents | 227757 | 140886 | -38.1% time (sys) | 65.253s | 37.464s | -42.6% time (real) | 74.032s | 44.722s | -39.6% Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 2cd86d309bd1203241ceb833effe90787f3564a1 Author: Qu Wenruo Date: Thu Sep 27 14:42:33 2018 +0800 btrfs: qgroup: Don't trace subtree if we're dropping reloc tree Reloc tree doesn't contribute to qgroup numbers, as we have accounted them at balance time (see replace_path()). Skipping the unneeded subtree tracing should reduce the overhead. [[Benchmark]] Hardware: VM 4G vRAM, 8 vCPUs, disk is using 'unsafe' cache mode, backing device is SAMSUNG 850 evo SSD. Host has 16G ram. Mkfs parameter: --nodesize 4K (To bump up tree size) Initial subvolume contents: 4G data copied from /usr and /lib. (With enough regular small files) Snapshots: 16 snapshots of the original subvolume. each snapshot has 3 random files modified. balance parameter: -m So the content should be pretty similar to a real world root fs layout. | v4.19-rc1 | w/ patchset | diff (*) --------------------------------------------------------------- relocated extents | 22929 | 22900 | -0.1% qgroup dirty extents | 227757 | 167139 | -26.6% time (sys) | 65.253s | 50.123s | -23.2% time (real) | 74.032s | 52.551s | -29.0% Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 5f527822be40104e9056c981ff06c7750153a10a Author: Qu Wenruo Date: Thu Sep 27 14:42:32 2018 +0800 btrfs: qgroup: Use generation-aware subtree swap to mark dirty extents Before this patch, with quota enabled during balance, we need to mark the whole subtree dirty for quota. E.g. OO = Old tree blocks (from file tree) NN = New tree blocks (from reloc tree) File tree (src) Reloc tree (dst) OO (a) NN (a) / \ / \ (b) OO OO (c) (b) NN NN (c) / \ / \ / \ / \ OO OO OO OO (d) OO OO OO NN (d) For old balance + quota case, quota will mark the whole src and dst tree dirty, including all the 3 old tree blocks in reloc tree. It's doable for small file tree or new tree blocks are all located at lower level. But for large file tree or new tree blocks are all located at higher level, this will lead to mark the whole tree dirty, and be unbelievably slow. This patch will change how we handle such balance with quota enabled case. Now we will search from (b) and (c) for any new tree blocks whose generation is equal to @last_snapshot, and only mark them dirty. In above case, we only need to trace tree blocks NN(b), NN(c) and NN(d). (NN(a) will be traced when COW happens for nodeptr modification). And also for tree blocks OO(b), OO(c), OO(d). (OO(a) will be traced when COW happens for nodeptr modification.) For above case, we could skip 3 tree blocks, but for larger tree, we can skip tons of unmodified tree blocks, and hugely speed up balance. This patch will introduce a new function, btrfs_qgroup_trace_subtree_swap(), which will do the following main work: 1) Read out real root eb And setup basic dst_path for later calls 2) Call qgroup_trace_new_subtree_blocks() To trace all new tree blocks in reloc tree and their counter parts in the file tree. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit ea49f3e73c4b7252c1569906c1b2cd54605af3c9 Author: Qu Wenruo Date: Thu Sep 27 14:42:31 2018 +0800 btrfs: qgroup: Introduce function to find all new tree blocks of reloc tree Introduce new function, qgroup_trace_new_subtree_blocks(), to iterate all new tree blocks in a reloc tree. So that qgroup could skip unrelated tree blocks during balance, which should hugely speedup balance speed when quota is enabled. The function qgroup_trace_new_subtree_blocks() itself only cares about new tree blocks in reloc tree. All its main works are: 1) Read out tree blocks according to parent pointers 2) Do recursive depth-first search Will call the same function on all its children tree blocks, with search level set to current level -1. And will also skip all children whose generation is smaller than @last_snapshot. 3) Call qgroup_trace_extent_swap() to trace tree blocks So although we have parameter list related to source file tree, it's not used at all, but only passed to qgroup_trace_extent_swap(). Thus despite the tree read code, the core should be pretty short and all about recursive depth-first search. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 25982561db7f43f29305704f9f24ff36ea7d5671 Author: Qu Wenruo Date: Thu Sep 27 14:42:30 2018 +0800 btrfs: qgroup: Introduce function to trace two swaped extents Introduce a new function, qgroup_trace_extent_swap(), which will be used later for balance qgroup speedup. The basis idea of balance is swapping tree blocks between reloc tree and the real file tree. The swap will happen in highest tree block, but there may be a lot of tree blocks involved. For example: OO = Old tree blocks NN = New tree blocks allocated during balance File tree (257) Reloc tree for 257 L2 OO NN / \ / \ L1 OO OO (a) OO NN (a) / \ / \ / \ / \ L0 OO OO OO OO OO OO NN NN (b) (c) (b) (c) When calling qgroup_trace_extent_swap(), we will pass: @src_eb = OO(a) @dst_path = [ nodes[1] = NN(a), nodes[0] = NN(c) ] @dst_level = 0 @root_level = 1 In that case, qgroup_trace_extent_swap() will search from OO(a) to reach OO(c), then mark both OO(c) and NN(c) as qgroup dirty. The main work of qgroup_trace_extent_swap() can be split into 3 parts: 1) Tree search from @src_eb It should acts as a simplified btrfs_search_slot(). The key for search can be extracted from @dst_path->nodes[dst_level] (first key). 2) Mark the final tree blocks in @src_path and @dst_path qgroup dirty NOTE: In above case, OO(a) and NN(a) won't be marked qgroup dirty. They should be marked during preivous (@dst_level = 1) iteration. 3) Mark file extents in leaves dirty We don't have good way to pick out new file extents only. So we still follow the old method by scanning all file extents in the leave. This function can free us from keeping two pathes, thus later we only need to care about how to iterate all new tree blocks in reloc tree. Signed-off-by: Qu Wenruo [ copy changelog to function comment ] Signed-off-by: David Sterba commit c337e7b02f71c4b2f6f2138807a284d2c4e1ac5e Author: Qu Wenruo Date: Thu Sep 27 14:42:29 2018 +0800 btrfs: qgroup: Introduce trace event to analyse the number of dirty extents accounted Number of qgroup dirty extents is directly linked to the performance overhead, so add a new trace event, trace_qgroup_num_dirty_extents(), to record how many dirty extents is processed in btrfs_qgroup_account_extents(). This will be pretty handy to analyze later balance performance improvement. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit fa6ac71524f206c33accfc12294fd35e17478fe0 Author: Qu Wenruo Date: Tue Sep 25 14:37:46 2018 +0800 btrfs: relocation: Add basic extent backref related comments for build_backref_tree fs/btrfs/relocation.c:build_backref_tree() is some code from 2009 era, although it works pretty fine, it's not that easy to understand. Especially combined with the complex btrfs backref format. This patch adds some basic comment for the backref build part of the code, making it less hard to read, at least for backref searching part. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 4779cc04248deff676c56ff9f3b2c679388a7d5e Author: Omar Sandoval Date: Mon Sep 24 15:16:55 2018 -0700 Btrfs: get rid of btrfs_symlink_aops The only aops we define for symlinks are identical to the aops for regular files. This has been the case since symlink support was added in commit 2b8d99a723a3 ("Btrfs: symlinks and hard links"). As far as I can tell, there wasn't a good reason to have separate aops then, and there isn't now, so let's just do what most other filesystems do and reuse the same structure. Signed-off-by: Omar Sandoval Reviewed-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7703bdd8d23e6ef057af3253958a793ec6066b28 Author: Chris Mason Date: Wed Jun 20 07:56:11 2018 -0700 Btrfs: don't clean dirty pages during buffered writes During buffered writes, we follow this basic series of steps: again: lock all the pages wait for writeback on all the pages Take the extent range lock wait for ordered extents on the whole range clean all the pages if (copy_from_user_in_atomic() hits a fault) { drop our locks goto again; } dirty all the pages release all the locks The extra waiting, cleaning and locking are there to make sure we don't modify pages in flight to the drive, after they've been crc'd. If some of the pages in the range were already dirty when the write began, and we need to goto again, we create a window where a dirty page has been cleaned and unlocked. It may be reclaimed before we're able to lock it again, which means we'll read the old contents off the drive and lose any modifications that had been pending writeback. We don't actually need to clean the pages. All of the other locking in place makes sure we don't start IO on the pages, so we can just leave them dirty for the duration of the write. Fixes: 73d59314e6ed (the original btrfs merge) CC: stable@vger.kernel.org # v4.4+ Signed-off-by: Chris Mason Reviewed-by: David Sterba Signed-off-by: David Sterba commit 818255feece6e2a432328020d78c8a81a153ce65 Author: David Sterba Date: Fri Sep 21 14:26:34 2018 +0200 btrfs: use common helper instead of open coding a bit test The helper does the same math and we take care about the special case when flags is 0 too. Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit 0110a4c43451533de1ea1bbdc57b5d452f9d8b25 Author: Nikolay Borisov Date: Wed Aug 15 10:39:56 2018 +0300 btrfs: refactor __btrfs_run_delayed_refs loop Refactor the delayed refs loop by using the newly introduced btrfs_run_delayed_refs_for_head function. This greatly simplifies __btrfs_run_delayed_refs and makes it more obvious what is happening. We now have 1 loop which iterates the existing delayed_heads and then each selected ref head is processed by the new helper. All existing semantics of the code are preserved so no functional changes. Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit e726138676f896146a55a98305665e81d34d038c Author: Nikolay Borisov Date: Wed Aug 15 10:39:55 2018 +0300 btrfs: Factor out loop processing all refs of a head This patch introduces a new helper encompassing the implicit inner loop in __btrfs_run_delayed_refs which processes all the refs for a given head. The code is mostly copy/paste, the only difference is that if we detect a newer reference then -EAGAIN is returned so that callers can react correctly. Also, at the end of the loop the head is relocked and btrfs_merge_delayed_refs is run again to retain the pre-refactoring semantics. Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit b1cdbcb53a6edd84d50b72117d49a350575bbe6a Author: Nikolay Borisov Date: Wed Aug 15 10:39:54 2018 +0300 btrfs: Factor out ref head locking code in __btrfs_run_delayed_refs This is in preparation to refactor the giant loop in __btrfs_run_delayed_refs. As a first step define a new function which implements acquiring a reference to a btrfs_delayed_refs_head and use it. No functional changes. Signed-off-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit b2fa11547bc1693a8dd8e7379dd4e43d31f49c50 Author: David Sterba Date: Fri Aug 17 17:48:13 2018 +0200 btrfs: tests: polish ifdefs around testing helper Avoid the inline ifdefs and use two sections for self-tests enabled and disabled. Though there could be no ifdef and unconditional test_bit of BTRFS_FS_STATE_DUMMY_FS_INFO, the static inline can help to optimize out any code that would depend on conditions using btrfs_is_testing. As this is only for the testing code, drop unlikely(). Reviewed-by: Omar Sandoval Signed-off-by: David Sterba commit a654666a3474312ee76aa2bb9744376a46da3307 Author: David Sterba Date: Fri Aug 17 17:44:13 2018 +0200 btrfs: tests: group declarations of self-test helpers Reviewed-by: Omar Sandoval Signed-off-by: David Sterba commit 57ec5fb478a3c27073ebc8f8f47a91eaaa083c13 Author: David Sterba Date: Fri Aug 17 17:38:12 2018 +0200 btrfs: tests: move testing members of struct btrfs_root to the end The data used only for tests are better placed at the end of the structure so that they don't change the structure layout. All new members of btrfs_root should be placed before. Reviewed-by: Omar Sandoval Signed-off-by: David Sterba commit 9c36396c2a788facd4282a2b0646a1c4ac19847a Author: David Sterba Date: Fri Aug 17 17:28:06 2018 +0200 btrfs: tests: add separate stub for find_lock_delalloc_range The helper find_lock_delalloc_range is now conditionally built static, dpending on whether the self-tests are enabled or not. There's a macro that is supposed to hide the export, used only once. To discourage further use, drop it an add a public wrapper for the helper needed by tests. Reviewed-by: Omar Sandoval Signed-off-by: David Sterba commit ecf160b424ee648a14116079ff72d7d1241e377d Author: Liu Bo Date: Thu Aug 23 03:51:53 2018 +0800 Btrfs: preftree: use rb_first_cached rb_first_cached() trades an extra pointer "leftmost" for doing the same job as rb_first() but in O(1). While resolving indirect refs and missing refs, it always looks for the first rb entry in a while loop, it's helpful to use rb_first_cached instead. For more details about the optimization see patch "Btrfs: delayed-refs: use rb_first_cached for href_root". Tested-by: Holger Hoffstätte Signed-off-by: Liu Bo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 07e1ce096db3605f3e0c98695df66a51e2be9f05 Author: Liu Bo Date: Thu Aug 23 03:51:52 2018 +0800 Btrfs: extent_map: use rb_first_cached rb_first_cached() trades an extra pointer "leftmost" for doing the same job as rb_first() but in O(1). As evict_inode_truncate_pages() removes all extent mapping by always looking for the first rb entry, it's helpful to use rb_first_cached instead. For more details about the optimization see patch "Btrfs: delayed-refs: use rb_first_cached for href_root". Tested-by: Holger Hoffstätte Signed-off-by: Liu Bo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 03a1d4c891634dd5b98da865fb783e8b22d4d027 Author: Liu Bo Date: Thu Aug 23 03:51:51 2018 +0800 Btrfs: delayed-inode: use rb_first_cached for ins_root and del_root rb_first_cached() trades an extra pointer "leftmost" for doing the same job as rb_first() but in O(1). Functions manipulating delayed_item need to get the first entry, this converts it to use rb_first_cached(). For more details about the optimization see patch "Btrfs: delayed-refs: use rb_first_cached for href_root". Tested-by: Holger Hoffstätte Signed-off-by: Liu Bo Reviewed-by: David Sterba Signed-off-by: David Sterba commit e3d039656384288bbe952413d8d404b3035fe7d7 Author: Liu Bo Date: Thu Aug 23 03:51:50 2018 +0800 Btrfs: delayed-refs: use rb_first_cached for ref_tree rb_first_cached() trades an extra pointer "leftmost" for doing the same job as rb_first() but in O(1). Functions manipulating href->ref_tree need to get the first entry, this converts href->ref_tree to use rb_first_cached(). For more details about the optimization see patch "Btrfs: delayed-refs: use rb_first_cached for href_root". Tested-by: Holger Hoffstätte Signed-off-by: Liu Bo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5c9d028b3b174e5cf3678a7b0c14e21e51665793 Author: Liu Bo Date: Thu Aug 23 03:51:49 2018 +0800 Btrfs: delayed-refs: use rb_first_cached for href_root rb_first_cached() trades an extra pointer "leftmost" for doing the same job as rb_first() but in O(1). Functions manipulating href_root need to get the first entry, this converts href_root to use rb_first_cached(). This patch is first in the sequenct of similar updates to other rbtrees and this is analysis of the expected behaviour and improvements. There's a common pattern: while (node = rb_first) { entry = rb_entry(node) next = rb_next(node) rb_erase(node) cleanup(entry) } rb_first needs to traverse the tree up to logN depth, rb_erase can completely reshuffle the tree. With the caching we'll skip the traversal in rb_first. That's a cached memory access vs looped pointer dereference trade-off that IMHO has a clear winner. Measurements show there's not much difference in a sample tree with 10000 nodes: 4.5s / rb_first and 4.8s / rb_first_cached. Real effects of caching and pointer chasing are unpredictable though. Further optimzations can be done to avoid the expensive rb_erase step. In some cases it's ok to process the nodes in any order, so the tree can be traversed in post-order, not rebalancing the children nodes and just calling free. Care must be taken regarding the next node. Tested-by: Holger Hoffstätte Signed-off-by: Liu Bo Reviewed-by: David Sterba [ update changelog from mail discussions ] Signed-off-by: David Sterba commit 3aa7c7a31c26321696b92841d5103461c6f3f517 Author: Josef Bacik Date: Wed Sep 12 10:45:45 2018 -0400 btrfs: wait on caching when putting the bg cache While testing my backport I noticed there was a panic if I ran generic/416 generic/417 generic/418 all in a row. This just happened to uncover a race where we had outstanding IO after we destroy all of our workqueues, and then we'd go to queue the endio work on those free'd workqueues. This is because we aren't waiting for the caching threads to be done before freeing everything up, so to fix this make sure we wait on any outstanding caching that's being done before we free up the block group, so we're sure to be done with all IO by the time we get to btrfs_stop_all_workers(). This fixes the panic I was seeing consistently in testing. ------------[ cut here ]------------ kernel BUG at fs/btrfs/volumes.c:6112! SMP PTI Modules linked in: CPU: 1 PID: 27165 Comm: kworker/u4:7 Not tainted 4.16.0-02155-g3553e54a578d-dirty #875 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 Workqueue: btrfs-cache btrfs_cache_helper RIP: 0010:btrfs_map_bio+0x346/0x370 RSP: 0000:ffffc900061e79d0 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffff880071542e00 RCX: 0000000000533000 RDX: ffff88006bb74380 RSI: 0000000000000008 RDI: ffff880078160000 RBP: 0000000000000001 R08: ffff8800781cd200 R09: 0000000000503000 R10: ffff88006cd21200 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: ffff8800781cd200 R15: ffff880071542e00 FS: 0000000000000000(0000) GS:ffff88007fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000817ffc4 CR3: 0000000078314000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: btree_submit_bio_hook+0x8a/0xd0 submit_one_bio+0x5d/0x80 read_extent_buffer_pages+0x18a/0x320 btree_read_extent_buffer_pages+0xbc/0x200 ? alloc_extent_buffer+0x359/0x3e0 read_tree_block+0x3d/0x60 read_block_for_search.isra.30+0x1a5/0x360 btrfs_search_slot+0x41b/0xa10 btrfs_next_old_leaf+0x212/0x470 caching_thread+0x323/0x490 normal_work_helper+0xc5/0x310 process_one_work+0x141/0x340 worker_thread+0x44/0x3c0 kthread+0xf8/0x130 ? process_one_work+0x340/0x340 ? kthread_bind+0x10/0x10 ret_from_fork+0x35/0x40 RIP: btrfs_map_bio+0x346/0x370 RSP: ffffc900061e79d0 ---[ end trace 827eb13e50846033 ]--- Kernel panic - not syncing: Fatal exception Kernel Offset: disabled ---[ end Kernel panic - not syncing: Fatal exception CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Josef Bacik Reviewed-by: Omar Sandoval Signed-off-by: David Sterba commit fee7acc361314df6561208c2d3c0882d663dd537 Author: Jeff Mahoney Date: Thu Sep 6 17:18:16 2018 -0400 btrfs: keep trim from interfering with transaction commits Commit 499f377f49f08 (btrfs: iterate over unused chunk space in FITRIM) fixed free space trimming, but introduced latency when it was running. This is due to it pinning the transaction using both a incremented refcount and holding the commit root sem for the duration of a single trim operation. This was to ensure safety but it's unnecessary. We already hold the the chunk mutex so we know that the chunk we're using can't be allocated while we're trimming it. In order to check against chunks allocated already in this transaction, we need to check the pending chunks list. To to that safely without joining the transaction (or attaching than then having to commit it) we need to ensure that the dev root's commit root doesn't change underneath us and the pending chunk lists stays around until we're done with it. We can ensure the former by holding the commit root sem and the latter by pinning the transaction. We do this now, but the critical section covers the trim operation itself and we don't need to do that. This patch moves the pinning and unpinning logic into helpers and unpins the transaction after performing the search and check for pending chunks. Limiting the critical section of the transaction pinning improves the latency substantially on slower storage (e.g. image files over NFS). Fixes: 499f377f49f08 ("btrfs: iterate over unused chunk space in FITRIM") CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Jeff Mahoney Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0be88e367fd8fbdb45257615d691f4675dda062f Author: Jeff Mahoney Date: Thu Sep 6 17:18:15 2018 -0400 btrfs: don't attempt to trim devices that don't support it We check whether any device the file system is using supports discard in the ioctl call, but then we attempt to trim free extents on every device regardless of whether discard is supported. Due to the way we mask off EOPNOTSUPP, we can end up issuing the trim operations on each free range on devices that don't support it, just wasting time. Fixes: 499f377f49f08 ("btrfs: iterate over unused chunk space in FITRIM") CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Jeff Mahoney Reviewed-by: David Sterba Signed-off-by: David Sterba commit d4e329de5e5e21594df2e0dd59da9acee71f133b Author: Jeff Mahoney Date: Thu Sep 6 17:18:14 2018 -0400 btrfs: iterate all devices during trim, instead of fs_devices::alloc_list btrfs_trim_fs iterates over the fs_devices->alloc_list while holding the device_list_mutex. The problem is that ->alloc_list is protected by the chunk mutex. We don't want to hold the chunk mutex over the trim of the entire file system. Fortunately, the ->dev_list list is protected by the dev_list mutex and while it will give us all devices, including read-only devices, we already just skip the read-only devices. Then we can continue to take and release the chunk mutex while scanning each device. Fixes: 499f377f49f ("btrfs: iterate over unused chunk space in FITRIM") CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Jeff Mahoney Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6ba9fc8e628becf0e3ec94083450d089b0dec5f5 Author: Qu Wenruo Date: Fri Sep 7 14:16:24 2018 +0800 btrfs: Ensure btrfs_trim_fs can trim the whole filesystem [BUG] fstrim on some btrfs only trims the unallocated space, not trimming any space in existing block groups. [CAUSE] Before fstrim_range passed to btrfs_trim_fs(), it gets truncated to range [0, super->total_bytes). So later btrfs_trim_fs() will only be able to trim block groups in range [0, super->total_bytes). While for btrfs, any bytenr aligned to sectorsize is valid, since btrfs uses its logical address space, there is nothing limiting the location where we put block groups. For filesystem with frequent balance, it's quite easy to relocate all block groups and bytenr of block groups will start beyond super->total_bytes. In that case, btrfs will not trim existing block groups. [FIX] Just remove the truncation in btrfs_ioctl_fitrim(), so btrfs_trim_fs() can get the unmodified range, which is normally set to [0, U64_MAX]. Reported-by: Chris Murphy Fixes: f4c697e6406d ("btrfs: return EINVAL if start > total_bytes in fitrim ioctl") CC: # v4.4+ Signed-off-by: Qu Wenruo Reviewed-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 93bba24d4b5ad1e5cd8b43f64e66ff9d6355dd20 Author: Qu Wenruo Date: Fri Sep 7 14:16:23 2018 +0800 btrfs: Enhance btrfs_trim_fs function to handle error better Function btrfs_trim_fs() doesn't handle errors in a consistent way. If error happens when trimming existing block groups, it will skip the remaining blocks and continue to trim unallocated space for each device. The return value will only reflect the final error from device trimming. This patch will fix such behavior by: 1) Recording the last error from block group or device trimming The return value will also reflect the last error during trimming. Make developer more aware of the problem. 2) Continuing trimming if possible If we failed to trim one block group or device, we could still try the next block group or device. 3) Report number of failures during block group and device trimming It would be less noisy, but still gives user a brief summary of what's going wrong. Such behavior can avoid confusion for cases like failure to trim the first block group and then only unallocated space is trimmed. Reported-by: Chris Murphy CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Qu Wenruo Reviewed-by: David Sterba [ add bg_ret and dev_ret to the messages ] Signed-off-by: David Sterba commit 5c06147128fbbdf7a84232c5f0d808f53153defe Author: Jeff Mahoney Date: Thu Sep 6 15:52:17 2018 -0400 btrfs: fix error handling in btrfs_dev_replace_start When we fail to start a transaction in btrfs_dev_replace_start, we leave dev_replace->replace_start set to STARTED but clear ->srcdev and ->tgtdev. Later, that can result in an Oops in btrfs_dev_replace_progress when having state set to STARTED or SUSPENDED implies that ->srcdev is valid. Also fix error handling when the state is already STARTED or SUSPENDED while starting. That, too, will clear ->srcdev and ->tgtdev even though it doesn't own them. This should be an impossible case to hit since we should be protected by the BTRFS_FS_EXCL_OP bit being set. Let's add an ASSERT there while we're at it. Fixes: e93c89c1aaaaa (Btrfs: add new sources for device replace code) CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Jeff Mahoney Reviewed-by: David Sterba Signed-off-by: David Sterba commit c1766dd7829802b3a451682234497a8539763bd1 Author: zhong jiang Date: Thu Sep 13 11:01:15 2018 +0800 btrfs: change remove_extent_mapping to return void remove_extent_mapping uses the variable "ret" for return value, but it is not modified after initialzation. Further, I find that any of the callers do not handle the return value and the callees are only simple functions so the return values does not need to be passed. Signed-off-by: zhong jiang Reviewed-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 315bed43fea532650933e7bba316a7601d439edf Author: Nikolay Borisov Date: Thu Sep 13 11:35:10 2018 +0300 btrfs: handle error of get_old_root In btrfs_search_old_slot get_old_root is always used with the assumption it cannot fail. However, this is not true in rare circumstance it can fail and return null. This will lead to null point dereference when the header is read. Fix this by checking the return value and properly handling NULL by setting ret to -EIO and returning gracefully. Coverity-id: 1087503 Signed-off-by: Nikolay Borisov Reviewed-by: Lu Fengqi Reviewed-by: David Sterba Signed-off-by: David Sterba commit 28bee489828ca7da9f9a0247a3fbe695fc0df6b4 Author: Nikolay Borisov Date: Thu Sep 13 11:35:00 2018 +0300 btrfs: Remove logically dead code from btrfs_orphan_cleanup In btrfs_orphan_cleanup the final 'if (ret) goto out' cannot ever be executed. This is due to the last assignment to 'ret' depending on the return value of btrfs_iget. If an error other than -ENOENT is returned then the loop is prematurely terminated by 'goto out'. On the other hand, if the error value is ENOENT then a subsequent if branch is executed that always re-assigns 'ret' and in case it's an error just terminates the loop. No functional changes. Coverity-id: 1437392 Signed-off-by: Nikolay Borisov Reviewed-by: Lu Fengqi Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4183c52ce8871544ea94054ee47c685ecae714f6 Author: Liu Bo Date: Wed Sep 12 06:06:22 2018 +0800 Btrfs: remove wait_ordered_range in btrfs_evict_inode When we delete an inode, btrfs_evict_inode() { truncate_inode_pages_final() truncate_inode_pages_range() lock_page() truncate_cleanup_page() btrfs_invalidatepage() wait_on_page_writeback btrfs_lookup_ordered_range() cancel_dirty_page() unlock_page() ... btrfs_wait_ordered_range() ... As VFS has called ->invalidatepage() to get all ordered extents done (if there are any) and truncated all page cache pages (no dirty pages to writeback after this step), wait_ordered_range() is just a noop. Signed-off-by: Liu Bo Reviewed-by: David Sterba Signed-off-by: David Sterba commit abb57ef3ff9720c42bbc06bcd1788da9ce1a3eb8 Author: Liu Bo Date: Fri Sep 14 01:44:42 2018 +0800 Btrfs: skip set_page_dirty if eb pages are already dirty As long as @eb is marked with EXTENT_BUFFER_DIRTY, all of its pages are dirty, so no need to set pages dirty again. Ftrace showed that the loop took 10us on my dev box, so removing this can save us at least 10us if eb is already dirty and otherwise avoid a potentially expensive calls to set_page_dirty. Signed-off-by: Liu Bo Reviewed-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 51995c399b73dacb9d84375ad5a8fda3aced03ab Author: Liu Bo Date: Fri Sep 14 01:46:08 2018 +0800 Btrfs: assert page dirty bit on extent buffer pages Just in case that someone breaks the rule that pages are dirty as long as eb is dirty. The next patch will dirty the pages conditionally. Signed-off-by: Liu Bo Reviewed-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 98e6b1eb4022f2eb9845f0da5f16c179e5f32b9f Author: Liu Bo Date: Wed Sep 12 06:06:23 2018 +0800 Btrfs: remove unnecessary level check in balance_level In the callchain: btrfs_search_slot() if (level != 0) setup_nodes_for_search() balance_level() It is just impossible to have level=0 in balance_level, we can drop the check. Signed-off-by: Liu Bo Reviewed-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3cf5068f3d068d788871b0da1a0348048e68b9d6 Author: Liu Bo Date: Wed Sep 12 06:06:26 2018 +0800 Btrfs: unify error handling of btrfs_lookup_dir_item Unify the error handling of directory item lookups using IS_ERR_OR_NULL. No functional changes. Signed-off-by: Liu Bo Reviewed-by: Nikolay Borisov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3b2fd8016069de59f73caca06f7ad60c25f3eb92 Author: Liu Bo Date: Sat Sep 8 04:41:40 2018 +0800 Btrfs: use args in the correct order for kcalloc in btrfsic_read_block kcalloc is defined as: kcalloc(size_t n, size_t size, gfp_t flags) Although this won't cause problems in practice, btrfsic_read_block() uses kcalloc with n and size in the opposite order. Reviewed-by: Omar Sandoval Signed-off-by: Liu Bo Reviewed-by: David Sterba Signed-off-by: David Sterba commit a27a94c2b0c727517c17cf2ca3a9f7291caadfbc Author: Nikolay Borisov Date: Mon Sep 3 12:46:14 2018 +0300 btrfs: Make btrfs_find_device_by_devspec return btrfs_device directly Instead of returning an error value and using one of the parameters for returning the actual object we are interested in just refactor the function to directly return btrfs_device *. Also bubble up the error handling for the special BTRFS_ERROR_DEV_MISSING_NOT_FOUND value into btrfs_rm_device. No functional changes. Signed-off-by: Nikolay Borisov Reviewed-by: Qu Wenruo Signed-off-by: David Sterba commit 6c05040702e7793e8ee63bb8384ac2f9235c926e Author: Nikolay Borisov Date: Mon Sep 3 12:46:13 2018 +0300 btrfs: Make btrfs_find_device_missing_or_by_path return directly a device This function returns a numeric error value and additionally the device found in one of its input parameters. Simplify this by making the function directly return a pointer to btrfs_device. Additionally adjust the caller to handle the case when we want to remove the 'missing' device and ENOENT is returned to return the expected positive error value, parsed by progs. Finally, unexport the function since it's not called outside of volume.c. No functional changes. Signed-off-by: Nikolay Borisov Reviewed-by: Qu Wenruo Signed-off-by: David Sterba commit b444ad46b2db4f8c682c99ffb994e532a4713012 Author: Nikolay Borisov Date: Mon Sep 3 12:46:12 2018 +0300 btrfs: Make btrfs_find_device_by_path return struct btrfs_device Currently this function returns an error code as well as uses one of its arguments as a return value for struct btrfs_device. Change the function so that it returns btrfs_device directly and use the usual "encode error in pointer" mechanics if something goes wrong. No functional changes. Signed-off-by: Nikolay Borisov Reviewed-by: Qu Wenruo Signed-off-by: David Sterba commit 374b0e2d6ba5da7fd1cadb3247731ff27d011f6f Author: Jeff Mahoney Date: Thu Sep 6 16:59:33 2018 -0400 btrfs: fix error handling in free_log_tree When we hit an I/O error in free_log_tree->walk_log_tree during file system shutdown we can crash due to there not being a valid transaction handle. Use btrfs_handle_fs_error when there's no transaction handle to use. BUG: unable to handle kernel NULL pointer dereference at 0000000000000060 IP: free_log_tree+0xd2/0x140 [btrfs] PGD 0 P4D 0 Oops: 0000 [#1] SMP DEBUG_PAGEALLOC PTI Modules linked in: CPU: 2 PID: 23544 Comm: umount Tainted: G W 4.12.14-kvmsmall #9 SLE15 (unreleased) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.0.0-prebuilt.qemu-project.org 04/01/2014 task: ffff96bfd3478880 task.stack: ffffa7cf40d78000 RIP: 0010:free_log_tree+0xd2/0x140 [btrfs] RSP: 0018:ffffa7cf40d7bd10 EFLAGS: 00010282 RAX: 00000000fffffffb RBX: 00000000fffffffb RCX: 0000000000000002 RDX: 0000000000000000 RSI: ffff96c02f07d4c8 RDI: 0000000000000282 RBP: ffff96c013cf1000 R08: ffff96c02f07d4c8 R09: ffff96c02f07d4d0 R10: 0000000000000000 R11: 0000000000000002 R12: 0000000000000000 R13: ffff96c005e800c0 R14: ffffa7cf40d7bdb8 R15: 0000000000000000 FS: 00007f17856bcfc0(0000) GS:ffff96c03f600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000060 CR3: 0000000045ed6002 CR4: 00000000003606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? wait_for_writer+0xb0/0xb0 [btrfs] btrfs_free_log+0x17/0x30 [btrfs] btrfs_drop_and_free_fs_root+0x9a/0xe0 [btrfs] btrfs_free_fs_roots+0xc0/0x130 [btrfs] ? wait_for_completion+0xf2/0x100 close_ctree+0xea/0x2e0 [btrfs] ? kthread_stop+0x161/0x260 generic_shutdown_super+0x6c/0x120 kill_anon_super+0xe/0x20 btrfs_kill_super+0x13/0x100 [btrfs] deactivate_locked_super+0x3f/0x70 cleanup_mnt+0x3b/0x70 task_work_run+0x78/0x90 exit_to_usermode_loop+0x77/0xa6 do_syscall_64+0x1c5/0x1e0 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x7f1784f90827 RSP: 002b:00007ffdeeb03118 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000556a60c62970 RCX: 00007f1784f90827 RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000556a60c62b50 RBP: 0000000000000000 R08: 0000000000000005 R09: 00000000ffffffff R10: 0000556a60c63900 R11: 0000000000000246 R12: 0000556a60c62b50 R13: 00007f17854a81c4 R14: 0000000000000000 R15: 0000000000000000 RIP: free_log_tree+0xd2/0x140 [btrfs] RSP: ffffa7cf40d7bd10 CR2: 0000000000000060 Fixes: 681ae50917df9 ("Btrfs: cleanup reserved space when freeing tree log on error") CC: # v3.13 Signed-off-by: Jeff Mahoney Reviewed-by: David Sterba Signed-off-by: David Sterba commit 380fd06640a7afe972e45310012c3e22d9c4783d Author: Misono Tomohiro Date: Thu Aug 30 10:59:16 2018 +0900 btrfs: remove redundant variable from btrfs_cross_ref_exist Since commit d7df2c796d7e ("Btrfs attach delayed ref updates to delayed ref heads"), check_delayed_ref() won't return -ENOENT. In btrfs_cross_ref_exist(), two variables 'ret' and 'ret2' are originally used to handle -ENOENT error case. Since the code is not needed anymore, let's just remove 'ret2'. Signed-off-by: Misono Tomohiro Reviewed-by: David Sterba Signed-off-by: David Sterba commit e49aabd973fd0b3e8e949bd9e7e05acbb9008244 Author: Liu Bo Date: Sat Aug 25 13:47:09 2018 +0800 Btrfs: set leave_spinning in btrfs_get_extent Unless it's going to read inline extents from btree leaf to page, btrfs_get_extent won't sleep during the period of holding path lock. This sets leave_spinning at first and sets path to blocking mode right before reading inline extent if that's the case. The benefit is that a path in spinning mode typically has lower impact (faster) on waiters rather than that in the blocking mode. Signed-off-by: Liu Bo Reviewed-by: David Sterba Signed-off-by: David Sterba commit de2c6615dcddf2af868c5cbd1db2e9e73b4beb58 Author: Liu Bo Date: Sat Aug 25 13:47:59 2018 +0800 Btrfs: fix alignment in declaration and prototype of btrfs_get_extent This fixes btrfs_get_extent to be consistent with our existing declaration style. Note: For the record, indentation styles that are accepted are both, aligning under the opening ( and tab or double tab indentation on the next line. Preferrably not spliting the type or long expressions in the argument lists. Signed-off-by: Liu Bo [ add note ] Signed-off-by: David Sterba commit 29c5e5d4966d8d56e18e008da01108167d8d6fd1 Author: Colin Ian King Date: Tue Aug 28 14:21:01 2018 +0100 btrfs: remove unused pointer 'tree' in btrfs_submit_compressed_read Pointer 'tree' is being assigned but is never used hence it is redundant and can be removed. This is a leftover from cleanup patch 00032d38eaa89c76de7 ("btrfs: drop extent_io_ops::merge_bio_hook callback"). Cleans up clang warning: warning: variable 'tree' set but not used [-Wunused-but-set-variable] Signed-off-by: Colin Ian King Reviewed-by: David Sterba Signed-off-by: David Sterba commit d005dbeca0814551ed243fc2d51480d0cd925d67 Author: Colin Ian King Date: Tue Aug 28 11:45:21 2018 +0100 btrfs: remove unused pointer inode in relink_file_extents Pointer inode is being assigned but is never used hence it is redundant and can be removed. It's been unused since the introduction in 38c227d87c49a ("Btrfs: snapshot-aware defrag"). Cleans up clang warning: variable ‘inode’ set but not used [-Wunused-but-set-variable] Signed-off-by: Colin Ian King Reviewed-by: David Sterba Signed-off-by: David Sterba commit 28c4a3e21ad030d7571ee9b1b246a5cbfd886627 Author: Su Yue Date: Wed Sep 5 11:07:33 2018 +0800 btrfs: defrag: use btrfs_mod_outstanding_extents in cluster_pages_for_defrag Since commit 8b62f87bad9c ("Btrfs: rework outstanding_extents"), manual operations of outstanding_extent in btrfs_inode are replaced by btrfs_mod_outstanding_extents(). The one in cluster_pages_for_defrag seems to be lost, so replace it of btrfs_mod_outstanding_extents(). Fixes: 8b62f87bad9c ("Btrfs: rework outstanding_extents") Signed-off-by: Su Yue Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6aadd9eb74877a004687a5f70ec20797e5b03c5a Author: Liu Bo Date: Wed Sep 5 09:55:27 2018 +0800 Btrfs: remove confusing tracepoint in btrfs_add_reserved_bytes Here we're not releasing any space, but transferring bytes from ->bytes_may_use to ->bytes_reserved. The last change to the code in commit 18513091af9483ba8 ("btrfs: update btrfs_space_info's bytes_may_use timely") removed a conditional tracepoint and the logic changed too but the tracepiont remained. Signed-off-by: Liu Bo Reviewed-by: Nikolay Borisov Reviewed-by: David Sterba [ update changelog ] Signed-off-by: David Sterba commit c64142807f5a4dcff5c69bfb0868df844b2e87c7 Author: Liu Bo Date: Thu Aug 23 07:36:17 2018 +0800 btrfs: free path at an earlier point in btrfs_get_extent trace_btrfs_get_extent() has nothing to do with path, place btrfs_free_path ahead so that we can unlock path on error. Signed-off-by: Liu Bo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9688e9a99e4b2d60d78fbaa270e7e0c70d90f6c2 Author: Liu Bo Date: Thu Aug 23 03:14:53 2018 +0800 Btrfs: use next_state in find_first_extent_bit As next_state() is already defined to get the next state, use it in find_first_extent_bit. No functional changes. Signed-off-by: Liu Bo Reviewed-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit b72c3aba09a53fc7c1824250d71180ca154517a7 Author: Qu Wenruo Date: Tue Aug 21 09:53:47 2018 +0800 btrfs: locking: Add extra check in btrfs_init_new_buffer() to avoid deadlock [BUG] For certain crafted image, whose csum root leaf has missing backref, if we try to trigger write with data csum, it could cause deadlock with the following kernel WARN_ON(): WARNING: CPU: 1 PID: 41 at fs/btrfs/locking.c:230 btrfs_tree_lock+0x3e2/0x400 CPU: 1 PID: 41 Comm: kworker/u4:1 Not tainted 4.18.0-rc1+ #8 Workqueue: btrfs-endio-write btrfs_endio_write_helper RIP: 0010:btrfs_tree_lock+0x3e2/0x400 Call Trace: btrfs_alloc_tree_block+0x39f/0x770 __btrfs_cow_block+0x285/0x9e0 btrfs_cow_block+0x191/0x2e0 btrfs_search_slot+0x492/0x1160 btrfs_lookup_csum+0xec/0x280 btrfs_csum_file_blocks+0x2be/0xa60 add_pending_csums+0xaf/0xf0 btrfs_finish_ordered_io+0x74b/0xc90 finish_ordered_fn+0x15/0x20 normal_work_helper+0xf6/0x500 btrfs_endio_write_helper+0x12/0x20 process_one_work+0x302/0x770 worker_thread+0x81/0x6d0 kthread+0x180/0x1d0 ret_from_fork+0x35/0x40 [CAUSE] That crafted image has missing backref for csum tree root leaf. And when we try to allocate new tree block, since there is no EXTENT/METADATA_ITEM for csum tree root, btrfs consider it's free slot and use it. The extent tree of the image looks like: Normal image | This fuzzed image ----------------------------------+-------------------------------- BG 29360128 | BG 29360128 One empty slot | One empty slot 29364224: backref to UUID tree | 29364224: backref to UUID tree Two empty slots | Two empty slots 29376512: backref to CSUM tree | One empty slot (bad type) <<< 29380608: backref to D_RELOC tree | 29380608: backref to D_RELOC tree ... | ... Since bytenr 29376512 has no METADATA/EXTENT_ITEM, when btrfs try to alloc tree block, it's an valid slot for btrfs. And for finish_ordered_write, when we need to insert csum, we try to CoW csum tree root. By accident, empty slots at bytenr BG_OFFSET, BG_OFFSET + 8K, BG_OFFSET + 12K is already used by tree block COW for other trees, the next empty slot is BG_OFFSET + 16K, which should be the backref for CSUM tree. But due to the bad type, btrfs can recognize it and still consider it as an empty slot, and will try to use it for csum tree CoW. Then in the following call trace, we will try to lock the new tree block, which turns out to be the old csum tree root which is already locked: btrfs_search_slot() called on csum tree root, which is at 29376512 |- btrfs_cow_block() |- btrfs_set_lock_block() | |- Now locks tree block 29376512 (old csum tree root) |- __btrfs_cow_block() |- btrfs_alloc_tree_block() |- btrfs_reserve_extent() | Now it returns tree block 29376512, which extent tree | shows its empty slot, but it's already hold by csum tree |- btrfs_init_new_buffer() |- btrfs_tree_lock() | Triggers WARN_ON(eb->lock_owner == current->pid) |- wait_event() Wait lock owner to release the lock, but it's locked by ourself, so it will deadlock [FIX] This patch will do the lock_owner and current->pid check at btrfs_init_new_buffer(). So above deadlock can be avoided. Since such problem can only happen in crafted image, we will still trigger kernel warning for later aborted transaction, but with a little more meaningful warning message. Link: https://bugzilla.kernel.org/show_bug.cgi?id=200405 Reported-by: Xu Wen CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 65c6e82becec33731f48786e5a30f98662c86b16 Author: Qu Wenruo Date: Tue Aug 21 09:42:03 2018 +0800 btrfs: Handle owner mismatch gracefully when walking up tree [BUG] When mounting certain crafted image, btrfs will trigger kernel BUG_ON() when trying to recover balance: kernel BUG at fs/btrfs/extent-tree.c:8956! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 662 Comm: mount Not tainted 4.18.0-rc1-custom+ #10 RIP: 0010:walk_up_proc+0x336/0x480 [btrfs] RSP: 0018:ffffb53540c9b890 EFLAGS: 00010202 Call Trace: walk_up_tree+0x172/0x1f0 [btrfs] btrfs_drop_snapshot+0x3a4/0x830 [btrfs] merge_reloc_roots+0xe1/0x1d0 [btrfs] btrfs_recover_relocation+0x3ea/0x420 [btrfs] open_ctree+0x1af3/0x1dd0 [btrfs] btrfs_mount_root+0x66b/0x740 [btrfs] mount_fs+0x3b/0x16a vfs_kern_mount.part.9+0x54/0x140 btrfs_mount+0x16d/0x890 [btrfs] mount_fs+0x3b/0x16a vfs_kern_mount.part.9+0x54/0x140 do_mount+0x1fd/0xda0 ksys_mount+0xba/0xd0 __x64_sys_mount+0x21/0x30 do_syscall_64+0x60/0x210 entry_SYSCALL_64_after_hwframe+0x49/0xbe [CAUSE] Extent tree corruption. In this particular case, reloc tree root's owner is DATA_RELOC_TREE (should be TREE_RELOC), thus its backref is corrupted and we failed the owner check in walk_up_tree(). [FIX] It's pretty hard to take care of every extent tree corruption, but at least we can remove such BUG_ON() and exit more gracefully. And since in this particular image, DATA_RELOC_TREE and TREE_RELOC share the same root (which is obviously invalid), we needs to make __del_reloc_root() more robust to detect such invalid sharing to avoid possible NULL dereference as root->node can be NULL in this case. Link: https://bugzilla.kernel.org/show_bug.cgi?id=200411 Reported-by: Xu Wen CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 45128b08f74131753a10a584e3e5c4496b279269 Author: zhong jiang Date: Fri Aug 17 00:37:15 2018 +0800 btrfs: change btrfs_pin_log_trans to return void btrfs_pin_log_trans defines the variable "ret" for return value, but it is not modified after initialization. Further, I find that none of the callers do handles the return value, so it is safe to drop the unneeded "ret" and make it return void. Signed-off-by: zhong jiang Reviewed-by: David Sterba Signed-off-by: David Sterba commit 556f3ca88ecb7087e7e3144e429414c60a300984 Author: zhong jiang Date: Fri Aug 17 00:37:14 2018 +0800 btrfs: change btrfs_free_reserved_bytes to return void btrfs_free_reserved_bytes uses the variable "ret" for return value, but it is not modified after initialzation. Further, I find that any of the callers do not handle the return value, so it is safe to drop the unneeded "ret" and return void. There are no callees that would need the function to handle or pass the value either. Signed-off-by: zhong jiang Reviewed-by: David Sterba [ update changelog ] Signed-off-by: David Sterba commit bee6ec822a6a686d1b8ac65298b07765a48aefad Author: Liu Bo Date: Fri Aug 17 05:05:28 2018 +0800 Btrfs: remove always true if branch in btrfs_get_extent @path is always NULL when it comes to the if branch. Signed-off-by: Liu Bo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9c7b0c2e8dbfbcd80a71e2cbfe02704f26c185c6 Author: Qu Wenruo Date: Fri Aug 10 10:20:26 2018 +0800 btrfs: qgroup: Dirty all qgroups before rescan [BUG] In the following case, rescan won't zero out the number of qgroup 1/0: $ mkfs.btrfs -fq $DEV $ mount $DEV /mnt $ btrfs quota enable /mnt $ btrfs qgroup create 1/0 /mnt $ btrfs sub create /mnt/sub $ btrfs qgroup assign 0/257 1/0 /mnt $ dd if=/dev/urandom of=/mnt/sub/file bs=1k count=1000 $ btrfs sub snap /mnt/sub /mnt/snap $ btrfs quota rescan -w /mnt $ btrfs qgroup show -pcre /mnt qgroupid rfer excl max_rfer max_excl parent child -------- ---- ---- -------- -------- ------ ----- 0/5 16.00KiB 16.00KiB none none --- --- 0/257 1016.00KiB 16.00KiB none none 1/0 --- 0/258 1016.00KiB 16.00KiB none none --- --- 1/0 1016.00KiB 16.00KiB none none --- 0/257 So far so good, but: $ btrfs qgroup remove 0/257 1/0 /mnt WARNING: quotas may be inconsistent, rescan needed $ btrfs quota rescan -w /mnt $ btrfs qgroup show -pcre /mnt qgoupid rfer excl max_rfer max_excl parent child -------- ---- ---- -------- -------- ------ ----- 0/5 16.00KiB 16.00KiB none none --- --- 0/257 1016.00KiB 16.00KiB none none --- --- 0/258 1016.00KiB 16.00KiB none none --- --- 1/0 1016.00KiB 16.00KiB none none --- --- ^^^^^^^^^^ ^^^^^^^^ not cleared [CAUSE] Before rescan we call qgroup_rescan_zero_tracking() to zero out all qgroups' accounting numbers. However we don't mark all qgroups dirty, but rely on rescan to do so. If we have any high level qgroup without children, it won't be marked dirty during rescan, since we cannot reach that qgroup. This will cause QGROUP_INFO items of childless qgroups never get updated in the quota tree, thus their numbers will stay the same in "btrfs qgroup show" output. [FIX] Just mark all qgroups dirty in qgroup_rescan_zero_tracking(), so even if we have childless qgroups, their QGROUP_INFO items will still get updated during rescan. Reported-by: Misono Tomohiro CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Qu Wenruo Reviewed-by: Misono Tomohiro Tested-by: Misono Tomohiro Signed-off-by: David Sterba commit 32934280967d00dc2b5c4d3b63b21a9c8638326e Author: Omar Sandoval Date: Tue Aug 14 11:09:52 2018 -0700 Btrfs: clean up scrub is_dev_replace parameter struct scrub_ctx has an ->is_dev_replace member, so there's no point in passing around is_dev_replace where sctx is available. Signed-off-by: Omar Sandoval Signed-off-by: David Sterba commit 1da739678e0b7a764a0f1ef46886f919f19f6446 Author: Anand Jain Date: Fri Aug 10 13:53:21 2018 +0800 btrfs: add helper to obtain number of devices with ongoing dev-replace When the replace is running the fs_devices::num_devices also includes the replaced device, however in some operations like device delete and balance it needs the actual num_devices without the repalced devices. The function btrfs_num_devices() just provides that. And here is a scenario how balance and repalce items could co-exist: Consider balance is started and paused, now start the replace followed by a unmount or system power-cycle. During following mount, the open_ctree() first restarts the balance so it must check for the device replace otherwise our num_devices calculation will be wrong. Signed-off-by: Anand Jain Reviewed-by: David Sterba [ update changelog ] Signed-off-by: David Sterba commit 16220c467ad34c8f103566a79ac047ed391f51f2 Author: Anand Jain Date: Fri Aug 10 13:53:20 2018 +0800 btrfs: add assertions where number of devices could go below 0 In preparation to add helper function to deduce the num_devices with replace running, use assert instead of BUG_ON or WARN_ON. The number of devices would not normally drop to 0 due to other checks so the assert is sufficient. Signed-off-by: Anand Jain Reviewed-by: David Sterba [ update changelog, adjust the assert condition ] Signed-off-by: David Sterba commit f8b00e0f06e54efed0dc919518841ad0dd2199cd Author: zhong jiang Date: Mon Aug 13 14:06:08 2018 +0800 btrfs: remove unneeded NULL checks before kfree Kfree has taken the NULL pointer into account. So remove the check before kfree. The issue is detected with the help of Coccinelle. Signed-off-by: zhong jiang Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba commit 4b6f8e9695da65e29f9f8ee84b39e0ba5b45e8e9 Author: Liu Bo Date: Tue Aug 14 10:46:53 2018 +0800 Btrfs: do not unnecessarily pass write_lock_level when processing leaf As we're going to return right after the call, it's not necessary to get update the new write_lock_level from unlock_up. Signed-off-by: Liu Bo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4fd786e6c3d67b1348e0ad4f450efe9fc9d7a306 Author: Misono Tomohiro Date: Mon Aug 6 14:25:24 2018 +0900 btrfs: Remove 'objectid' member from struct btrfs_root There are two members in struct btrfs_root which indicate root's objectid: objectid and root_key.objectid. They are both set to the same value in __setup_root(): static void __setup_root(struct btrfs_root *root, struct btrfs_fs_info *fs_info, u64 objectid) { ... root->objectid = objectid; ... root->root_key.objectid = objecitd; ... } and not changed to other value after initialization. grep in btrfs directory shows both are used in many places: $ grep -rI "root->root_key.objectid" | wc -l 133 $ grep -rI "root->objectid" | wc -l 55 (4.17, inc. some noise) It is confusing to have two similar variable names and it seems that there is no rule about which should be used in a certain case. Since ->root_key itself is needed for tree reloc tree, let's remove 'objecitd' member and unify code to use ->root_key.objectid in all places. Signed-off-by: Misono Tomohiro Reviewed-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5a2cb25ab9da5046f10e773c9ecfdb3339f3dd7c Author: Lu Fengqi Date: Sat Aug 4 21:10:56 2018 +0800 btrfs: remove a useless return statement in btrfs_block_rsv_add Since ret must be 0 here, don't have to return. No functional change and code readability is not hurt. Signed-off-by: Lu Fengqi Reviewed-by: David Sterba Signed-off-by: David Sterba commit 684572df940181b070760bf027a6ded6b7b55c3d Author: Lu Fengqi Date: Sat Aug 4 21:10:57 2018 +0800 btrfs: Remove root parameter from btrfs_insert_dir_item All callers pass the root tree of dir, we can push that down to the function itself. Signed-off-by: Lu Fengqi Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3a58417486ca99a3bfef40e309f38adb45a5171d Author: Lu Fengqi Date: Sat Aug 4 21:10:55 2018 +0800 btrfs: switch update_size to bool in btrfs_block_rsv_migrate and btrfs_rsv_add_bytes Using true and false here is closer to the expected semantic than using 0 and 1. No functional change. Signed-off-by: Lu Fengqi Reviewed-by: David Sterba Signed-off-by: David Sterba commit a7176f74fa570c83a48e66435b77651ad8fc5aee Author: Lu Fengqi Date: Sat Aug 4 21:10:53 2018 +0800 btrfs: simplify the send_in_progress check in btrfs_delete_subvolume Only when send_in_progress, we have to do something different such as btrfs_warn() and return -EPERM. Therefore, we could check send_in_progress first and process error handling, after the root_item_lock has been got. Just for better readability. No functional change. Signed-off-by: Lu Fengqi Reviewed-by: David Sterba Signed-off-by: David Sterba commit bbf2f71e061a47e57e2c61abe406f2348be5058e Author: Michael Straube Date: Sun Oct 14 21:09:33 2018 +0200 staging: rtl8188eu: cleanup comparsions to false Cleanup remaining comparsions to false. if(x == false) -> if(!x) Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman commit c2aed5648fe02324f8a4567bb611c289202d9f07 Author: Nick Ewalt Date: Sun Oct 14 21:59:27 2018 -0700 staging: gasket: Update device virtual address comment Add that number of page table entries and extended address bit offset are configurable. Update example virtual address format to be more consistent with typical usage. Signed-off-by: Nick Ewalt Signed-off-by: Todd Poynor Signed-off-by: Greg Kroah-Hartman commit df5f470de0f5b57e9a169253a800bb4a69e4d742 Author: Nick Ewalt Date: Sun Oct 14 21:59:26 2018 -0700 staging: gasket: sysfs: fix attribute release comment Comments for gasket_sysfs_get_attr() incorrectly describe reference release procedure. Signed-off-by: Nick Ewalt Signed-off-by: Todd Poynor Signed-off-by: Greg Kroah-Hartman commit 9edcf710ab0f58d4ab47a7f9aba5dbc9ad0c7900 Author: Nick Ewalt Date: Sun Oct 14 21:59:25 2018 -0700 staging: gasket: apex: fix sysfs_show sysfs_show was incorrectly extracting the sysfs_attribute_type from the gasket_sysfs_attribute. This prevented dispatch from working properly. Signed-off-by: Nick Ewalt Signed-off-by: Todd Poynor Signed-off-by: Greg Kroah-Hartman commit 4a966fa24a5a7e236db8ac1e58e04107db1c1930 Author: Nick Ewalt Date: Sun Oct 14 21:59:24 2018 -0700 staging: gasket: page_table: simplify gasket_components_to_dev_address Refactor gasket_components_to_dev_address to be faster and easier to understand. The old implementation was unnecessarily complex and masked the page_index for simple addresses but not extended ones. It makes the most sense for this function to perform no such masking. Signed-off-by: Nick Ewalt Signed-off-by: Todd Poynor Signed-off-by: Greg Kroah-Hartman commit bae54fb8121da9d52cd6919758defb24639901cf Author: Nick Ewalt Date: Sun Oct 14 21:59:23 2018 -0700 staging: gasket: page_table: fix comment in components_to_dev_address Comments in components_to_dev_address() describing examples are inconsistent, fix these to be accurate. Signed-off-by: Nick Ewalt Signed-off-by: Todd Poynor Signed-off-by: Greg Kroah-Hartman commit 54be7ec98875e3061e6ae788d6e7088cffa5ed2e Author: Nick Ewalt Date: Sun Oct 14 21:59:22 2018 -0700 staging: gasket: page table: fixup error path allocating coherent mem Correctly clean up data structure state in gasket_alloc_coherent_memory error path, to ensure no double free on the stale pointer value. Signed-off-by: Nick Ewalt Signed-off-by: Todd Poynor Signed-off-by: Greg Kroah-Hartman commit 53f8a81d465b10aabaf6e0ffc99e7ea2c25bef5a Author: Nick Ewalt Date: Sun Oct 14 21:59:21 2018 -0700 staging: gasket: page_table: rearrange gasket_page_table_entry Rearrange gasket_page_table entry to reduce padding slop. Signed-off-by: Nick Ewalt Signed-off-by: Todd Poynor Signed-off-by: Greg Kroah-Hartman commit efa5dcfa8f9ded669da15e29e69e13f56b6bb524 Author: Nick Ewalt Date: Sun Oct 14 21:59:20 2018 -0700 staging: gasket: page_table: remove unnecessary PTE status set to free Remove unnecessary ptes[i].status update in gasket_perform_unmapping. The vaaue will be cleared in the following memset. Signed-off-by: Nick Ewalt Signed-off-by: Todd Poynor Signed-off-by: Greg Kroah-Hartman commit 02d37186331d389bb19257e330c1ed47afe178ba Author: Todd Poynor Date: Sun Oct 14 21:59:19 2018 -0700 staging: gasket: page table: remove dead code in coherent mem alloc gasket_alloc_coherent_memory() has some unnecessary code related to out of memory checking that will never hit the condition checked, remove. Signed-off-by: Todd Poynor Signed-off-by: Greg Kroah-Hartman commit b1004491c9c2a62a8ca4d939e35b3c21abc8f28a Author: Todd Poynor Date: Sun Oct 14 21:59:18 2018 -0700 staging: gasket: page table: return valid error code on map fail Return -EINVAL on mapping failures, instead of -1, which triggers a checkpatch error. Signed-off-by: Todd Poynor Signed-off-by: Greg Kroah-Hartman commit 9c9f1ddee729846506b5d671ef5084f6e16dd1d1 Author: Janusz Krzysztofik Date: Fri Oct 12 21:09:01 2018 +0200 mmc: pwrseq_simple: Fix incorrect handling of GPIO bitmap Commit b9762bebc633 ("gpiolib: Pass bitmaps, not integer arrays, to get/set array") changed the way GPIO values are passed to gpiod_get/set_array_value() and friends. The new code introduced into mmc_pwrseq_simple_set_gpios_value() incorrectly interpretes the 'value' argument as a bitmap of GPIO values and assigns it directly to the 'values' bitmap variable passed to gpiod_set_array_value_cansleep() instead of filling that bitmap with bits equal to the 'value' argument. As a result, only member 0 of the array is handled correctly. Moreover, wrong assumption is taken about the 'values' bitmap size not exceding the number of bits of the 'value' argument type. Fix it. Signed-off-by: Janusz Krzysztofik Tested-by: Marek Szyprowski Acked-by: Ulf Hansson Signed-off-by: Linus Walleij commit a7c0b4b80f02d748031c785e30d380cfa7fd41ee Author: Randy Dunlap Date: Fri Oct 12 20:46:29 2018 -0700 gpio: fix SNPS_CREG kconfig dependency warning Fix kconfig warning for GPIO_SNPS_CREG: WARNING: unmet direct dependencies detected for OF_GPIO Depends on [n]: GPIOLIB [=y] && OF [=n] && HAS_IOMEM [=y] Selected by [y]: - GPIO_SNPS_CREG [=y] && GPIOLIB [=y] && HAS_IOMEM [=y] && (ARC || COMPILE_TEST [=y]) Drivers in drivers/gpio/Kconfig depend on OF_GPIO, not select it. This prevents attempting to build when OF is not enabled. Signed-off-by: Randy Dunlap Cc: Linus Walleij Cc: linux-gpio@vger.kernel.org Cc: Eugeniy Paltsev Signed-off-by: Linus Walleij commit 202dc3cc10b4d37e5251431acf8d5040a8876c7d Author: Geert Uytterhoeven Date: Tue Oct 9 19:41:58 2018 +0200 serial: sh-sci: Fix receive on SCIFA/SCIFB variants with DMA On SCIFA and SCIFB serial ports with DMA support (i.e. some ports on R-Car Gen2 and RZ/G1 SoCs), receive DMA operations are submitted before the DMA channel pointer is initialized. Hence this fails, and the driver tries to fall back to PIO. However, at this early phase in the initialization sequence, fallback to PIO does not work, leading to a serial port that cannot receive any data. Fix this by calling sci_submit_rx() after initialization of the DMA channel pointer. Reported-by: Yoshihiro Shimoda Fixes: 2c4ee23530ffc022 ("serial: sh-sci: Postpone DMA release when falling back to PIO") Signed-off-by: Geert Uytterhoeven Reviewed-by: Wolfram Sang Tested-by: Wolfram Sang Signed-off-by: Greg Kroah-Hartman commit 2b9ea543fa433689301cf16c5b391e1e552ac73d Author: YueHaibing Date: Fri Oct 12 09:33:28 2018 +0000 pinctrl: renesas: Fix platform_no_drv_owner.cocci warnings Remove .owner field if calls are used which set it automatically Generated by: scripts/coccinelle/api/platform_no_drv_owner.cocci Signed-off-by: YueHaibing Signed-off-by: Linus Walleij commit 28e0603c4df4b327aa1f92ccfbc3733323d898ba Author: Manivannan Sadhasivam Date: Tue Oct 9 00:44:10 2018 +0530 pinctrl: mediatek: Make eint_m u16 For SoC's which lacks EINT support, U16_MAX is assigned to both eint_m and eint_n through macro NO_EINT_SUPPORT. This will generate integer overflow warning because eint_m is declared as u8 type. Hence modify the eint_m type to u16. Signed-off-by: Manivannan Sadhasivam Reviewed-by: Matthias Brugger Signed-off-by: Linus Walleij commit 59eaeba63a171127a90bb76187536ba66076af40 Author: Michal Simek Date: Fri Oct 12 07:43:11 2018 +0200 of: base: Change logic in of_alias_get_alias_list() Check compatible string first before setting up bit in bitmap to also cover cases that allocated bitfield is not big enough. Show warning about it but let driver to continue to work with allocated bitfield to keep at least some devices (included console which is commonly close to serial0) to work. Fixes: b1078c355d76 ("of: base: Introduce of_alias_get_alias_list() to check alias IDs") Fixes: ae1cca3fa347 ("serial: uartps: Change uart ID port allocation") Signed-off-by: Michal Simek Reviewed-by: Rob Herring Signed-off-by: Greg Kroah-Hartman commit 7acf79b6b2160540af87f47a55d7e3e5637ddeb5 Author: Michal Simek Date: Mon Oct 8 13:58:47 2018 +0200 of: base: Fix english spelling in of_alias_get_alias_list() Fix english spelling in of_alias_get_alias_list(). Reported-by: Geert Uytterhoeven Reported-by: Randy Dunlap Fixes: b1078c355d76 ("of: base: Introduce of_alias_get_alias_list() to check alias IDs") Signed-off-by: Michal Simek Acked-by: Rob Herring Signed-off-by: Greg Kroah-Hartman commit c58a3ae58bce99d20fdbc5d97beecf31cc19f3dd Author: Ulrich Hecht Date: Fri Oct 12 15:47:49 2018 +0200 serial: sh-sci: do not warn if DMA transfers are not supported Not all (H)SCIF devices support DMA, and failure to set it up is not normally a cause for concern. This patch demotes the associated warning to debug output. Inspired by BSP patch "sci: sh-sci: Fix transfer sequence of unsupport DMA transfer" (6beb1f98d3bd30) by Hiromitsu Yamasaki. Signed-off-by: Ulrich Hecht Reviewed-by: Wolfram Sang Signed-off-by: Greg Kroah-Hartman commit a7f172ab6a8e755e60311f27512034b0441ef421 Author: Honghui Zhang Date: Mon Oct 15 16:08:53 2018 +0800 PCI: mediatek: Fix class type for MT7622 to PCI_CLASS_BRIDGE_PCI commit 101c92dc80c8 ("PCI: mediatek: Set up vendor ID and class type for MT7622") erroneously set the class type for MT7622 to PCI_CLASS_BRIDGE_HOST. The PCIe controller of MT7622 integrates a Root Port that has type 1 configuration space header and related bridge windows. The HW default value of this bridge's class type is invalid. Fix its class type and set it to PCI_CLASS_BRIDGE_PCI to match the hardware implementation. Fixes: 101c92dc80c8 ("PCI: mediatek: Set up vendor ID and class type for MT7622") Signed-off-by: Honghui Zhang [lorenzo.pieralisi@arm.com: reworked the commit log] Signed-off-by: Lorenzo Pieralisi Acked-by: Ryder Lee commit 490d84f6d73c12f4204241cff8651eed60aae914 Author: Hans Verkuil Date: Mon Oct 15 06:14:22 2018 -0400 media: cec: forgot to cancel delayed work If the wait for completion was interrupted, then make sure to cancel any delayed work. This can only happen if a transmit is waiting for a reply, and you press Ctrl-C or reboot/poweroff or something like that which interrupts the thread waiting for the reply and then proceeds to delete the CEC message. Since the delayed work wasn't canceled, once it would trigger it referred to stale data and resulted in a kernel oops. Fixes: 7ec2b3b941a6 ("cec: add new tx/rx status bits to detect aborts/timeouts") Signed-off-by: Hans Verkuil Cc: # for v4.18 and up Signed-off-by: Mauro Carvalho Chehab commit ef1a2a62cc48c81c68599ff56cc0a97b954c87fe Author: Hans Ulli Kroll Date: Thu Oct 11 21:35:20 2018 +0200 usb: host: add DT bindings for faraday fotg2 This adds device tree bindings for the Faraday FOTG2 dual-mode host controller. Cc: devicetree@vger.kernel.org Signed-off-by: Hans Ulli Kroll Acked-by: Rob Herring Signed-off-by: Linus Walleij Signed-off-by: Greg Kroah-Hartman commit 325b9313ec3be56c8e2fe03f977fee19cec75820 Author: Tudor.Ambarus@microchip.com Date: Mon Oct 15 09:00:54 2018 +0000 usb: host: ohci-at91: fix request of irq for optional gpio atmel,oc-gpio is optional. Request its irq only when atmel,oc is set in device tree. devm_gpiod_get_index_optional returns NULL if -ENOENT. Check its return value for NULL before error, because it is more probable that atmel,oc is not set. This fixes the following errors on boards where atmel,oc is not set in device tree: [ 0.960000] at91_ohci 500000.ohci: failed to request gpio "overcurrent" IRQ [ 0.960000] at91_ohci 500000.ohci: failed to request gpio "overcurrent" IRQ [ 0.970000] at91_ohci 500000.ohci: failed to request gpio "overcurrent" IRQ Signed-off-by: Tudor Ambarus Acked-by: Nicolas Ferre Signed-off-by: Greg Kroah-Hartman commit 3c53e2352a9bf87128e7a8ddb69c7543941a3092 Author: Arnd Bergmann Date: Tue Oct 2 23:11:12 2018 +0200 nvmem: hide unused nvmem_find_cell_by_index function nvmem_find_cell_by_index() is only called from inside an #ifdef, so we get a build warning without CONFIG_OF: drivers/nvmem/core.c:496:1: error: 'nvmem_find_cell_by_index' defined but not used [-Werror=unused-function] Move it into the same #ifdef as the caller to avoid the warning. Fixes: e888d445ac33 ("nvmem: resolve cells from DT at registration time") Signed-off-by: Arnd Bergmann Acked-by: Srinivas Kandagatla Signed-off-by: Greg Kroah-Hartman commit 098ec84f1ad2f7b9a4c88bf61fab021ac2876173 Author: Bartosz Golaszewski Date: Wed Oct 3 09:24:30 2018 +0200 nvmem: lpc18xx_eeprom: remove unused variable Remove a variable that's no longer used from lpc18xx_eeprom_remove(). Signed-off-by: Bartosz Golaszewski Reported-by: Stephen Rothwell Acked-by: Srinivas Kandagatla Signed-off-by: Greg Kroah-Hartman commit cccb3b19e762edc8ef0481be506967555cb9e317 Author: Bartosz Golaszewski Date: Wed Oct 3 09:31:11 2018 +0200 nvmem: fix nvmem_cell_get_from_lookup() We check if the pointer returned by __nvmem_device_get() is not NULL while we should actually check if it is not IS_ERR(nvmem). Fix it. While we're at it: fix the next error path where we should assign an error value to cell before returning. Signed-off-by: Bartosz Golaszewski Reported-by: Stephen Rothwell Acked-by: Srinivas Kandagatla Signed-off-by: Greg Kroah-Hartman commit badcdff107cbfd7fef5f089260177efc56fe1a9f Author: Rob Herring Date: Wed Oct 3 18:47:04 2018 +0100 nvmem: Convert to using %pOFn instead of device_node.name In preparation to remove the node name pointer from struct device_node, convert printf users to use the %pOFn format specifier. Cc: Srinivas Kandagatla Signed-off-by: Rob Herring [srinivas: rebased on top of next] Signed-off-by: Srinivas Kandagatla Signed-off-by: Greg Kroah-Hartman commit 074d6f32689ce05a084b6fa3db38445745bf11cc Author: Honghui Zhang Date: Mon Oct 15 16:08:52 2018 +0800 PCI: mediatek: Fix mtk_pcie_find_port() endpoint/port matching logic The Mediatek's host controller has two slots, each with its own control registers. The host driver needs to identify what slot is connected to what port in order to access the device's configuration space. Current code retrieving slot connected to a given endpoint device. Assuming each slot is connected to one endpoint device as below: host bridge bus 0 --> __________|_______ | | | | slot 0 slot 1 bus 1 -->| bus 2 --> | | | EP 0 EP 1 During PCI enumeration, system software will scan all the PCI devices on every bus starting from devfn 0. Using PCI_SLOT(devfn) for matching an endpoint to its slot is erroneous in that the devfn does not contain the hierarchical bus numbering in it. In order to match an endpoint with its slot (and related port), the PCI tree must be walked up to the root bus (where the root ports are situated) and then the PCI_SLOT(devfn) matching logic can be correctly applied for matching. This patch fixes the mtk_pcie_find_port() slot matching logic by adding appropriate PCI tree walking code to retrieve the slot/port a given endpoint is connected to. Signed-off-by: Honghui Zhang [lorenzo.pieralisi@arm.com: rewrote the commit log] Signed-off-by: Lorenzo Pieralisi Acked-by: Ryder Lee commit 5571f1e65486be025f73fa6aa30fb03725d362a2 Author: Dan Schatzberg Date: Thu Oct 11 08:17:00 2018 -0700 fuse: enable caching of symlinks FUSE file reads are cached in the page cache, but symlink reads are not. This patch enables FUSE READLINK operations to be cached which can improve performance of some FUSE workloads. In particular, I'm working on a FUSE filesystem for access to source code and discovered that about a 10% improvement to build times is achieved with this patch (there are a lot of symlinks in the source tree). Signed-off-by: Miklos Szeredi commit 9a2eb24d1a349f53e20f3d4503568551561eed23 Author: Miklos Szeredi Date: Mon Oct 15 15:43:06 2018 +0200 fuse: only invalidate atime in direct read After sending a synchronous READ request from __fuse_direct_read() we only need to invalidate atime; none of the other attributes should be changed by a read(). Signed-off-by: Miklos Szeredi commit 802dc0497be2b538ca4300704b45b59bffe29585 Author: Miklos Szeredi Date: Mon Oct 15 15:43:06 2018 +0200 fuse: don't need GETATTR after every READ If 'auto_inval_data' mode is active, then fuse_file_read_iter() will call fuse_update_attributes(), which will check the attribute validity and send a GETATTR request if some of the attributes are no longer valid. The page cache is then invalidated if the size or mtime have changed. Then, if a READ request was sent and reply received (which is the case if the data wasn't cached yet, or if the file is opened for O_DIRECT), the atime attribute is invalidated. This will result in the next read() also triggering a GETATTR, ... This can be fixed by only sending GETATTR if the mode or size are invalid, we don't need to do a refresh if only atime is invalid. More generally, none of the callers of fuse_update_attributes() need an up-to-date atime value, so for now just remove STATX_ATIME from the request mask when attributes are updated for internal use. Signed-off-by: Miklos Szeredi commit 2f1e81965fd0f672c3246e751385cdfe8f86bbee Author: Miklos Szeredi Date: Mon Oct 15 15:43:06 2018 +0200 fuse: allow fine grained attr cache invaldation This patch adds the infrastructure for more fine grained attribute invalidation. Currently only 'atime' is invalidated separately. The use of this infrastructure is extended to the statx(2) interface, which for now means that if only 'atime' is invalid and STATX_ATIME is not specified in the mask argument, then no GETATTR request will be generated. Signed-off-by: Miklos Szeredi commit edfa87281f4fa1b78a21f6db999935a2faa2f6b8 Author: Miklos Szeredi Date: Mon Oct 15 15:43:06 2018 +0200 bitops: protect variables in bit_clear_unless() macro Unprotected naming of local variables within bit_clear_unless() can easily lead to using the wrong scope. Noticed this by code review after having hit this issue in set_mask_bits() Signed-off-by: Miklos Szeredi Fixes: 85ad1d13ee9b ("md: set MD_CHANGE_PENDING in a atomic region") Cc: Guoqing Jiang commit 18127429a854e7607b859484880b8e26cee9ddab Author: Miklos Szeredi Date: Mon Oct 15 15:43:06 2018 +0200 bitops: protect variables in set_mask_bits() macro Unprotected naming of local variables within the set_mask_bits() can easily lead to using the wrong scope. Noticed this when "set_mask_bits(&foo->bar, 0, mask)" behaved as no-op. Signed-off-by: Miklos Szeredi Fixes: 00a1a053ebe5 ("ext4: atomically set inode->i_flags in ext4_set_inode_flags()") Cc: Theodore Ts'o commit fd82cc3020a024fc97fbc0a5242c26d06bb5e203 Author: Chaotian Jing Date: Sat Oct 13 15:20:50 2018 +0800 mmc: mediatek: drop too much code of tuning method the tuning code is becoming more and more bloated, let's make the set cmd/data delay to inline function to avoid too much redundant code. Signed-off-by: Chaotian Jing Signed-off-by: Ulf Hansson commit a2e6d1f6b30dc8f51456ace6132a243f77cde686 Author: Chaotian Jing Date: Sat Oct 13 15:20:49 2018 +0800 mmc: mediatek: add MT8183 MMC driver support MT8183 puts the tune register at top layer, so need add new code to support it. Signed-off-by: Chaotian Jing Signed-off-by: Ulf Hansson commit 86601d0eac2de45f86a908e5b3591d86878e3143 Author: Chaotian Jing Date: Sat Oct 13 15:20:48 2018 +0800 mmc: mediatek: tune CMD/DATA together for MSDC IP which supports both data tune and async fifo, it can tune cmd/data together. which can save the time and make the tune result of CMD more stable as data line are 4bit or 8bit. Signed-off-by: Chaotian Jing Signed-off-by: Ulf Hansson commit f38a9774ddde9d79b3487dd888edd8b8623552af Author: Chaotian Jing Date: Sat Oct 13 15:20:47 2018 +0800 mmc: mediatek: fix cannot receive new request when msdc_cmd_is_ready fail when msdc_cmd_is_ready return fail, the req_timeout work has not been inited and cancel_delayed_work() will return false, then, the request return directly and never call mmc_request_done(). so need call mod_delayed_work() before msdc_cmd_is_ready() Signed-off-by: Chaotian Jing Signed-off-by: Ulf Hansson commit 56f6cbbed0463f1c78d602b17c315916cc1cd238 Author: Chaotian Jing Date: Sat Oct 13 15:20:46 2018 +0800 mmc: mediatek: fill the actual clock for mmc debugfs as the mmc core layer has the mmc->actual_clock, so fill it and drop msdc_host->sclk. Signed-off-by: Chaotian Jing Signed-off-by: Ulf Hansson commit 0b1a69fd8394b3ce62045b2012489c3870f06763 Author: Chaotian Jing Date: Sat Oct 13 15:20:45 2018 +0800 mmc: dt-bindings: add support for MT8183 SoC Add the devicetree binding for MT8183 SoC Signed-off-by: Chaotian Jing Signed-off-by: Ulf Hansson commit 90f835414067b104d9249e279413dfa65abb99b6 Author: Masahiro Yamada Date: Fri Oct 12 23:57:38 2018 +0900 mmc: uniphier-sd: avoid using broken DMA RX channel host->chan_rx is NULL when UNIPHIER_SD_CAP_BROKEN_DMA_RX quirk flag is set. In this case, it should not set up DMA. Signed-off-by: Masahiro Yamada Acked-by: Wolfram Sang Signed-off-by: Ulf Hansson commit b7ced87746ebaad2ce2306061293be268575ed44 Author: Masahiro Yamada Date: Fri Oct 12 23:57:37 2018 +0900 mmc: uniphier-sd: fix DMA disabling Once DMA is enabled, it is not possible to disable it because uniphier_sd_dma_endisable() always sets the DMA_ENABLE_DMASDRW bit regardless of the argument 'enable'. It should disable DMA when 'enable' is false. Signed-off-by: Masahiro Yamada Acked-by: Wolfram Sang Signed-off-by: Ulf Hansson commit d3dd5db0c1b904e71690ef8cfaebd562d8e865b1 Author: Masahiro Yamada Date: Sat Oct 13 00:03:08 2018 +0900 mmc: tmio: simplify the DMA mode test host->chan_{rx,tx} represents the DMA capability of the platform. Even if DMA is supported, there are cases where we want to use PIO, for example, data length is short enough as commit 5f52c3552946 ("mmc: tmio: use PIO for short transfers") mentioned. Regarding the hardware control flow, we are interested in whether DMA is currently enabled or not, instead of whether the platform has the DMA capability. Hence, the several conditionals in tmio_mmc_core.c end up with checking host->chan_{rx,tx} and !host->force_pio. This is not nice. Let's flip the flag host->force_pio into host->dma_on. host->dma_on represents whether the DMA is currently enabled or not. This flag is set false in the beginning of each command, then should be set true by tmio_mmc_start_dma() when the DMA is turned on. Signed-off-by: Masahiro Yamada Reviewed-by: Wolfram Sang Tested-by: Wolfram Sang Signed-off-by: Ulf Hansson commit 722fb61e2ed39473297157839ec7230b77fd6940 Author: Masahiro Yamada Date: Wed Oct 10 12:51:32 2018 +0900 mmc: tmio: remove TMIO_MMC_HAVE_HIGH_REG flag TMIO_MMC_HAVE_HIGH_REG is confusing due to its counter-intuitive name. All the TMIO MMC variants (TMIO MMC, Renesas SDHI, UniPhier SD) actually have high registers. It is just that each of them implements its own registers there. The original IP from Panasonic only defines registers 0x00-0xff in the bus_shift=1 review. The register area above them is platform-dependent. In fact, TMIO_MMC_HAVE_HIGH_REG is set only by tmio-mmc.c and used to test the accessibility of CTL_SDIO_REGS. Because it is specific to the TMIO MFD variant, the right thing to do is to move such registers to tmio_mmc.c and delete the TMIO_MMC_HAVE_HIGH_REG flag. Signed-off-by: Masahiro Yamada Reviewed-by: Wolfram Sang Tested-by: Wolfram Sang Signed-off-by: Ulf Hansson commit acb9fce7309a38d25be7331375012b9481f20b27 Author: Masahiro Yamada Date: Wed Oct 10 12:51:31 2018 +0900 mmc: tmio: move MFD variant reset to a platform hook CTL_RESET_SDIO register is specific to the TMIO MFD (tmio_mmc.c). Add a new hook host->reset() for performing a platform-specific reset sequence, and move CTL_RESET_SDIO over there. Signed-off-by: Masahiro Yamada Reviewed-by: Wolfram Sang Tested-by: Wolfram Sang Signed-off-by: Ulf Hansson commit 60ab43ba6b6e0f888aab3ce0f84a8aaf15d15079 Author: Fabrizio Castro Date: Mon Oct 8 09:51:49 2018 +0100 mmc: renesas_sdhi: Add r8a77470 SDHI1 support The RZ/G1C (a.k.a. R8A77470) comes with three SDHI interfaces, SDHI0 and SDHI2 are compatible with the R-Car Gen2 SDHIs, SDHI1 is compatible with R-Car Gen3 SDHIs and it can be used as eMMC as well. This patch adds driver compatibility, and makes sure both drivers get compiled for the R8A77470. Signed-off-by: Fabrizio Castro Reviewed-by: Biju Das Signed-off-by: Ulf Hansson commit be6f8db406a49511a8d213f9443ae79fe5b086c3 Author: Fabrizio Castro Date: Mon Oct 8 09:51:47 2018 +0100 dt-bindings: mmc: renesas_sdhi: Add r8a77470 support The RZ/G1C (a.k.a. R8A77470) comes with three SDHI interfaces, SDHI0 and SDHI2 are compatible with R-Car Gen2 SDHIs, and SDHI1 is compatible with R-Car Gen3 SDHIs, as it comes with an internal DMAC, therefore SDHI1 is fully compatible with driver renesas_sdhi_internal_dmac driver. As a result, the compatible strings for the R8A77470 SDHI interfaces are a little bit special. Document SDHI support for the RZ/G1C SoC. Signed-off-by: Fabrizio Castro Reviewed-by: Biju Das Reviewed-by: Geert Uytterhoeven Reviewed-by: Simon Horman Reviewed-by: Rob Herring Signed-off-by: Ulf Hansson commit f34c6e6257aa477cdfe7e9bbbecd3c5648ecda69 Author: Sergei Shtylyov Date: Fri Oct 12 22:48:22 2018 +0300 spi: sh-msiof: fix deferred probing Since commit 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq") platform_get_irq() can return -EPROBE_DEFER. However, the driver overrides an error returned by that function with -ENOENT which breaks the deferred probing. Propagate upstream an error code returned by platform_get_irq() and remove the bogus "platform" from the error message, while at it... Fixes: 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq") Signed-off-by: Sergei Shtylyov Signed-off-by: Mark Brown commit 6530adeaaf5018cd13437dc82adcd9349657a00e Author: Mac Chiang Date: Tue Oct 9 15:37:08 2018 +0800 ASoC: Intel: common: Add Kabylake Dialog+Maxim machine driver entry This patch adds da7219_max98927 machine driver entry into machine table Signed-off-by: Mac Chiang Signed-off-by: Mark Brown commit bca0ac1d96739c07ee1a158e4b1202260ad7480e Author: Mac Chiang Date: Tue Oct 9 15:35:47 2018 +0800 ASoC: Intel: Boards: Add KBL Dialog Maxim I2S machine driver This patch adds Kabylake I2S machine driver with: DA7219 audio codec(SSP1) and MAXIM98927(SSP0) speaker amplifier. Signed-off-by: Mac Chiang Signed-off-by: Mark Brown commit 2657c6a9037df1c98eb5dae10dd554ac8c37d38f Author: Akshu Agrawal Date: Mon Oct 15 12:24:44 2018 +0530 ASoC: AMD: Add SND_JACK_LINEOUT jack type Some 3 pole connectors report impedance greater than threshold of 1000Ohm. Thus, da7219 reports them as LINEOUT. Adding the SND_JACK_LINEOUT type so that we don't fail to detect any 3 pole jack type. Also, changing SND_JACK_HEADPHONE | SND_JACK_MICROPHONE -> SND_JACK_HEADSET Signed-off-by: Akshu Agrawal Signed-off-by: Mark Brown commit b5130dc2224d1881f24224c0590c6d97f2168d6a Author: Janosch Frank Date: Tue Oct 2 10:57:52 2018 +0200 s390/sthyi: Fix machine name validity indication When running as a level 3 guest with no host provided sthyi support sclp_ocf_cpc_name_copy() will only return zeroes. Zeroes are not a valid group name, so let's not indicate that the group name field is valid. Also the group name is not dependent on stsi, let's not return based on stsi before setting it. Fixes: 95ca2cb57985 ("KVM: s390: Add sthyi emulation") Signed-off-by: Janosch Frank Signed-off-by: Martin Schwidefsky commit 9434f5d3bef97c7212ef6d96d7783e3a3a6c1cb5 Author: Harald Freudenberger Date: Fri Oct 12 08:35:24 2018 +0200 s390/zcrypt: fix broken zcrypt_send_cprb in-kernel api function With the new multi zcrypt device node support there came in a code rework which broke the in-kernel api function zcrypt_send_cprb(). This function is used by the pkey kernel module and as an effect, transforming a secure key into a protected key did not work any more. Signed-off-by: Harald Freudenberger Signed-off-by: Martin Schwidefsky commit 63239e4bf7eff394d2bcba95999d6e3eae2be6a6 Author: Linus Walleij Date: Mon Oct 15 11:02:40 2018 +0200 regulator: Fetch enable gpiods nonexclusive Since the core regulator code is treating GPIO descriptors as nonexclusive, i.e. it assumes that the enable GPIO line may be shared with several regulators, let's add the flag introduced for fixing this problem on fixed regulators to all drivers fetching GPIO descriptors to avoid possible regressions. Reported-by: Mark Brown Signed-off-by: Linus Walleij Signed-off-by: Mark Brown commit 8d4b6bce2559755cf2db6513a267fccdfbf7c3ab Author: Michal Kubecek Date: Fri Oct 12 14:24:44 2018 +0200 xfrm: use complete IPv6 addresses for hash In some environments it is common that many hosts share the same lower half of their IPv6 addresses (in particular ::1). As __xfrm6_addr_hash() and __xfrm6_daddr_saddr_hash() calculate the hash only from the lower halves, as much as 1/3 of the hosts ends up in one hashtable chain which harms the performance. Use complete IPv6 addresses when calculating the hashes. Rather than just adding two more words to the xor, use jhash2() for consistency with __xfrm6_pref_hash() and __xfrm6_dpref_spref_hash(). Signed-off-by: Michal Kubecek Signed-off-by: Steffen Klassert commit c6aed238b7a9b15a5c90a0c31f1d36577b5d2cbe Author: Loic Pallardy Date: Fri Jul 27 15:14:47 2018 +0200 remoteproc: modify vring allocation to rely on centralized carveout allocator Current version of rproc_alloc_vring function supports only dynamic vring allocation. This patch allows to allocate vrings based on memory region declatation. Vrings are now manage like memory carveouts, to communize memory management code in rproc_alloc_registered_carveouts(). Allocated buffer is retrieved in rp_find_vq() thanks to rproc_find_carveout_by_name() functions for. This patch sets vrings names to vdev"x"vring"y" with x vdev index in resource table and y vring index in vdev. This will be updated when name will be associated to vdev in firmware resource table. Signed-off-by: Loic Pallardy Signed-off-by: Bjorn Andersson commit 9e753ba9b9b405e3902d9f08aec5f2ea58a0c317 Author: Shaohua Li Date: Sun Oct 14 17:05:07 2018 -0700 MD: fix invalid stored role for a disk - try2 Commit d595567dc4f0 (MD: fix invalid stored role for a disk) broke linear hotadd. Let's only fix the role for disks in raid1/10. Based on Guoqing's original patch. Reported-by: kernel test robot Cc: Gioh Kim Cc: Guoqing Jiang Signed-off-by: Shaohua Li commit 921060ccdae9756f645bcf42ca27fd3ad3a352ff Merge: d864991b220b f95cd52476de Author: David S. Miller Date: Sun Oct 14 13:04:54 2018 -0700 Merge tag 'wireless-drivers-next-for-davem-2018-10-14' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next Kalle Valo says: ==================== wireless-drivers-next patches for 4.20 Third set of patches for 4.20. Most notable is finalising ath10k wcn3990 support, all components should be implemented now. Major changes: ath10k * support NET_DETECT WoWLAN feature * wcn3990 basic functionality now working after we got QMI support mt76 * mt76x0e improvements (should be usable now) * more mt76x0/mt76x2 unification work brcmsmac * fix a problem on AP mode with clients using power save mode iwlwifi * support for a new scan type: fast balance ==================== Signed-off-by: David S. Miller commit 8f94004e2a51a3ea195cf3447eb5d5906f36d8b3 Author: Jens Axboe Date: Sun Oct 14 13:20:48 2018 -0600 cdrom: don't attempt to fiddle with cdo->capability We can't modify cdo->capability as it is defined as a const. Change the modification hack to just WARN_ON_ONCE() if we hit any of the invalid combinations. This fixes a regression for pcd, which doesn't work after the constify patch. Fixes: 853fe1bf7554 ("cdrom: Make device operations read-only") Tested-by: Ondrej Zary Signed-off-by: Jens Axboe commit 5e27891e88555fecd8262e110e1a29feca4b0166 Author: Jens Axboe Date: Fri Oct 12 09:24:57 2018 -0600 block: remove bogus check for queue_lock assignment We just allocated the queue and haven't even set it up yet, hence we know that checking if ->mq_ops is NULL is always going to be true. In fact we do need to assign a lock to ->queue_lock always, as we need it for the queue flags modifications. Signed-off-by: Jens Axboe commit e50b1e327aeb4b224364aa6f85c1713ff8b3654b Author: Jens Axboe Date: Thu Oct 11 17:58:17 2018 -0600 null_blk: remove legacy IO path We're planning on removing this code completely, kill the old path. Signed-off-by: Jens Axboe commit 4e6da0fe8058df9bfa937902fcd9cb2b7b89b2df Author: Richard Weinberger Date: Sun Nov 26 13:33:11 2017 +0100 um: Convert ubd driver to blk-mq Convert the driver to the modern blk-mq framework. As byproduct we get rid of our open coded restart logic and let blk-mq handle it. Signed-off-by: Richard Weinberger Signed-off-by: Jens Axboe commit 6d1f9dfde7343c4ebfb8f84dcb333af571bb3b22 Author: Jens Axboe Date: Thu Oct 11 14:56:14 2018 -0600 skd: fixup usage of legacy IO API We need to be using the mq variant of request requeue here. Fixes: ca33dd92968b ("skd: Convert to blk-mq") Signed-off-by: Jens Axboe commit 3582dd291788e9441c3ba9047e55089edb98da5c Author: Jens Axboe Date: Fri Oct 12 10:03:14 2018 -0600 aoe: convert aoeblk to blk-mq Straight forward conversion - instead of rewriting the internal buffer retrieval logic, just replace the previous elevator peeking with an internal list of requests. Reviewed-by: "Ed L. Cashin" Signed-off-by: Jens Axboe commit 7fa3069dfcf82d9c84197f7dae2759cc9bf80667 Author: Michael Straube Date: Sun Oct 14 12:17:42 2018 +0200 staging: rtl8188eu: remove whitespace - style Remove extra space in variable declaration. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman commit 18e1aec85941bbc767c59a8cbe08cebfee22d507 Author: Michael Straube Date: Sun Oct 14 12:17:41 2018 +0200 staging: rtl8188eu: rename Hal_MappingOutPipe() - style Rename Hal_MappingOutPipe() to avoid CamelCase. Hal_MappingOutPipe -> hal_mapping_out_pipe Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman commit 30d046f2a7932dcef346949296065edae95d6ede Author: Michael Straube Date: Sun Oct 14 12:17:40 2018 +0200 staging: rtl8188eu: rename parameters of Hal_MappingOutPipe() - style Rename parameters of Hal_MappingOutPipe() in header to avoid CamelCase and match the names used in the function definition in hal_com.c. pAdapter -> adapter NumOutPipe -> numoutpipe Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman commit b96ec4e874e6a91980277d231062c693235a1c72 Author: Michael Straube Date: Sun Oct 14 12:17:39 2018 +0200 staging: rtl8188eu: rename parameter of hal_com_get_channel_plan() - style Rename parameter of hal_com_get_channel_plan() in header to avoid CamelCase and match the name used in the function definition in hal_com.c. AutoLoadFail -> load_fail Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman commit b4a6b11cd2a83062fe3da5d2ef060f3feda9c05d Author: Michael Straube Date: Sun Oct 14 12:17:38 2018 +0200 staging: rtl8188eu: remove unused parameter of hal_com_get_channel_plan() The parameter 'struct adapter *padapter' of hal_com_get_channel_plan() is unused, so remove it. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman commit aa906bb630157fc772d26b70b58d43c79715d4ef Author: Michael Straube Date: Sun Oct 14 12:17:37 2018 +0200 staging: rtl8188eu: rename HalSetBrateCfg() - style Rename HalSetBrateCfg() to avoid CamelCase. HalSetBrateCfg -> hal_set_brate_cfg Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman commit a7ce32d1430e3b365ad196b66adabbf723b3d4c6 Author: Michael Straube Date: Sun Oct 14 12:17:36 2018 +0200 staging: rtl8188eu: rename parameters of HalSetBrateCfg() - style Rename parameters of HalSetBrateCfg() in header to avoid CamelCase and match the names used in the function definition in hal_com.c. mBratesOS -> brates BrateCfg -> rate_cfg Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman commit 6d475d38e6a5a32ac8f840cc6e351db1806c1404 Author: Michael Straube Date: Sun Oct 14 12:17:35 2018 +0200 staging: rtl8188eu: remove unused parameter of HalSetBrateCfg() The parameter 'struct adapter *adapt' of HalSetBrateCfg() is unused, so remove it. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman commit 8525589130e8a37b63bacec8ef6dbea2dab01216 Author: Michael Straube Date: Thu Oct 11 21:57:12 2018 +0200 staging: rtl8188eu: remove whitespace in qos_acm() Remove whitespace in qos_acm() to improve readability. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman commit e0437819db68e060f11bcec3f79b92b0382bfbdb Author: Michael Straube Date: Thu Oct 11 21:57:11 2018 +0200 staging: rtl8188eu: cleanup long lines in stop_sta_xmit() Line break lines over 80 characters in stop_sta_xmit() to clear checkpatch warnings. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman commit d7c252002b53498f8f30147730ed39a0551762b3 Author: Michael Straube Date: Thu Oct 11 21:57:10 2018 +0200 staging: rtl8188eu: cleanup long lines in rtw_get_sta_pending() Line break lines over 80 characters in rtw_get_sta_pending() to clear checkpatch warnings. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman commit 909495c8db610d840ddcefb08c212d6e319574ee Author: Michael Straube Date: Thu Oct 11 21:57:09 2018 +0200 staging: rtl8188eu: cleanup block comments Cleanup block comments to clear 'please, no space before tabs' and 'line over 80 characters' checkpatch warnings. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman commit 1330c795c57368d4259402aa4b9ae6fdea5858e1 Author: Michael Straube Date: Thu Oct 11 21:57:08 2018 +0200 staging: rtl8188eu: remove commented code Remove unused commented code in the file core/rte_xmit.c. Clears 'please, no space before tabs' and 'line over 80 characters' checkpatch warnings. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman commit f996f37471d89a3c3ec6e52b9cef6413665fddd0 Author: Michael Straube Date: Thu Oct 11 21:57:07 2018 +0200 staging: rtl8188eu: cleanup alignment issue Clear a 'Alignment should match open parenthesis' checkpatch issue. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman commit cac04b1fc6a41c26f81713a115dcc16ecde65118 Author: Michael Straube Date: Thu Oct 11 21:57:06 2018 +0200 staging: rtl8188eu: use __func__ in qos_acm() Use __func__ instead of hardcoded name in qos_acm(). Reported by checkpatch. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman commit a66ecb24f24251e55a74070d0a025157411377a3 Author: Michael Straube Date: Thu Oct 11 21:57:05 2018 +0200 staging: rtl8188eu: cleanup missing spaces around operators Clear all missing spaces around operators checkpatch issues in the file core/rtw_xmit.c. Use '+=' or '-=' where possible. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman commit fde54ecea2be9506fc25f62dd3d9dd6dda0f761f Author: Colin Ian King Date: Fri Oct 12 23:31:37 2018 +0100 staging: rtl8188eu: fix spelling mistake "EINPROGESS" -> "EINPROGRESS" Trivial fix to spelling mistake in RT_TRACE message text. Signed-off-by: Colin Ian King Signed-off-by: Greg Kroah-Hartman commit 9e269dcdec5bbbe6680c1a5473e1788f88db1b08 Author: Colin Ian King Date: Fri Oct 12 16:07:27 2018 +0100 staging: rtlwifi: phydm: fix spelling mistake "Abnrormal" -> "Abnormal" Trivial fix to spelling mistake in message text Signed-off-by: Colin Ian King Signed-off-by: Greg Kroah-Hartman commit 2a5b8d97c67cdc9c18f98950948e41ed4fdb11dc Author: Colin Ian King Date: Fri Oct 12 16:02:36 2018 +0100 staging: rtl8188eu: fix spelling mistake "Abnornally" -> "Abnormally" Trivial fix to spelling mistake in ODM_RT_TRACE trace message Signed-off-by: Colin Ian King Signed-off-by: Greg Kroah-Hartman commit a7ed5b3e7dca197de4da6273940a7ca6d1d756a1 Author: Gustavo A. R. Silva Date: Thu Oct 11 21:05:20 2018 +0200 staging: comedi: tio: fix multiple missing break in switch bugs Currently, there are multiple missing break statements in two switch code blocks. This makes the execution path to fall all the way down through to the default cases, which makes the function ni_tio_set_gate_src() to always return -EINVAL. Fix this by adding the missing break statements. Also, notice that due to the absence of the break statements, the following pieces of code are unreachable: 1078 if (ret) 1079 return ret; 1080 /* 3. reenable & set mode to starts things back up */ 1081 ni_tio_set_gate_mode(counter, src); 1098 if (ret) 1099 return ret; 1100 /* 3. reenable & set mode to starts things back up */ 1101 ni_tio_set_gate2_mode(counter, src); So, by adding the missing breaks, this patch also fixes the problem above. Addresses-Coverity-ID: 1474165 ("Missing break in switch") Addresses-Coverity-ID: 1474162 ("Structurally dead code") Fixes: 347e244884c3 ("staging: comedi: tio: implement global tio/ctr routing") Signed-off-by: Gustavo A. R. Silva Reviewed-by: Ian Abbott Signed-off-by: Greg Kroah-Hartman commit 370a1b573d1d70c7adcdc1cb3da772337fe0a286 Author: Nishad Kamdar Date: Thu Oct 11 21:39:29 2018 +0530 staging: mt7621-mmc: Use BIT macro instead of explicit shifting in dbg.h Replace explicit shifting with BIT macro in dbg.h. Issue found by checkpatch. Signed-off-by: Nishad Kamdar Signed-off-by: Greg Kroah-Hartman commit 23f5fb5d87bd6dc85ccd042f7d531bd50b928988 Author: Nishad Kamdar Date: Thu Oct 11 21:37:57 2018 +0530 staging: mt7621-mmc: Fix lines over 80 characters in dbg.h This patch fixes lines over 80 characters in dbg.h. Issue found by checkpatch. Signed-off-by: Nishad Kamdar Signed-off-by: Greg Kroah-Hartman commit 01378deb37d46fa05061ec7cca09e8b75fbdc1a7 Author: Nishad Kamdar Date: Thu Oct 11 21:36:19 2018 +0530 staging: mt7621-mmc: Fix lines over 80 characters in dbg.c This patch fixes lines over 80 characters in dbg.c. Issue found by checkpatch. Signed-off-by: Nishad Kamdar Signed-off-by: Greg Kroah-Hartman commit d840eb63baed31af29e8d9993944808854837bf9 Author: Mamta Shukla Date: Fri Oct 12 23:01:07 2018 +0530 staging: rtl8723bs: os_dep: Shift * to be adjacent to pointer name Shift * to be adjacent to pointer name to follow Linux coding style. Issue found with checkpatch.pl ERROR: "foo * bar" should be "foo *bar" Signed-off-by: Mamta Shukla Acked-by:Larry Finger Signed-off-by: Greg Kroah-Hartman commit 90b217a74be46f9a99eb053b886c63c1547477ef Author: Colin Ian King Date: Fri Oct 12 16:05:32 2018 +0100 staging: rtl8723bs: fix spelling mistake "Abnrormal" -> "Abnormal" Trivial fix to spelling mistake in message text Signed-off-by: Colin Ian King Signed-off-by: Greg Kroah-Hartman commit f95cd52476dee761a1a8ebe617dd01793e0eb39c Merge: 6bfa6975f1b7 ba94c753ccb4 Author: Kalle Valo Date: Sun Oct 14 12:21:43 2018 +0300 Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git ath.git patches for 4.20. Major changes: ath10k * support NET_DETECT WoWLAN feature * wcn3990 basic functionality now working after we got QMI support commit 6bfa6975f1b72e3e65fb27eedabbe8348322f20a Merge: 03ce6f8a6776 bbd10586f0df Author: Kalle Valo Date: Sun Oct 14 11:40:41 2018 +0300 Merge tag 'mt76-for-kvalo-2018-10-13' of https://github.com/nbd168/wireless mt76 patches for 4.20 * mt76x0 fixes * mt76x0e improvements (should be usable now) * usb support improvements * more mt76x0/mt76x2 unification work * minor fix for aggregation + powersave clients commit d17010bf6301b62df09f7878f3474f42ee0754eb Author: Colin Ian King Date: Wed Oct 10 15:37:31 2018 +0100 Bluetooth: Remove redundant check on status The check on status is redundant as a status has to be zero at the point it is being checked because of a previous check and return path via label 'unlock'. Remove the redundant check and the deadcode that can never be reached. Detected by CoverityScan, CID#1471710 ("Logically dead code") Signed-off-by: Colin Ian King Signed-off-by: Marcel Holtmann commit dd1a8f8a88eecbc903f9ffff12332bec6d3f3be3 Author: Mallikarjun Phulari Date: Fri Oct 5 14:48:13 2018 +0530 Bluetooth: Errata Service Release 8, Erratum 3253 L2CAP: New result values 0x0006 - Connection refused – Invalid Source CID 0x0007 - Connection refused – Source CID already allocated As per the ESR08_V1.0.0, 1.11.2 Erratum 3253, Page No. 54, "Remote CID invalid Issue". Applies to Core Specification versions: V5.0, V4.2, v4.1, v4.0, and v3.0 + HS Vol 3, Part A, Section 4.2, 4.3, 4.14, 4.15. Core Specification Version 5.0, Page No.1753, Table 4.6 and Page No. 1767, Table 4.14 New result values are added to l2cap connect/create channel response as 0x0006 - Connection refused – Invalid Source CID 0x0007 - Connection refused – Source CID already allocated Signed-off-by: Mallikarjun Phulari Signed-off-by: Marcel Holtmann commit 571f739083e2544b343b5998608de679519de4e9 Author: Mallikarjun Phulari Date: Fri Oct 5 14:48:12 2018 +0530 Bluetooth: Use separate L2CAP LE credit based connection result values Add the result values specific to L2CAP LE credit based connections and change the old result values wherever they were used. Signed-off-by: Mallikarjun Phulari Signed-off-by: Marcel Holtmann commit 70ecdd3d8b36cd2bb960bc4e7ae047fbb94c031b Author: Cho, Yu-Chen Date: Tue Oct 2 17:57:04 2018 +0800 Bluetooth: btsdio: Do not bind to non-removable BCM43430 BCM43430 devices soldered onto the PCB (non-removable) use an UART connection for bluetooth. But also advertise btsdio support on their 3th sdio function. Signed-off-by: Cho, Yu-Chen Signed-off-by: Marcel Holtmann commit 23fdf223bbe4bd42bbb3f0f5b9d5e64a58956ef7 Author: Christoph Hellwig Date: Sat Oct 13 17:17:03 2018 +0200 ALSA: asihpi: don't pass GFP_DMA32 to dma_alloc_coherent The DMA API does its own zone decisions based on the coherent_dma_mask. [ Note: as the driver doesn't set the DMA coherent mask, we can assume the default 32bit DMA, hence it should be safe to drop the flag here -- tiwai ] Signed-off-by: Christoph Hellwig Signed-off-by: Takashi Iwai commit 4ffe713b7587b14695c9bec26a000fc88ef54895 Author: Aneesh Kumar K.V Date: Thu Sep 20 14:03:58 2018 +0530 powerpc/mm: Increase the max addressable memory to 2PB Currently we limit the max addressable memory to 128TB. This patch increase the limit to 2PB. We can have devices like nvdimm which adds memory above 512TB limit. We still don't support regular system ram above 512TB. One of the challenge with that is the percpu allocator, that allocates per node memory and use the max distance between them as the percpu offsets. This means with large gap in address space ( system ram above 1PB) we will run out of vmalloc space to map the percpu allocation. In order to support addressable memory above 512TB, kernel should be able to linear map this range. To do that with hash translation we now add 4 context to kernel linear map region. Our per context addressable range is 512TB. We still keep VMALLOC and VMEMMAP region to old size. SLB miss handlers is updated to validate these limit. We also limit this update to SPARSEMEM_VMEMMAP and SPARSEMEM_EXTREME Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman commit c9f80734cd552ddba50567bc43b0ff250a4b2c17 Author: Aneesh Kumar K.V Date: Thu Sep 20 14:03:57 2018 +0530 powerpc/mm/hash: Rename get_ea_context to get_user_context We will be adding get_kernel_context later. Update function name to indicate this handle context allocation user space address. Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman commit e15a4fea4dee2771c6989862527546b2b3326799 Author: Nicholas Piggin Date: Wed Oct 3 00:27:59 2018 +1000 powerpc/64s/hash: Add some SLB debugging tests This adds CONFIG_DEBUG_VM checks to ensure: - The kernel stack is in the SLB after it's flushed and bolted. - We don't insert an SLB for an address that is aleady in the SLB. - The kernel SLB miss handler does not take an SLB miss. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman commit 94ee42727ce06522787a28476465becace1c238b Author: Nicholas Piggin Date: Wed Oct 3 00:27:58 2018 +1000 powerpc/64s/hash: Simplify slb_flush_and_rebolt() slb_flush_and_rebolt() is misleading, it is called in virtual mode, so it can not possibly change the stack, so it should not be touching the shadow area. And since vmalloc is no longer bolted, it should not change any bolted mappings at all. Change the name to slb_flush_and_restore_bolted(), and have it just load the kernel stack from what's currently in the shadow SLB area. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman commit 5434ae74629af58ad0fc27143a9ea435f7734410 Author: Nicholas Piggin Date: Sat Sep 15 01:30:56 2018 +1000 powerpc/64s/hash: Add a SLB preload cache When switching processes, currently all user SLBEs are cleared, and a few (exec_base, pc, and stack) are preloaded. In trivial testing with small apps, this tends to miss the heap and low 256MB segments, and it will also miss commonly accessed segments on large memory workloads. Add a simple round-robin preload cache that just inserts the last SLB miss into the head of the cache and preloads those at context switch time. Every 256 context switches, the oldest entry is removed from the cache to shrink the cache and require fewer slbmte if they are unused. Much more could go into this, including into the SLB entry reclaim side to track some LRU information etc, which would require a study of large memory workloads. But this is a simple thing we can do now that is an obvious win for common workloads. With the full series, process switching speed on the context_switch benchmark on POWER9/hash (with kernel speculation security masures disabled) increases from 140K/s to 178K/s (27%). POWER8 does not change much (within 1%), it's unclear why it does not see a big gain like POWER9. Booting to busybox init with 256MB segments has SLB misses go down from 945 to 69, and with 1T segments 900 to 21. These could almost all be eliminated by preloading a bit more carefully with ELF binary loading. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman commit 425d33146260a4a2e8a1ba64003d6c8ff3bdfcc4 Author: Nicholas Piggin Date: Sat Sep 15 01:30:55 2018 +1000 powerpc/64s/hash: Provide arch_setup_exec() hooks for hash slice setup This will be used by the SLB code in the next patch, but for now this sets the slb_addr_limit to the correct size for 32-bit tasks. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman commit 126b11b294d15a90e38eb2dcded2433619b2c794 Author: Nicholas Piggin Date: Sat Sep 15 01:30:53 2018 +1000 powerpc/64s/hash: Add SLB allocation status bitmaps Add 32-entry bitmaps to track the allocation status of the first 32 SLB entries, and whether they are user or kernel entries. These are used to allocate free SLB entries first, before resorting to the round robin allocator. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman commit 48e7b76957457f9a6f086ca2bbe49ec1ffd75f84 Author: Nicholas Piggin Date: Sat Sep 15 01:30:51 2018 +1000 powerpc/64s/hash: Convert SLB miss handlers to C This patch moves SLB miss handlers completely to C, using the standard exception handler macros to set up the stack and branch to C. This can be done because the segment containing the kernel stack is always bolted, so accessing it with relocation on will not cause an SLB exception. Arbitrary kernel memory must not be accessed when handling kernel space SLB misses, so care should be taken there. However user SLB misses can access any kernel memory, which can be used to move some fields out of the paca (in later patches). User SLB misses could quite easily reconcile IRQs and set up a first class kernel environment and exit via ret_from_except, however that doesn't seem to be necessary at the moment, so we only do that if a bad fault is encountered. [ Credit to Aneesh for bug fixes, error checks, and improvements to bad address handling, etc ] Signed-off-by: Nicholas Piggin [mpe: Disallow tracing for all of slb.c for now.] Signed-off-by: Michael Ellerman commit 4c2de74cc8696154b283f241d74ec0bb24438e22 Author: Nicholas Piggin Date: Sat Oct 13 00:15:16 2018 +1100 powerpc/64: Interrupts save PPR on stack rather than thread_struct PPR is the odd register out when it comes to interrupt handling, it is saved in current->thread.ppr while all others are saved on the stack. The difficulty with this is that accessing thread.ppr can cause a SLB fault, but the SLB fault handler implementation in C change had assumed the normal exception entry handlers would not cause an SLB fault. Fix this by allocating room in the interrupt stack to save PPR. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman commit 3eeacd9f4ea33546f272fcf131d6a11edbe3b4a6 Author: Michael Ellerman Date: Sat Oct 13 00:39:31 2018 +1100 powerpc/ptrace: Don't use sizeof(struct pt_regs) in ptrace code Now that we've split the user & kernel versions of pt_regs we need to be more careful in the ptrace code. For now we've ensured the location of the fields in both structs is the same, so most of the ptrace code doesn't need updating. But there are a few places where we use sizeof(pt_regs), and these will be wrong as soon as we increase the size of the kernel structure. So flip them all to use sizeof(user_pt_regs). Signed-off-by: Michael Ellerman commit 002af9391bfbe84f8e491bb10bd9c6001a6becee Author: Michael Ellerman Date: Fri Oct 12 23:13:17 2018 +1100 powerpc: Split user/kernel definitions of struct pt_regs We use a shared definition for struct pt_regs in uapi/asm/ptrace.h. That means the layout of the structure is ABI, ie. we can't change it. That would be fine if it was only used to describe the user-visible register state of a process, but it's also the struct we use in the kernel to describe the registers saved in an interrupt frame. We'd like more flexibility in the content (and possibly layout) of the kernel version of the struct, but currently that's not possible. So split the definition into a user-visible definition which remains unchanged, and a kernel internal one. At the moment they're still identical, and we check that at build time. That's because we have code (in ptrace etc.) that assumes that they are the same. We will fix that code in future patches, and then we can break the strict symmetry between the two structs. Signed-off-by: Michael Ellerman commit 7f995d3ba6f2bfbe274f5a012f5b549f881e78fe Author: Benjamin Herrenschmidt Date: Thu May 31 14:33:41 2018 +1000 powerpc/prom_init: Make "default_colors" const It's never modified. Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Michael Ellerman commit 30c69ca0486fd73f2e5d40096ee68bfaed469b76 Author: Benjamin Herrenschmidt Date: Thu May 31 14:33:40 2018 +1000 powerpc/prom_init: Make "fake_elf" const It is never modified Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Michael Ellerman commit 3bad719b495467a7e7023c5b26f0f5a523a4a193 Author: Benjamin Herrenschmidt Date: Thu May 31 14:33:39 2018 +1000 powerpc/prom_init: Make of_workarounds static It's not used anywhere else. Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Michael Ellerman commit 1b2443a547f91cf7f89eed6bddb07394dafae24e Author: Christophe Leroy Date: Tue Oct 9 13:52:20 2018 +0000 powerpc/book3s64: Avoid multiple endian conversion in pte helpers In the same spirit as already done in pte query helpers, this patch changes pte setting helpers to perform endian conversions on the constants rather than on the pte value. In the meantime, it changes pte_access_permitted() to use pte helpers for the same reason. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit ff00552578ba30e2e1625fb559b43f8d082b6522 Author: Christophe Leroy Date: Tue Oct 9 13:52:18 2018 +0000 powerpc/8xx: change name of a few page flags to avoid confusion _PAGE_PRIVILEGED corresponds to the SH bit which doesn't protect against user access but only disables ASID verification on kernel accesses. User access is controlled with _PMD_USER flag. Name it _PAGE_SH instead of _PAGE_PRIVILEGED _PAGE_HUGE corresponds to the SPS bit which doesn't really tells that's it is a huge page but only that it is not a 4k page. Name it _PAGE_SPS instead of _PAGE_HUGE Reviewed-by: Aneesh Kumar K.V Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 5662315384fcb3d81125562124cf4e1743aa2c3a Author: Christophe Leroy Date: Tue Oct 9 13:52:16 2018 +0000 powerpc/mm: Get rid of pte-common.h Do not include pte-common.h in nohash/32/pgtable.h As that was the last includer, get rid of pte-common.h Reviewed-by: Aneesh Kumar K.V Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit cbcbbf4afd6d38272bf0119d890caa5ebba6fe4c Author: Christophe Leroy Date: Tue Oct 9 13:52:14 2018 +0000 powerpc/mm: Define platform default caches related flags Cache related flags like _PAGE_COHERENT and _PAGE_WRITETHRU are defined on most platforms. The platforms not defining them don't define any alternative. So we can give them a NUL value directly for those platforms directly. Reviewed-by: Aneesh Kumar K.V Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit a0da4bc166f21d88400ec91e01b815054561804e Author: Christophe Leroy Date: Tue Oct 9 13:52:12 2018 +0000 powerpc/mm: Allow platforms to redefine some helpers The 40xx defines _PAGE_HWWRITE while others don't. The 8xx defines _PAGE_RO instead of _PAGE_RW. The 8xx defines _PAGE_PRIVILEGED instead of _PAGE_USER. The 8xx defines _PAGE_HUGE and _PAGE_NA while others don't. Lets those platforms redefine pte_write(), pte_wrprotect() and pte_mkwrite() and get _PAGE_RO and _PAGE_HWWRITE off the common helpers. Lets the 8xx redefine pte_user(), pte_mkprivileged() and pte_mkuser() and get rid of _PAGE_PRIVILEGED and _PAGE_USER default values. Lets the 8xx redefine pte_mkhuge() and get rid of _PAGE_HUGE default value. Reviewed-by: Aneesh Kumar K.V Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 6c5d2d3fd376c6b4b8d8624b53dbdda966ce762b Author: Christophe Leroy Date: Tue Oct 9 13:52:10 2018 +0000 powerpc/nohash/64: do not include pte-common.h nohash/64 only uses book3e PTE flags, so it doesn't need pte-common.h This also allows to drop PAGE_SAO and H_PAGE_4K_PFN from pte_common.h as they are only used by PPC64 Reviewed-by: Aneesh Kumar K.V Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit d82fd29c5a8caafdc88c6c59c18019a7a5975d99 Author: Christophe Leroy Date: Tue Oct 9 13:52:08 2018 +0000 powerpc/mm: Distribute platform specific PAGE and PMD flags and definitions The base kernel PAGE_XXXX definition sets are more or less platform specific. Lets distribute them close to platform _PAGE_XXX flags definition, and customise them to their exact platform flags. Also defines _PAGE_PSIZE and _PTE_NONE_MASK for each platform allthough they are defined as 0. Do the same with _PMD flags like _PMD_USER and _PMD_PRESENT_MASK Reviewed-by: Aneesh Kumar K.V Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit e0f57031ca0b52f7db4bad57db4037a7daa546c3 Author: Christophe Leroy Date: Tue Oct 9 13:52:06 2018 +0000 powerpc/mm: Move pte_user() into nohash/pgtable.h Now the pte-common.h is only for nohash platforms, lets move pte_user() helper out of pte-common.h to put it together with other helpers. Reviewed-by: Aneesh Kumar K.V Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit b2133bd7a553ae22c5cd849e3229197d4517fdb0 Author: Christophe Leroy Date: Tue Oct 9 13:52:04 2018 +0000 powerpc/book3s/32: do not include pte-common.h As done for book3s/64, add necessary flags/defines in book3s/32/pgtable.h and do not include pte-common.h It allows in the meantime to remove all related hash definitions from pte-common.h and to also remove _PAGE_EXEC default as _PAGE_EXEC is defined on all platforms except book3s/32. Reviewed-by: Aneesh Kumar K.V Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit f4805785f068a29f3be757d837cfc05903a8afe8 Author: Christophe Leroy Date: Tue Oct 9 13:52:02 2018 +0000 powerpc/mm: move __P and __S tables in the common pgtable.h __P and __S flags are the same for all platform and should remain as is in the future, so avoid duplication. Reviewed-by: Aneesh Kumar K.V Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 093d7ca22920c79ecdda87614ac4c5e3786068d6 Author: Christophe Leroy Date: Tue Oct 9 13:52:00 2018 +0000 powerpc/mm: drop unused page flags The following page flags in pte-common.h can be dropped: _PAGE_ENDIAN is only used in mm/fsl_booke_mmu.c and is defined in asm/nohash/32/pte-fsl-booke.h _PAGE_4K_PFN is nowhere defined nor used _PAGE_READ, _PAGE_WRITE and _PAGE_PTE are only defined and used in book3s/64 The following page flags in book3s/64/pgtable.h can be dropped as they are not used on this platform nor by common code. _PAGE_NA, _PAGE_RO, _PAGE_USER and _PAGE_PSIZE Reviewed-by: Aneesh Kumar K.V Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 97026b5a5ac26541b3d294146f5c941491a9e609 Author: Christophe Leroy Date: Tue Oct 9 13:51:58 2018 +0000 powerpc/mm: Split dump_pagelinuxtables flag_array table To reduce the complexity of flag_array, and allow the removal of default 0 value of non existing flags, lets have one flag_array table for each platform family with only the really existing flags. Reviewed-by: Aneesh Kumar K.V Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 26973fa5ac0e3b88d0d476caccfc10839b26098b Author: Christophe Leroy Date: Tue Oct 9 13:51:56 2018 +0000 powerpc/mm: use pte helpers in generic code Get rid of platform specific _PAGE_XXXX in powerpc common code and use helpers instead. mm/dump_linuxpagetables.c will be handled separately Reviewed-by: Aneesh Kumar K.V Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 34eb138ed74dc95285478903148a53bd034829be Author: Christophe Leroy Date: Tue Oct 9 13:51:54 2018 +0000 powerpc/mm: don't use _PAGE_EXEC for calling hash_preload() The 'access' parameter of hash_preload() is either 0 or _PAGE_EXEC. Among the two versions of hash_preload(), only the PPC64 one is doing something with this 'access' parameter. In order to remove the use of _PAGE_EXEC outside platform code, 'access' parameter is replaced by 'is_exec' which will be either true of false, and the PPC64 version of hash_preload() creates the access flag based on 'is_exec'. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit daba790242dfbdf6ef1bcabf3d6ed4c88cccf59a Author: Christophe Leroy Date: Tue Oct 9 13:51:52 2018 +0000 powerpc/mm: add pte helpers to query and change pte flags In order to avoid using generic _PAGE_XXX flags in powerpc core functions, define helpers for all needed flags: - pte_mkuser() and pte_mkprivileged() to set/unset and/or unset/set _PAGE_USER and/or _PAGE_PRIVILEGED - pte_hashpte() to check if _PAGE_HASHPTE is set. - pte_ci() check if cache is inhibited (already existing on book3s/64) - pte_exprotect() to protect against execution - pte_exec() and pte_mkexec() to query and set page execution - pte_mkpte() to set _PAGE_PTE flag. - pte_hw_valid() to check _PAGE_PRESENT since pte_present does something different on book3s/64. On book3s/32 there is no exec protection, so pte_mkexec() and pte_exprotect() are nops and pte_exec() returns always true. Reviewed-by: Aneesh Kumar K.V Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit aa9cd505e39d63034243c9c1ea8b0a984a6b201f Author: Christophe Leroy Date: Tue Oct 9 13:51:50 2018 +0000 powerpc/mm: move some nohash pte helpers in nohash/[32:64]/pgtable.h In order to allow their use in nohash/32/pgtable.h, we have to move the following helpers in nohash/[32:64]/pgtable.h: - pte_mkwrite() - pte_mkdirty() - pte_mkyoung() - pte_wrprotect() Reviewed-by: Aneesh Kumar K.V Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit d81e6f8b7c6600c891cd133312061d23d4e6690c Author: Christophe Leroy Date: Tue Oct 9 13:51:47 2018 +0000 powerpc/mm: don't use _PAGE_EXEC in book3s/32 book3s/32 doesn't define _PAGE_EXEC, so no need to use it. All other platforms define _PAGE_EXEC so no need to check it is not NUL when not book3s/32. Reviewed-by: Aneesh Kumar K.V Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit c766ee72235d09b0080f77474085fc17d6ae2fb1 Author: Christophe Leroy Date: Tue Oct 9 13:51:45 2018 +0000 powerpc: handover page flags with a pgprot_t parameter In order to avoid multiple conversions, handover directly a pgprot_t to map_kernel_page() as already done for radix. Do the same for __ioremap_caller() and __ioremap_at(). Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 56f3c1413f5cce0c8f4d6f1ab79d790da5aa61af Author: Christophe Leroy Date: Tue Oct 9 13:51:43 2018 +0000 powerpc/mm: properly set PAGE_KERNEL flags in ioremap() Set PAGE_KERNEL directly in the caller and do not rely on a hack adding PAGE_KERNEL flags when _PAGE_PRESENT is not set. As already done for PPC64, use pgprot_cache() helpers instead of _PAGE_XXX flags in PPC32 ioremap() derived functions. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit aa91796ec46339f2ed53da311bd3ea77a3e4dfe1 Author: Christophe Leroy Date: Tue Oct 9 13:51:41 2018 +0000 powerpc: don't use ioremap_prot() nor __ioremap() unless really needed. In many places, ioremap_prot() and __ioremap() can be replaced with higher level functions like ioremap(), ioremap_coherent(), ioremap_cache(), ioremap_wc() ... Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 402a5698b4462a3dcfcf9bdafabed7f63c9be7d8 Author: Christophe Leroy Date: Tue Oct 9 13:51:39 2018 +0000 soc/fsl/qbman: use ioremap_cache() instead of ioremap_prot(0) ioremap_prot() with flag set to 0 relies on a hack in __ioremap_caller() which adds PAGE_KERNEL flags when the handed flags don't look like a valid set of flags (ie don't include _PAGE_PRESENT) The intention being to map cached memory, use ioremap_cache() instead. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit 67e89ac32828a29adc74e5c9bd59bd70943466f0 Author: Joe Stringer Date: Fri Oct 12 14:50:53 2018 -0700 bpf: Fix dev pointer dereference from sk_skb Dan Carpenter reports: The patch 6acc9b432e67: "bpf: Add helper to retrieve socket in BPF" from Oct 2, 2018, leads to the following Smatch complaint: net/core/filter.c:4893 bpf_sk_lookup() error: we previously assumed 'skb->dev' could be null (see line 4885) Fix this issue by checking skb->dev before using it. Signed-off-by: Joe Stringer Signed-off-by: Alexei Starovoitov commit e01ad46d53b59720c6ae69963ee1756506954c85 Author: Jianchao Wang Date: Fri Oct 12 18:07:28 2018 +0800 blk-mq: fallback to previous nr_hw_queues when updating fails When we try to increate the nr_hw_queues, we may fail due to shortage of memory or other reason, then blk_mq_realloc_hw_ctxs stops and some entries in q->queue_hw_ctx are left with NULL. However, because queue map has been updated with new nr_hw_queues, some cpus have been mapped to hw queue which just encounters allocation failure, thus blk_mq_map_queue could return NULL. This will cause panic in following blk_mq_map_swqueue. To fix it, when increase nr_hw_queues fails, fallback to previous nr_hw_queues and post warning. At the same time, driver's .map_queues usually use completion irq affinity to map hw and cpu, fallback nr_hw_queues will cause lack of some cpu's map to hw, so use default blk_mq_map_queues to do that. Reported-by: syzbot+83e8cbe702263932d9d4@syzkaller.appspotmail.com Signed-off-by: Jianchao Wang Signed-off-by: Jens Axboe commit 34d11ffac1f56c3895dad32153abd6814452dc77 Author: Jianchao Wang Date: Fri Oct 12 18:07:27 2018 +0800 blk-mq: realloc hctx when hw queue is mapped to another node When the hw queues and mq_map are updated, a hctx could be mapped to a different numa node. At this moment, we need to realloc the hctx. If fail to do that, go on using previous hctx. Signed-off-by: Jianchao Wang Signed-off-by: Jens Axboe commit 5b202853ffbc54b29f23c4b1b5f3948efab489a2 Author: Jianchao Wang Date: Fri Oct 12 18:07:26 2018 +0800 blk-mq: change gfp flags to GFP_NOIO in blk_mq_realloc_hw_ctxs blk_mq_realloc_hw_ctxs could be invoked during update hw queues. At the momemt, IO is blocked. Change the gfp flags from GFP_KERNEL to GFP_NOIO to avoid forever hang during memory allocation in blk_mq_realloc_hw_ctxs. Signed-off-by: Jianchao Wang Signed-off-by: Jens Axboe commit 477e19dedc9d3e1f4443a1d4ae00572a988120ea Author: Jianchao Wang Date: Fri Oct 12 18:07:25 2018 +0800 blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues blk-mq debugfs and sysfs entries need to be removed before updating queue map, otherwise, we get get wrong result there. This patch fixes it and remove the redundant debugfs and sysfs register/unregister operations during __blk_mq_update_nr_hw_queues. Signed-off-by: Jianchao Wang Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 2d29c9f89fcd9bf408fcdaaf515c90a169f22ecd Author: Federico Motta Date: Fri Oct 12 11:55:57 2018 +0200 block, bfq: improve asymmetric scenarios detection bfq defines as asymmetric a scenario where an active entity, say E (representing either a single bfq_queue or a group of other entities), has a higher weight than some other entities. If the entity E does sync I/O in such a scenario, then bfq plugs the dispatch of the I/O of the other entities in the following situation: E is in service but temporarily has no pending I/O request. In fact, without this plugging, all the times that E stops being temporarily idle, it may find the internal queues of the storage device already filled with an out-of-control number of extra requests, from other entities. So E may have to wait for the service of these extra requests, before finally having its own requests served. This may easily break service guarantees, with E getting less than its fair share of the device throughput. Usually, the end result is that E gets the same fraction of the throughput as the other entities, instead of getting more, according to its higher weight. Yet there are two other more subtle cases where E, even if its weight is actually equal to or even lower than the weight of any other active entities, may get less than its fair share of the throughput in case the above I/O plugging is not performed: 1. other entities issue larger requests than E; 2. other entities contain more active child entities than E (or in general tend to have more backlog than E). In the first case, other entities may get more service than E because they get larger requests, than those of E, served during the temporary idle periods of E. In the second case, other entities get more service because, by having many child entities, they have many requests ready for dispatching while E is temporarily idle. This commit addresses this issue by extending the definition of asymmetric scenario: a scenario is asymmetric when - active entities representing bfq_queues have differentiated weights, as in the original definition or (inclusive) - one or more entities representing groups of entities are active. This broader definition makes sure that I/O plugging will be performed in all the above cases, provided that there is at least one active group. Of course, this definition is very coarse, so it will trigger I/O plugging also in cases where it is not needed, such as, e.g., multiple active entities with just one child each, and all with the same I/O-request size. The reason for this coarse definition is just that a finer-grained definition would be rather heavy to compute. On the opposite end, even this new definition does not trigger I/O plugging in all cases where there is no active group, and all bfq_queues have the same weight. So, in these cases some unfairness may occur if there are asymmetries in I/O-request sizes. We made this choice because I/O plugging may lower throughput, and probably a user that has not created any group cares more about throughput than about perfect fairness. At any rate, as for possible applications that may care about service guarantees, bfq already guarantees a high responsiveness and a low latency to soft real-time applications automatically. Signed-off-by: Federico Motta Signed-off-by: Paolo Valente Signed-off-by: Jens Axboe commit ba94c753ccb471bafe8bd824b744fda6fee0001e Author: Govind Singh Date: Thu Oct 11 13:16:26 2018 +0300 ath10k: add QMI message handshake for wcn3990 client Add WCN3990 QMI client handshakes for Q6 integrated WLAN connectivity subsystem. This layer is responsible for communicating qmi control messages to wifi fw QMI service using QMI messaging protocol. Qualcomm MSM Interface(QMI) is a messaging format used to communicate between components running between remote processors with underlying transport layer based on integrated chipset(shared memory) or discrete chipset(PCI/USB/SDIO/UART). Signed-off-by: Govind Singh Reviewed-by: Bjorn Andersson Acked-by: Niklas Cassel Reviewed-by: Brian Norris Signed-off-by: Kalle Valo commit 35a6657667375d1564f9e9b75491c9e41b04c51f Author: Govind Singh Date: Thu Oct 11 13:16:14 2018 +0300 ath10k: add debug mask for QMI layer Add debug mask to control debug info of ath10k qmi messaging layer. Signed-off-by: Govind Singh Acked-by: Niklas Cassel Reviewed-by: Brian Norris Signed-off-by: Kalle Valo commit cc53aabcc283c36274d3f3ce9adc4b40c21d4838 Author: Govind Singh Date: Thu Oct 11 13:16:01 2018 +0300 firmware: qcom: scm: Add WLAN VMID for Qualcomm SCM interface Add WLAN related VMID's to support wlan driver to set up the remote's permissions call via TrustZone. Signed-off-by: Govind Singh Reviewed-by: Bjorn Andersson Acked-by: Niklas Cassel Reviewed-by: Brian Norris Signed-off-by: Kalle Valo commit 2b741a8aaa342fc0694b84e16245090e32594db2 Author: Govind Singh Date: Thu Oct 11 13:15:49 2018 +0300 dt: bindings: add bindings for msa memory region Add device tree binding documentation details of msa memory region for ath10k qmi client for SDM845/APQ8098 SoC into "qcom,ath10k.txt". Signed-off-by: Govind Singh Reviewed-by: Bjorn Andersson Acked-by: Niklas Cassel Reviewed-by: Brian Norris Reviewed-by: Rob Herring Signed-off-by: Kalle Valo commit 22e8a46027387b4e8db75f73ede9bbf337115e9c Author: Rakesh Pillai Date: Thu Oct 11 13:11:45 2018 +0300 ath10k: add support to create boardname for non-bmi target Add support to create the boardname for non-bmi targets like WCN3990, which uses qmi for bdf download. This boardname is used to parse the board data from board-2.bin. Signed-off-by: Rakesh Pillai Signed-off-by: Govind Singh Acked-by: Niklas Cassel Reviewed-by: Brian Norris Signed-off-by: Kalle Valo commit bc17d4b90cdd3e557d195937c0003260dfce67d6 Author: Govind Singh Date: Thu Oct 11 13:11:32 2018 +0300 ath10k: add qmi service helpers for wcn3990 qmi client WLAN qmi server running in Q6 exposes host to target cold boot qmi handshakes. Add WLAN QMI service helpers for ath10k wcn3990 qmi client. Signed-off-by: Govind Singh Reviewed-by: Bjorn Andersson Acked-by: Niklas Cassel Reviewed-by: Brian Norris Signed-off-by: Kalle Valo commit f9dca154a4e4d185bad15a431f0ff095cd931df6 Author: YueHaibing Date: Fri Oct 5 11:07:26 2018 +0000 wil6210: fix debugfs_simple_attr.cocci warnings Use DEFINE_DEBUGFS_ATTRIBUTE rather than DEFINE_SIMPLE_ATTRIBUTE for debugfs files. Semantic patch information: Rationale: DEFINE_SIMPLE_ATTRIBUTE + debugfs_create_file() imposes some significant overhead as compared to DEFINE_DEBUGFS_ATTRIBUTE + debugfs_create_file_unsafe(). Generated by: scripts/coccinelle/api/debugfs/debugfs_simple_attr.cocci Signed-off-by: YueHaibing Signed-off-by: Kalle Valo commit 72569b7be461ad563c8118c50f26692e53a189bc Author: Arnd Bergmann Date: Tue Oct 9 18:03:06 2018 +0200 ath9k: fix RX_STAT_INC() etc macros A couple of macros that deal with statistics in ath9k rely on the declaration of the 'sc' variable, which they dereference. However, when the statistics are disabled, the new instance in ath_cmn_process_fft() causes a warning for an unused variable: drivers/net/wireless/ath/ath9k/common-spectral.c: In function 'ath_cmn_process_fft': drivers/net/wireless/ath/ath9k/common-spectral.c:474:20: error: unused variable 'sc' [-Werror=unused-variable] It's better if those macros only operate on their arguments instead of known variable names, and adding a cast to (void) kills off that warning. Fixes: 03224678c013 ("ath9k: add counters for good and errorneous FFT/spectral frames") Signed-off-by: Arnd Bergmann Signed-off-by: Kalle Valo commit e3bfecd5cd37a93c47c146c41d5f1fde7405b592 Author: Dan Carpenter Date: Thu Oct 11 11:09:20 2018 +0300 ath10k: htt: remove some dead code We added an unnecessary condition here in commit a904417fc876 ("ath10k: add extended per sta tx statistics support"). "legacy_rate_idx" is a u8 so it can't be negative. The caller doesn't pass negatives either. I have deleted this code. Signed-off-by: Dan Carpenter Signed-off-by: Kalle Valo commit 0738b4998c6d1caf9ca2447b946709a7278c70f1 Author: Carl Huang Date: Thu Oct 11 15:55:26 2018 +0800 ath10k: allocate small size dma memory in ath10k_pci_diag_write_mem ath10k_pci_diag_write_mem may allocate big size of the dma memory based on the parameter nbytes. Take firmware diag download as example, the biggest size is about 500K. In some systems, the allocation is likely to fail because it can't acquire such a large contiguous dma memory. The fix is to allocate a small size dma memory. In the loop, driver copies the data to the allocated dma memory and writes to the destination until all the data is written. Tested with QCA6174 PCI with firmware-6.bin_WLAN.RM.4.4.1-00119-QCARMSWP-1, this also affects QCA9377 PCI. Signed-off-by: Carl Huang Reviewed-by: Brian Norris Signed-off-by: Kalle Valo commit 9de4162f099948ad85871b8b2ed61e84f139cb5a Author: Wen Gong Date: Mon Oct 8 17:02:43 2018 +0800 ath10k: add peer flush in ath10k_flush for STATION In the noisy environment, if there are packets in the queue and can't send out, the suspend timing will be more than 5 seconds due to the wait, flush the queue to optimize the suspend timing, and let the upper layer to retry the packets after resume. Tested with QCA6174 PCI with firmware WLAN.RM.4.4.1-00109-QCARMSWPZ-1, but this will also affect QCA9377 PCI. It's not a regression with new firmware releases. Signed-off-by: Wen Gong Signed-off-by: Kalle Valo commit 7bfd82bff60ef572b9acef8ca32669ace1f50664 Author: Gustavo A. R. Silva Date: Fri Oct 5 20:56:23 2018 +0200 ath10k: remove unnecessary comparison of unsigned integer with < 0 There is no need to compare *ps_state_enable* with < 0 because such variable is of type u8 (8 bits, unsigned), making it impossible to hold a negative value. Fix this by removing such comparison. Addresses-Coverity-ID: 1473921 ("Unsigned compared against 0") Signed-off-by: Gustavo A. R. Silva Signed-off-by: Kalle Valo commit 9d9cdbf3f9edbcc0d4f2b4d17f3329315c5f84ad Author: Gustavo A. R. Silva Date: Fri Oct 5 20:42:45 2018 +0200 ath10k: htt_rx: fix signedness bug in ath10k_update_per_peer_tx_stats Currently, the error handling for the call to function ath10k_get_legacy_rate_idx() doesn't work because *rate_idx* is of type u8 (8 bits, unsigned), which makes it impossible for it to hold a value less than 0. Fix this by changing the type of variable *rate_idx* to s8 (8 bits, signed). Addresses-Coverity-ID: 1473914 ("Unsigned compared against 0") Fixes: 0189dbd71cbd ("ath10k: get the legacy rate index to update the txrate table") Signed-off-by: Gustavo A. R. Silva Signed-off-by: Kalle Valo commit 6bc17950f4b2459f8d50b999ace6b30b505aee50 Author: Balaji Pothunoori Date: Mon Sep 10 11:54:30 2018 +0530 ath10k: management tx ack rssi capability check Adding WMI service check for management tx ack rssi support; this is done to maintain common avg ack signal in user level for both data and management tx ack packet. Tested on QCA4019(fw version-10.4-3.2.1-00063). Signed-off-by: Balaji Pothunoori Signed-off-by: Kalle Valo commit ce834e280f2f8753ab0432fb5b1912547abc5330 Author: Wen Gong Date: Thu Oct 4 08:45:31 2018 +0300 ath10k: support NET_DETECT WoWLAN feature For WoWLAN support it is expected to support wake up based on discovery of one or more known SSIDs. This is the WIPHY_WOWLAN_NET_DETECT feature, which shows up as an NL80211 feature flag. This shows up in 'iw phy' as: WoWLAN support: * wake up on network detection, up to 16 match sets And it can be enabled with command: iw phy0 wowlan enable net-detect interval 5000 delay 30 freqs 2412 matches ssid foo Firmware will do scan by the configured parameters after suspend and wakeup if it found matched SSIDs. Tested with QCA6174 hw3.0 with firmware WLAN.RM.4.4.1-00110-QCARMSWPZ-1. Signed-off-by: Wen Gong [kvalo@codeaurora.org: fix lots of endian bugs, whitespace, commit log and style cleanup] Signed-off-by: Kalle Valo commit f1157695c527d4ee949ac83f743f80107751a70c Author: Rakesh Pillai Date: Tue Oct 2 23:33:13 2018 +0530 ath10k: set probe request oui during driver start Currently the wmi command for setting probe request oui, needed for mac randomization, is sent during the mac register. At this time, during the driver init the wmi has already been detached. This can cause unexpected behavior since the firmware is already down and the wmi has been detached. Send the wmi command for setting probe request oui during the driver start. This will make sure that the firmware is started and wmi is initialized before we send this command. Tested HW: WCN3990 Tested FW: WLAN.HL.2.0-01188-QCAHLSWMTPLZ-1 Fixes: 60e1d0fb290197fe505dff6e4e3b7e4d258dbf60 Signed-off-by: Rakesh Pillai Signed-off-by: Kalle Valo commit 34e141eea7dd8525dd1ef7a925459e455b4d307f Author: Sriram R Date: Wed Oct 3 08:43:50 2018 +0530 ath10k: fix possible out of bound access of ath10k_rates array While using 'ath10k_mac_get_rate_hw_value()' to obtain the hw value from the passed bitrate, there is a chance of out of bound array access when wrong bitrate is passed. This is fixed by comparing the bitrates within the correct size of the ath10k_rates array. Fixes commit f279294e9ee2 ("ath10k: add support for configuring management packet rate"). Also correction made to some indents used in the above commit. Signed-off-by: Sriram R Signed-off-by: Kalle Valo commit 03ce6f8a677692e4e5d5196b4e337555285b8996 Author: YueHaibing Date: Mon Oct 8 14:16:59 2018 +0000 rtl8xxxu: Remove set but not used variables 'usedesc40' and 'seq_number' Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c: In function 'rtl8xxxu_tx': drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c:4925:7: warning: variable 'usedesc40' set but not used [-Wunused-but-set-variable] drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c:4921:6: warning: variable 'seq_number' set but not used [-Wunused-but-set-variable] 'usedesc40' and 'seq_number' are not used any more after commit b59415c2dd08 ("rtl8xxxu: Split filling of TX descriptors into separate functions") Signed-off-by: YueHaibing Signed-off-by: Kalle Valo commit 4cb5054957b24dd83f5747cd1771c790726d7836 Author: Sergey Matyukevich Date: Mon Oct 8 09:56:03 2018 +0000 qtnfmac_pcie: cleanup Pearl platform headers Remove redundant information from Pearl platform headers. Signed-off-by: Sergey Matyukevich Signed-off-by: Kalle Valo commit b458a033ca2fc19115790b2b583dcdc7c1e43886 Author: Sergey Matyukevich Date: Mon Oct 8 09:56:02 2018 +0000 qtnfmac: use SPDX identifier for pcie bus layer files Change pcie bus layer licensing information to SPDX format. Signed-off-by: Sergey Matyukevich Signed-off-by: Kalle Valo commit db62abe51853e2fb3853bd1c3a3f7050cacaa239 Author: Sergey Matyukevich Date: Mon Oct 8 09:56:00 2018 +0000 qtnfmac: use 'help' in Kconfig Fix checkpatch warning: use preferred 'help' option in Kconfig. Signed-off-by: Sergey Matyukevich Signed-off-by: Kalle Valo commit bbc2a101f06beef093dda87bd7de47ad532e5448 Author: Lubomir Rintel Date: Sun Oct 7 02:33:27 2018 +0200 libertas: return errno from lbs_add_card() This makes the error handling somewhat cleaner -- lbs_add_card() does no logner throw away the errno and lets its callers propagate it. Signed-off-by: Lubomir Rintel Signed-off-by: Kalle Valo commit 6528d88047801b80d2a5370ad46fb6eff2f509e0 Author: Lubomir Rintel Date: Sat Oct 6 22:12:32 2018 +0200 libertas: don't set URB_ZERO_PACKET on IN USB transfer The USB core gets rightfully upset: usb 1-1: BOGUS urb flags, 240 --> 200 WARNING: CPU: 0 PID: 60 at drivers/usb/core/urb.c:503 usb_submit_urb+0x2f8/0x3ed Modules linked in: CPU: 0 PID: 60 Comm: kworker/0:3 Not tainted 4.19.0-rc6-00319-g5206d00a45c7 #39 Hardware name: OLPC XO/XO, BIOS OLPC Ver 1.00.01 06/11/2014 Workqueue: events request_firmware_work_func EIP: usb_submit_urb+0x2f8/0x3ed Code: 75 06 8b 8f 80 00 00 00 8d 47 78 89 4d e4 89 55 e8 e8 35 1c f6 ff 8b 55 e8 56 52 8b 4d e4 51 50 68 e3 ce c7 c0 e8 ed 18 c6 ff <0f> 0b 83 c4 14 80 7d ef 01 74 0a 80 7d ef 03 0f 85 b8 00 00 00 8b EAX: 00000025 EBX: ce7d4980 ECX: 00000000 EDX: 00000001 ESI: 00000200 EDI: ce7d8800 EBP: ce7f5ea8 ESP: ce7f5e70 DS: 007b ES: 007b FS: 0000 GS: 00e0 SS: 0068 EFLAGS: 00210292 CR0: 80050033 CR2: 00000000 CR3: 00e80000 CR4: 00000090 Call Trace: ? if_usb_fw_timeo+0x64/0x64 __if_usb_submit_rx_urb+0x85/0xe6 ? if_usb_fw_timeo+0x64/0x64 if_usb_submit_rx_urb_fwload+0xd/0xf if_usb_prog_firmware+0xc0/0x3db ? _request_firmware+0x54/0x47b ? _request_firmware+0x89/0x47b ? if_usb_probe+0x412/0x412 lbs_fw_loaded+0x55/0xa6 ? debug_smp_processor_id+0x12/0x14 helper_firmware_cb+0x3c/0x3f request_firmware_work_func+0x37/0x6f process_one_work+0x164/0x25a worker_thread+0x1c4/0x284 kthread+0xec/0xf1 ? cancel_delayed_work_sync+0xf/0xf ? kthread_create_on_node+0x1a/0x1a ret_from_fork+0x2e/0x38 ---[ end trace 3ef1e3b2dd53852f ]--- Cc: stable@vger.kernel.org Signed-off-by: Lubomir Rintel Signed-off-by: Kalle Valo commit 52a312673aff9baac0d677e0aee068d65dc30467 Author: Jia-Ju Bai Date: Fri Oct 5 21:55:46 2018 +0800 iwlegacy: Add a lock assertion in il4965_send_rxon_assoc() The variables il->staging.filter_flags, rxon1->filter_flags and rxon2->filter_flags need to be protected by the mutex lock il->mutex. This patch adds a lock assertion of il->mutex to check whether this lock is held. Signed-off-by: Jia-Ju Bai Acked-by: Stanislaw Gruszka Signed-off-by: Kalle Valo commit 2258ee58baa554609a3cc3996276e4276f537b6d Author: Ali MJ Al-Nasrawy Date: Wed Oct 3 19:21:39 2018 +0300 brcmsmac: AP mode: update beacon when TIM changes Beacons are not updated to reflect TIM changes. This is not compliant with power-saving client stations as the beacons do not have valid TIM and can cause the network to stall at random occasions and to have highly variable latencies. Fix it by updating beacon templates on mac80211 set_tim callback. Addresses an issue described in: https://marc.info/?i=20180911163534.21312d08%20()%20manjaro Signed-off-by: Ali MJ Al-Nasrawy Signed-off-by: Kalle Valo commit bbd10586f0df1a3ff6abda39c9542458fdfc5686 Author: Lorenzo Bianconi Date: Fri Oct 12 12:16:28 2018 +0200 mt76x0: phy: do not run calibration during channel switch Do not perform phy/vga calibration during channel switch. Moreover remove mt76x0_agc_save and mt76x0_agc_restore routines since they are no longer necessary. Furthermore run mt76_set_channel in order to check if there are pending frames during channel switch Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 4636a2544c3b79b95115bd612455de7c176dadcf Author: Lorenzo Bianconi Date: Fri Oct 12 12:16:27 2018 +0200 mt76x0: phy: align channel gain logic to mt76x2 one Update vga tuning algorithm to the one used in mt76x2 driver Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit e48797e9b6810383badfec429904a369c3e830da Author: Lorenzo Bianconi Date: Fri Oct 12 12:16:26 2018 +0200 mt76: introduce mt76x02_init_agc_gain routine Add mt76x02_init_agc_gain routine in mt76x02-lib moudule in order to be reused by mt76x0 for vga initalization Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 9f884f0f9d000998a3e413232e9efcdbb5901139 Author: Lorenzo Bianconi Date: Fri Oct 12 12:16:25 2018 +0200 mt76: move mt76x02_phy_adjust_vga_gain in mt76/mt76x02_phy.c Move mt76x02_phy_adjust_vga_gain routine in mt76x02-lib module in order to be reused by mt76x0 driver for vga calibration Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit b225a9b6c27ef2a0ea4a5e7fce647c6017b8affb Author: Lorenzo Bianconi Date: Fri Oct 12 12:16:24 2018 +0200 mt76: move rssi_gain_thresh routines in mt76x02-lib module Move mt76x2_get_rssi_gain_thresh and mt76x2_get_low_rssi_gain_thresh routines in mt76x02-lib module in order to be reused by mt76x0 driver for dynamic vga calibration Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 66a34c66e0cbf53c9e5c8b8f4445bf6f271c4571 Author: Lorenzo Bianconi Date: Fri Oct 12 12:16:23 2018 +0200 mt76x0: phy: add phy/vco temperature compensation Introduce phy/vco temperature calibration. Moreover fix configuration of register 67 on bank0 during temperature reading and use mt76_poll utility routine to poll core34 register. Furthermore temperature compensation needs to be disabled if the device supports tssi compensation. This issue has never been hit since temperature reading is not actually used by usb code. Fixes: 10de7a8b4ab9 ("mt76x0: phy files") Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 4afeb39624f376a6eb1e4e7d5f189a5cf82cfd33 Author: Lorenzo Bianconi Date: Fri Oct 12 12:16:22 2018 +0200 mt76x0: eeprom: introduce mt76x0_tssi_enabled routine Add mt76x0_tssi_enabled in order to check if tssi compensation is enabled since mt76x0 condition differs from mt76x2 one. Moreover move back mt76x02_temp_tx_alc_enabled and mt76x02_tssi_enabled routines in mt76x2/eeprom.h since they are mt76x2 specific Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 592ebc9cc6e0e00eeca7e60d534f219ee1f64d6c Author: Lorenzo Bianconi Date: Fri Oct 12 12:16:21 2018 +0200 mt76x0: phy: update set_channel for mt76x0e devices Do not run mt76x0_vco_cal and mt76x0_bbp_set_bw routines and configure MT_TX_SW_CFG0 register for pcie devices in mt76x0_phy_set_channel function. Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 9aec146d0f6b532446b81f3fb3f8b7545b436dc5 Author: Lorenzo Bianconi Date: Fri Oct 12 12:16:20 2018 +0200 mt76x0: pci: introduce mt76x0_phy_calirate routine Add mt76x0_phy_calirate routine in order to perform phy calibration for mt76x0e devices. Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 3eaf05de1b35dbdd9fee2e7ad1b04ee424846814 Author: Lorenzo Bianconi Date: Fri Oct 12 12:16:19 2018 +0200 mt76x0: pci: rename mt76x0_phy_calibrate Rename mt76x0_phy_calibrate routine in mt76x0_phy_calibration_work in order to not collide with calibration routine for mt76x0e Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 370c6415ef34404d4d0b430039da8b0ed30bedf1 Author: Lorenzo Bianconi Date: Fri Oct 12 12:16:18 2018 +0200 mt76: move mt76x02_phy_set_band in mt76x02-lib module Move mt76x02_phy_set_band routine in mt76x02_phy.c since it is shared between mt76x0 and mt76x2 drivers and remove duplicated code Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 032c08f4c675b9a61888055703eca06118a92a3f Author: Lorenzo Bianconi Date: Fri Oct 12 12:16:17 2018 +0200 mt76: move mt76x02_phy_set_bw in mt76x02-lib module Move mt76x02_phy_set_bw routine in mt76x02_phy.c since it is shared between mt76x0 and mt76x2 drivers and remove duplicated code Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 7859c543b65d4621d22dbfd7d884fc0d417a1722 Author: Lorenzo Bianconi Date: Wed Oct 10 12:31:13 2018 +0200 mt76x0: phy: remove channel parameter from mt76x0_phy_set_chan_bbp_params Remove unused channel parameter from mt76x0_phy_set_chan_bbp_params routine signature Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 4df942733fd26d9378a4a00619be348c771e0190 Author: Lorenzo Bianconi Date: Tue Oct 9 10:57:06 2018 +0200 mt76x0: phy: fix restore phase in mt76x0_phy_recalibrate_after_assoc Fix restore value configured in MT_BBP(IBI, 9) register in mt76x0_phy_recalibrate_after_assoc routine. Fixes: 10de7a8b4ab9 ("mt76x0: phy files") Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit ebb632db0f0789d2216fc0e78dd950681b569036 Author: Felix Fietkau Date: Tue Oct 9 10:44:36 2018 +0200 mt76: mt76x0e: another fix for the external PA current setting - Use the register number define instead of a magic value - Fix inverted bit test (override needs to be applied if the bit is not set) Fixes: 2b2cb40bcd7d ("mt76x0: pci: add hw initialization at bootstrap") Signed-off-by: Felix Fietkau commit 69585ef9bb9f326baaad27d7579b3dfaf42bf1e7 Author: YueHaibing Date: Mon Oct 8 13:21:49 2018 +0000 mt76x0: pci: fix set external PA I/O current Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/wireless/mediatek/mt76/mt76x0/pci.c: In function 'mt76x0e_register_device': drivers/net/wireless/mediatek/mt76/mt76x0/pci.c:107:8: warning: variable 'data' set but not used [-Wunused-but-set-variable] It seems correct value to write is 'data' Fixes: 2b2cb40bcd7d ("mt76x0: pci: add hw initialization at bootstrap") Acked-by: Lorenzo Bianconi Signed-off-by: YueHaibing Signed-off-by: Felix Fietkau commit 5155938d8a0fe0e0251435cae02539e81fb8e407 Author: Felix Fietkau Date: Mon Oct 8 10:39:24 2018 +0200 mt76: do not store aggregation sequence number for null-data frames Fixes a rare corner case where a BlockAckReq might get the wrong sequence number. Signed-off-by: Felix Fietkau commit 09580a1ec4e9c3d62c7386e2b227b4a6b586e6b8 Author: Stanislaw Gruszka Date: Mon Oct 8 13:22:20 2018 +0200 mt76x0: remove dma.h dma.h is not used any longer. Signed-off-by: Stanislaw Gruszka Signed-off-by: Felix Fietkau commit f3727daed83279bc1571b23222e7937949e978c6 Author: Stanislaw Gruszka Date: Mon Oct 8 13:22:00 2018 +0200 mt76: reserve enough room for USB tx skbs Reserve enough room for USB skb, so we don not need to check the room every time we send frame. Signed-off-by: Stanislaw Gruszka Signed-off-by: Felix Fietkau commit 4ce78b048c4908118cfd5345f16241f58b85e5c6 Author: Lorenzo Bianconi Date: Sun Oct 7 11:57:22 2018 +0200 mt76x0: pci: add mt76x0_register_device in mt76x0e_register_device Run mt76x0_register_device routine in mt76x0e_register_device in order to register the device to the mac80211 layer. Moreover init mt76_driver_ops data structure and register interrupt line Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 320c85e6d038e75c0b895dde8c10c5d1bf9aab5f Author: Lorenzo Bianconi Date: Sun Oct 7 11:57:21 2018 +0200 mt76: disable ldpc coding for mt76x0 devices Disable ldpc coding for mt76x0 devices. Morover remove mt76x02_mac_fill_txwi routine since it is used just in mt76x02_mac_write_txwi Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 78e62de3227f99d0e18714f49f8a58f3f9a98af6 Author: Lorenzo Bianconi Date: Sun Oct 7 11:57:20 2018 +0200 mt76x0: pci: add missing mac80211 callbacks Add missing mac80211 callbacks in mt76x0e_ops data structure Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 127aa72691ff567ea220c095843bf8d66f84e9af Author: Lorenzo Bianconi Date: Sun Oct 7 11:51:16 2018 +0200 mt76x0: pci: report firmware version using ethtool Report via ethtool fw_ver and build_ver members of mt76x02_fw_header data structure similarly to what is reported in the syslog Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 26a9daa69123f599b95e01c31313e6bbc4047bdb Author: Lorenzo Bianconi Date: Sun Oct 7 11:45:24 2018 +0200 mt76: use mt76x02_dev instead of mt76_dev in mt76x02_eeprom.c Use mt76x02_dev data structure as reference in mt76x02_eeprom.c instead of mt76_dev Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 91be8e8a2c4f72cf5aedaddb27a716bf9b1d0625 Author: Lorenzo Bianconi Date: Sun Oct 7 11:45:23 2018 +0200 mt76: use mt76x02_dev instead of mt76_dev in mt76x02_txrx.c Use mt76x02_dev data structure as reference in mt76x02_txrx.c instead of mt76_dev Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 8d66af49a3db9a74c34c0bbf9b47e376fc1f7019 Author: Lorenzo Bianconi Date: Sun Oct 7 11:45:22 2018 +0200 mt76: use mt76x02_dev instead of mt76_dev in mt76x02_mac.c Use mt76x02_dev data structure as reference in mt76x02_mac.c instead of mt76_dev Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 95c3e451e6277462790b56aac568414c067a11f8 Author: Lorenzo Bianconi Date: Sun Oct 7 11:45:21 2018 +0200 mt76: use mt76x02_dev instead of mt76_dev in mt76x02_usb_mcu.c Use mt76x02_dev data structure as reference in mt76x02_usb_mcu.c instead of mt76_dev Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit d87cf75f11118367f2e85dd049be9cab22ae0138 Author: Lorenzo Bianconi Date: Sun Oct 7 11:45:20 2018 +0200 mt76: use mt76x02_dev instead of mt76_dev in mt76x02_util.c Use mt76x02_dev data structure as reference in mt76x02_util.c instead of mt76_dev Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit bfdff5d03e9bc6837acd0bad574cb263d6e345c3 Author: Lorenzo Bianconi Date: Sun Oct 7 11:45:19 2018 +0200 mt76: use mt76x02_dev instead of mt76_dev in mt76x02_phy.c Use mt76x02_dev data structure as reference in mt76x02_phy.c instead of mt76_dev Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 499cd0aa3ba60e202abf233d7a7b5e8a4b725d37 Author: Lorenzo Bianconi Date: Sun Oct 7 11:45:18 2018 +0200 mt76: use mt76x02_dev instead of mt76_dev in mt76x02_mcu.c Use mt76x02_dev data structure as reference in mt76x02_mcu.c instead of mt76_dev Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit a14054ce0b8ada03a7ddea14e51812e2fd583c94 Author: Lorenzo Bianconi Date: Sun Oct 7 11:37:40 2018 +0200 mt76x0: phy: fix bank check in mt76x0_rf_csr_{wr,rr} Fix typo in bank check in mt76x0_rf_csr_{wr,rr} routines. This issue has never been hit since mt76x0_rf_csr_{wr,rr} are actually used just by pci code Fixes: 10de7a8b4ab9 ("mt76x0: phy files") Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau commit 69cacac3b3ffdd9495e83bc34674d3fab34aaa44 Author: Stanislaw Gruszka Date: Thu Oct 4 12:04:55 2018 +0200 mt76x0: use bus helper to identify rf access method Use mt76_is_usb() to identify RF access method instead of MT76_STATE_MCU_RUNNING flag and add warning since MCU has to be initialized before we can access RF registers via MCU. Signed-off-by: Stanislaw Gruszka Signed-off-by: Felix Fietkau commit f2761e53d69fb851f54429c030fcc6c42ed68a51 Author: Stanislaw Gruszka Date: Thu Oct 4 12:04:54 2018 +0200 mt76x0: correct RF reg pairs write for PCIe We have to use RF CSR method for PCIe. Signed-off-by: Stanislaw Gruszka Signed-off-by: Felix Fietkau commit c50479fa7a9e3379359d188aefc90f17fea216fe Author: Stanislaw Gruszka Date: Thu Oct 4 12:04:53 2018 +0200 mt76: allow to identify bus Add helpers to identify bus type. Signed-off-by: Stanislaw Gruszka Signed-off-by: Felix Fietkau commit 6f223a3dab94b9f39ea89ab9d912dec9bcbca666 Author: Stanislaw Gruszka Date: Thu Oct 4 12:04:52 2018 +0200 mt76x0: correct RF access via RF_CSR register. PCIe version don't use MCU for RF registers access. We need to correct RF CSR method to support up to 127 RF registers. Signed-off-by: Stanislaw Gruszka Signed-off-by: Felix Fietkau commit bed259051dc3ae5754f63fa18b0c5e383b5c1314 Author: Stanislaw Gruszka Date: Thu Oct 4 12:04:51 2018 +0200 mt76x0: print BBP version only for debug Use dev_dbg to print BBP version. Signed-off-by: Stanislaw Gruszka Signed-off-by: Felix Fietkau commit c8ca6e70fb74cd3bb6fc0738aed40991b9de0b87 Author: Marek Behún Date: Wed Oct 10 17:17:27 2018 +0200 watchdog: armada_37xx_wdt: use do_div for u64 division When the driver is built on 32 bit architectures during compile test, the linker complains about "__udivdi3" being undefined. We have to use do_div macro instead of the division operator when dividing u64 value. Signed-off-by: Marek Behún Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit cd69606ad05e1d6a930e2d29ac277c00108ef908 Author: Marek Behún Date: Mon Sep 24 13:06:53 2018 +0200 documentation: watchdog: add documentation for armada-37xx-wdt Add documentation for the kernel module parameters accepted by armada-37xx-wdt. Signed-off-by: Marek Behún Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 8562205592a69dd8817f9ff361fc0ffc55f5e9fe Author: Marek Behún Date: Mon Sep 24 13:06:52 2018 +0200 dt-bindings: watchdog: Document armada-37xx-wdt binding This adds device tree binding documentation for the CPU watchdog found on Armada 37xx SOCs (EspressoBin, Turris Mox). Signed-off-by: Marek Behún Cc: Rob Herring Cc: devicetree@vger.kernel.org Reviewed-by: Rob Herring Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 54e3d9b518c8a2a7a3acb14a5912fafd8ef38f40 Author: Marek Behún Date: Mon Sep 24 13:06:51 2018 +0200 watchdog: Add support for Armada 37xx CPU watchdog This adds support for the CPU watchdog found on Marvell Armada 37xx SoCs. There are 4 counters which can be set as CPU watchdog counters. This driver uses the second counter (ID 1, counting from 0) as watchdog counter, and first counter (ID 0) to implement pinging on the second counter without the need to disable it. Since counters IDs 2 and 3 are enabled already before even U-Boot starts, this driver does not use them at all, for example by adding a device tree property for counter selection. Signed-off-by: Marek Behún Reviewed-by: Guenter Roeck Tested-by: Miquel Raynal Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 270c4265f259e4f9695b86b1ded00f7f202ecba4 Author: Christophe Leroy Date: Mon Sep 17 06:22:53 2018 +0000 dt-bindings: watchdog: add mpc8xxx-wdt support Add description of DT bindings for mpc8xxx-wdt driver which handles the CPU watchdog timer on the mpc83xx, mpc86xx and mpc8xx. Signed-off-by: Christophe Leroy Reviewed-by: Rob Herring Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 38e48b718934d32d45bb9f917b3430822fca76bb Author: Christophe Leroy Date: Mon Sep 17 06:22:50 2018 +0000 watchdog: mpc8xxx: provide boot status mpc8xxx watchdog driver supports the following platforms: - mpc8xx - mpc83xx - mpc86xx Those three platforms have a 32 bits register which provides the reason of the last boot, including whether it was caused by the watchdog. mpc8xx: Register RSR, bit SWRS (bit 3) mpc83xx: Register RSR, bit SWRS (bit 28) mpc86xx: Register RSTRSCR, bit WDT_RR (bit 11) This patch maps the register as defined in the device tree and updates wdt.bootstatus based on the value of the watchdog related bit. Then the information can be retrieved via the WDIOC_GETBOOTSTATUS ioctl. Hereunder is an example of devicetree for mpc8xx, the Reset Status Register being at offset 0x288: WDT: watchdog@0 { compatible = "fsl,mpc823-wdt"; reg = <0x0 0x10 0x288 0x4>; }; On the mpc83xx, RSR is at offset 0x910 On the mpc86xx, RSTRSCR is at offset 0xe0094 Suggested-by: Radu Rendec Tested-by: Christophe Leroy # On mpc885 Signed-off-by: Christophe Leroy Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit ed18e423a3d9b2dc9db801358b754e722fcabaff Author: Christophe Leroy Date: Tue Oct 9 13:51:37 2018 +0000 drivers/block/z2ram: use ioremap_wt() instead of __ioremap(_PAGE_WRITETHRU) _PAGE_WRITETHRU is a target specific flag. Prefer generic functions. Acked-by: Geert Uytterhoeven Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit e04e39507c3c3da9cba31ee2e52f51b10b6350d0 Author: Christophe Leroy Date: Tue Oct 9 13:51:35 2018 +0000 drivers/video/fbdev: use ioremap_wc/wt() instead of __ioremap() _PAGE_NO_CACHE is a platform specific flag. In addition, this flag is misleading because one would think it requests a noncached page whereas a noncached page is _PAGE_NO_CACHE | _PAGE_GUARDED _PAGE_NO_CACHE alone means write combined noncached page, so lets use ioremap_wc() instead. _PAGE_WRITETHRU is also platform specific flag. Use ioremap_wt() instead. Signed-off-by: Christophe Leroy Acked-by: Daniel Vetter Acked-by: Bartlomiej Zolnierkiewicz Signed-off-by: Michael Ellerman commit c894696188d5c2af1e636e458190e80c53fb893d Author: Colin Ian King Date: Mon Oct 8 09:50:28 2018 +0100 rtlwifi: rtl8821ae: replace _rtl8821ae_mrate_idx_to_arfr_id with generic version Function _rtl8821ae_mrate_idx_to_arfr_id is functionally identical to the generic version rtl_mrate_idx_to_arfr_id, so remove _rtl8821ae_mrate_idx_to_arfr_id and use the generic one instead. This also fixes a missing break statement found by CoverityScan in _rtl8821ae_mrate_idx_to_arfr_id, namely: CID#1167237 ("Missing break in switch") Thanks to Joe Perches for spotting this when I submitted an earlier patch. Fixes: 3c05bedb5fef ("Staging: rtl8812ae: Add Realtek 8821 PCI WIFI driver") Signed-off-by: Colin Ian King ACKed-by: Larry Finger Signed-off-by: Kalle Valo commit d8c27ba86a2fd806d3957e5a9b30e66dfca2a61d Author: Dan Carpenter Date: Sat Oct 13 13:28:43 2018 +0300 EDAC, thunderx: Fix memory leak in thunderx_l2c_threaded_isr() Fix memory leak in L2c threaded interrupt handler. [ bp: Rewrite commit message. ] Fixes: 41003396f932 ("EDAC, thunderx: Add Cavium ThunderX EDAC driver") Signed-off-by: Dan Carpenter Signed-off-by: Borislav Petkov CC: David Daney CC: Jan Glauber CC: Mauro Carvalho Chehab CC: Sergey Temerkhanov CC: linux-edac Link: http://lkml.kernel.org/r/20181013102843.GG16086@mwanda commit 3d71c3f1f50cf309bd20659422af549bc784bfff Author: Luca Coelho Date: Sat Oct 13 09:46:08 2018 +0300 iwlwifi: mvm: check return value of rs_rate_from_ucode_rate() The rs_rate_from_ucode_rate() function may return -EINVAL if the rate is invalid, but none of the callsites check for the error, potentially making us access arrays with index IWL_RATE_INVALID, which is larger than the arrays, causing an out-of-bounds access. This will trigger KASAN warnings, such as the one reported in the bugzilla issue mentioned below. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=200659 Cc: stable@vger.kernel.org Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo commit 12f7a1867467e44507e5da5fc01c0479ce9a14b3 Merge: d864991b220b 724fe7710ac5 Author: Kalle Valo Date: Sat Oct 13 14:47:09 2018 +0300 Merge tag 'iwlwifi-next-for-kalle-2018-10-12' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Fourth set of iwlwifi patches intended for 4.20 * Support for a new scan type; * Clean-up in the queue handling code; * A few bug fixes; commit 86c391bd5f47101acf1f3e0abd9fe0616ae2a4fb Author: Christophe Leroy Date: Tue Oct 9 13:51:33 2018 +0000 powerpc/32: Add ioremap_wt() and ioremap_coherent() Other arches have ioremap_wt() to map IO areas write-through. Implement it on PPC as well in order to avoid drivers using __ioremap(_PAGE_WRITETHRU) Also implement ioremap_coherent() to avoid drivers using __ioremap(_PAGE_COHERENT) Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit dfd718a2ed1f678e66749ffe41bdeafedf3f4314 Author: Gautham R. Shenoy Date: Mon Oct 1 16:10:39 2018 +0530 powerpc/rtas: Fix a potential race between CPU-Offline & Migration Live Partition Migrations require all the present CPUs to execute the H_JOIN call, and hence rtas_ibm_suspend_me() onlines any offline CPUs before initiating the migration for this purpose. The commit 85a88cabad57 ("powerpc/pseries: Disable CPU hotplug across migrations") disables any CPU-hotplug operations once all the offline CPUs are brought online to prevent any further state change. Once the CPU-Hotplug operation is disabled, the code assumes that all the CPUs are online. However, there is a minor window in rtas_ibm_suspend_me() between onlining the offline CPUs and disabling CPU-Hotplug when a concurrent CPU-offline operations initiated by the userspace can succeed thereby nullifying the the aformentioned assumption. In this unlikely case these offlined CPUs will not call H_JOIN, resulting in a system hang. Fix this by verifying that all the present CPUs are actually online after CPU-Hotplug has been disabled, failing which we restore the state of the offline CPUs in rtas_ibm_suspend_me() and return an -EBUSY. Cc: Nathan Fontenot Cc: Tyrel Datwyler Suggested-by: Michael Ellerman Signed-off-by: Gautham R. Shenoy Reviewed-by: Nathan Fontenot Signed-off-by: Michael Ellerman commit 500fe5f550ec6dbc1d7d3154d8eccc7cb834d434 Author: Gautham R. Shenoy Date: Thu Oct 11 11:03:03 2018 +0530 powerpc/cacheinfo: Report the correct shared_cpu_map on big-cores Currently on POWER9 SMT8 cores systems, in sysfs, we report the shared_cache_map for L1 caches (both data and instruction) to be the cpu-ids of the threads in SMT8 cores. This is incorrect since on POWER9 SMT8 cores there are two groups of threads, each of which shares its own L1 cache. This patch addresses this by reporting the shared_cpu_map correctly in sysfs for L1 caches. Before the patch /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map : 000000ff /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map : 000000ff /sys/devices/system/cpu/cpu1/cache/index0/shared_cpu_map : 000000ff /sys/devices/system/cpu/cpu1/cache/index1/shared_cpu_map : 000000ff After the patch /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map : 00000055 /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map : 00000055 /sys/devices/system/cpu/cpu1/cache/index0/shared_cpu_map : 000000aa /sys/devices/system/cpu/cpu1/cache/index1/shared_cpu_map : 000000aa Signed-off-by: Gautham R. Shenoy Signed-off-by: Michael Ellerman commit 8e8a31d7fd54d68fc9c6c1e69f52ccdaf43b01ea Author: Gautham R. Shenoy Date: Thu Oct 11 11:03:02 2018 +0530 powerpc: Use cpu_smallcore_sibling_mask at SMT level on bigcores POWER9 SMT8 cores consist of two groups of threads, where threads in each group shares L1-cache. The scheduler is not aware of this distinction as the current sched-domain hierarchy has all the threads of the core defined at the SMT domain. SMT [Thread siblings of the SMT8 core] DIE [CPUs in the same die] NUMA [All the CPUs in the system] Due to this, we can observe run-to-run variance when we run a multi-threaded benchmark bound to a single core based on how the scheduler spreads the software threads across the two groups in the core. We fix this in this patch by defining each group of threads which share L1-cache to be the SMT level. The group of threads in the SMT8 core is defined to be the CACHE level. The sched-domain hierarchy after this patch will be : SMT [Thread siblings in the core that share L1 cache] CACHE [Thread siblings that are in the SMT8 core] DIE [CPUs in the same die] NUMA [All the CPUs in the system] Signed-off-by: Gautham R. Shenoy Signed-off-by: Michael Ellerman commit 425752c63b6f3fed7b5a9cba2b8101a92cf36995 Author: Gautham R. Shenoy Date: Thu Oct 11 11:03:01 2018 +0530 powerpc: Detect the presence of big-cores via "ibm, thread-groups" On IBM POWER9, the device tree exposes a property array identifed by "ibm,thread-groups" which will indicate which groups of threads share a particular set of resources. As of today we only have one form of grouping identifying the group of threads in the core that share the L1 cache, translation cache and instruction data flow. This patch adds helper functions to parse the contents of "ibm,thread-groups" and populate a per-cpu variable to cache information about siblings of each CPU that share the L1, traslation cache and instruction data-flow. It also defines a new global variable named "has_big_cores" which indicates if the cores on this configuration have multiple groups of threads that share L1 cache. For each online CPU, it maintains a cpu_smallcore_mask, which indicates the online siblings which share the L1-cache with it. Signed-off-by: Gautham R. Shenoy Signed-off-by: Michael Ellerman commit bf6cbd0c87f30d0e4401be91a8161ce11079027a Author: Michael Ellerman Date: Fri Oct 12 22:09:09 2018 +1100 powerpc: Fix stackprotector detection for non-glibc toolchains If GCC is not built with glibc support then we must explicitly tell it which register to use for TLS mode stack protector, otherwise it will error out and the cc-option check will fail. Signed-off-by: Michael Ellerman commit 50530f5eac0c023cfc313d7ed342d4f1731becdb Author: Michael Ellerman Date: Fri Oct 12 13:58:52 2018 +1100 powerpc/xmon: Show the stack protector canary in xmon This is helpful for debugging stack protector crashes. Signed-off-by: Michael Ellerman commit ed9e84a4d703243a232e6549a13dedfaf0d5d2d8 Author: Joel Stanley Date: Fri Oct 12 13:14:06 2018 +1030 powerpc: Use SWITCH_FRAME_SIZE for prom and rtas entry Commit 6c1719942e19 ("powerpc/of: Remove useless register save/restore when calling OF back") removed the saving of srr0 and srr1 when calling into OpenFirmware. Commit e31aa453bbc4 ("powerpc: Use LOAD_REG_IMMEDIATE only for constants on 64-bit") did the same for rtas. This means we don't need to save the extra stack space and can use the common SWITCH_FRAME_SIZE. There were already no users of _SRR0 and _SRR1 so we can remove them too. Link: https://github.com/linuxppc/linux/issues/83 Signed-off-by: Joel Stanley Signed-off-by: Michael Ellerman commit 65b9fdadfc4d87e2577b791fb3495cd39c93d8c0 Author: Michael Bringmann Date: Tue Oct 9 15:12:14 2018 -0500 powerpc/pseries/mobility: Extend start/stop topology update scope The powerpc mobility code may receive RTAS requests to perform PRRN (Platform Resource Reassignment Notification) topology changes at any time, including during LPAR migration operations. In some configurations where the affinity of CPUs or memory is being changed on that platform, the PRRN requests may apply or refer to outdated information prior to the complete update of the device-tree. This patch changes the duration for which topology updates are suppressed during LPAR migrations from just the rtas_ibm_suspend_me() / 'ibm,suspend-me' call(s) to cover the entire migration_store() operation to allow all changes to the device-tree to be applied prior to accepting and applying any PRRN requests. For tracking purposes, pr_info notices are added to the functions start_topology_update() and stop_topology_update() of 'numa.c'. Signed-off-by: Michael Bringmann Reviewed-by: Nathan Fontenot Signed-off-by: Michael Ellerman commit 960e30029863db95ec79a71009272d4661db5991 Author: Joel Stanley Date: Thu Oct 11 13:13:03 2018 +1030 powerpc/Makefile: Fix PPC_BOOK3S_64 ASFLAGS Ever since commit 15a3204d24a3 ("powerpc/64s: Set assembler machine type to POWER4") we force -mpower4 to be passed to the assembler irrespective of the CFLAGS used (for Book3s 64). When building a powerpc64 kernel with clang, clang will not add -many to the assembler flags, so any instructions that the compiler has generated that are not available on power4 will cause an error: /usr/bin/as -a64 -mppc64 -mlittle-endian -mpower8 \ -I ./arch/powerpc/include -I ./arch/powerpc/include/generated \ -I ./include -I ./arch/powerpc/include/uapi \ -I ./arch/powerpc/include/generated/uapi -I ./include/uapi \ -I ./include/generated/uapi -I arch/powerpc -I arch/powerpc \ -maltivec -mpower4 -o init/do_mounts.o /tmp/do_mounts-3b0a3d.s /tmp/do_mounts-51ce54.s:748: Error: unrecognized opcode: `isel' GCC does include -many, so the GCC driven gas call will succeed: as -v -I ./arch/powerpc/include -I ./arch/powerpc/include/generated -I ./include -I ./arch/powerpc/include/uapi -I ./arch/powerpc/include/generated/uapi -I ./include/uapi -I ./include/generated/uapi -I arch/powerpc -I arch/powerpc -a64 -mpower8 -many -mlittle -maltivec -mpower4 -o init/do_mounts.o Note that isel is power7 and above for IBM CPUs. GCC only generates it for Power9 and above, but the above test was run against the clang generated assembly. Peter Bergner explains: When using -many -mpower4, gas will first try and find a matching power4 mnemonic and failing that, it will then allow any valid mnemonic that gas knows about. GCC's use of -many predates me though. IIRC, Alan looked at trying to remove it, but I forget why he didn't. Could be either a gcc or gas issue at the time. I'm not sure whether issue still exists or not. He and I have modified how gas works internally a fair amount since he tried removing gcc use of -many. I will also note that when using -many, gas will choose the first mnemonic that matches in the mnemonic table and we have (mostly) sorted the table so that server mnemonics show up earlier in the table than other mnemonics, so they'll be seen/chosen first. By explicitly setting -many we can build with Clang and GCC while retaining the -mpower4 option. Signed-off-by: Joel Stanley Signed-off-by: Michael Ellerman commit b45e9d761ba2d60044b610297e3ef9f947ac157f Author: YueHaibing Date: Tue Oct 9 21:59:13 2018 +0800 powerpc/pseries/memory-hotplug: Fix return value type of find_aa_index The variable 'aa_index' is defined as an unsigned value in update_lmb_associativity_index(), but find_aa_index() may return -1 when dlpar_clone_property() fails. So change find_aa_index() to return a bool, which indicates whether 'aa_index' was found or not. Fixes: c05a5a40969e ("powerpc/pseries: Dynamic add entires to associativity lookup array") Signed-off-by: YueHaibing Reviewed-by: Nathan Fontenot nfont@linux.vnet.ibm.com> [mpe: Tweak changelog, rename is_found to just found] Signed-off-by: Michael Ellerman commit b90484ec1137424f606832a22f24d6cfc62a1427 Author: Sam Bobroff Date: Wed Sep 12 11:23:33 2018 +1000 powerpc/eeh: Cleanup control flow in eeh_handle_normal_event() Rather than mixing "if (state)" blocks and gotos, convert entirely to "if (state)" blocks to make the state machine behaviour clearer. Signed-off-by: Sam Bobroff Signed-off-by: Michael Ellerman commit fef7f905523fb96b431e5e73487a689c10c77875 Author: Sam Bobroff Date: Wed Sep 12 11:23:32 2018 +1000 powerpc/eeh: Cleanup eeh_ops.wait_state() The wait_state member of eeh_ops does not need to be platform dependent; it's just logic around eeh_ops.get_state(). Therefore, merge the two (slightly different!) platform versions into a new function, eeh_wait_state() and remove the eeh_ops member. While doing this, also correct: * The wait logic, so that it never waits longer than max_wait. * The wait logic, so that it never waits less than EEH_STATE_MIN_WAIT_TIME. * One call site where the result is treated like a bit field before it's checked for negative error values. * In pseries_eeh_get_state(), rename the "state" parameter to "delay" because that's what it is. Signed-off-by: Sam Bobroff Signed-off-by: Michael Ellerman commit e762bb891a294af00b83f54062dae4e24565edf8 Author: Sam Bobroff Date: Wed Sep 12 11:23:31 2018 +1000 powerpc/eeh: Cleanup eeh_pe_state_mark() Currently, eeh_pe_state_mark() marks a PE (and it's children) with a state and then performs additional processing if that state included EEH_PE_ISOLATED. The state parameter is always a constant at the call site, so rearrange eeh_pe_state_mark() into two functions and just call the appropriate one at each site. Signed-off-by: Sam Bobroff Signed-off-by: Michael Ellerman commit eed4bdbeecd0b59d3e487d1a2b726d51810015ab Author: Sam Bobroff Date: Wed Sep 12 11:23:30 2018 +1000 powerpc/eeh: Cleanup unnecessary eeh_pe_state_mark_with_cfg() The function eeh_pe_state_mark_with_cfg() just performs the work of eeh_pe_state_mark() and then, conditionally, the work of eeh_pe_state_clear(). However it is only ever called with a constant state such that the condition is always true, so replace it by direct calls. Signed-off-by: Sam Bobroff Signed-off-by: Michael Ellerman commit 54644927a01d53b69e0e27e4778d329049c1c335 Author: Sam Bobroff Date: Wed Sep 12 11:23:29 2018 +1000 powerpc/eeh: Cleanup eeh_enabled() Signed-off-by: Sam Bobroff Signed-off-by: Michael Ellerman commit 9a3eda266fb55fee0e19f2afbbc57607fa379d23 Author: Sam Bobroff Date: Wed Sep 12 11:23:28 2018 +1000 powerpc/eeh: Cleanup logic in eeh_rmv_from_parent_pe() Move the call to eeh_dev_to_pe() up, so that later it's clear that "pe" isn't NULL. Signed-off-by: Sam Bobroff Signed-off-by: Michael Ellerman commit 1c5c533b149f02d0ce00fc7ab5810766398acc11 Author: Sam Bobroff Date: Wed Sep 12 11:23:27 2018 +1000 powerpc/eeh: Cleanup field names in eeh_rmv_data Change the name of the fields in eeh_rmv_data to clarify their usage. Change "edev_list" to "removed_vf_list" because it does not contain generic edevs, but rather only edevs that contain virtual functions (which need to be removed during recovery). Similarly, change "removed" to "removed_dev_count" because it is a count of any removed devices, not just those in the above list. Signed-off-by: Sam Bobroff Signed-off-by: Michael Ellerman commit 80e65b009413e3d36eb7f24cbcab49a201c3088d Author: Sam Bobroff Date: Wed Sep 12 11:23:26 2018 +1000 powerpc/eeh: Cleanup list_head field names Instances of struct eeh_pe are placed in a tree structure using the fields "child_list" and "child", so place these next to each other in the definition. The field "child" is a list entry, so remove the unnecessary and misleading use of the list initializer, LIST_HEAD(), on it. The eeh_dev struct contains two list entry fields, called "list" and "rmv_list". Rename them to "entry" and "rmv_entry" and, as above, stop initializing them with LIST_HEAD(). Signed-off-by: Sam Bobroff Signed-off-by: Michael Ellerman commit bf773df9d12f73daaa60584b43d6deb21f9c9fc1 Author: Sam Bobroff Date: Wed Sep 12 11:23:25 2018 +1000 powerpc/eeh: Cleanup eeh_add_virt_device() Remove the unnecessary cast through void * on the first parameter and remove the unused second parameter (always NULL). Signed-off-by: Sam Bobroff Signed-off-by: Michael Ellerman commit b95a46062bd44ae7d5685d467c39fb3181b05798 Author: Sam Bobroff Date: Wed Sep 12 11:23:24 2018 +1000 powerpc/eeh: Cleanup unused field in eeh_dev The 'bus' member of struct eeh_dev is assigned to once but never used, so remove it. Signed-off-by: Sam Bobroff Signed-off-by: Michael Ellerman commit bffc0176e7d0ae0f560aaa9b702dd9264433d780 Author: Sam Bobroff Date: Wed Sep 12 11:23:23 2018 +1000 powerpc/eeh: Cleanup EEH_POSTPONED_PROBE Currently a flag, EEH_POSTPONED_PROBE, is used to prevent an incorrect message "EEH: No capable adapters found" from being displayed during the boot of powernv systems. It is necessary because, on powernv, the call to eeh_probe_devices() made from eeh_init() is too early and EEH can't yet be enabled. A second call is made later from eeh_pnv_post_init(), which succeeds. (On pseries, the first call succeeds because PCI devices are set up early enough and no second call is made.) This can be simplified by moving the early call to eeh_probe_devices() from eeh_init() (where it's seen by both platforms) to pSeries_final_fixup(), so that each platform only calls eeh_probe_devices() once, at a point where it can succeed. This is slightly later in the boot sequence, but but still early enough and it is now in the same place in the sequence for both platforms (the pcibios_fixup hook). The display of the message can be cleaned up as well, by moving it into eeh_probe_devices(). Signed-off-by: Sam Bobroff Signed-off-by: Michael Ellerman commit 473af09b56dc4be68e4af33220ceca6be67aa60d Author: Sam Bobroff Date: Wed Sep 12 11:23:22 2018 +1000 powerpc/eeh: Fix use of EEH_PE_KEEP on wrong field eeh_add_to_parent_pe() sometimes removes the EEH_PE_KEEP flag, but it incorrectly removes it from pe->type, instead of pe->state. However, rather than clearing it from the correct field, remove it. Inspection of the code shows that it can't ever have had any effect (even if it had been cleared from the correct field), because the field is never tested after it is cleared by the statement in question. The clear statement was added by commit 807a827d4e74 ("powerpc/eeh: Keep PE during hotplug"), but it didn't explain why it was necessary. Signed-off-by: Sam Bobroff Signed-off-by: Michael Ellerman commit bcbe3730531239abd45ab6c6af4a18078b37dd47 Author: Sam Bobroff Date: Wed Sep 12 11:23:21 2018 +1000 powerpc/eeh: Fix null deref for devices removed during EEH If a device is removed during EEH processing (either by a driver's handler or as part of recovery), it can lead to a null dereference in eeh_pe_report_edev(). To handle this, skip devices that have been removed. Signed-off-by: Sam Bobroff Signed-off-by: Michael Ellerman commit f9bc28aedfb5bbd572d2d365f3095c1becd7209b Author: Sam Bobroff Date: Wed Sep 12 11:23:20 2018 +1000 powerpc/eeh: Fix possible null deref in eeh_dump_dev_log() If an error occurs during an unplug operation, it's possible for eeh_dump_dev_log() to be called when edev->pdn is null, which currently leads to dereferencing a null pointer. Handle this by skipping the error log for those devices. Signed-off-by: Sam Bobroff Signed-off-by: Michael Ellerman commit 747b21760822957750d41a430b4f3974852895f5 Author: Joel Stanley Date: Wed Oct 10 13:15:23 2018 +1030 powerpc/boot: Build boot wrapper with optimisations The boot wrapper is currently built with -Os. By building with O2 we can meaningfully reduce the time decompressing the kernel. I tested by comparing 10 runs of each option in Qemu and on hardware. The kernel is compressed with KERNEL_XZ built with GCC 8.2.0-7ubuntu1. The values are counts of the timebase. Qemu TCG powernv Power8: Os O2 O3 median 10221123889 6201518438 6568186825 stddev 1361267211 429090641 657930076 improvement 39.33% 35.74% Palmetto Power8: Os O2 O3 median 50279 50599 35790 stddev 992144533 627130655 623721078 improvement 36.79% 37.13% Romulus Power9: Os O2 O3 median 670312391 454733720 448881398 stddev 157569 107276 108760 improvement 32.16% 33.03% TCG was quite noisy, with every few runs producing an outlier. Even so, O2 is faster than O3. On hardware the numbers were less noisy and O3 is slightly faster than O2. The wrapper size increases when moving from Os. Comparing zImage.epapr to the existing Os build using bloat-o-meter: Before=43401, After=56837 (13KB), chg +30.96% Before=43401, After=64305 (20KB), chg +48.16% I chose O2 for a balance between Qemu and hardware speed up. Signed-off-by: Joel Stanley Signed-off-by: Michael Ellerman commit e8e132e6885962582784b6fa16a80d07ea739c0f Author: Joel Stanley Date: Wed Oct 10 13:15:22 2018 +1030 powerpc/boot: Disable vector instructions This will avoid auto-vectorisation when building with higher optimisation levels. We don't know if the machine can support VSX and even if it's present it's probably not going to be enabled at this point in boot. These flag were both added prior to GCC 4.6 which is the minimum compiler version supported by upstream, thanks to Segher for the details. Signed-off-by: Joel Stanley Signed-off-by: Michael Ellerman commit 1a855eaccf353f7ed1d51a3d4b3af727ccbd81ca Author: Joel Stanley Date: Wed Oct 10 09:58:03 2018 +1030 powerpc/boot: Fix opal console in boot wrapper As of commit 10c77dba40ff ("powerpc/boot: Fix build failure in 32-bit boot wrapper") the opal code is hidden behind CONFIG_PPC64_BOOT_WRAPPER, but the boot wrapper avoids include/linux, so it does not get the normal Kconfig flags. We can drop the guard entirely as in commit f8e8e69cea49 ("powerpc/boot: Only build OPAL code when necessary") the makefile only includes opal.c in the build if CONFIG_PPC64_BOOT_WRAPPER is set. Fixes: 10c77dba40ff ("powerpc/boot: Fix build failure in 32-bit boot wrapper") Signed-off-by: Joel Stanley Signed-off-by: Michael Ellerman commit 5e9dcb6188a40e604e66dc30fab30c2be89aa1cc Author: Joel Stanley Date: Wed Oct 10 09:58:02 2018 +1030 powerpc/boot: Expose Kconfig symbols to wrapper Currently the wrapper is built without including anything in $(src)/include/, which means there are no CONFIG_ symbols defined. This means the platform specific serial drivers were never enabled. We now copy the definitions into the boot directory, so any C file can now include autoconf.h to depend on configuration options. Fixes: 866bfc75f40e ("powerpc: conditionally compile platform-specific serial drivers") Signed-off-by: Joel Stanley [mpe: Fix to use $(objtree) to find autoconf.h] Signed-off-by: Michael Ellerman commit 719736e1cc12b2fc28eba2122893a449eee66d08 Author: Bartlomiej Zolnierkiewicz Date: Tue Oct 9 17:39:46 2018 +0200 powerpc: remove redundant 'default n' from Kconfig-s 'default n' is the default value for any bool or tristate Kconfig setting so there is no need to write it explicitly. Also since commit f467c5640c29 ("kconfig: only write '# CONFIG_FOO is not set' for visible symbols") the Kconfig behavior is the same regardless of 'default n' being present or not: ... One side effect of (and the main motivation for) this change is making the following two definitions behave exactly the same: config FOO bool config FOO bool default n With this change, neither of these will generate a '# CONFIG_FOO is not set' line (assuming FOO isn't selected/implied). That might make it clearer to people that a bare 'default n' is redundant. ... Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Michael Ellerman commit b27e5f939b6d50e1b83e9febfee1c3f8de7789d7 Author: Oliver O'Halloran Date: Wed Oct 10 16:23:02 2018 +1100 powerpc/rtasd: Improve unknown error logging Currently when we get an unknown RTAS event it prints the type as "Unknown" and no other useful information. Add the raw type code to the log message so that we have something to work off. Signed-off-by: Oliver O'Halloran Reviewed-by: Vasant Hegde Signed-off-by: Michael Ellerman commit aea447141c7e7824b81b49acd1bc785506fba46e Author: Joel Stanley Date: Mon Sep 17 17:16:21 2018 +0930 powerpc: Disable -Wbuiltin-requires-header when setjmp is used The powerpc kernel uses setjmp which causes a warning when building with clang: In file included from arch/powerpc/xmon/xmon.c:51: ./arch/powerpc/include/asm/setjmp.h:15:13: error: declaration of built-in function 'setjmp' requires inclusion of the header [-Werror,-Wbuiltin-requires-header] extern long setjmp(long *); ^ ./arch/powerpc/include/asm/setjmp.h:16:13: error: declaration of built-in function 'longjmp' requires inclusion of the header [-Werror,-Wbuiltin-requires-header] extern void longjmp(long *, long); ^ This *is* the header and we're not using the built-in setjump but rather the one in arch/powerpc/kernel/misc.S. As the compiler warning does not make sense, it for the files where setjmp is used. Signed-off-by: Joel Stanley Reviewed-by: Nick Desaulniers [mpe: Move subdir-ccflags in xmon/Makefile to not clobber -Werror] Signed-off-by: Michael Ellerman commit 014704e6f54189a203cc14c7c0bb411b940241bc Author: Dan Carpenter Date: Mon Oct 1 19:44:58 2018 +0300 powerpc: Fix signedness bug in update_flash_db() The "count < sizeof(struct os_area_db)" comparison is type promoted to size_t so negative values of "count" are treated as very high values and we accidentally return success instead of a negative error code. This doesn't really change runtime much but it fixes a static checker warning. Signed-off-by: Dan Carpenter Acked-by: Geoff Levand Signed-off-by: Michael Ellerman commit 6233b6da0c00a9768bdab1c502115b960929889a Author: Joel Stanley Date: Tue Oct 9 16:50:38 2018 +1030 powerpc/perf: Quiet IMC PMU registration message On a Power9 box we get a few screens full of these on boot. Drop them to pr_debug. [ 5.993645] nest_centaur6_imc performance monitor hardware support registered [ 5.993728] nest_centaur7_imc performance monitor hardware support registered [ 5.996510] core_imc performance monitor hardware support registered [ 5.996569] nest_mba0_imc performance monitor hardware support registered [ 5.996631] nest_mba1_imc performance monitor hardware support registered [ 5.996685] nest_mba2_imc performance monitor hardware support registered Signed-off-by: Joel Stanley Reviewed-by: Madhavan Srinivasan Reviewed-by: Stewart Smith Signed-off-by: Michael Ellerman commit df13102f82f1c8d0a1f43505275bf18246d7f9a0 Author: Christophe Leroy Date: Sat Oct 6 16:51:16 2018 +0000 powerpc/process: Constify the number of insns printed by show instructions functions. instructions_to_print var is assigned value 16 and there is no way to change it. This patch replaces it by a constant. Reviewed-by: Murilo Opsfelder Araujo Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit fb2d9505c0dbd4f5e00db70f7ca0ca7a3d75ca63 Author: Christophe Leroy Date: Sat Oct 6 16:51:14 2018 +0000 powerpc/process: Fix interleaved output in show_user_instructions() When two processes crash at the same time, we sometimes encounter interleaving in the middle of a line: init[1]: segfault (11) at 0 nip 0 lr 0 code 1 init[1]: code: XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX init[74]: segfault (11) at 10a74 nip 1000c198 lr 100078c8 code 1 in sh[10000000+14000] XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX init[1]: code: XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX init[74]: code: 90010024 bf61000c 91490a7c 3fa01002 3be00000 7d3e4b78 3bbd0c20 3b600000 init[74]: code: 3b9d0040 7c7fe02e 2f830000 419e0028 <89230000> 2f890000 41be001c 4b7f6e79 This patch fixes it by preparing complete lines in a buffer and printing it at once. Fixes: 88b0fe1757359 ("powerpc: Add show_user_instructions()") Reviewed-by: Murilo Opsfelder Araujo Signed-off-by: Christophe Leroy [mpe: Use seq_buf_printf() not seq_buf_puts() which doesn't NULL terminate] Signed-off-by: Michael Ellerman commit c9386bfd37d37f29588de9ea9add455510049c33 Author: Christophe Leroy Date: Tue Oct 9 16:46:25 2018 +1100 powerpc/process: Add missing include of stacktrace.h As spotted by sparse: arch/powerpc/kernel/process.c:1302:6: warning: symbol 'show_user_instructions' was not declared. Should it be static? Fixes: 88b0fe1757359 ("powerpc: Add show_user_instructions()") Reviewed-by: Murilo Opsfelder Araujo Signed-off-by: Christophe Leroy [mpe: Split out of larger patch] Signed-off-by: Michael Ellerman commit 3b35bd48b8a06e02a25af84baba782876b8a6572 Author: Christophe Leroy Date: Sat Oct 6 16:51:12 2018 +0000 powerpc/process: Fix sparse address space warnings This patch fixes the following warnings, which are leftovers from when __get_user() was replaced by probe_kernel_address(). arch/powerpc/kernel/process.c:1287:22: warning: incorrect type in argument 2 (different address spaces) arch/powerpc/kernel/process.c:1287:22: expected void const *src arch/powerpc/kernel/process.c:1287:22: got unsigned int [noderef] * arch/powerpc/kernel/process.c:1319:21: warning: incorrect type in argument 2 (different address spaces) arch/powerpc/kernel/process.c:1319:21: expected void const *src arch/powerpc/kernel/process.c:1319:21: got unsigned int [noderef] * Fixes: 7b051f665c32d ("powerpc: Use probe_kernel_address in show_instructions") Reviewed-by: Murilo Opsfelder Araujo Signed-off-by: Christophe Leroy [mpe: Split out of larger patch] Signed-off-by: Michael Ellerman commit 7241d26e8175e95290a6549a470c330dbfc63442 Author: Christophe Leroy Date: Sat Oct 13 09:45:12 2018 +0000 powerpc/64: properly initialise the stackprotector canary on SMP. commit 06ec27aea9fc ("powerpc/64: add stack protector support") doesn't initialise the stack canary on SMP secondary CPU's paca, leading to the following false positive report from the stack protector. smp: Bringing up secondary CPUs ... Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: __schedule+0x978/0xa80 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.19.0-rc7-next-20181010-autotest-autotest #1 Call Trace: [c000001fed5b3bf0] [c000000000a0ef3c] dump_stack+0xb0/0xf4 (unreliable) [c000001fed5b3c30] [c0000000000f9d68] panic+0x140/0x308 [c000001fed5b3cc0] [c0000000000f9844] __stack_chk_fail+0x24/0x30 [c000001fed5b3d20] [c000000000a2c3a8] __schedule+0x978/0xa80 [c000001fed5b3e00] [c000000000a2c9b4] schedule_idle+0x34/0x60 [c000001fed5b3e30] [c00000000013d344] do_idle+0x224/0x3d0 [c000001fed5b3ec0] [c00000000013d6e0] cpu_startup_entry+0x30/0x50 [c000001fed5b3ef0] [c000000000047f34] start_secondary+0x4d4/0x520 [c000001fed5b3f90] [c00000000000b370] start_secondary_prolog+0x10/0x14 This patch properly initialises the stack_canary of the secondary idle tasks. Reported-by: Abdul Haleem Fixes: 06ec27aea9fc ("powerpc/64: add stack protector support") Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman commit efebf0aaec3de4df2bdb2949ebaacacd82de37db Author: Liran Alon Date: Mon Oct 8 23:42:20 2018 +0300 KVM: nVMX: Do not flush TLB on L1<->L2 transitions if L1 uses VPID and EPT If L1 uses VPID, it expects TLB to not be flushed on L1<->L2 transitions. However, code currently flushes TLB nonetheless if we didn't allocate a vpid02 for L2. As in this case, vmcs02->vpid == vmcs01->vpid == vmx->vpid. But, if L1 uses EPT, TLB entires populated by L2 are tagged with EPTP02 while TLB entries populated by L1 are tagged with EPTP01. Therefore, we can also avoid TLB flush if L1 uses VPID and EPT. Reviewed-by: Mihai Carabas Reviewed-by: Darren Kenny Reviewed-by: Nikita Leshenko Signed-off-by: Liran Alon Signed-off-by: Paolo Bonzini commit 327c072187f7af4e4a371b635099f615c14082a7 Author: Liran Alon Date: Mon Oct 8 23:42:19 2018 +0300 KVM: nVMX: Flush linear and combined mappings on VPID02 related flushes All VPID12s used on a given L1 vCPU is translated to a single VPID02 (vmx->nested.vpid02 or vmx->vpid). Therefore, on L1->L2 VMEntry, we need to invalidate linear and combined mappings tagged by VPID02 in case L1 uses VPID and vmcs12->vpid was changed since last L1->L2 VMEntry. However, current code invalidates the wrong mappings as it calls __vmx_flush_tlb() with invalidate_gpa parameter set to true which will result in invalidating combined and guest-physical mappings tagged with active EPTP which is EPTP01. Similarly, INVVPID emulation have the exact same issue. Fix both issues by just setting invalidate_gpa parameter to false which will result in invalidating linear and combined mappings tagged with given VPID02 as required. Reviewed-by: Nikita Leshenko Reviewed-by: Mark Kanda Signed-off-by: Liran Alon Signed-off-by: Paolo Bonzini commit 3d5bdae8b16418781ec2c34a024aceee66267322 Author: Liran Alon Date: Mon Oct 8 23:42:18 2018 +0300 KVM: nVMX: Use correct VPID02 when emulating L1 INVVPID In case L0 didn't allocate vmx->nested.vpid02 for L2, vmcs02->vpid is set to vmx->vpid. Consider this case when emulating L1 INVVPID in L0. Reviewed-by: Nikita Leshenko Reviewed-by: Mark Kanda Signed-off-by: Liran Alon Signed-off-by: Paolo Bonzini commit 1438921c6dc1bbdce800bfc7db04bd15cb260fc0 Author: Liran Alon Date: Mon Oct 8 23:42:17 2018 +0300 KVM: nVMX: Flush TLB entries tagged by dest EPTP on L1<->L2 transitions If L1 and L2 share VPID (because L1 don't use VPID or we haven't allocated a vpid02), we need to flush TLB on L1<->L2 transitions. Before this patch, this TLB flushing was done by vmx_flush_tlb(). If L0 use EPT, this will translate into INVEPT(active_eptp); However, if L1 use EPT, in L1->L2 VMEntry, active EPTP is EPTP01 but TLB entries populated by L2 are tagged with EPTP02. Therefore we should delay vmx_flush_tlb() until active_eptp is EPTP02. To achieve this, instead of directly calling vmx_flush_tlb() we request it to be called by KVM_REQ_TLB_FLUSH which is evaluated after KVM_REQ_LOAD_CR3 which sets the active_eptp to EPTP02 as required. Similarly, on L2->L1 VMExit, active EPTP is EPTP02 but TLB entries populated by L1 are tagged with EPTP01 and therefore we should delay vmx_flush_tlb() until active_eptp is EPTP01. Reviewed-by: Mihai Carabas Reviewed-by: Darren Kenny Reviewed-by: Nikita Leshenko Signed-off-by: Liran Alon Signed-off-by: Paolo Bonzini commit 3de6347bf96abead5c5257b43a58ca0a057df894 Author: Sean Christopherson Date: Fri Jul 13 08:42:30 2018 -0700 KVM: vmx: rename KVM_GUEST_CR0_MASK tp KVM_VM_CR0_ALWAYS_OFF The KVM_GUEST_CR0_MASK macro tracks CR0 bits that are forced to zero by the VMX architecture, i.e. CR0.{NW,CD} must always be zero in the hardware CR0 post-VMXON. Rename the macro to clarify its purpose, be consistent with KVM_VM_CR0_ALWAYS_ON and avoid confusion with the CR0_GUEST_HOST_MASK field. Signed-off-by: Sean Christopherson Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini commit 3d0d0d9b1d805e39456a9d49443d847092cb21ab Merge: 7dd2157cb61a ed3054a30258 Author: Paolo Bonzini Date: Sat Oct 13 12:00:26 2018 +0200 Merge tag 'kvm-s390-next-4.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD KVM: s390/vfio-ap: Fixes and enhancements for vfio-ap - add tracing - fix a locking bug - make local functions and data static commit ce5a983191ce466cbe35e240ac09e28cca3e50c9 Author: Al Viro Date: Fri Sep 14 14:46:18 2018 -0400 kill TIOCSERGSTRUCT Once upon a time a bunch of serial drivers used to provide that; today it's only amiserial and it's FUBAR - the structure being copied to userland includes kernel pointers, fields with config-dependent size, etc. No userland code using it could possibly survive - e.g. enabling lockdep definitely changes the layout. Besides, it's a massive infoleak. Kill it. If somebody needs that data for debugging purposes, they can bloody well expose it saner ways. Assuming anyone does debugging of amiserial in the first place, that is. Signed-off-by: Al Viro commit f0193d3ea73b966b5dbfa272c8228d743b8856ef Author: Al Viro Date: Thu Sep 13 22:12:15 2018 -0400 change semantics of ldisc ->compat_ioctl() First of all, make it return int. Returning long when native method had never allowed that is ridiculous and inconvenient. More importantly, change the caller; if ldisc ->compat_ioctl() is NULL or returns -ENOIOCTLCMD, tty_compat_ioctl() will try to feed cmd and compat_ptr(arg) to ldisc's native ->ioctl(). That simplifies ->compat_ioctl() instances quite a bit - they only need to deal with ioctls that are neither generic tty ones (those would get shunted off to tty_ioctl()) nor simple compat pointer ones. Note that something like TCFLSH won't reach ->compat_ioctl(), even if ldisc ->ioctl() does handle it - it will be recognized earlier and passed to tty_ioctl() (and ultimately - ldisc ->ioctl()). For many ldiscs it means that NULL ->compat_ioctl() does the right thing. Those where it won't serve (see e.g. n_r3964.c) are also easily dealt with - we need to handle the numeric-argument ioctls (calling the native instance) and, if such would exist, the ioctls that need layout conversion, etc. All in-tree ldiscs dealt with. Signed-off-by: Al Viro commit 7ee329655189f32f0c17e0bad60c23a69b003e9e Author: Al Viro Date: Thu Sep 13 16:39:58 2018 -0400 kill TIOCSER[SG]WILD the only user is very old setserial rc script and even that (as far back as MCC Interim, AFAICS) doesn't actually fail - just gives one message during the boot ("Cannot scan for wild interrupts") and proceeds past that just fine. Signed-off-by: Al Viro commit 27230e51349fde075598c1b59d15e1ff802f3f6e Author: Al Viro Date: Wed Sep 12 20:57:18 2018 -0400 synclink_gt(): fix compat_ioctl() compat_ptr() for pointer-taking ones... Signed-off-by: Al Viro commit 50f45326afab723df529eca54095e2feac24da2d Author: Al Viro Date: Wed Sep 12 20:53:46 2018 -0400 pty: fix compat ioctls pointer-taking ones need compat_ptr(); int-taking one doesn't. Signed-off-by: Al Viro commit 82a6857bf9efa8f66e2476f248021c17cd423159 Author: Al Viro Date: Wed Sep 12 20:18:09 2018 -0400 compat_ioctl - kill keyboard ioctl handling all of those are provided only by vt and s390 tty3270; both have proper ->compat_ioctl() Signed-off-by: Al Viro commit 969ec01e992009200ecf7ba760f9fe8a95abf32a Author: Al Viro Date: Wed Sep 12 20:02:50 2018 -0400 gigaset: add ->compat_ioctl() ... and get rid of COMPAT_IOCTL() for its private ioctls Signed-off-by: Al Viro commit 9d1807daefc00c7b3a4ecca02e3a783263c1e00d Author: Al Viro Date: Wed Sep 12 19:02:10 2018 -0400 vt_compat_ioctl(): clean up, use compat_ptr() properly we need it for "convert the structure" cases too Signed-off-by: Al Viro commit 09d88c85769262aadc85a49d6d4e91d35c115db1 Author: Al Viro Date: Wed Sep 12 18:45:29 2018 -0400 gigaset: don't try to printk userland buffer contents especially when you've just copied it in... Signed-off-by: Al Viro commit 7ebec8d235419a92af42b2d20e0d6cb6dac07dd8 Author: Al Viro Date: Wed Sep 12 18:41:46 2018 -0400 dgnc: don't bother with (empty) stub for TCXONC for pity sake, that case is identical to their default: _and_ bears an explicit comment re leaving to ldisc. Which is what default is doing, obviously... Signed-off-by: Al Viro commit 88d50890b78f68ff047e4deee651ec4e256cefea Author: Al Viro Date: Wed Sep 12 18:40:04 2018 -0400 dgnc: leave TIOC[GS]SOFTCAR to ldisc no point duplicating that in tty_operations ->ioctl() Signed-off-by: Al Viro commit a3096199226c2e4dc019f21c1bed6e96092d4a71 Author: Al Viro Date: Wed Sep 12 18:37:18 2018 -0400 remove fallback to drivers for TIOCGICOUNT none of them handles it anyway. Reviewed-by: Johan Hovold Signed-off-by: Al Viro commit b413f00ab1a99ccb239fc5afd4b8e0c7ada6c9db Author: Al Viro Date: Wed Sep 12 18:32:47 2018 -0400 dgnc: break-related ioctls won't reach ->ioctl() kill the dead code, especially since ->break_ctl() will do the right thing anyway. Signed-off-by: Al Viro commit 6bbf265892241f540d3465c074c04a39b7f127ec Author: Al Viro Date: Wed Sep 12 18:05:07 2018 -0400 kill the rest of tty COMPAT_IOCTL() entries TIOCLINUX is handled by ->compat_ioctl() in the only place that has native ->ioctl() recognizing it, TIOC{START,STOP} are simply useless these days - unrecognized compat ioctl won't spew into syslog anymore. Signed-off-by: Al Viro commit 04ec1c8c7411d4bbb80d7ac93e93b2a5d2824842 Author: Al Viro Date: Wed Sep 12 18:00:47 2018 -0400 dgnc: TIOCM... won't reach ->ioctl() bury the dead code (and ->tiocmget()/->tiocmset() are there, so I really wonder why have they kept the stuff that became unreachable with the introduction of those...) Signed-off-by: Al Viro commit e67504c5958f122944d4b9316d1cfc737027c466 Author: Al Viro Date: Wed Sep 12 17:54:22 2018 -0400 isdn_tty: TCSBRK{,P} won't reach ->ioctl() kill the long-dead code - it's been unreachable since 2008. Redundant, as well - generic will do exact same thing, since ->break_ctl is NULL here... Signed-off-by: Al Viro commit 864e880de59ecd891260f264d2884eabb9d6760c Author: Al Viro Date: Wed Sep 12 17:52:23 2018 -0400 kill capinc_tty_ioctl() NULL ->ioctl() in tty_operations is treated as "returns -ENOIOCTLCMD"... Signed-off-by: Al Viro commit 77654350306accb55efa73eaa2b1424a639595fc Author: Al Viro Date: Wed Sep 12 11:28:34 2018 -0400 take compat TIOC[SG]SERIAL treatment into tty_compat_ioctl() Signed-off-by: Al Viro commit f82fc0fedf28ba09b0abd0533202447846d48fb9 Author: Al Viro Date: Wed Sep 12 07:49:44 2018 -0400 synclink: reduce pointless checks in ->ioctl() it's never getting called with TIOC[SG]SERIAL anymore (nor has it ever supported those, while we are at it) Signed-off-by: Al Viro commit 930236a30897532653a61ed22ae7eca13154accd Author: Al Viro Date: Wed Sep 12 07:46:51 2018 -0400 complete ->[sg]et_serial() switchover Reviewed-by: Johan Hovold Signed-off-by: Al Viro commit 15cc7bad48977582a35c06f5afa0cfc1d4975bd9 Author: Al Viro Date: Wed Sep 12 07:45:23 2018 -0400 usb_wwan: switch to ->[sg]et_serial() Reviewed-by: Johan Hovold Signed-off-by: Al Viro commit fc6cc979e42264efbff6c01a8c6af144cc3e43e4 Author: Al Viro Date: Wed Sep 12 07:34:34 2018 -0400 whiteheat: switch to ->get_serial() ... and fix the return value - on success it used to have ioctl(2) fill the user-supplied struct serial_struct and return -ENOTTY. Reviewed-by: Johan Hovold Signed-off-by: Al Viro commit 57e5723611bb1598bb1cb11a5ec8a4d257f69bb3 Author: Al Viro Date: Wed Sep 12 07:31:12 2018 -0400 ti_usb_3410_5052: switch to ->[sg]et_serial() Reviewed-by: Johan Hovold Signed-off-by: Al Viro commit ee08cefbb5bd261676c6e7965dffd8ee2ad5e1e8 Author: Al Viro Date: Wed Sep 12 07:26:07 2018 -0400 ssu100: switch to ->get_serial() Reviewed-by: Johan Hovold Signed-off-by: Al Viro commit 8fbde7984e7f84aa98c6bf9eff11c6c8b72c2517 Author: Al Viro Date: Wed Sep 12 07:24:37 2018 -0400 quatech2: switch to ->get_serial() Reviewed-by: Johan Hovold Signed-off-by: Al Viro commit 9326ec59ec64399e031aa2fe3ab6404d24423630 Author: Al Viro Date: Wed Sep 12 07:23:18 2018 -0400 pl2303: switch to ->get_serial() Reviewed-by: Johan Hovold Signed-off-by: Al Viro commit 30296aa419f8caec24e31cc2e6e3e6081460e97d Author: Al Viro Date: Wed Sep 12 07:21:40 2018 -0400 opticon: switch to ->get_serial() Reviewed-by: Johan Hovold Signed-off-by: Al Viro commit b27ef409b415099aa2c540630db03ea84f45c5cc Author: Al Viro Date: Wed Sep 12 07:20:09 2018 -0400 mos7840: switch to ->get_serial() Reviewed-by: Johan Hovold Signed-off-by: Al Viro commit 7cf3e600a07bc73823bf0ae0309e59dafd303817 Author: Al Viro Date: Wed Sep 12 00:20:17 2018 -0400 mos7720: switch to ->get_serial() Reviewed-by: Johan Hovold Signed-off-by: Al Viro commit 2a5357e56360a076867a21b4914a5340399eff5b Author: Al Viro Date: Wed Sep 12 00:17:54 2018 -0400 io_ti: switch to ->get_serial() Reviewed-by: Johan Hovold Signed-off-by: Al Viro commit e27235eda550a58ab8884836a190b3c1b3940e92 Author: Al Viro Date: Tue Sep 11 23:45:02 2018 -0400 io_edgeport: switch to ->get_serial() Reviewed-by: Johan Hovold Signed-off-by: Al Viro commit 3ae36bed3a93f5b871341be9b2e39aaff0d2559f Author: Al Viro Date: Tue Sep 11 23:42:36 2018 -0400 fdti_sio: switch to ->[sg]et_serial() Reviewed-by: Johan Hovold Signed-off-by: Al Viro commit c8f97e77d53ff0717a1175b3cdefa497127347f9 Author: Al Viro Date: Tue Sep 11 23:38:49 2018 -0400 f81534: switch to ->get_serial() Reviewed-by: Johan Hovold Signed-off-by: Al Viro commit 056abede09a779acda8e24b941d62bf0fed33f64 Author: Al Viro Date: Tue Sep 11 23:37:01 2018 -0400 f81232: switch to ->get_serial() Reviewed-by: Johan Hovold Signed-off-by: Al Viro commit aadcd0a178be1770394259d2c345b91b9b6be048 Author: Al Viro Date: Tue Sep 11 23:35:20 2018 -0400 ark3116: switch to ->get_serial() Reviewed-by: Johan Hovold Signed-off-by: Al Viro commit 99f75a1fcd865d39b5f2b99ce067bf5a2259e03a Author: Al Viro Date: Tue Sep 11 23:33:40 2018 -0400 cdc-acm: switch to ->[sg]et_serial() Signed-off-by: Al Viro commit 81732b26e05994552f347746eb11762e986079a0 Author: Al Viro Date: Tue Sep 11 23:28:07 2018 -0400 usb-serial: begin switching to ->[sg]et_serial() add such methods for usb_serial_driver, provide tty_operations ->[sg]et_serial() calling those. For now the lack of methods in driver means ENOIOCTLCMD from usb-serial ->[sg]et_serial(), making tty_ioctl() fall back to calling ->ioctl(). Once all drivers are converted, we'll be returning -ENOTTY instead, completing the switchover. Reviewed-by: Johan Hovold Signed-off-by: Al Viro commit 6a9daed31cc8dc1ca0b3d25f85426adbd2112293 Author: Al Viro Date: Tue Sep 11 23:22:59 2018 -0400 rfcomm: get rid of mentioning TIOC[SG]SERIAL no support there Signed-off-by: Al Viro commit 5099d234a52a0a9a9c6acbe8c9ee286a73ac1aed Author: Al Viro Date: Tue Sep 11 22:29:55 2018 -0400 serial_core: switch to ->[sg]et_serial() Signed-off-by: Al Viro commit 6da5b587631cb729de917a0ba629b139781cb3ef Author: Al Viro Date: Tue Sep 11 22:22:06 2018 -0400 mxser: switch to ->[sg]et_serial() Signed-off-by: Al Viro commit 1c729ab15a0eeff57aafab704161f8d3663b2854 Author: Al Viro Date: Tue Sep 11 22:01:00 2018 -0400 moxa: switch to ->[sg]et_serial() Pointless dead assignments in moxa_set_serial_info() killed off; they would've been a bug, if not for the fact that user-settable flags had never been used in that driver. Bogus from day 1, though... Signed-off-by: Al Viro commit b60f38c6640f3b0e15f37c63167df9560fe00e6a Author: Al Viro Date: Tue Sep 11 22:00:37 2018 -0400 isicom: switch to ->[sg]et_serial() Signed-off-by: Al Viro commit a7b06fcf2ecef39b37979ac8b8838a182ba569e2 Author: Al Viro Date: Tue Sep 11 22:00:08 2018 -0400 ipwireless: switch to ->[sg]et_serial() Acked-by: David Sterba Signed-off-by: Al Viro commit 6fbf9582548105e7548a2342f67b32977fe8a43a Author: Al Viro Date: Tue Sep 11 21:59:48 2018 -0400 cyclades: switch to ->[sg]et_serial() Signed-off-by: Al Viro commit b129cbc99b2d09a4c4c5de60f91118ecb380e2fa Author: Al Viro Date: Tue Sep 11 21:59:13 2018 -0400 amiserial: switch to ->[sg]et_serial() Signed-off-by: Al Viro commit d864991b220b7c62e81d21209e1fd978fd67352c Merge: a688c53a0277 bab5c80b2110 Author: David S. Miller Date: Fri Oct 12 21:38:46 2018 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Conflicts were easy to resolve using immediate context mostly, except the cls_u32.c one where I simply too the entire HEAD chunk. Signed-off-by: David S. Miller commit 3df629d873f8683af6f0d34dfc743f637966d483 Author: Al Viro Date: Sat Oct 13 00:19:13 2018 -0400 gfs2_meta: ->mount() can get NULL dev_name get in sync with mount_bdev() handling of the same Reported-by: syzbot+c54f8e94e6bba03b04e9@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by: Al Viro commit 995f608e7a349c837d6c0b3ffa7d1a94d01f7203 Author: Al Viro Date: Fri Oct 12 22:46:50 2018 -0400 ntfs: don't open-code ERR_CAST Signed-off-by: Al Viro commit 1ae80cf31938c8f77c37a29bbe29e7f1cd492be8 Author: Daniel Colascione Date: Fri Oct 12 03:54:27 2018 -0700 bpf: wait for running BPF programs when updating map-in-map The map-in-map frequently serves as a mechanism for atomic snapshotting of state that a BPF program might record. The current implementation is dangerous to use in this way, however, since userspace has no way of knowing when all programs that might have retrieved the "old" value of the map may have completed. This change ensures that map update operations on map-in-map map types always wait for all references to the old map to drop before returning to userspace. Signed-off-by: Daniel Colascione Reviewed-by: Joel Fernandes (Google) Signed-off-by: Alexei Starovoitov commit e1af4779617928efa84562de4de5dc071e7deb08 Author: Arnd Bergmann Date: Fri Oct 5 18:11:47 2018 +0200 apparmor: add #ifdef checks for secmark filtering The newly added code fails to build when either SECMARK or NETFILTER are disabled: security/apparmor/lsm.c: In function 'apparmor_socket_sock_rcv_skb': security/apparmor/lsm.c:1138:12: error: 'struct sk_buff' has no member named 'secmark'; did you mean 'mark'? security/apparmor/lsm.c:1671:21: error: 'struct nf_hook_state' declared inside parameter list will not be visible outside of this definition or declaration [-Werror] Add a set of #ifdef checks around it to only enable the code that we can compile and that makes sense in that configuration. Fixes: ab9f2115081a ("apparmor: Allow filtering based on secmark policy") Signed-off-by: Arnd Bergmann Signed-off-by: John Johansen commit 63625899c6eba697fdbefcdcdc2cb27549df9e43 Author: Mike Rapoport Date: Sun Oct 7 19:32:44 2018 +0300 docs/admin-guide: memory-hotplug: remove table of contents Remove "manual" table of contents and leave only the ReST tag so that Sphinx will take care of TOC generation. Signed-off-by: Mike Rapoport Signed-off-by: Jonathan Corbet commit 22a7488c54a03773ef7cf0dc952047c75cc1446a Author: Jerome Forissier Date: Mon Oct 8 18:16:42 2018 +0800 Documentation: dt: Add binding for /secure-chosen/stdout-path Some platforms may use a single device tree to describe two address spaces, as described in d9f43babb998 ("Documentation: dt: Add bindings for Secure-only devices"). For these platforms it makes sense to define a secure counterpart of /chosen, namely: /secure-chosen. This new node is meant to be used by the secure firmware to pass data to the secure OS. Only the stdout-path property is supported for now. Signed-off-by: Jerome Forissier Signed-off-by: Rob Herring commit a688c53a0277d8ea21d86a5c56884892e3442c5e Merge: 139ce90a4570 0aef8392d257 Author: David S. Miller Date: Fri Oct 12 11:27:01 2018 -0700 Merge branch 's390-qeth-next' Julian Wiedmann says: ==================== s390/qeth: updates 2018-10-12 please apply one more patchset for net-next. This extends the TSO support in qeth. ==================== Signed-off-by: David S. Miller commit 0aef8392d257288a7b6a905d19d126bc98f14474 Author: Julian Wiedmann Date: Fri Oct 12 17:27:15 2018 +0200 s390/qeth: add TSO support for L2 devices Except for the new HW header id, this works just like TSO6 on L3 devices and reuses all the existing data path support in qeth_xmit(). Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit 82bf5c0867f66440a98341441fb593fe019ea361 Author: Julian Wiedmann Date: Fri Oct 12 17:27:14 2018 +0200 s390/qeth: add support for IPv6 TSO This adds TSO6 support for L3 qeth devices. Just like for standard IPv6 traffic, TSO6 doesn't use IP offload and thus runs over the normal qeth_xmit() path. Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit 4666d7fb1a90280d8d3fa8766b7cdaf822d41a40 Author: Julian Wiedmann Date: Fri Oct 12 17:27:13 2018 +0200 s390/qeth: enhance TSO control sequence TSO6 requires the full programming sequence, and not just a simple START command. This implements the additional ENABLE command, and adds some sanity checks that were missing for the START command. Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit 1f83b817d0f14ac06ab593b47fdd6f51238cd73e Author: Julian Wiedmann Date: Fri Oct 12 17:27:12 2018 +0200 s390/qeth: make TSO controls protocol-agnostic In preparation for IPv6 TSO, turn the protocol version into a parameter for the TSO control code. Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller commit 139ce90a45700234fdd78bec1ffe780085989f52 Merge: 5886d932e52a 829edbd8d45e Author: David S. Miller Date: Fri Oct 12 11:23:45 2018 -0700 Merge branch 'hns3-promisc-next' Salil Mehta says: ==================== Fixes & small enhancements related to the promisc mode in HNS3 This patch-set presents some fixes and enhancements related to promiscuous mode and MAC VLAN Table full condition in HNS3 Ethernet Driver. ==================== Signed-off-by: David S. Miller commit 829edbd8d45e2f5c384a0b6c741cde46e0fa02a8 Author: Jian Shen Date: Fri Oct 12 15:34:06 2018 +0100 net: hns3: Resume promisc mode and vlan filter status after loopback test This patch resumes promisc mode and vlan filter status after loopback test. Fixes: 3b75c3df599d ("net: hns3: net: hns3: Add support for IFF_ALLMULTI flag") Signed-off-by: Jian Shen Signed-off-by: Salil Mehta Signed-off-by: David S. Miller commit 7325523ab616791c418e2edc67d18e21958fb3ce Author: Jian Shen Date: Fri Oct 12 15:34:05 2018 +0100 net: hns3: Resume promisc mode and vlan filter status after reset This patch resumes promisc mode and vlan filter status after reset. Signed-off-by: Jian Shen Signed-off-by: Salil Mehta Signed-off-by: David S. Miller commit c60edc17df391e33c9c3cd6e319eb1f32ce26730 Author: Jian Shen Date: Fri Oct 12 15:34:04 2018 +0100 net: hns3: Enable promisc mode when mac vlan table is full Currently, the driver does nothing when mac vlan table is full. In this case, the packet with new mac address will be dropped by hardware. This patch adds check for the result of sync mac address, and enable promisc mode when mac vlan table is full. Furtherly, disable vlan filter when enable promisc by user command. Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support") Signed-off-by: Jian Shen Signed-off-by: Salil Mehta Signed-off-by: David S. Miller commit 5886d932e52acfbe12ea5aac8e7c3ad6f16364d1 Author: Johannes Berg Date: Fri Oct 12 12:53:00 2018 +0200 netlink: replace __NLA_ENSURE implementation We already have BUILD_BUG_ON_ZERO() which I just hadn't found before, so we should use it here instead of open-coding another implementation thereof. Signed-off-by: Johannes Berg Signed-off-by: David S. Miller commit e32cf9a386236523be005a66dbee7cdcb5148b4d Merge: 9163a0fc1f0c f8252e7b5a83 Author: David S. Miller Date: Fri Oct 12 10:56:56 2018 -0700 Merge tag 'mac80211-next-for-davem-2018-10-12' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next Johannes Berg says: ==================== Highlights: * merge net-next, so I can finish the hwsim workqueue removal * fix TXQ NULL pointer issue that was reported multiple times * minstrel cleanups from Felix * simplify lib80211 code by not using skcipher, note that this will conflict with the crypto tree (and this new code here should be used) * use new netlink policy validation in nl80211 * fix up SAE (part of WPA3) in client-mode * FTM responder support in the stack ==================== Signed-off-by: David S. Miller commit 9fc9c9b83a463ebe5f7f2666632da364d974f5d1 Author: James Zhu Date: Tue Oct 9 17:06:56 2018 -0400 drm/amdgpu/vcn:Update SPG mode UVD status clear Update Static Power Gate mode UVD status clear Signed-off-by: James Zhu Acked-by: Leo Liu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 10b66b2c65a271998042259b7fffafdd76809ad1 Author: James Zhu Date: Tue Oct 9 16:59:57 2018 -0400 drm/amdgpu/vcn:Set VCPU busy after gate power during vcn SPG start Set VCPU busy after gate power during vcn Static Power Gate start Signed-off-by: James Zhu Acked-by: Leo Liu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 3d904ee4c30e5a91bdad363624f46bf484fd604a Author: James Zhu Date: Tue Oct 9 16:57:26 2018 -0400 drm/amdgpu/vcn:Apply new UMC enable for VNC DPG mode Apply new UMC enable for VNC Dynamic Power Gate mode Signed-off-by: James Zhu Acked-by: Leo Liu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit ad7187bfe130ddd51128e1f7068fbc930c9eccf4 Author: James Zhu Date: Tue Oct 9 16:53:42 2018 -0400 drm/amdgpu/vcn:Remove SPG mode unused steps during vcn start Remove Sitatic Power Gate mode unused steps during vcn start Signed-off-by: James Zhu Acked-by: Leo Liu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 3d022a01fe369329adc859ab6f8e015340040905 Author: James Zhu Date: Tue Oct 9 16:48:29 2018 -0400 drm/amdgpu/vcn:Add SPG mode Register XX check Add Static Power Gate mode Register XX check Signed-off-by: James Zhu Acked-by: Leo Liu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit a1584957ffe17a43fb6b6a825187bc01b4fa22bd Author: James Zhu Date: Tue Oct 9 16:46:53 2018 -0400 drm/amdgpu/vcn:Move SPG mode mc resume after MPC control Move Static Power Gate mode mc resume after MPC control Signed-off-by: James Zhu Acked-by: Leo Liu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 92bbdaeb9109b2c31681d24d28d9030f2d862851 Author: James Zhu Date: Tue Oct 9 16:43:32 2018 -0400 drm/amdgpu/vcn:Update SPG mode VCN global tiling Update Static Power Gate mode VCN global tiling Signed-off-by: James Zhu Acked-by: Leo Liu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 298dc39a3a203697d959dc086cf81f90959582da Author: James Zhu Date: Tue Oct 9 16:40:56 2018 -0400 drm/amdgpu/vcn:Update SPG mode VCN memory control Update Static Power Gate mode VCN memory control Signed-off-by: James Zhu Acked-by: Leo Liu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit f5c5451fefceb24f2969d9f3ad6ef4c591d0272e Author: James Zhu Date: Tue Oct 9 13:05:15 2018 -0400 drm/amdgpu/vcn:Apply new UMC enable for VNC DPG mode start Apply new UMC enable for VNC Dynamic Power Gate mode start Signed-off-by: James Zhu Acked-by: Leo Liu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit fe146873f545f28b6c53e1d2405fc6816d5301ea Author: James Zhu Date: Thu Oct 4 16:09:33 2018 -0400 drm/amdgpu/vcn:Remove DPG mode unused steps during vcn start Remove Dynamic Power Gate mode unused steps during VCN start Signed-off-by: James Zhu Acked-by: Leo Liu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 368d0dd81a506365f0c899cef731889ee712cae6 Author: James Zhu Date: Thu Oct 4 16:02:51 2018 -0400 drm/amdgpu/vcn:Add DPG mode Register XX check Add Dynamic Power Gate mode Register XX check Signed-off-by: James Zhu Acked-by: Leo Liu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit abd2d47c5152878649c3c1077a9594e34793339b Author: James Zhu Date: Thu Oct 4 15:42:51 2018 -0400 drm/amdgpu/vcn:Update DPG mode VCN global tiling registers Update Dynamic Power Gate mode VCN global tiling registers Signed-off-by: James Zhu Acked-by: Leo Liu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 6747c2021ccda6df5e19bcb37c5584266b68fa75 Author: James Zhu Date: Thu Oct 4 15:10:52 2018 -0400 drm/amdgpu/vcn:Update DPG mode VCN memory control Update Dynamic Power Gate mode VCN memory control Signed-off-by: James Zhu Acked-by: Leo Liu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit cce9d555858899eb4b919ec6a65d6e4d47e8ba4e Author: James Zhu Date: Thu Oct 4 09:29:22 2018 -0400 drm/amdgpu/vcn:Reduce unnecessary local variable Reduce unnecessary local variable. Signed-off-by: James Zhu Acked-by: Leo Liu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 15296db70619984157e60666da5da8994a66870e Author: James Zhu Date: Wed Oct 3 17:36:58 2018 -0400 drm/amdgpu/vcn:Add ring W/R PTR check for VCN DPG mode stop Add ring write/read pointer check for VCN dynamic power gate mode stop,to make sure that no job is left in ring before turn off DPG mode. Signed-off-by: James Zhu Acked-by: Leo Liu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 5866fb929c90e3189c1abd4d6518712ad56c90b4 Author: James Zhu Date: Wed Oct 3 10:24:43 2018 -0400 drm/amdgpu/vcn:Update latest spg mode stop for VCN Update latest static power gate mode stop function for VCN Signed-off-by: James Zhu Acked-by: Leo Liu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 5327f025dc3c1dd87716839d5a1a3a9635591725 Author: James Zhu Date: Tue Oct 2 14:55:46 2018 -0400 drm/amdgpu/vcn:Update latest UVD_MPC register for VCN Update latest UVD_MPC register for VCN. Use defined macro to replace value for readability. Signed-off-by: James Zhu Acked-by: Leo Liu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit b53d3049d258fe731ebc510cd631ceffc7abfc91 Author: James Zhu Date: Tue Oct 2 14:38:18 2018 -0400 drm/amdgpu/vcn:Add new register offset/mask for VCN Add new register offset/mask for VCN to support latest VCN implementation. Signed-off-by: James Zhu Acked-by: Leo Liu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 8c6259bedab1681382b7829b1e8fc4f12fc4a215 Author: hersen wu Date: Thu Oct 4 09:28:20 2018 -0400 drm/amdgpu/display: dm/amdgpu: make dp phy debugfs for eDP [WHY] dp debugfs file does not exist for eDP under /sys/kernel/debug/dri/0/eDP-1. the root is phy debugfs is created for dp connector only. [HOW] for eDP connector, create phy debugfs too. Signed-off-by: Hersen Wu Reviewed-by: David Francis Acked-by: Leo Li Signed-off-by: Alex Deucher commit 8bda1013ddb1dffdee7f9a1912f9845b9cf529cb Author: Emily Deng Date: Fri Oct 12 18:14:32 2018 +0800 drm/amdgpu: Set the default value about gds vmid0 size For sriov, when first run windows guest, then run linux guest, the gds vmid0 size will be reset to 0 by windows guest. So if the value has been reset to 0, then set the value to the default value in linux guest. v2: Fixed value instead of reading mmGDS_VMID0_SIZE. v3: Set the default value of the switch. Signed-off-by: Emily Deng Reviewed-by: Junwei Zhang Signed-off-by: Alex Deucher commit 0efd2d2f68cd5dbddf4ecd974c33133257d16a8e Author: Christian König Date: Mon Oct 8 13:30:12 2018 +0200 drm/sched: fix timeout handling v2 We need to make sure that we don't race between job completion and timeout. v2: put revert label after calling the handling manually Signed-off-by: Christian König Reviewed-by: Nayan Deshmukh Signed-off-by: Alex Deucher commit b981c86f03068ca63391bb54ac4686e7ac419fa3 Author: Christian König Date: Fri Oct 5 19:56:39 2018 +0200 drm/sched: add drm_sched_start_timeout helper Cleanup starting the timeout a bit. Signed-off-by: Christian König Reviewed-by: Nayan Deshmukh Signed-off-by: Alex Deucher commit 94ac8f2074b22465f75e93ecbb98060d7960f4b6 Author: Geert Uytterhoeven Date: Mon Oct 8 13:08:48 2018 +0200 doc: printk-formats: Remove bogus kobject references for device nodes When converting from text to rst, the kobjects section and its sole subsection about device tree nodes were coalesced into a single section, yielding an inconsistent result. Remove all references to kobjects, as 1. Device tree object pointers are not compatible to kobject pointers (the former may embed the latter, though), and 2. there are no printk formats defined for kobject types. Update the vsprintf() source code comments to match the above. Fixes: b3ed23213eab1e08 ("doc: convert printk-formats.txt to rst") Signed-off-by: Geert Uytterhoeven Signed-off-by: Jonathan Corbet commit 44280690ced5dacd3004d4966ef9b15f940f34e0 Author: Andrew Murray Date: Mon Oct 8 14:15:15 2018 +0100 Documentation: preempt-locking: Use better example The existing wording implies that the use of spin_unlock whilst irqs are disabled might trigger a reschedule. However the preemptible() test in preempt_schedule will prevent a reschedule if irqs are disabled. Lets improve the clarity of this wording to change the example from spin_unlock to cond_resched() and cond_resched_lock() as these are functions that will trigger a reschedule if the preempt count is 0 without testing that irqs are disabled. Also remove the 'Last Updated' line as this is not up to date and better tracked via GIT. Signed-off-by: Andrew Murray Signed-off-by: Jonathan Corbet commit 0c6c987f3706fedff42eee5384c7ede8a910c4ed Author: Nikolay Borisov Date: Tue Oct 9 11:31:31 2018 +0300 dm flakey: Document "error_writes" feature Commit ef548c551e72 ("dm flakey: introduce "error_writes" feature") added the ability to dm flakey to error out writes in contrast to silently dropping it with 'drop_writes'. Unfortunately this feature is not currently documented and one has to be either familiar with the source code of dm flakey or check out xfstests sources to know of this parameter. So document it. Signed-off-by: Nikolay Borisov Signed-off-by: Jonathan Corbet commit bc0e5262d3a06cd48a5aed90a817623ec16dc5c4 Author: John Garry Date: Wed Oct 10 22:56:32 2018 +0800 docs/completion.txt: Fix a couple of punctuation nits This patch fixes a couple of punctuation nits which can make the document more correct and readable. Also missing "()" are added to some function references for consistency. Signed-off-by: John Garry Acked-by: Randy Dunlap Signed-off-by: Jonathan Corbet commit 9dc84ee6e5361e65de37b459c80ee4800d2cf87d Author: Hans de Goede Date: Wed Oct 10 22:15:09 2018 +0200 LICENSES: Add ISC license text Add the full text of the ISC license to the kernel tree. It was copied directly from: https://spdx.org/licenses/ISC.html With the mention of "ISC" in the warranty disclaimer replaced with "THE AUTHOR" as done in the ISC license headers used in the ath10k and brcmfmac wifi drivers. Cc: Kalle Valo Signed-off-by: Hans de Goede Signed-off-by: Jonathan Corbet commit 8639a0c790add196bdd457c98437fec299cde60e Author: Hans de Goede Date: Wed Oct 10 22:15:08 2018 +0200 LICENSES: Add note to CDDL-1.0 license that it should not be used The only reason we have the CDDL-1.0 license text around is for some dual-licensed files from virtualbox. New code should not use this license. Add a note about this and change the example tag to be dual-licensed. Signed-off-by: Hans de Goede Signed-off-by: Jonathan Corbet commit 7a862028b95a54adf9b3b88a1415e15478c257be Author: Evan Quan Date: Wed Oct 10 15:24:59 2018 +0800 drm/amd/powerplay: hint when power profile setting is not supported Give user some hints when the power profile setting is not supported. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 73d0a446690e342667dace1964b3238140fa4763 Author: Evan Quan Date: Wed Oct 10 15:00:28 2018 +0800 drm/amd/powerplay: translate power_profile mode to pplib workload type Correctly translate the power profile specified by user to workload type accepted by SMU fw. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 9163a0fc1f0c0980f117cc25f4fa6ba9b0750a36 Author: Nikolay Aleksandrov Date: Fri Oct 12 13:41:16 2018 +0300 net: bridge: add support for per-port vlan stats This patch adds an option to have per-port vlan stats instead of the default global stats. The option can be set only when there are no port vlans in the bridge since we need to allocate the stats if it is set when vlans are being added to ports (and respectively free them when being deleted). Also bump RTNL_MAX_TYPE as the bridge is the largest user of options. The current stats design allows us to add these without any changes to the fast-path, it all comes down to the per-vlan stats pointer which, if this option is enabled, will be allocated for each port vlan instead of using the global bridge-wide one. CC: bridge@lists.linux-foundation.org CC: Roopa Prabhu Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit 3a7452c5a72bd8098f6d4b37341e25a8725d790b Author: David Hildenbrand Date: Thu Oct 11 07:58:17 2018 +0300 docs/core-api: memory-hotplug: add some details about locking internals Let's document the magic a bit, especially why device_hotplug_lock is required when adding/removing memory and how it all play together with requests to online/offline memory from user space. [ rppt: moved the text to Documentation/core-api/memory-hotplug.rst ] Link: http://lkml.kernel.org/r/20180925091457.28651-7-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Pavel Tatashin Reviewed-by: Rashmica Gupta Cc: Jonathan Corbet Cc: Michal Hocko Cc: Balbir Singh Cc: Benjamin Herrenschmidt Cc: Boris Ostrovsky Cc: Dan Williams Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Heiko Carstens Cc: John Allen Cc: Joonsoo Kim Cc: Juergen Gross Cc: Kate Stewart Cc: "K. Y. Srinivasan" Cc: Len Brown Cc: Martin Schwidefsky Cc: Mathieu Malaterre Cc: Michael Ellerman Cc: Michael Neuling Cc: Nathan Fontenot Cc: Oscar Salvador Cc: Paul Mackerras Cc: Philippe Ombredanne Cc: Rafael J. Wysocki Cc: "Rafael J. Wysocki" Cc: Stephen Hemminger Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: YASUAKI ISHIMATSU Signed-off-by: Andrew Morton Signed-off-by: Mike Rapoport Signed-off-by: Jonathan Corbet commit 52d7e21fd5677829353f7490723adf5f61999d84 Author: Mike Rapoport Date: Thu Oct 11 07:58:16 2018 +0300 docs/core-api: rename memory-hotplug-notifier to memory-hotplug to allow additions of new documentation about memory hotplug under the same roof. Signed-off-by: Mike Rapoport Reviewed-by: David Hildenbrand Signed-off-by: Jonathan Corbet commit 684e07ed39ddd12731eda9933a946c7424e91c14 Author: Biju Das Date: Thu Oct 4 17:07:47 2018 +0100 dt-bindings: PCI: rcar: Add device tree support for r8a7744 Add support for r8a7744. The Renesas RZ/G1N (R8A7744) PCIe controller is identical to the R-Car Gen2 family. Signed-off-by: Biju Das Signed-off-by: Lorenzo Pieralisi Reviewed-by: Chris Paterson Reviewed-by: Simon Horman commit b0ce7b29bfcd090ddba476f45a75ec0a797b048a Author: Linus Walleij Date: Fri Oct 12 14:54:12 2018 +0200 regulator/gpio: Allow nonexclusive GPIO access This allows nonexclusive (simultaneous) access to a single GPIO line for the fixed regulator enable line. This happens when several regulators use the same GPIO for enabling and disabling a regulator, and all need a handle on their GPIO descriptor. This solution with a special flag is not entirely elegant and should ideally be replaced by something more careful as this makes it possible for several consumers to enable/disable the same GPIO line to the left and right without any consistency. The current use inside the regulator core should however be fine as it takes special care to handle this. For the state of the GPIO backend, this is still the lesser evil compared to going back to global GPIO numbers. Cc: Marek Szyprowski Cc: Jon Hunter Fixes: efdfeb079cc3 ("regulator: fixed: Convert to use GPIO descriptor only") Reported-by: Marek Szyprowski Tested-by: Jon Hunter Tested-by: Marek Szyprowski Signed-off-by: Linus Walleij Signed-off-by: Mark Brown commit 133eb8e38b02c6c63a039523fca12737009a6686 Author: Robin Gong Date: Wed Oct 10 10:32:48 2018 +0000 spi: imx: use PIO mode if size is small Use PIO mode instead if size is smaller than fifo size, since dma may be less efficient. Signed-off-by: Robin Gong Signed-off-by: Mark Brown commit 5ba5a3730639caddf42af11c60f3f3d99d9a5f00 Author: Robin Gong Date: Wed Oct 10 10:32:45 2018 +0000 spi: imx: correct wml as the last sg length Correct wml as the last rx sg length instead of the whole transfer length. Otherwise, mtd_stresstest will be failed as below: insmod mtd_stresstest.ko dev=0 ================================================= mtd_stresstest: MTD device: 0 mtd_stresstest: not NAND flash, assume page size is 512 bytes. mtd_stresstest: MTD device size 4194304, eraseblock size 65536, page size 512, count of eraseblocks 64, pa0 mtd_stresstest: doing operations mtd_stresstest: 0 operations done mtd_test: mtd_read from 1ff532, size 880 mtd_test: mtd_read from 20c267, size 64998 spi_master spi0: I/O Error in DMA RX m25p80 spi0.0: SPI transfer failed: -110 spi_master spi0: failed to transfer one message from queue mtd_test: error: read failed at 0x20c267 mtd_stresstest: error -110 occurred ================================================= insmod: ERROR: could not insert module mtd_stresstest.ko: Connection timed out Signed-off-by: Robin Gong Signed-off-by: Mark Brown commit 987a2dfe3f0485a82d87106e7e1c43f35c1d3b09 Author: Robin Gong Date: Wed Oct 10 10:32:42 2018 +0000 spi: imx: move wml setting to later than setup_transfer Current dynamic burst length is based on the whole transfer length, that's ok if there is only one sg, but is not right in case multi sgs in one transfer,because the tail data should be based on the last sg length instead of the whole transfer length. Move wml setting for DMA to the later place, thus, the next patch could get the right last sg length for wml setting. This patch is a preparation one, no any function change involved. Signed-off-by: Robin Gong Signed-off-by: Mark Brown commit bef9391cbec547351c6a13e52f3a26bb2d271ec7 Author: Charles Keepax Date: Mon Oct 8 14:25:41 2018 +0100 regulator: lochnagar: Add support for the Cirrus Logic Lochnagar Lochnagar is an evaluation and development board for Cirrus Logic Smart CODEC and Amp devices. It allows the connection of most Cirrus Logic devices on mini-cards, as well as allowing connection of various application processor systems to provide a full evaluation platform. This driver supports the board controller chip on the Lochnagar board. The Lochnagar board provides power supplies for the attached CODEC/Amp device. Currently this driver supports the microphone supplies and the digital core voltage for the attached device. There are some additional supplies that will be added in time but these supplies are sufficient for most systems/use-cases. Signed-off-by: Charles Keepax Signed-off-by: Mark Brown commit 471a7ba89158c6d52dae69636c94c4aa1a6b7b22 Author: Kuninori Morimoto Date: Fri Oct 12 06:31:49 2018 +0000 ASoC: pcm3168a: add I2S/Left_J TDM support pcm3168a is supporting TDM on I2S/Left_J, but there is no settings for it. This patch add it. Signed-off-by: Kuninori Morimoto Signed-off-by: Mark Brown commit 594680ea4a394f19d38a39a7d7c673fbad02a3d6 Author: Kuninori Morimoto Date: Fri Oct 12 06:31:18 2018 +0000 ASoC: pcm3168a: add hw constraint for channel LEFT_J / I2S only can use TDM. This patch adds channel constraint for it. Signed-off-by: Kuninori Morimoto Signed-off-by: Mark Brown commit 3809688980205622f75ed5d5890759430da4e7e4 Author: Kuninori Morimoto Date: Fri Oct 12 06:31:00 2018 +0000 ASoC: pcm3168a: add HW constraint for non RIGHT_J RIGHT_J only can handle 16bit data bits. Current driver just errored if user requests non RIGHT_J + 16bit combination. But it is not useful for user. This patch adds HW constraint for it, and avoid error on such situation. Signed-off-by: Kuninori Morimoto Signed-off-by: Mark Brown commit bf173ca92da97863e1579a982d500da98f2e7a3f Author: Steven Rostedt (VMware) Date: Fri Oct 12 12:50:22 2018 -0400 tracing: probeevent: Fix uninitialized used of offset in parse args Dan's smatch utility found an uninitialized use of offset in a path in parse_probe_args(). Unless an offset is specifically specified for commands that allow them, it should default to zero. Link: http://lkml.kernel.org/r/20181012134246.5doqaobxunlqqs53@mwanda Fixes: 533059281ee5 ("tracing: probeevent: Introduce new argument fetching code") Reported-by: Dan Carpenter (smatch) Signed-off-by: Steven Rostedt (VMware) commit 9c2120090586d7e509faa885988d4eb2441fabc2 Author: Lubomir Rintel Date: Wed Oct 10 19:09:27 2018 +0200 PCI: Provide pci_match_id() with CONFIG_PCI=n This spares drivers from #ifdef-ing on CONFIG_PCI if the driver can be optionally built on machines without PCI bus. Consistent with acpi_driver_match_device() and similar. Acked-by: Bjorn Helgaas Signed-off-by: Lubomir Rintel Signed-off-by: Mark Brown commit 666046418d5c07469f9b1c0e3f515c1ea8126207 Author: Christoph Hellwig Date: Fri Oct 12 10:17:51 2018 +0200 fore200e: fix sbus compile Fix a stupid typo introduced in the refactoring. Fixes: 0efe5523 ("fore200e: simplify fore200e_bus usage") Signed-off-by: Christoph Hellwig Signed-off-by: David S. Miller commit 747df19747bc9752cd40b9cce761e17a033aa5c2 Author: Daniel Mack Date: Thu Oct 11 20:32:05 2018 +0200 ASoC: sta32x: set ->component pointer in private struct The ESD watchdog code in sta32x_watchdog() dereferences the pointer which is never assigned. This is a regression from a1be4cead9b950 ("ASoC: sta32x: Convert to direct regmap API usage.") which went unnoticed since nobody seems to use that ESD workaround. Fixes: a1be4cead9b950 ("ASoC: sta32x: Convert to direct regmap API usage.") Signed-off-by: Daniel Mack Signed-off-by: Mark Brown Cc: stable@vger.kernel.org commit 859bd2ef1fc1110a8031b967ee656c53a6260a76 Author: David Ahern Date: Thu Oct 11 20:33:49 2018 -0700 net: Evict neighbor entries on carrier down When a link's carrier goes down it could be a sign of the port changing networks. If the new network has overlapping addresses with the old one, then the kernel will continue trying to use neighbor entries established based on the old network until the entries finally age out - meaning a potentially long delay with communications not working. This patch evicts neighbor entries on carrier down with the exception of those marked permanent. Permanent entries are managed by userspace (either an admin or a routing daemon such as FRR). Signed-off-by: David Ahern Signed-off-by: David S. Miller commit 25972d0c33deb5c49708baa48e7796c8d0348e98 Author: Phil Elwell Date: Fri Oct 12 10:23:18 2018 +0100 spi: Make GPIO CSs honour the SPI_NO_CS flag The SPI configuration state includes an SPI_NO_CS flag that disables all CS line manipulation, for applications that want to manage their own chip selects. However, this flag is ignored by the GPIO CS code in the SPI framework. Correct this omission with a trivial patch. Signed-off-by: Phil Elwell Signed-off-by: Mark Brown commit 7c6bb7d2faaf1ed7d78bafd712476e4cf2cf0d7d Author: David Ahern Date: Thu Oct 11 20:17:21 2018 -0700 net/ipv6: Add knob to skip DELROUTE message on device down Another difference between IPv4 and IPv6 is the generation of RTM_DELROUTE notifications when a device is taken down (admin down) or deleted. IPv4 does not generate a message for routes evicted by the down or delete; IPv6 does. A NOS at scale really needs to avoid these messages and have IPv4 and IPv6 behave similarly, relying on userspace to handle link notifications and evict the routes. At this point existing user behavior needs to be preserved. Since notifications are a global action (not per app) the only way to preserve existing behavior and allow the messages to be skipped is to add a new sysctl (net/ipv6/route/skip_notify_on_dev_down) which can be set to disable the notificatioons. IPv6 route code already supports the option to skip the message (it is used for multipath routes for example). Besides the new sysctl we need to pass the skip_notify setting through the generic fib6_clean and fib6_walk functions to fib6_clean_node and to set skip_notify on calls to __ip_del_rt for the addrconf_ifdown path. Signed-off-by: David Ahern Signed-off-by: David S. Miller commit 7cc2d504daa0454d2c7c1a0c15a6a21df0ac3c8a Author: YueHaibing Date: Fri Oct 12 10:37:41 2018 +0800 net: fddi: skfp: Remove unused macros 'PNMI_GET_ID' and 'PNMI_SET_ID' The two PNMI macros are never used Signed-off-by: YueHaibing Signed-off-by: David S. Miller commit 1b8530bf6a69d5021a1f44ca30681b3914c099f3 Author: YueHaibing Date: Fri Oct 12 01:49:13 2018 +0000 net: cdc_ncm: remove set but not used variable 'ctx' Fixes gcc '-Wunused-but-set-v